By now, everyone has heard of the avian flu. Most organizations have begun to watch the news for information on H5N1 with an eye toward business continuity planning. Many have started to collect and distribute health related information. But after raising the awareness and getting senior executives to listen, how does an organization start building a pandemic response plan?

The first step is to assign a pandemic planning coordinator. The person assigned this responsibility does not have to be the business continuity planning (BCP) coordinator for the organization, but they should have some BCP experience. The organization should not forget to appoint an alternate pandemic planning coordinator as well.

The responsibilities of the coordinator may include:

• Being knowledgeable about the latest pandemic information in general
• Oversee strategic decisions
• Coordinate discussions between departments and outside organizations
• Identify and assign appropriate resources
• Help modify plans
• Distribute awareness information
• Ensure all critical roles are staffed in the response plan and alternates are named
• Liaise with the healthcare community

One of the most important duties of the pandemic coordinator is to determine triggers for activating parts of plans and whether the conditions for a given trigger exist. Triggers will vary by company and may come down to an economic discussion. An organization may choose to trigger their plan when one employee displays symptoms, or they may decide that the trigger will be when five percent of the employees become sick. It will depend on the nature of the organization and its willingness to accept risk and the potential economic impact.

After a pandemic coordinator is identified, organizations can start building plans. Plans will almost always employ one of three strategies or a combination of the three:

• Employees working from home;
• Transfer of work to other departments or companies;
• An in-office strategy.

Each strategy has benefits and risks associated and those need to be examined ahead of time in order for the strategy to be effective.

Understanding Business Impact
Critical to any continuity strategy is understanding which of the processes of the business model are critical and which can be set aside for an extended period of time. In many cases, the issue may be to identify those departments that can be “out of business” for several days or weeks and those that are vital to keeping the businesses operating successfully. If your company has an established business impact analysis, use it to make decisions about department and process criticalities, what needs to be done to continue business operations and what operations can cease until a later date.

If the organization has an established BIA, use it to make these decisions. If you don’t, conduct a survey or make a high level assessment to make these determinations. Then, predicated on the outcome, make the decisions about which departments can cease operations and which can’t and provide department heads the ability to recommend which of the following strategies are best suited to keep the operation running.

Employees Working from Home
The first step in developing a work-from-home strategy is to conduct a survey in order to identify which employees have the resources to work from home and which do not.

Organizations will need to identify critical processes for each department. For example a manufacturing company may be able to send their accounting staff home to work, but not its call center.

Questions that should be asked regarding the work at home strategy include:

• Do you have a computer at home?
• Do you have Internet access at home?
• Do you have the necessary software on your home computer to effectively work from home?

Once an organization has identified which employees can work from home, they will need to ensure that the IT department can support the increased load. But IT isn’t the only concern when a large number of employees are working from home.

Organizations will also need to review and revise their mail handling procedures. The best way to do this is to assign employees to work with facilities for mail pick-ups and drop-offs. This person will have to set up a schedule for employees to come in for mail, in order to limit social interaction between employees. The same system will need to be put in place when employees need documents as well.

These processes need to be developed and communicated to management and employees ahead of time.

Transfer of Work to Other Departments or Companies
Sometimes the potential for this strategy may be overlooked, but in a crisis situation, it is perfectly acceptable to hire a temporary call center for example. Preferably, this other department or company should not be affected by the pandemic.

If this strategy is utilized, IT will also have to be heavily involved. They will have to create new system profiles and ensure adequate capacity is available for another organization to access the databases or systems.

Many credit unions located in the Gulf Coast were able to successfully implement this strategy. After recognizing operational problems associated with Katrina (prior to Rita), they identified other credit unions with the same core computer systems and signed reciprocal agreements to transfer processing to these organizations.

It’s a difficult strategy to implement and requires a great deal of advanced planning and coordination, but there are lesser costs associated with it.

In-Office Strategy
The final possible choice is an in office strategy and this too is sometimes overlooked. Organizations feel that they cannot possibly have their employees come into a building and potentially exposed to germs. But with scaled back staff in office, determined by using the previously mentioned business impact analysis, this strategy could prove to be very successful.

Prior to the pandemic, the response plan for this strategy should allow for increased separation between employees and there should be no personal meetings. The organization will need to provide masks and cleansing stations and communicate their whereabouts and proper use to employees.

The separated workstations need to be set up with appropriate software and phones will need to be rerouted. Additionally, the organization will have to set strict schedules about where employees are to be in the building at any given time.

Companies or organizations that typically have interaction between customers and employees will have to face additional considerations – retail for example. An organization may be able to place cleansing stations at the entrance to their facility, but they will need to investigate the legal ramifications of requiring customers to use them. A better alternative could be to encourage customers to use the Web to shop. The retail chain could offer discounts or lower prices online to discourage in-store shopping. Financial institutions could encourage the use of electronic banking and drive-through services.

The combined use of these three strategies will provide an organization with more flexibility and may provide for a more effective pandemic response. No matter what strategy or strategies are chosen, each will require advance planning and coordination, a job whose responsibilities should be assigned to the pandemic coordinator.

Whether a pandemic occurs or not, the planning and coordination involved should prove valuable to an organization no matter what disruption they may face, because it will increase the understanding of how the business can operate in the face of adversity, and will pressure the organization into adopting a more flexible approach to responding to an unexpected event.

About the Author Lee Milligan is a Senior Project Leader for Strohl Systems. Previously, he was the Director, Business Continuity Planning for Gap, Inc., Director of Emergency Contingency Planning and Information Security for Charles Schwab, and in the technology field for Apple Computer, Bank of America, and State Farm Insurance. He has over 40 years of experience in business, with a major focus on technology, information security, and business continuity/recovery. In addition, he has served as Chairman of the Strohl User Group Advisory Board and Chairman of the Northern California Disaster Preparedness Network with the Red Cross.