For business continuity experts, after action reports (AAR) are required documentation following a workplace incident. But imagine being able to complete an AAR before that incident unfolds, fully aware of everything which will happen, every mistake that will be made. Impossible, right?
While this wasn’t the exact scenario experienced by MD Financial Management (MD), a financial services firm which serves Canadian physicians and their families, an incident in January 2020 wound up equipping the company to quickly pivot when COVID-19 hit North America full-force later that March.
In January, COVID-19 was unfortunately only beginning to hit risk radars, as it seemed mostly confined to China. We have all now received a dramatic crash course in how a pandemic can quickly rage through organizations and our entire society. The incident: an MD employee picked up a friend from the airport who had flown in from Wuhan, China. A few days later, that employee began to feel unwell.
At that time, both the understanding of the virus and appropriate responses to exposure were still emerging. If an employee felt unwell, but still quite fine enough to work, the natural tendency was to push through and come into office. Before this employee had settled down to work, they met with colleagues over coffee and visited desks across many floors. In the span of 30 minutes, they had traversed through all major traffic corridors and most of the floors of the building. I hope they adapted well to social distancing.
At the end of the business day – less than an hour before closing, and on the only overlapping day of vacation for some members of our business continuity management team – the employee’s colleague asked our business continuity management team about policies regarding COVID-19. This threw up red flags, and we activated our crisis response team as well as the front-line teams who shared the same facility as the ill employee.
Through previous continuity plan exercises, we were able to quickly convene the correct people to make decisions, but we soon realized a pandemic is an incident different in type. A fire means people get out and stay out until the interior is repaired to a certain standard. A data center failure should trigger an organization’s disaster recovery plans. But each answer to a pandemic invites more questions. How long does a desk surface stay infectious? How should they be sterilized? How long must other employees stay home? In January, nobody had clear answers.
Our team needed medical advice on how to respond – except the regional public health agency had already closed for the day. That moment transitioned our continuity incident into an event. We had a sick employee who had come into our largest office with a dramatically higher-than-normal chance of carrying COVID-19. We had questions. Yet we were unable to contact a public health expert.
MD’s head office faced two choices: re-open the next day after a thorough cleaning, or close until consulting with public health officials. While all employees technically had the capability to work from home, it had been more than a year since they had to evacuate the facility (let alone shutting down the building). Executives were well aware of the difference between theory and practice and asked us if it was possible to close in this manner. We were confident it was, based on our tested continuity scenarios. Yet the markets had just taken a turn, and while exceptional client service is always imperative, closing down an entire building in the middle of a financial downturn could be incredibly stressful for both clients and staff. In the end, in order to protect employee safety, the decision was made to close the entire office for the day.
Some people forgot to take laptops home with them. Some people could not access the company portal – but fewer than a dozen out of many hundreds. Technology like VPN, email, and call-routing software handled the load and worked without outages. Client business largely functioned as normal. The silence of complaints from having a well-developed and well-tested business continuity plan was deafening.
While that employee could have had COVID-19, in the end, this person thankfully did not. The one-day closure proved to be a meaningful exercise to prepare for the complete national shutdown which happened in March.
Six key learnings to shore up continuity
That January “dress rehearsal” exposed our strengths and weaknesses in handling an unforeseen threat. Here are six key learnings, each of which bolstered our full COVID-19 response:
- Schedule back-ups. As the saying goes, if one thing goes wrong, everything else will all at the same time. As business continuity professionals, we know events often occur at the most inopportune times. That’s why it’s imperative to ensure back-up staff are identified to cover for vacations – and a protocol in place if those on vacations need to return.
- Have clear reporting structures. Make sure employees know who to call right from the start. In this case, it took an entire day before an employee notified the business continuity department of concerns. Make sure there is a clear plan for whom employees must contact and which teams and departments need to be involved right from the start. Include procedures for escalation if needed.
- Plan exercises for every possible scenario. It’s been an interesting year. Aside from planning for a “2020 Volume II,” it’s important to be able to plan for every possibility. Are your plans time-sensitive, flexible enough to direct course depending on when the continuity-event occurs? For example: if it’s an hour to closing, does a four-hour maximum tolerable outage mean the same as an hour before opening? What if major client issues are at play, markets crash, or protests arise?
- Ensure your contact lists have closing times for external agencies, if applicable. As we learned with public health, resources aren’t always available when they’re needed. Document operating hours for government agencies and other important contacts – and steps to take if they are not available (as incidents can occur at any time). After January, we realized we couldn’t make proper decisions without health care expertise available to us at all times, so we hired a physician to be on staff and on-call 24/7.
- Exercise continuity plans regularly. Despite pandemic-level challenges, our regular continuity exercises proved essential in ensuring people knew how to respond to an office closure, including what to bring home with them. We were able to identify teams most impacted by loss-of-facilities, identify key contacts on those teams, and develop potential workarounds. As the office closed, communication pieces were developed to share the way forward with impacted teams. Being a bilingual organization added another layer of complexity with translation, but this too was pre-built in our plans.
- You can never over-prepare. Always learn from your last incident or event and make changes accordingly. The first moments of a response set the direction for the rest. Do it poorly, and you’ll own the risk of explaining your team’s actions to your executive steering committee. Do it well and no one will know you were doing anything at all. This holds true for any sort of continuity event such as an active shooter, hurricane, ruptured water main, or pandemic. The sooner you can get on top of an incident, the more you can control the outcome.
In January, only hours after the very first discussions around the infection began, all employees were notified to work from home the following day, the office was closed, and business continuity plans were activated. It wasn’t seamless, but it was effective. Most important, it helped ensure our national response was primed for success.