Checklist to develop your practical COVID-19 business continuity strategies (and next steps)

[This article is the first in my COVID-19 series, helping organizations and people conquer the crisis. The second and third can be found here and here.]

Here are some practical considerations you need to make in developing and implementing your COVID-19 business continuity strategies for your organization or business, or even for yourself.

If you already have some form of business continuity plans already developed, execute them. Otherwise, you have to take a practical short-cut and use the information below to flexibly develop your next steps as you go.

COVID-19 has fundamentally changed the culture of workplaces, how people distribute work and deploy workforces, and how employers engage with their employees.

In a time of crisis, trust is paramount

This simple formula emphasizes the key elements of trust for individuals and for organizations in times of COVID-19 crisis:

Trust = Transparency + Relationship + Experience

The first priority should be safeguarding your employees — their immediate health and safety — followed by their economic well-being. This includes focusing on addressing employees’ psychological stress.

Focus on your work, your workforce, and your workplace.

Directors’ duties

Directors need to constantly assess the foreseeable risk of harm to employees and their business including non-financial risks such as reputational harm and compliance with laws, to satisfy their directors’ duties.

Boards and management teams will need to understand the impact of COVID-19 risks on their business and, where relevant, develop and implement contingency plans.

Directors of listed companies will also need to consider the continuous disclosure ramifications of COVID-19.

Identify members of your management response team for COVID-19

Apart from the CEO, select/nominate members from your senior management team to be part of the COVID-19 management response team. Then assign clear responsibilities.

Establish emergency response teams right away in order to assess the risks and formulate response strategies after conducting robust scenario planning, which significantly improved the epidemic response mechanisms and toolkits.

Create subteams to manage specific workstreams such as communications, legal, finance, and operations.

The team’s responsibilities can be summarized as follows:

Acting as the single source of truth for issue resolution.
Ensuring that sufficient resources are deployed where and when needed.
Coordinating actions across the workstreams of all teams, based on scenarios and triggers.
Aligning team leaders on scenarios, with the help of roundtables and other exercises as needed.

Establish a COVID-19 Response Coordinating Group

The group will comprise of key operational representatives from IT, finance, operations, customer service, etc.

The purpose of this coordinating group is to steer your organization operationally, serving as an important central information center, managing risks, issues and responses, and aligning all internal stakeholders by centrally coordinating all internal COVID-19 responses and projects. This will give a coordinated and integrated approach to your organization’s internal COVID-19 response, thus avoiding duplication of work and efforts across the department.

The coordinating group can serve as the main source of information and a single source of truth where members discuss matters, creating communication and action plans, and aligning with key messages.

The coordinating group could focus on the following deliverables:

Creating a threat-map dashboard — Using digital tools to create threat maps with real-time data imported from internal and public sources. For instance, location and numbers of employees working from home, list of critical services/functions/activities, critical employees required to perform critical services, and non-critical employee availability and mobility.
Establishing an employee deployment and mobility database — Linked to (a) above, this database will capture skills and availability data from employees across the organization to facilitate a centrally coordinated staff deployment approach.
Developing an integrated COVID-19 response plan — The coordinating group will get updates from key internal stakeholders — ideally, at least twice a week. Its members can then integrate these reports into a plan to ensure that all groups coordinate their efforts and follow best practices.
Establishing a risk and issues log — While a threat map will make many risks visible, it will not capture every important development. If employees, teams or functions become aware of any additional threats, issues, and risks, they can immediately log the information in a database accessible to all employees, allowing the coordinating group to respond quickly with interventions.
Establishing a ‘self-declaration’ work from home database — This database will discharge the organization’s responsibility under the applicable OSH requirements and employer’s duty of care for the provision of a safe working environment, even whilst working from home. Employees have an avenue to provide a ‘self-declaration’ that they have complied with all working from home policies and requirements, whilst ensuring that their homes are safe for carrying out the organization’s work.

Stay on top of communications from the government and authorities

This may seem obvious, but it is imperative that you stay on top of alerts being issued by the Government, authorities, and even industry groups. News has been evolving on a daily basis. No doubt it will continue to do so indefinitely.

Seek advice or help in these unprecedented circumstances.

Protect your workforce

Prepared to provide your employees with factual information on the illness and related symptoms, as well as details of the organization’s plan. Employees should be educated on the symptoms and encouraged to avoid coming in to work sick.

