Mitigating risk and responding effectively to coronavirus (COVID-19): Three key tools

When planning your response to specific incidents that can be reasonably foreseen, such as coronavirus (COVID-19), there are three tools you should be using. These are a crisis (or major incident) plan and business continuity plans. These should be designed to be able to respond to a wide range of incidents, along with a specific COVID-19 plan.

Crisis (or major incident) management plan

Your organisation’s crisis (or major incident) plan sets out the management structures, including lines of authority, and the arrangements in place for them to lead the proactive response to any major incident, including responding to COVID-19. If you have not yet activated your plan, check your crisis/major incident plans are fit for purpose for this type of event, refreshing them as necessary. Considerations might include:

Do your current structures allow decisions to be made with appropriate speed and authority?
When should central decision making be consistent across all geographies and business units?
What decision making will be delegated to local markets or business units?
Have stakeholder communications been planned, and are communication channels viable?

You may need to brief new colleagues and exercise the leadership and teams appropriately in order to embed the crisis plan in your organisation. This will create confidence and familiarity with each other and the processes in place as well as the arrangements available for their use.

COVID-19 plan

If you have pre-existing pandemic plans then you may want to refresh and revise them. Ask yourself “What change is required for this plan to be relevant for COVID-19?” COVID-19 specific planning will focus on creating risk reduction (where that is in the control of the organisation). Considerations of the areas might be key at this time: People; Workspaces; Supply and distribution chains; Technology; Critical assets; Reputation; Commercial risk.

Business continuity plans

Business continuity (BCM) planning provides arrangements to continue or recover critical business activity in response to significant disruption. For example, when faced with an absence of people, technology, usual workplaces, supply chain and critical assets. Where they can’t enable that, management should already be aware of that risk. Business continuity planning leaders should consider:

Do we need to amend the BCM plans to cover any services, outputs or processes that are, or may become, critical during a disruption such as the one we have scenario planned for?
Are there any single points of failure highlighted in our plans, and can/should our COVID-19 specific planning be augmented to better protect these?
Are our plans to respond with fewer people, both internal and external, fit for purpose when considering our scenario planning? Are our IT capabilities able to support the potential volume of remote working we may require? If not, action should be taken to augment the plans and/or ensure management are aware of the risk profile.
Are our plans to respond to loss of supply and distribution chains fit for purpose in light of our scenario planning? Is there an increased risk that our third parties may not be able to meet contractual SLAs, and have we taken this into account in our planning? If not, do the plans need to change?

As with the other tools, exercising the business continuity plans to ensure that people are familiar with them, and they will deliver what is expected of them is advised.

The outbreak is a timely reminder that if we plan for the reasonable worst-case scenario, then we are better prepared for almost anything. With good responses and a little luck, we all hope that the COVID-19 outbreak will soon abate and crisis plans won’t be needed by anyone not already using them. But the most successful businesses rarely leave their core response capability to chance.