Skip to main content

Is your business continuity plan prepared to address the COVID-19 outbreak?

By David Gluckman and Deana Allen | March 16, 2020

With the uncertainty associated with the spread of COVID-19, organizations should review and have a business continuity plan in place.
Risk & Analytics
COVID 19 Coronavirus

The degree of spread of COVID-19 is uncertain. In the unlikely event of a worst-case scenario, is your organization prepared for the issues and to answer the questions that are sure to arise?

Business continuity plan — Key concepts

If you do not have a business continuity plan (BCP) in place or have not reviewed it in a while, now is the time to do so. The first step is to identify mission-critical operations and business functions. Because everyone in an organization tends to feel what he or she does is most important, a formalized method is needed to separate the essential business functions from the non-essential functions that can be suspended during a major business disruption.

Business continuity plans tend to address more common catastrophes (e.g., earthquakes, fires, hurricanes, floods) that result in physical damage to property and assets. Communicable disease events require special consideration. Unlike natural disasters, COVID-19 or other communicable disease outbreaks may not always be geographically or temporally bound.

A fire may blaze over a single location and strike without warning. A hurricane or flood may devastate a specific region. Communicable diseases such as COVID-19, however, can occur in waves of variable duration and severity throughout the world.

The good news is that a traditional business continuity management program can be the core of a plan that addresses these types of threats.

Business impact analysis

If we compare business continuity plan development to building a house, the business impact analysis (BIA) is the foundation. The BIA is a process that determines the effect of an interruption or disruption on systems, equipment, services or personnel. In performing a BIA, identify the maximum time before the interruption of a function or process causes significant harm to the business. This time lapse is called the recovery time objective (RTO). RTOs can range from seconds, to hours, to days and beyond.

When determining RTOs, consider operational contingencies, e.g., worker(s) with potential exposure to a communicable disease that may require extended quarantine. You may have positions that are not easily filled by others (contingency staffing); this should also be factored into the RTO.

Practice your implementation

Once the plan is developed, perform an exercise in which everyone assigned a specific task becomes familiar with their assigned role. Remember: this is a plan exercise and not a test, since a test implies something you either pass or fail. Here, the emphasis is on practicing and learning.

Consider several types of exercises and training steps.

  • An informal orientation that lasts about an hour is one way to educate personnel on the function and processes of the plan.
  • In a tabletop exercise, staff review and discuss the actions they would take, but no one performs any of these actions. This may take 2 – 4 hours.
  • A functional exercise simulates a scenario as realistically as possible without moving personnel, equipment and resources to the actual backup sites. This may take 4 – 6 hours.
  • In a full-scale exercise, personnel, equipment and resources are deployed to specific locations for a real-time simulation of a scenario. This can last 6 – 8 hours.

A business continuity plan should also include regular plan review, both during (including someone taking notes) and after an actual event. One scenario could be: “You had employees who were actually exposed to the virus and your operations were on lock down. What could have been done better to prepare and respond?” Remember to include how you would address any media issues.

Conducting a business impact analysis

In conducting any BIA, all levels of leadership in the organization should address these key questions:

  • How important is a function to your overall business? What clients/customers and other business units depend on this function?
  • Could you lose clients/customers if this function is not provided in a timely manner?
  • Could there be significant revenue loss if this function is not performed?
  • Is there risk of a substantial fine or penalty if the function is not completed?
  • How long can a business function or customer service be delayed before there is an adverse effect?
  • Do you rely on outside service providers (vendors) for vital information, products or services? Could they become inaccessible? Are there contingent backups?
  • What would be the impact to your business if these providers are unable to operate?
  • Could a service disruption lead to a loss of client/customer confidence and, ultimately, the business?
  • Could your company reputation be harmed because of a prolonged business interruption?
  • Have you analyzed the ultimate costs the organization could potentially sustain and how to mitigate those losses?
  • In addition to detailed interviews with senior management in charge of each business unit, when developing your BIA, consider the following:
    • It may be helpful to diagram your workflow so you can visualize all the dependencies and components of each function. That will help you estimate the impact of losing one of these dependencies or components.
    • As outage time increases, a function or service that began as a low priority may become a higher priority.
    • Business interruption can result in tangible losses: declining revenue, departing customers and potential fines.
  • There are also intangible losses, such as loss of reputation and damage to the company’s image.
    • Disruptions affect business units at different times. Some functions or services may be adversely affected within minutes, while others may take hours or days.