To protect your workforce and ensure its continued productivity. It is critical to:

a. Establish strategies that enable employees to continue to function without endangering them.

b. Have a plan to isolate employees should the threat of possible infection arise.

c Ensure employees can effectively work from home in the right working environment that is safe.

d. Verify that you have the appropriate tools, technology, capacity, and security measures in place to support a large remote workforce.

e. Review your HR policies and procedures to ensure that employees will not be personally impacted if they must be quarantined for an extended period, continuously modifying any policies as appropriate to give greater flexibility to normal working arrangements.

f. Determine your priorities and the minimum workforce requirements to support these ever-changing priorities, especially in case you need to function with a significantly reduced workforce.

g. Identify key employees and ensure other employee members have received appropriate training or on-the-job exposure to comprehensively cover their absence.

h. Create a communications plan that includes providing employees and other stakeholders with regular situation updates as well as actions taken.

i. Review workforce locations and travel.

Other specific actions to improve employee wellbeing include:

Institute mandatory work-from-home or remote work policies where practical.
Close on-site facilities such as gyms, cafeterias, and common areas.
Make revisions to employee compensation and benefits policies.
Grant paid time off for symptomatic employees, employees who must care for family members who are diagnosed with COVID-19, and/or employees with diagnosed cases of COVID-19.
Extend sick leave, vacation time, paid time off or flex-time policies.
Increase sick leave or paid time off for all or on a case-by-case basis.
Utilize short-term disability or other existing benefits.
Encourage the use of Employee Assistance Programs (EAPs).
Remind employees about caring for their mental health.
Use back-up care programs, childcare subsidies or other dependent care benefits.
Refrain from penalizing time off of any kind.
Permit unlimited unpaid time off without penalty.
Pay for time spent under quarantine.
Offer work from home options or adjusting schedules due to school closures, transportation shut-down, etc.
Communicate any employer-sponsored insurance and other relevant benefits.
Advise employees to avoid public transportation.
Stagger shifts to help employees avoid busy commutes.
Advise employees to avoid visiting high-traffic events or locations on personal time.
Reconfigure meeting rooms, break rooms and other common areas to promote social distancing.
Remind employees about good hand cleaning.

Working from home legal issues

Employers have the ultimate responsibility for ensuring a safe work environment, wherever that work is carried out, even at home. This means that when employees are working from home doing your work, you have a duty of care for your employees’ health, safety, and wellbeing.

In a highly anxious environment, employers should consider how they can support the wellbeing of their employees. Plan for a likely increase in demand for employee welfare or wellbeing services.

The most common issue to arise is when an employee is injured at home in the course of their employment. For example, when an employee falls down the steps answering the front door or slips over in their ‘home office’.

If the employee is working from home, check that your insurance will cover that employee.

Employers may provide employees with work equipment, including a work laptop. Then it is a question of whether employees have ergonomic chairs, how good are their screens, if they sit all day resulting in a repetitive stress injury, etc.

So, how will you know if your employees’ homes are safe?

Develop working at home policies that outline the method to verification of the safety of employees’ work environments.

Smaller businesses may develop a ‘self-check’ policy for employees to verify to them that they will be working in a safe environment.

Review your HR policies and communications

Constantly review your HR policies and clearly communicate updates to your workforce.

Your key objective when reviewing your policies is to look out for your most vulnerable employees and helping them with others.

Businesses will need to be clear about their expectations as to when their employees should attend work. Be vigilant in relation to employees who are unwell.

In imposing restrictions on employees, you should be wary of your legal obligation to comply with regulatory provisions and relevant anti-discrimination laws. Ensure that any restrictions are lawful and reasonable and are required to keep workplaces safe.

Employees who are not able to work may or may not be entitled to paid leave. Some may be able to work productively from home, depending on the job role.

It may also be in your interest to expedite the identification or exclusion of COVID-19 cases by funding quicker tests offered at some private hospitals for a higher fee.

For employees working at workplaces, infection control policies should be reinforced and stringent protocols implemented. Personal protective equipment should be provided, where appropriate.

While masks have not generally been recommended for people who are well, some experts consider they provide a limited level of protection with the added benefit of preventing people from touching their face (which is thought to be a significant mechanism of self-transmission).

