Business Continuity Disaster Recovery COOP Crisis Management John Glenn CRP MBCI
Mitigate risk, mitigate impact
Two faces of every risk
John Glenn, MBCI
Certified Business Continuity Planner
First, it has called the world's fleeting attention to Business Continuity. That's good.
Second, it caused me to articulate what I've had in the back of my mind all along. That, too, is good.
Pandemic - according to Webster
Pandemic
occurring over a wide geographic area and affecting an exceptionally high proportion of the population
Mitigation and mitigation
The risk du jour, the threat of a pandemic outbreak of Avian Influenza A/ (H5N1), also known as "Bird Flu," is a perfect example of planning two separate mitigation efforts.
In the first effort, planners focus on prevention.
Currently there are no known and proven anti-flu medications for this threat.
We have a history from previous fatal flus, notably the 1918-1919 misnamed "Spanish Flu" which killed between 20 million and 40 million people. The death rate for 15 to 34-year-olds of influenza and pneumonia were 20 times higher in 1918 than in previous years.1
Since we lack a proven prophylactic for this risk, we need to look at ways to mitigate its impact on numbers of people while still maintaining at least a minimum level of service for the organization.
According to the US Centers for Disease Control,2 "Flu viruses spread in respiratory droplets caused by coughing and sneezing. They usually spread from person to person, though sometimes people become infected by touching something with flu viruses on it and then touching their mouth or nose. Most healthy adults may be able to infect others beginning 1 day before symptoms develop and up to 5 days after becoming sick. That means that you can pass on the flu to someone else before you know you are sick, as well as while you are sick."
Knowing how the illness spreads provides planners with a basic tool to combat the illness: basic antisepsis. This won't prevent the illness, but it may slow or limit its spread. Basic antisepsis really translates into basic hygiene common sense, both on a personal level and on an organizational level. (Who ever said the cleaning crew was not a critical Business Continuity component?)
The risk may be farther mitigated by reducing and isolating the number of carriers. There are several ways to accomplish this; which way, or ways, depends on the nature of the organization.
(This is not a tutorial on how to put together a Business Continuity plan for a specific risk. For that, email me for my rates.)
Suffice it to write that there are "off the shelf" ways available to mitigate the risk's threat to the organization.
There also are ways to mitigate the risk's impact on the organization.
This is the second mitigation effort.
When some planners start building the response sections of a plan, they begin with the famous "You go to work and there's nothing there" scenario.
For our risk du jour, the building and its contents are in place - hazardous to workers, perhaps, but none the less, available. Experienced planners know this is actually a relatively common scenario. Falls along the ocean and gulf; springs along the rivers to name but two events which lead to the scenario.
Since in truth inaccessible facilities are relatively common, the experienced planner knows how to mitigate the situation and creates response plans accordingly. Note that the response plan is about the same regardless of the risk which shuts down the site.
Inaccessible buildings are easy to accommodate for some organizations, but for manufacturing facilities and small, single-site call centers, the problem can cause a planner - and the plan's sponsor - some Excedrin headaches and even more pain in the budget. But, the impact can be mitigated none-the-less, using "off-the-shelf" options.
The bottom line for the planner is that the risk's impact must be mitigated, not the risk itself - we did that previously.
Beyond personnel
Telly Savala's Kojak3 frequently remarked, lollipop in mouth, "Who loves ya, baby?"
Business Continuity planners need to take the remark to heart.
Not just for the risk du jour, but for all risks.
How concerned are employees for their dependents' welfare? Will they forego their job to be caregivers to a spouse, children, or parent? It is not a simple question and a lot depends upon the work environment. Smart planners will make an effort to take the pulse of the workforce and to get a feel for the workplace. Rare is the organization that generates the employee loyalty of yesteryear.
How will personnel react if their home is in shambles, with nothing left but the foundation? Will they be willing to travel to a back-up site? The "bottom line" employee response may be the same as it was for the caregiver.
What about policies and procedures? Are they in place and advertised to the staff? Again, it makes no difference if the facility is unavailable because it isn't there or because it cannot be accessed and used - for any reason.
Final note.
Flu and cold seasons come around every year.
There are prophylaxis available to counter these illnesses, and the US Centers for Disease Control recommends that people in "high risk" groups be vaccinated each fall. It should be noted that (a) currently there is no vaccination for Avian Influenza A/(H5N1) and (b) the yearly flu attacks a different demographic than past encounters with bird flu.
Regardless of the flu type, the real question comes down to legal issues. Can, should, personnel be required to accept the prophylaxis which will make some as ill as if they contracted the actual disease. Can, should, people who live in close proximity to the employee be obliged to accept vaccination?
Where will the prophylaxis be offered? Who will pay?
(1) The Influenza Pandemic of 1918 http://virus.stanford.edu/uda Return to text
(2) http://www.cdc.gov/flu/keyfacts.htm Return to text
(3) http://en.wikipedia.org/wiki/Telly_Savalas#Kojak Return to text
"It is far better to foresee even without certainty than not to foresee at all." Henri Poincare, French mathematician, one of the greatest mathematicians and mathematical physicists at the end of 19th century.
John Glenn, MBCI, has been helping organizations of all types avoid or mitigate risks to their operations since 1994. Comments about this article, or others at http://JohnGlennMBCI.com/ may be sent to Planner @ JohnGlennMBCI. com.
