Mitigating risk and responding effectively to coronavirus (COVID-19): Three key tools

Crisis (or major incident) management plan

Your organisation’s crisis (or major incident) plan sets out the management structures, including lines of authority, and the arrangements in place for them to lead the proactive response to any major incident, including responding to COVID-19. If you have not yet activated your plan, check your crisis/major incident plans are fit for purpose for this type of event, refreshing them as necessary. Considerations might include:

• Do your current structures allow decisions to be made with appropriate speed and authority?
  
• When should central decision making be consistent across all geographies and business units?
  
• What decision making will be delegated to local markets or business units?
  
• Have stakeholder communications been planned, and are communication channels viable?

You may need to brief new colleagues and exercise the leadership and teams appropriately in order to embed the crisis plan in your organisation. This will create confidence and familiarity with each other and the processes in place as well as the arrangements available for their use.

Business continuity plans

Business continuity (BCM) planning provides arrangements to continue or recover critical business activity in response to significant disruption. For example, when faced with an absence of people, technology, usual workplaces, supply chain and critical assets. Where they can’t enable that, management should already be aware of that risk. Business continuity planning leaders should consider:

• Do we need to amend the BCM plans to cover any services, outputs or processes that are, or may become, critical during a disruption such as the one we have scenario planned for?
  
• Are there any single points of failure highlighted in our plans, and can/should our COVID-19 specific planning be augmented to better protect these?
  
• Are our plans to respond with fewer people, both internal and external, fit for purpose when considering our scenario planning? Are our IT capabilities able to support the potential volume of remote working we may require? If not, action should be taken to augment the plans and/or ensure management are aware of the risk profile.
  
• Are our plans to respond to loss of supply and distribution chains fit for purpose in light of our scenario planning? Is there an increased risk that our third parties may not be able to meet contractual SLAs, and have we taken this into account in our planning? If not, do the plans need to change?