Work rosters might also be adjusted to limit potential transmission.

Employees (and wider stakeholders) will be looking for reassurance that they are being protected and that the business is prepared.

Areas of coverage when reviewing your HR policies include:

a. General advice for employers and employees

It is essential that employers and employees be as informed as they can be regarding COVID-19.

b. Employees exposed or at risk of exposure to coronavirus

Your policies should cover:

Employees exposed to coronavirus.
Employees returning from overseas travel.
Employees who have contracted COVID-19.
Where the employee is a carer for an affected family/household member.
Where the employee is required to self-isolate.
Where the employee wants to stay home because they are not feeling well.
Where the employee is otherwise required to be absent from work.
If there is no requirement by law or direction by the government or employer to self-isolate.
Casual or part-time employees.
Independent contractors.

c. Safe working practices

Employers and employees have mutual obligations to ensure that workplaces are safe and without risks to the health of employees and other people who may be in contact with your employees.

Personal Protective Equipment

Part of the employer’s responsibilities in minimizing risk is providing the appropriate personal protective equipment (PPE) such as gloves, masks and eye protection for employees who provide frontline services.

However, the provision of such equipment will be commensurate with the level of risk faced by an employee in terms of their duties and the direct environment in which those duties are performed. This is particularly relevant and important at this time as the nature of the public health threat posed and response required will place pressure on the availability and supply of these items worldwide.

Employee notification

Employees (including casual employees) and independent contractors should be required to notify the employer immediately if they:

(1) have traveled to an affected area;

(2) have been exposed to coronavirus, and/or

(3) are suffering, or have suffered, flu-like symptoms.

Other exclusions from the workplace

Employers should consider excluding other people from their workplaces including visitors, contractors, and volunteers.

Appropriate signage and other notices should be visible. Relevant information should be made available to those likely to be affected by such restrictions.

Minimizing unlawful discrimination and vilification

It is likely that COVID-19 could be characterized as a ‘disability’ for the purposes of anti-discrimination laws.

Employers have a responsibility to ensure that employees are not unlawfully discriminated against, knowingly or unknowingly, by their managers, their colleagues, and the organization.

Employers should remain aware of the potential for heightened unlawful discrimination in the workplace during a time of heightened public health concerns and possible pandemic.

Employers should be aware that if an infectious disease originates from a geographical region, employees from that region (or perceived to be from or connect to that region) may be at an increased risk of experiencing unlawful discrimination from others. They should monitor this and intervene where necessary to remind employees, customers, and suppliers of their obligations to behave respectfully towards others at work.

Any inappropriate workplace behavior by employees may be subject to a misconduct investigation.

d. Assigning and managing work

Employers might need to adopt policies and arrangements that allow dynamic responses to how, when and where work is to be performed and by whom.

Employee concerns over attending/performing work

Provided the workplace is safe, other than in the circumstances set out above, employees are expected to report for work as usual. Employees should discuss any concerns with their employer.

If employees request to work from home or to take some form of paid or unpaid leave, these requests are subject to the normal leave or flexible work application process in the workplace.

Maintenance of critical functions

In some circumstances, it may not be appropriate to provide employees with the opportunity to work from alternative work locations because employees are required to attend the workplace in order to maintain critical functions or services or implement the Government’s response to an outbreak of COVID-19. In such circumstances, employers must ensure that as far as is reasonably possible they have taken steps to minimize risks to employees and other people coming in contact with employees.

Consulting on workloads and overtime

While employers can ask their employees to work additional hours, those additional hours must be reasonable.

Employers have a practical — and in some cases, a legal — obligation to consult with their employees where there is likely to be a prolonged increase to employees’ working hours and/or workloads. Consulting in advance where higher workloads are expected is good practice.

Employers must continue to meet their industrial, legal, and contractual obligations.

Managing fatigue

Managing fatigue will be essential for a surge period that might last for a considerable period of time. Employers must comply with all legal obligations to provide a safe working environment and to avoid placing excessive or onerous workloads on their employees.

Employers should consider all available options to meet increased or changed service needs including offering additional hours to part-time and casual employees, offering paid overtime or time-off-in-lieu arrangements or engaging additional resources.

e. Managing leave requests

Where approval is discretionary for the type of leave requested, that discretion should be exercised cautiously and in consultation with the employee.

