Disaster Recovery Journal- Volume 19, Issue 3 - Summer 2006 Issue

Return to the
Summer 2006 Issue

DISASTER RECOVERY
JOURNAL

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276
Fax: (314) 894-7474
Internet www.drj.com
E-mail drj@drj.com

PUBLISHER
Richard L. Arnold, CBCP
richard@drj.com

EDITOR-IN-CHIEF
Jon Seals
jon@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

COPY EDITORS
Richard Sandhofer
richards@drj.com
Pamela Clifton
pamelaclifton@hotmail.com

ADVERTISING
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

EXECUTIVE COUNCIL
Jeff Dato, MBCP, KPMG
John Jackson, J Albright Advisors
Edward Devlin, E.S. Devlin & Associates
James Hammill, CBCP, JMH Consulting
Pat McAnally, SunGard Availability
Brian Turley, Strohl Systems
Belinda Wilson, Hewlett-Packard

INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Click Here for a Printable Version

Is it Hype or Real?

By TIM ARMIT

If you work in business continuity long enough, you will see new threats appear and become the focus of this year’s conferences, sales pitches, and marketing. Some of this is justified and a correct reaction to a new threat. Others are hype and in an industry led by consultants, a new method to sell an old product is always welcome.
Without doubt 2006 will be the year of the Avian flu threat. But what, if anything, does this mean to the business continuity industry? Is it hype or real? Is Avian flu different to any other threat? What are the implications to the business continuity planner if this does become a pandemic? What should we expect from the government and what do we need to know from them? How can we prepare for it? This article examines these areas and gives some practical advice on what we can actually do to help prepare.

Is bird flu different?
We can observe reports of cases of humans infected with Avian flu being identified across the world. In most cases, so far, these are restricted to people working daily and intensely in the Avian industry. If, and so far it is an if, the strain of flu mutates and becomes transferable to humans then this may result in an outbreak which may spread across the world. Re-read that sentence again. Consider the number of may’s, mights and maybe’s in it. So are we building up a level of fear out of proportion to the threat?
Well the answer to that, as with many areas concerning Avian flu is not within the jurisdiction of the business continuity professional. Many times people working in business continuity forget the areas of responsibility and capability they have. We are, in most cases, not medically qualified, not in a position to make controlling orders on movements of goods or people and cannot make demands on how people behave. Our role is simply to ensure business continues. We are employed to identify risks, determine impacts, implement strategies to protect our people and operations, and then implement plans to ensure business continues in the face of any threat. We must never lose focus on our scope or our limits.
Currently there are conferences in all business sectors devoted to Avian flu. There are guidelines being printed in many publications but none seem to offer anything new to what we have been doing in business continuity for the last 20 years. Is there a danger of people cashing in on others’ fears and making money out of their concerns?

What will be the impact on your organization?
Let’s examine what avian flu would mean to your organization. The published statistics in the UK consider at worse a 25 percent infection rate in each area impacted. The infected areas are seen as moving across the country with the impact to each person being about eight days. As such, in your imagined family of four, if one falls ill on day one and the next on day two and so on, the last will recover on day 12. So we can expect all members of that family to be out of circulation for 50 percent longer than the expected infection time.
But let us always remember those two key phrases in business continuity: “so what” and “who cares.” Consider the true impacts on your company. If 25 percent of your staff are infected and a further 25 percent refuse to come to work, this still means you potentially have 50 percent of your staff in place and operating as normal. In many of your business continuity plans you will have a strategy which will involve you leaving your office, redeploying to a strange location, utilizing recovered, reduced, or replicated systems and working in a very much reduced fashion, in most cases initially 10 or 20 percent of normal staffing. Unless of course you have the operations duplicated in another location geographically where the function can be picked up immediately, all of this should sound familiar. So what you ask? Well lets return to the start of this paragraph. You still have 50 percent of your staff in your normal office, using your normal systems with no interruption so this could be more than 100 percent of the staffing your plans say you require in a crisis. So is there any crisis? Is there any threat to your operation in these circumstances? Let’s keep things in perspective: if Avian flu arrives, it may be tragic, it may debilitate large areas of the country but as business continuity managers, it is already within scope of our normal plans.
Of course there are two things to consider in the above statement. First, will the levels be this apocalyptic and will we lose this many people? Well a lot of this could depend on how the nation’s media react to it. Headlines stating, “We can fight this together,” as opposed to, “death bug strikes, millions to die,” will determine for many how they react. Secondly, the 50 percent of staff unavailable may include 100 percent of staff from our critical areas.

What are the wider implications?
If mass hysteria strikes and people decide they won’t use public places or shops, then what must happen? This is where, for most of us, we move away from our areas of control and look to central guidance. In the worst case what do we need? People in their homes need to stay warm, have water, and be able to eat. Everything else becomes secondary. Whole areas of normal operations can be suspended. Once again let’s keep it real. After Sept. 11, 2001, the U.S., in simplistic terms, stopped the entire financial sector for four days. As such, with this precedent we know the financial sector can stop with an acceptable level of impact. Look to the UK during the football world cup. Companies across the nation almost come to a standstill. Look when new public holidays are announced. They are implemented with minimal impact. Now many of these events are known ahead of time and are scheduled. So let’s work from that position.