Response and recovery

Once your BIA is complete and your recovery time objectives are set, begin developing response and recovery procedures.

  1. 01

    Management structure

    Orders of succession for business plan execution by key positions should be of enough depth to ensure continuity in the management and direction of the organization’s essential functions and operations. They should be at least three-deep in each position. Organizations should also document delegations of authority that specify limits of that authority. Who, in your organization, has the authority to declare an event a disaster? This declaration will set everything in motion, so be certain your definition of disaster/event is clear and its criteria have been met.

  2. 02


    Disaster/event plans usually call for the setup of a command center or emergency operations center (EOC). Keep in mind that during a communicable disease (such as COVID-19) outbreak, you may need to (re)locate the command center from its original planned designated area. Regardless of location, the center is there to manage support services and infrastructure. This may include supplying such essential items as food and water, laptops and phones.

  3. 03

    Vital records

    Depending on your industry, you will want to have the data available to sustain operations for at least 30 days. If not already developed and maintained, a current list of vital records/documents, systems and databases should be developed. Hard copies of vital records/documents should be current at each facility.

Creating a BCP helps ensure development of complex responses to complex situations. A wait-and-see approach will not work. Since everyone in the organization becomes involved in the process, an examination of difficult and controversial issues takes place. The time to work out the logistics of who is in charge, what authority they have, as well as other accountability issues that can surface in an emergency and affect large numbers of people is before the crisis, not during it.

What now?

Now that you have a BCP, the first order of business is to communicate. The key message is often: “We are monitoring the situation and will be providing additional information as it becomes available.” Communicating something is better than communicating nothing. Employees who feel safe and that their employer is prepared are more likely to remain productive during a crisis. Apprehensive or scared employees may not show up to work.

Share with your customers that you have a plan in place, that you intend for business to continue as usual. Depending on your industry, you may need to communicate more broadly; for example, when there is limited access to a health care facility because of an event impacting operations.

Methods to communicate and educate

HR matters

Human Resources must play a large role in any assessment of COVID-19 risk. An organization’s most important asset is its people. While COVID-19 will not likely affect the physical infrastructure of an organization, it may ultimately threaten all operations by its impact on individuals. Since HR departments strive to ensure the health, safety and welfare of employees, in a crisis this team will need to maintain adequate staffing and monitor employee health.

HR awareness

Your guiding principle regarding HR issues should be flexibility, with the overriding goal being wellness in the workplace. The aim is to keep a healthy workforce on the job. Beyond that:

  • Know your sick pay and absenteeism policies (not just HR professionals but supervisors, as well).
  • A team should have already-determined responses to the most frequently asked HR questions to deliver a consistent message. This message could be scripted for managers.
  • Know your company’s normal absentee rates. Monitor current rates and be ready to act if they start to climb.
  • Know how to handle employees who arrive at work ill and how best to send them home (if they can leave the premises).
  • Explore alternative child care/elder care solutions.
  • Does your type of business put your employees at a higher risk of a potential communicable disease (COVID-19) exposure? Have you addressed that in your plan?
  • Depending on your industry, review travel policies. Know how you would address employees/volunteers located in high risk areas.
  • Consider partnering or meeting with occupational health or corporate medical service provider vendors concerning the following (where applicable):
    • Turn-key operations
    • Education
    • Medical supplies

A word of caution:

  • On extended time out, family leave issues may apply, especially if an employee or family member has complications or extended illness.
  • Also, there is potential for ADA, OSHA and workers compensation regulatory issues to arise. Be very cautious with personal medical information, which must be kept strictly private. You cannot say, “We sent Jen home because her daughter came into contact with someone they are screening for COVID-19.”
  • Remember, OSHA’s general duty clause requires employers to provide “safe and healthful working conditions.” Be prepared to show that you did — and you do.

When all is over, you can reflect on things and adjust accordingly. Bring your key team and key stakeholders together, evaluate your performance and update your plan to ensure the best possible preparedness in the face of future uncertainties.


Willis Towers Watson hopes you found the general information provided in this publication informative and helpful. The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal advisors. In the event you would like more information regarding your insurance coverage, please do not hesitate to reach out to us.

In North America, Willis Towers Watson offers insurance products through licensed subsidiaries of Willis North America Inc., including Willis Towers Watson Northeast, Inc. (in the United States) and Willis of Canada, Inc.


ARM, CBCP, CBCA, CFPS Sr. Risk Control Consultant


Related content tags, list of links Article Risk & Analytics COVID-19 (Coronavirus)
Contact Us