If employee leave is to be disallowed for operational reasons — such as employee shortages or higher workloads influenced by COVID-19 — this should be made clear and all alternatives to disallowing the requested period of leave be explored and discounted.

The employer might also seek to negotiate a different period of leave or for the leave to be taken at a different time.

Evidentiary requirements

Many employees will require leave during a time of heightened threats to public health for a variety of reasons.

In a pandemic or other emergency that affects public health, employees may find that access to medical practitioners is limited. Employers should establish local procedures for recording and approving applications for leave during this period, which are, at a minimum, consistent with the documentary evidence requirements.

Employers may wish to consider a more flexible approach to the evidentiary requirements, given access to medical practitioners may be limited or visiting a medical practitioner may otherwise not be advisable.

It is important that processes are established, in advance, to protect vulnerable employees and to ensure sick employees do not report for work. Employers need to consider how best to manage employees once they have exhausted their personal/carers leave entitlements.

f. Employees undertaking overseas travel

In all cases where employees might be traveling overseas, employers should ensure those employees receive broad advice on minimizing the risk of exposure to coronavirus. This includes good hand hygiene and cough etiquette.

Employees should monitor their health closely whilst away and seek urgent assessment for any symptoms of coronavirus. If unwell, the employee should isolate them to self from others whilst awaiting assessment.

International work-related travel

Employers should defer any work-related travel at this time.

Where work-related travel is proposed, employers should undertake a risk assessment for any work-related travel by employees and should consult openly and directly with those employees.

Personal travel

Where an employee has booked, is booking or is otherwise planning overseas travel to a ‘risk’ country for personal purposes — whether that be for a holiday or for family purposes — employers should ensure that the employee understands the implications this might have for them on their return from that travel. This includes any periods of self-isolation.

Employees must inform their employers if they are intending to travel to a ‘risk’ country. Where employees choose to go ahead with their travel arrangements, any period of self-isolation.

g. Employee assistance program and debriefing

Employers who run employee assistance programs or similar should ensure that all employees are aware of these programs and that they can access them if they have concerns about how COVID-19 is affecting them, their family or their colleagues.

Employers should ensure that appropriate peer-support and debriefing is available for employees directly involved in the testing and treatment of patients suspected to have and who have contracted the coronavirus.

Take care of your cash, financing, and reporting obligations

Determine which sources of cash the organization has available, including unused credit lines (committed and uncommitted), revolving credit facilities, and related borrowing restrictions; new sources of credit, such as fixed credit facilities to refinance existing revolvers; excess working capital (e.g., via inventory reductions, extended payment terms); equity infusions; etc.

Model financial impact using worse-case scenarios on profitability and liquidity. This includes assessing the probability of violating debt covenants and terms, and determining when available cash sources should be drawn.

Take into account any potential accounting and financial reporting implications.

Business closure is inevitable, if ….

Financial challenges faced by smaller organizations and sole traders may require them to close without government assistance. Maintaining cash flow in these times will be crucial to weathering this storm, especially when profit margins are very small.

Compile a list of your key customers

This is a critical moment that matters in the relationship with your customers. It is also a time for your brand to lead.

Establish a plan to serve your key customers for the duration.

Develop ways to limit contact with the public, customers, and vendors through changes in receiving practices, barriers or distance. This is especially true for retail, restaurant, hospitality, and other industries with direct contact with customers.

Since it is impossible at this time to know how long that will be, plan for at least four to six months and identify priorities for each.

Consider reprioritization of your product line to respond to market impacts associated with the threat, increase safety stock levels and stockpile essential supplies/resources, as needed.

Factors to consider include:

Understanding how your customer’s demand impact your business.
Develop a short-term demand-supply synchronization strategy.
Prepare for potential channel shifts.
Evaluate alternative inbound logistics options.
Enhance your ability to meet your customers’ demands and requirements based on priority and ability.
Maintain open channels of communication with key customers.
Prepare for the rebound, down the road.
Perform global scenario planning.

Most importantly, stay engaged with customers at all times.

Determine the Maximum Tolerable Outage (MTO) for all services

Maximum Tolerable Outage refers to the maximum period of time that the business can tolerate the disruption of the service.

Your MTO for a service could be NIL, in hours, in days, or in months. Be honest and practical about your service MTO.

