Would your organization's business continuity strategy protect it from a flu pandemic? Most would not, say risk consultants. "The big question on everybody's mind is, given the catastrophic impact of a flu pandemic, and the vast uncertainty about whether it will or when it will occur, what level of planning is reasonable? What amount of preparedness is reasonable?" says Mike Keating, senior manager of the business continuity practice at Protiviti, Robert Half International's audit and risk consulting services subsidiary.
"In that sense," he continues, "it's no different from a hurricane or a tornado or a flood, in that none of those is ever certain to happen. You have to use a little subjective judgment in figuring out how much preparation to take. The problem with something like a bird flu pandemic is that there aren't commercially available strategies for dealing with it, even if you have an unlimited budget."
The World Health Organization (WHO) had logged just 132 cases of the disease at the end of November, but the victims' high mortality rate has sparked widespread anxiety. In a global pandemic, WHO estimates the disease could take 7.5 million lives in less than three months. But whatever the disease's ultimate impact, it (coupled with the devastation wrought by Hurricane Katrina) has served to turn corporate attention to the potential problem of staff decimation due to any number of environmental factors.
Related economic consequences of a flu pandemic could be huge. Illness and worker absenteeism would contribute to economic disruption, WHO says, and thanks to global business ties, an outbreak in one region could strangle businesses on the other side of the planet. Missing staff could affect operations of essential services like utilities and transportation. A World Bank estimate puts the worldwide cost of a serious flu pandemic at around $800 billion.
While a flu epidemic might not materialize at all, even a limited occurrence could damage local economies. The 2003 SARS outbreak in Toronto was responsible for about four dozen deaths in a population of 2.5 million, but it temporarily devastated the city's economy. Hotel vacancy rates rose to 70 percent after WHO issued a travel warning, and other tourism and convention businesses also suffered. Asians, thought by some to be SARS carriers, saw their businesses shunned, and thousands of the city's citizens were quarantined for 10-day periods.
And even hype brings its own collateral damage, irrespective of a disease's material impact. "How much of your workforce uses mass transit to get to work?" Keating says. "If you look at Toronto with SARS, there was a significant drop in how many people would use mass transit. You have areas of public assembly. If you're the Chicago Bears and you're asking people to come to a football game, or you just do business in a mall or a business park, people are going to be less likely to come to work. The physical configuration of your office space can make a difference. If you're cubicle city and there's a bird flu scare, people are going to be less likely to come to work."
In any epidemic, the most vulnerable organizations will be those with extensive international supply chains, those that rely on international travel and those that exposes workers to many potential carriers of the virus (retail outfits, for example). Organizations will need strategies to deal with high absenteeism, Keating says. "A lot of people think, 'We'll just have people work from home.' The reality is, if they're not already doing that today, they probably can't do it in an emergency."
Dorian Cougias, CEO of Network Frontiers and author of The Compliance Book and The Backup Book recommends developing a continuity-minded staffing plan. Cougias points to the Spanish flu epidemic of 1918, which caused an estimated 40 million deaths worldwide. "Organizations coped with it, and they coped by turning to secondary staff. Bethlehem Steel called people in who had been working on the railroad, and said, 'You're not driving spikes anymore; you're now doing something else.'"
Look at employees as assets, Cougias counsels. "Ask yourself, 'If this asset isn't available or if this group isn't available, what's the workaround? Have we tested and trained with the workaround?' If you can't answer that, you're out of luck."
In any disaster, Cougias explains, it's crucial for managers to stay in touch with employees; remediate fear, uncertainty, and distrust; and let workers know who's in charge and how the organization plans to deal with the disaster. "If the organization doesn't have a robust communications methodology in place that allows for communicating around people or around technologies that might not be working at the time, it's already dead," states Cougias.
Companies should also consider compliance requirements in any strategy related to staff disruption. Some regulations require separation of duties and careful security vetting for managers of sensitive functions. If a lot of key staff are taken out of the office, companies may be forced to suspend compliance in order to keep functioning. But, Cougias notes, companies should keep in mind audits and recovery plans—even under dire circumstances: "How long are you going to declare that the rules are set aside? How are you going to document what you're doing during the emergency? How are you going to document renormalization once the crisis is past?"
Keating agrees that communication is critical. Employees need to know what the plans are in case of a disaster, and they need to know before disaster strikes—otherwise the message will lack credibility. Managers should communicate these plans to executives and board members, too, and stay in touch with local and regional public health agencies, in order ensure that corporate disaster-recovery plans will work within the broader civic context.
Finally, Keating advises business continuity planners to make careful estimates of the actual risk to their organizations and resign themselves to the fact that, if there is a flu pandemic, much of what happens will be out of their control. "Eighty percent of what's going on you have no control over," he says. "Make sure you understand and plan for the 20 percent you can control.
"Regardless of the impact of a flu pandemic—whether it's on travel or your supply chain or your work force—it's important people think through their strategies for dealing with it. Will the strategy actually work? Can they execute on it? And today, most of the time, they're going to find out that they can't."
Bob Mueller was a contributing editor for the IT Compliance Institute.
This article originally appeared at itcinstitute.com. Copyright 2008, 1105 Media Inc. Reprinted with permission.