October of last year I led a business continuity (BC) workshop for clients, prospects and partners. While explaining that a good BC program permeates throughout an entire organization an attendee asked how he could best deliver that message to upper management. He worked for the IT department of a healthcare provider. His concern was that while the IT department was capable of solving many BC problems related to their technical needs, that they were not the appropriate resource to handle other non-technical disruptions to the organization. Many of his fellow attendees agreed that too often BC is treated as an IT issue and not addressed with a collaborative approach. He needed an example to help his leadership visualize his concerns.
My response was to describe a computer virus infecting various systems on the network, and I asked if that scenario was one that IT should resolve. All of the attendees agreed that IT was the right department to deal with a computer virus.
I then changed the example to be a biological virus infecting various staff members within the organization, and I again asked if that scenario was one that IT should resolve. Again the attendees were unanimous in their responses, but this time they agreed that IT was not the right department to deal with the problem.
I then explained that regardless of which resource was the best choice to deal with each disruptive event, that both events still required a BC plan. Organizations that put the effort into understanding their BC roles across all business units, and to encourage various departments to work together in developing BC plans for both known and unknown threats, are more likely to maintain predefined levels of performance following a disruptive event. IT alone cannot solve every BC problem.
Sometimes truth is stranger than fiction. That hypothetical example was by no means a prediction, but today many organizations are rightfully concerned with how the COVID-19 coronavirus outbreak will impact their operations (or how best to respond if an impact has already occurred). With frightening headlines emerging everyday it may appear that it is too late to prepare.
The good news is that you can still start taking action to minimize any potential impact from the outbreak by first addressing your organization’s culture. Communicate with your staff, partners and various stakeholders to let them know what the potential risks are from the outbreak to your organization and how you intend to respond to such risks. Start identifying what third party dependencies your organization has, and contact those providers to learn more about their BC plans. Schedule a time for the heads of various business units to meet, and run through an exercise where a fictional outbreak impacting the organization is described and each attendee shares what their response will be to ensure that commitments are met. Emphasize that the point of the exercise is to discover potential weak points in the BC response, so that the organization as a whole can become more resilient to this and other scenarios.
Finally, do not be afraid to admit that your organization might not be fully prepared to deal with a major disruptive event. BC programs only work when they promote a culture of honest self-evaluation. The first step in preparing for any emergency is identifying how you are unprepared. Only then will you be able to address the challenges that your organization may face both inside and outside of IT.