Prioritize all services based on the Maximum Tolerable Outage

Using the MTO determined for each identified service, categorize them into:

a. Essential services (i.e., services that must be performed).

b. Services that could be delayed for a period of time.

c. Services that could be stopped.

Use other categories that suit your requirements.

The key objective is to find a way to prioritize your services so that you can dedicate your limited resources in keeping your essential or critical services running.

Identify all potential single points of failure

A single point of failure (SPOF) is a part of a system or process that, if it fails, will stop the entire system or process from working. SPOFs are undesirable in any system or process with a goal of high availability or reliability, be it a business practice, software application, or other systems.

By identifying your single points of failure for each essential service, you are able to ensure that all uncertainties throughout the value chain could be identified and managed. The results will feed into the high-level risk assessment process (see below).

Conduct a high-level risk assessment across these services

Understand contractual obligations, evaluate financial impacts and liquidity requirements, formulate debt restructuring plans, and optimize assets to help restore financial viability.

Another core focus was to understand financial impacts across the entire value chain.

The high-level risk assessment could include the following considerations:

a. Impact of service reduction on your key stakeholders and on your financial sustainability.

b. Health, safety, and wellbeing of employees and clients.

Employers in high-risk industries will need to go further in assessing their policies and the provision and use of appropriate personal protective equipment.

Potential risk mitigations include:

Closely monitoring supply chains or providers for potential impacts.
Conducting ongoing supply chain risk assessment and operation impact assessment.
Considering alternative suppliers.
Preparing for shortages, transportation delays or communication delays.
Approving the additional budget for supplies or additional paid time off.
Reducing or suspending bonuses.
Analyzing and forecasting potential market impacts.

Don’t lose sight of other risks

COVID-19 isn’t the only threat on the horizon — and often organizations are at their most vulnerable when dealing with a crisis that dominates their attention.

There will be many other risks that your business faces aren’t diminished by an epidemic.

A particular concern is that cyber risk multiplies when the workforce is suddenly distributed. Although many employers may be set up for remote work for their employees, far fewer have the proper cybersecurity protocols in place. Make sure that you have the necessary protections in place to safeguard your infrastructure, networks, and data.

There will be phishing e-mails with coronavirus-related subject lines or content. Train your employees on phishing and remind them that new
attempts will involve coronavirus or work from home issues.

Review any existing business continuity plans and standard operating procedures

Good time to dust off any existing plans and procedures.

It is too late to write any business continuity plans down. At this point in time, develop high-level intuitive strategies to respond to your current situation.

Determine whether the service is a full service or can be scale-down

Identify which part of the service can be delivered by employees working remotely from home (or off-site) and what tools, equipment, and resources are needed for doing so.

Identify any process changes or manual workarounds required to enable parts or the entire service to be delivered by employees working from home.

Some of your essential services may not be able to be delivered remotely by employees working from home. Alternative processes and workarounds are required to achieve the same outcomes.

Develop mitigation strategies for the essential service using scenario planning

Possible workforce outage scenarios that could be used in your scenario planning:

10 percent workforce outage
25 percent workforce outage
40 percent workforce outage
60 percent workforce outage (worse case).

Scenario planning is a critical tool for you to test your preparedness.

Consider the worst-case scenario in your planning and preparation. Factor in the closure of schools, universities, etc. and the shut-down of public transport, etc.

Develop contingency strategies to manage operating costs and protect the business in the long term.

Develop manual or paper-based workaround strategies and processes if employees cannot remotely access the organization’s digital information or IT systems

There is an assumption that employees working remotely from home will have Internet access or remote access to the organization’s digital information or IT systems. When more people work from home, these networks may not cope with increased usage.

There is also an assumption that public mobile and telephone services will still run during peak loads, which may not be the case. So, plan for the worse case and don’t assume.

Consider the worst-case scenario in your planning and preparation including developing manual-workaround processes without IT or system access.

A manual workaround process can be defined as a temporary method used to provide the continuation of a critical service activity when normal systems, technology or personnel are unavailable for a period of time. Once a problem is fixed, a workaround is usually abandoned.

Manual workarounds require manual labor, so you may need to reassign employees or bring in temporary assistance to continue the business process concerned. It also requires paper-based processes where information has to be processed and documented on paper and transposed later into the system when it is up and running.

There will be a number of manual forms and documents to be created if this occurs. Pre-determine which forms need to be created and get them printed for emergency use.

