Skip to main content

COVID-19 : Business continuity programmes

Risk & Analytics|Future of Work|Insurance Consulting and Technology|Risk Management Consulting
COVID 19 Coronavirus

By David Gluckman and Frederick Gentile | April 17, 2020

Does your business continuity management programme address the COVID-19 pandemic?

Protect your organisational resilience and effectively respond to a pandemic

The degree of spread of COVID-19 in the weeks or months ahead is uncertain. In the event of a worst-case scenario, can your organisation meet the issues and answer the questions that are sure to arise? One response to the current situation is to undertake action to formulate and implement a pandemic response plan.

Threats to your organisation: Whether you have established a mature business continuity management programme or have just begun the planning process, it is important to keep in mind that best practice risk assessments should take an “all hazards” approach regardless of the threats or hazards. The probability that a specific hazard will impact an organisation’s business is hard to determine and why it is important to consider many different threats and hazards and the likelihood they will occur.

However, when specifically focusing on a pandemic, we have seen the following impacts to organisations that you may wish to consider:

  • A major event has occurred, not a daily operational problem
  • The pandemic has not produced a "business as usual environment”
  • Responding to the pandemic requires considerable time, resources and upper management involvement/commitment
  • Having a methodology in place to continue executive decision-making capabilities
  • Continuity strategies and any additional plan enhancements can be affected by other business priorities
  • The impact to your existing IT infrastructure, human capital, business processes and other essential functions may be affected

Responses to complex situations: Having a business continuity management programme in place helps ensure the development of complex responses to complex situations. A wait-and-see approach is not recommended. Due to the pandemic, the time to determine the logistics of who is in charge, what roles and responsibilities staff will have, and other sensitive issues is likely a priority.

The following are guidelines which may help refine your existing business continuity management programme or provide some guidance to assist in your response to any COVID-19 related issues.

  1. 01

    Assessing the business impact

    This component involves reviewing (or developing) long-term actions designed to bring critical business functions/operations back to pre-pandemic levels as quickly and efficiently as possible.

    Critical functions: For each operation that is deemed critical, determine the essential functions performed and identify how long these functions can be inoperative or severely hampered before adverse impact is realised. The key is to develop your recovery time objectives in order to determine how quickly you need to resume these critical business functions.

    Essential staffing: When performing this assessment, it is important to identify essential employees and other necessary data (e.g., raw materials, suppliers, sub-contractor services/products and logistics) to maintain business operation. Also, identify what internal or external departments or locations are needed to perform these functions or processes and who is the recipient of this output. It may be helpful to develop a process flow chart to clearly see the dependencies impacted by the pandemic. Furthermore, consider reviewing contractual obligations if unable to deliver goods or services in order to determine if there are fines or penalties involved if you cannot meet those obligations.

    Pandemic – special considerations: Business continuity plans tend to focus on more common catastrophes, such as earthquakes, fires or floods that result in physical damage to property and assets. A health emergency requires special consideration. Unlike other potentially catastrophic events, a pandemic may not be geographically or temporally bound. A fire may impact only a single location and strike without warning. A hurricane or flood may impact a specific region.

    Pandemics, however, usually occur in waves of variable duration and will vary in severity throughout the world. Thus, the impact on human capital within an organisation may be enormous.

    For example, consider the possibility that a large portion of your workforce is unavailable for weeks or months and implement other strategies such as working remotely, modifying work schedules and locations, changing operating hours, cross-training employees and temporarily ceasing non-essential functions. Additionally, consider having the data available to sustain operations for at least 30 days. If not already developed and maintained, develop a current list of vital records, systems and databases.

  2. 02

    Supply chain evaluation

    Evaluating your supply chain risk is a continuous process that will reveal the acceptable level of interruption throughout the life cycle of the good or service produced. During this process, answering the following questions should prove beneficial:

    • Do you understand the operational and financial impact if a component of the supply chain fails?
    • Has a seasonality impact analysis been performed?
    • Have issues or concerns with time-sensitive constraints been identified?
    • Have recovery and technology resources critical for functions performed in the supply chain been identified? Are back-up strategies available?
    • Are any documented bypass procedures available in the event of a disruption of services or materials?
    • Is there sufficient back-up (such as safety stock) or alternative suppliers of raw materials, third-party production capabilities or personnel?
    • Do your suppliers and business partners have a business continuity plan that is up to date and tested on a regular basis?
    • Do supplier contracts contain a service level agreement (a formal agreement between a service provider, both internal and external, and their client which covers the nature, quality, availability, scope and response of the service provider)?
    • Are back-up or alternative suppliers’ capacities verified regularly against current needs?
  3. 03

    Communication strategies

    Employee messaging: Providing a clear, concise and accurate message to all employees, business partners and other stakeholders is critical during any emergency. This may be especially challenging during a pandemic since systems need to be available when person-to-person contact is not possible. It is suggested that you find up-to-date, reliable pandemic information from community public health, emergency management and other sources and make sustainable links.

