The main purpose of Cybersecurity Awareness training course is to minimize huma....
1 Most Common Blind Spot in Business Continuity Plans
Company x is proud of its comprehensive business continuity plan (bcp).
If a flood or some other disaster prevents Company X from using its main facility, production will shift to an alternative plant in an elevated area about 20 kilometres away. Supplies will be redirected to this new location. Data stored on the intranet and other information systems will gradually become available over the next 24 hours.
Staff will receive communication by SMS, voice, personal email and WhatsApp. A media release will explain the recovery plan and any implications for customers, investors, suppliers and staff, and provide reassurance for all stakeholders. Staff will return to work the next day, and everything will happen pretty much as it did in the rehearsals that Company X has been conducting religiously every 6-12 months.
Is this a fairy-tale?
Yes, it is. Let’s look at a few realistic scenarios of what might happen if a flood really were to strike and Company X had to invoke its plan.
Joe is an operations manager responsible for a key product manufactured by Company X. Much of the daily decision-making rests on Joe’s shoulders. He lives with his wife and two children in a high area that’s nice and safe from floods.
Joe’s sister Elly lives in their hometown, 10 kilometres away, and her situation is different. Her house is severely damaged and the area she lives in has been evacuated. So Elly, her husband and their three children are welcomed with open arms by Joe and his wife. Many public services are closed, including local schools, and Joe’s kids are having the time of their lives at home with their cousins.
But the fun doesn’t last for long. Four adults and five kids in Joe’s small house is creating problems: not least, there’s hardly enough food in the fridge to feed everyone and local stores are unable to re-stock. On top of this, Joe’s boss expects him back at work straight away because his house is unaffected, even though Elly and her husband need help with theirs. Joe finds himself unable to handle the stress. He secretly wishes his house had gone with the floods too.
Joanna works in the accounting department at Company X. She’s in charge of the ledgers, purchases, invoicing and payroll: complex and specific functions. Joanna’s husband is a volunteer in the flood rescue team, helping people evacuate from the flood. But he’s been missing for two days. Joanna is very emotional and hasn’t returned to work. Someone else has stepped in to cover for her, and they’re making a lot of mistakes.
These are just two examples. Company X will likely have many more staff like Joe and Joanna. Potentially the entire workforce.
The blind spot
Even though the company’s BCP has been thoroughly tested, the rehearsals involved capable people. In real-life disasters, capable people might not be around. We often talk about BCP training, staff safety and creating a ‘risk culture’, but very little is said about who activates the plan when staff aren’t coping, or how an organisation should help staff return to ‘normal’ when they’re suffering from post-traumatic stress disorder (PTSD), or even how an organisation should ensure the longer-term wellbeing of its staff to prevent burn-out.
BCPs tend to concentrate on scenarios such as damage to buildings, denial of access to offices and loss of IT, but the most important ingredient to successful disaster recovery is an organisation’s greatest asset: its people.
Hard-hitting, often sudden phenomena such as earthquakes, fires, wars and floods do not give people time to create individual or collective responses. For organisations that value corporate social responsibility highly, this creates another pressure: in addition to looking after business continuity, they will need to help staff with their domestic and personal recovery. Even organisations that haven’t formally committed to their social responsibility are likely to end up with the same challenge because, in a disaster, there are usually no ‘spare people’ who are unaffected and available to be engaged as temporary or permanent relief staff.
Types of impact that disasters could have on your staff
Being directly affected by the disaster, as in the situations described above, causing inability to get to work, or to cope with work and life in general.
Experiencing fatigue during recovery activities, which is particularly relevant to key staff/departments involved with the restoration of systems, facilities and services. I’m thinking back and remembering IT staff working 20-hour sessions, surrounded by cold coffee and pizza boxes, becoming less productive and more prone to errors. All of this during critical work, applying procedures that might have been poorly tested and poorly documented, were not validated recently or were simply never tried.
Trying to stay effective in a nerve-wracking work environment, including dealing with stressed-out bosses and co-workers, and irate customers. Knock-on effects can include a breakdown in work relationships, an increase in absenteeism/sick leave, attrition, premature retirement, accidents/mistakes, low productivity, less creativity and more customer complaints. It's a vicious circle.
Some real-life examples
-
Hurricane Katrina, 2005: New Orleans Police Department and the Health Department reported up to 70 per cent staff absenteeism after the storm, due to destruction of staff homes, danger to staff and their families, and related stress. There were also longer-term labour market changes and unemployment due to staff displacement after Hurricane Katrina, and other disasters.
-
World Trade Centre attack, 11 September 2001: Even before this major event, studies had found that in disaster situations managers may be overwhelmed by the emotional needs of survivors returning to the workplace. Managers in these situations often lack the experience, resources and training to support staff emotionally and help them adapt back into the workplace when they return. This was decidedly the case after September 11.
- Athens earthquake, 1999: A few years earlier, an earthquake in Athens, Greece, seriously affected the social and economic life of the city, including the functioning of the Bank of Greece. Although its IT systems and communication components were up and running, staff were unwilling to get back to work as they were suffering from fear, anxiety and acute stress. This resulted in a temporary stop of all the bank’s operations, even the most critical ones.
A few relevant ways to get better prepared
-
Adopt proactive measures that will enable staff to cope better with unforeseen events. These could include regular rehearsals/simulations, but also initiatives that promote a physically and mentally healthy workforce. Apart from the day-to-day productivity benefits, staff will be in a better position to cope if a disaster strikes.
-
Promote a cooperative culture and positive morale. This will enable staff to rely on each other effectively in times of need and make job rotation a realistic concept.
-
Create multidisciplinary business recovery teams. Nominate first and second ‘additional’ team members, and then put this practice to the test during BCP walk-throughs and disaster simulation exercises.
- Set up business recovery provisions and staff assistance programs that do not rely on local services, and test them. For example, recovery service providers located in the same area as your organisation are prone to the same disasters and will probably be overloaded with enquiries just when you need them. Have a plan B, C and D at the ready. In addition to business recovery services (for spare parts, continuity equipment, IT data recovery and so on), it’s advisable to be able to activate staff assistance programs with remote counsellors (on a phone basis). Proper psychological assessment of staff should be part of every organisation’s BCP.
If you want your BCP to work when you need it most, contact me at www.businessasusual.net.au and if you’re keen on ISO 22301 / ISO 31000 / ISO 27001 training, see the calendar on www.tinyurl.com/bau-events.
About the author
Ms Rinske Geerlings is an internationally known, award winning consultant, speaker and certified trainer in Business Continuity, Security, Disaster Recovery and Risk Management with over 20 years global experience. She founded Business As Usual (www.businessasusual.net.au) in 2006.