Do restrict personal device usage including USB sticks

Personal/BYO devices can be infected by malware. Processing business materials on these devices or even them to access your IT network especially through unsecured VPNs runs will represent a high risk.

Unless you have an organizational-wide secure Mircosoft 365 applications with Teams or OneDrive to store your digital assets, make it clear to your employees that materials cannot, under any circumstance, be processed on any personal devices including USB sticks.

As such, employees should only be remotely accessing files on the organization’s IT infrastructure via secure VPN connections.

List names of employees — primary and secondary — who are capable of performing the essential services under different workforce outage scenarios

Key actions include:

a. Develop a succession plan for leaders and managers. This includes delegate decision making/authority.

b. Develop call-tree contact lists for all employees. They may object to the collection of personal information on the grounds of privacy. However, employers have a duty of care for their employees to keep them safe.

c. Perform a skills gaps analysis to identify all potential employees who can perform the essential service with some training. It is not too late for upskilling your employees to provide the essential service.

d. Determine whether your secondary employees are able and willing to be redeployed to perform the essential service. Not everyone is flexible to be redeployed to do other roles not documented in their employment contracts.

e. Ensure that all critical employees can remotely access the organization’s IT network and systems from home.

f. For client-facing services, consider employee health and wellbeing.

g. Ensure that employees can conduct online meetings to minimize face-to-face contact. Evaluate your business needs for continued face-to-face contact with your customers and suppliers. Modify the frequency and type of face-to-face contacts.

List all in-bound critical numbers that must be redirected to designated mobile phones

All critical inbound phone numbers related to a critical or essential service should be identified and redirected where practical.

Protocols and processes must be in place to receive these inbound calls via mobile phones by trained employees.

Information received may be processed electronically, if there is remote access to core applications, or using paper-based or manual methods if the remote access to the organization’s IT network is unavailable.

List all in-bound fax numbers that must be redirected to alternate locations

Faxes received may contain personal information.

Exercise caution when redirecting faxes to alternate locations, ensuring that processes are in place to ensure confidentiality and security of the information received.

Identify key information or records — hardcopy or digital — that are required to perform the service

Employees working remotely will require access to information or records, either digitally or in hardcopy.

Develop manual workarounds when employees cannot access any of the organization’s digital information remotely.

If your business relies on hard-copy information, develop processes for accessing this information. Courier companies may be stretched during this time.

Inform your postal service to redirect all mail and courier deliveries at an alternate location

If your services are relying on mail or postal services, inform your postal service to redirect any documents.

Identify key suppliers required to provide the service — total reliance and dependency on third-party providers

The sustainability and availability of key suppliers in delivering your services will be vital during this period. If the service requires third party assistance (i.e., courier, tradesperson, etc.), determine whether they have business continuity plans and what service levels they can provide to you if there is a total shut-down.

Work out the extent and likely duration of any potential exposure or disruption to key third-party providers and supply chain. Any disruption to their supply chain may impact the delivery of your services.

Review key agreements and negotiate temporary arrangements for the continued delivery of services especially when there are resource constraints.

Continued payments to providers and suppliers should be monitored closely. This is to ensure that key suppliers remain committed to providing services to you.

Accelerate investment in digital trading solutions to combat supply chain interruptions, overcome logistics and labor shortages, and get better visibility into local access limitations in order to ensure product supply for the domestic market. Focus on operational agility and data quality.

A supply-chain-stabilization team could manage the following:-

Ensuring risk transparency across tier-one, -two, and -three suppliers.
Supporting supplier restarts, managing orders, and ensuring the qualifications of new suppliers.
Managing ports, prebooking logistics capacity, and optimizing routes.
Identifying critical parts, rationing parts as needed, and optimizing locations.
Developing scenario-based sales and operations planning for SKU-level demand and managing the planning for production and sourcing.

Manage supplies and be prepared for shortage

Consider the terms of your supply contracts. Make contingency plans for any interruption to supply.

Suppliers who are unable to fulfill their contractual obligations may argue they are not liable as the contract has been frustrated. You may need to seek other sources of supplies required to provide care and services and document their efforts in doing so.