    Providing a clear, concise and accurate message to all employees

    Crisis communications: Some organisations have in place a crisis communications structure that uses a corporate crisis management team in addition to templates for press releases, guidelines for media relations and strategies for internal communication. Consider establishing a formalized succession planning procedure as well as develop memorandum of understandings (MOUs) or memorandum of agreements (MOAs) to ensure essential functions continue when staffs are unavailable.

    Emergency notification systems: The use of a mass notification system as well as an organisation’s intranet site allows for a clear and concise method for ensuring the most accurate message is disseminated. Organisations should provide updates and protocols for colleagues as well as guidance for specific situations including traveling, managing people, sharing information with clients, hosting/attending in-person meetings and health and safety suggestions. It is important to consider the mental health and physical well-being of individuals affected by the incident as well.

    When employees have the capability to work remotely, you will want to identify appropriate tools and resources such as laptop computers, high-speed communication links, PDA’s and other peripherals needed to perform essential functions.

  4. 04

    Incident response

    In order to provide direction on how to handle an incident in the workplace, organisations need to determine the roles and responsibilities of key individuals.

    Incident management system: The use of an incident management system is recommended since this can be used by public, private and non-profit sectors. It is a proven management system designed to enable effective and efficient incident management by integrating a combination of facilities, equipment, personnel, procedures and communications operating within a common organisational structure.

    Emergency operations center: An emergency operation center (EOC) plays a vital role for incident response since it is used to support continuity, response and recovery operations. An EOC is a place for leaders of the emergency response and business continuity teams to assemble. How can this be accomplished during a pandemic when access to buildings may not be available or you need to shelter-in-place? A virtual EOC is created through conference bridges or videoconferencing allowing team leaders to participate in meetings in addition to managing their response and recovery efforts. Furthermore, a virtual EOC is a valuable tool when coordination is required over a large geographical area.

  5. 05

    Program awareness and exercises

    Once the plan is developed, it is recommended you perform an exercise so everyone assigned specific tasks become familiar with their assigned role. This is a plan exercise and not a test, since a test implies something you either pass or fail. The emphasis is on practicing and learning. Additionally, several types of exercises and training steps are worth considering, including:

    • An informal orientation (that lasts about an hour) is one way to educate personnel on the function and processes of the plan.
    • In a tabletop exercise, staff reviews and discusses the actions they would take, but no one actually performs any of these actions (this may take several hours).
    • A functional exercise simulates a scenario as realistically as possible without moving personnel, equipment and resources to the actual backup sites (as a guide this may take 4-6 hours).
    • In a full-scale exercise, personnel, equipment and resources are deployed to specific locations for a real-time simulation of a scenario (as a guide this can last 6-8 hours).

BCP plan regular content reviews: A business continuity plan should also include regular plan review, both during (including someone taking notes) and after an actual event. For example if there were employees who were exposed to COVID-19, what could have been done better to prepare and respond? Hold a critique post-event to be better prepared for the next disruption and remember to include how to address any media issues resulting from being identified as the employer.

In conclusion, during a pandemic it is almost certain that maintaining critical business functions requires additional considerations beyond traditional business continuity planning. Even though a pandemic may not directly affect the physical infrastructure of the organisation, it may not be possible to relocate staff to a sister location or other alternate work site. Therefore, recovery plans must focus on social distancing, infection control and cross-training in order to protect key personnel and enable the organisation to perform critical functions and adequate pandemic response.

With regard to the COVID-19 experience, take the time now to document the issues that have occurred in your organisation that may not be captured in your current recovery actions. Now is the time to capture the key findings to enhance your future recovery efforts by drawing in the experiences of the COVID-19.


Each applicable policy of insurance must be reviewed to determine the extent, if any, of coverage for COVID-19. Coverage may vary depending on the jurisdiction and circumstances. For global client programs it is critical to consider all local operations and how policies may or may not include COVID-19 coverage.

The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal and/or other professional advisors. Some of the information in this publication may be compiled by third party sources we consider to be reliable, however we do not guarantee and are not responsible for the accuracy of such information. We assume no duty in contract, tort, or otherwise in connection with this publication and expressly disclaim, to the fullest extent permitted by law, any liability in connection with this publication. Willis Towers Watson offers insurance-related services through its appropriately licensed entities in each jurisdiction in which it operates.

The information given in this publication is believed to be accurate at the date of publication shown at the top of this document. This information may have subsequently changed or have been superseded, and should not be relied upon to be accurate or suitable after this date.


Senior Risk Control Consultant

Related Services

Related Solutions

Contact Us