1. Once an infection is discovered and its human-to-human link proven, then work from the premise that work will stop, or be impacted, and plan operations with this in mind.
2. If you work in food retail then there will be a rush on goods as people stockpile – plan for it.
3. If you work in retail banking there will be a rush on ATM withdrawals as people horde cash – plan for it.
Don’t let yourself be taken by surprise.
Let us then assume that people want the minimum to survive and don’t want to leave their homes. We can assume a mass demand on internet services.
4. If food retailers offer Internet shopping and home delivery, expect a large increase – plan for it.
5. Assume your own call center operators will not want to work together – plan for it.
6. Implement telephone systems that allow operators to work from home and still deliver service to customers.

None of this is difficult and only requires basic planning and yet it will help. In many ways looking at Avian flu is like looking at the millennium bug. It may impact everyone across the world, or it may be expected and never arrive in the way foreseen.

“What about protecting our staff?” you may ask? Well, “how?” is the reply. Some companies are buying what they think will be vaccines. The fact is there is no vaccine for a virus. If a company buys a vaccine for an employee, are they buying them for their partners and their children as well? If they are protected will leave sick people at home just to come to work? Keep it real at all times in your planning.

So in reality there is little we can do beyond what we do for any other type of risk. We know our priorities, we know the minimal staff levels required to meet these priorities and we know the key staff or alternate areas that can deliver critical operations if an area is lost. So is there anything new or is it all hype? We are told that one of the best things we can do is to wash our hands at least seven times a day. Is this just so simple and not technical enough or modern enough so that it gets ignored? Will people wear masks? What rights do companies have to ask staff to do this, and will staff listen to managers who suggest this? Is it the government’s job to start promoting these practices?

If a true pandemic arrives and leads to the mortality rates suggested for the UK, in the region of 400,000 above normal levels of winter death, then how does this impact UK companies and what do we as planners need to know to help us make decisions? First, unsavory as it may sound, the UK’s major funeral companies could not cope with this number of deaths. As such, at a time of heightened emotions we can expect the press to run photographs of bodies awaiting burial. We know this will happen so plans must be in place now for it.

The National Layer Cake
If we look at a nation as a layer cake with each layer delivering a part of what makes the whole, then each of these can be examined and priorities implemented – almost a national impact analysis. Only then can we understand what must be in place to protect the nation’s needs and not base recovery on assumptions. In most cases companies have planned to ensure their operations continue so that stakeholders share value and profitability are protected. They have not considered the wider implications of many companies being impacted at the same time and this is where business continuity needs to move to now.

The nation’s basic infrastructure must be in place for all other businesses to function. So power – be it gas, electric, or oil – and food and water need to be delivered to where they are needed. But to allow personnel to work in those sectors that deliver these to the public they must be able to get to work. So the roads must be open. To enable shops to have food they must have deliveries, so transport must be working and again the roads must be functional to allow them to run. If we also consider hospitals, schools, and other key support functions that must be in place for a nation to function, we still have some way to go before we start worrying about the financial sector or luxury shops. These layers must be in place one on top of the other to allow the nation to function and this level of prioritization needs to be implemented with central guidance. However, it needs to be done now, not in two or three year’s time. The key details need to be made clear to the business world so they understand how their plans dovetail into the national priorities.

What should we do?

7. Our plans must consider much longer time periods of loss of employees than those published for infection.
Consider this: if your child or loved one is infected will you leave to go to work? It is unlikely.
8. Agree your human resources policy to extended sick leave for people who are not sick but are supporting sick family members.
Will your employer want you to come in if living in an infected household but as yet not showing symptoms yourself?
9. Agree your internal strategy to staff in these circumstances and consider the bullets below:
- If your staff do not want to come into your offices, what is your policy?
- If your staff doesn’t want to use public transport what is your policy?
- If schools are closed and family members have to remain home, what is your policy?
10. Standard business continuity approaches such as cross training and working from home must be reviewed and implemented where weaknesses are found.
Now there is not much new in the above suggestions and many of you will have catered for these points in your existing human resources plans – but for some planners this will be new. In the recent UK Tripartite review of the financial sectors business continuity capability, it was found that human resources planning showed weaknesses in almost 50 percent of all major companies. Ensure that your plans are tightened up to better cater for the needs of your staff.

Conclusion
If Avian flu comes, it may or may not have tragic implications for our companies. There is very little that can be done in terms of business continuity at an operational business level, and what can be done in most cases relates to any plan or strategy already in place. Let’s not overreact to the threat of the moment but rather plan for the worst-case scenario and allow your plans to be fine tuned to the specific threats.

Tim Armit, of Clifton Risk Management, has been one of Europe’s leading experts in business continuity for the last 17 years implementing and proving strategies in every business sector across the world.