If you suspect there may be disruptions to your supply chain:

Contact your suppliers, carriers, forwarders, and brokers immediately to confirm.
If possible, build inventories of your short raw materials and secure production and transport capacity from your supply chain partners.
Start sourcing alternative suppliers as needed.
Identify a resource to monitor the crisis and potential impacts to your supply chain.

Review key contracts

Your business may not be able to fulfill its contractual obligations to your own customers because of supply chain complications, risking severe penalties. If this occurs, businesses throughout the supply chain have options for protecting themselves or recovering from lost business.

Steps to take include:

a. Review key contracts to determine what, if any, rights and remedies you have as a result of the delayed performance of contracts are due to force majeure.

b. Provide timely notice of a force majeure event.

c. Prepare for potential litigation concerning failure-to-supply issues and the application of force majeure clauses, including by taking (and documenting) reasonable steps to mitigate any impacts of COVID-19.

d. Update force majeure clauses in contracts to take into account, to the extent possible, modern risks to contractual performance, including diseases, epidemics or quarantines.

Check your insurance

Review your organization’s insurance policies to ascertain coverage (e.g., business interruption insurance, the extent of public liability insurance, etc.).

It’s also important that you check your obligations to notify your insurer in the event that something goes wrong.

Identify key stakeholders impacted by non-provision of services — service reliance by third parties

If your service has a downstream impact on third parties, make contact and inform them of any potential limitation of your service.

Proactively manage their expectations and communicate clearly.

List all IT systems and applications — internal and external — that the provision of the service is dependent on

Software and systems rely on other software and systems in order to be functional. Identify all possible single points of failure.

If the system you are using is totally dependent on another system to be fully functional, then evaluate the extent and likely duration of any potential exposure or disruption of these other dependent systems.

Part of this exercise is to list all critical and non-critical IT systems — internal and external — used in your essential services, whether upstream or downstream.

Contact all system owners to determine the level of redundancies and limitations especially for remote access by employees working off-site. Understand their business continuity and disaster recovery plans and how that would impact on the provision of your service.

Identify any communication messaging — internal or external — required in the event that the service cannot be provided

Digital notification via email or text message — how can the message be sent and who is responsible for sending the message. Messages can be pre-drafted and approved.

Hard-copy notification to be displayed on location — who is responsible for putting out the display (i.e., at reception or front of the office).

Develop an emergency communications plan and revise periodically. This plan should include both internal and external key contacts.

All communications should be culturally and linguistically appropriate, especially for people with disabilities.

Preparing your communications strategies now

Create an internal communication plan — a process for reaching employees through combinations of emails, intranet postings, flyers/ posters, leader talking points, FAQs or a website situation room. The plan should identify simple, key messages, a reliable process and the vehicles for providing continual updates and collecting feedback from employees.
Create an external communication plan — a process for reaching external stakeholders, customers, media, shareholders, suppliers, local community, health care providers, analysts, retirees, union representatives, etc.

Communicate the facts from authoritative resources on how COVID-19 is spread and how to avoid infection. Clearly articulate and communicate preventive actions the organization is taking to avert or contain transmission of COVID-19 at work.

Your communication strategies include:

Social media for public messages.
Email, mail, text messages, hotlines and internal systems (i.e., intranet) to propagate pertinent information.
Signage to reinforce hygiene, screening and other organizational policies.

Ensure proper building management

Determine who will be in charge of the premises in the event that your business needs to close suddenly.

Consider the ways in which people, products, supplies and other things get into and leave your building or facility. Make sure that all building entrances and exits are secure.

Identify machinery, computers, custom parts or other essential equipment needed to keep the business up and running — and what (if anything) needs to be moved (or removed) in the event the building will be closed for any length of time.

If any of your employees are identified as having even casual contact with anyone known to have coronavirus, your facility may be involuntarily shut down. Plan what you will do if your building, plant or office is not accessible.

Regular cleaning of office locations

Put in place additional measures to reduce the risk of infection with more frequent cleaning.

Test all plans and processes

It is vital that all COVID-19 strategies and business continuity plans are tested with employees working from home. Where possible, test any related disaster recovery plans for IT systems. These tests need not be extensive.

In performing the test, teams should establish some conventions around ways of working — when do they touch base, using what tools, what hours are people working, how are they going to let others know when they are available, etc.

Document key lessons learned from these tests for future debriefs and improvement in the way the department approaches business continuity and disaster recovery especially from a pandemic perspective.