Crisis in Times of COVID

Alvaro Orrantia

Just short of 40 years ago my schoolteacher asked us to bring the most recent currency conversion rates between US Dollars and the Peso, my local currency. My dad used to work on imported goods, and he helped me. The most recent rate was one month old until I showed up with mine: it was “just” three days old.

Today this is unimaginable. We all know in many cases three-day old information isn’t that useful anymore. It is considered “old news”. Information travels by the millisecond and the news spread so quickly that any situation rapidly turns into crisis.

When it comes to events and crisis, it is quite common for BCM practitioners to say, “And I thought I’d seen it all”. Back in 2003 when we faced SARS in Toronto, we never thought a nurse with two police officers would be able to shutdown a corporate facility. Well, many of us probably never thought the COVID-19 pandemic would be so global and would last so long.

As we get more and more connected, the news of disruptive events spread faster and impacts take less time to materialize. But the good news is that the dramatic connectivity increase also helps us all communicate and respond better ... potentially.

Our approach to Business Continuity Planning has typically been aimed at addressing one event at a time; one event that comes and then goes. Yes, practitioners who are worth their salt say their approach is “all hazards” but I doubt many mean “all hazards at the same time”.

As many organizations have activated their business continuity plans (or specifically pandemic plans, for that matter), they are also facing the reality of operating under new constraints. An alternate facility, for instance, may no longer be suitable due to new occupancy restrictions; working from home may be impaired as many homes are not “hurricane hardened” like a data centre would be, and all of a sudden a local ISP may become your own key third party for which you never planned a workaround.

Many for their first time now experience the need to account for a “BCP on BCP” – a disruptive event that takes place while dealing with another disruptive event, not after – while.

It is at this point where sound understanding of the business and its risk tolerance comes to add significant value to organizations. Many decisions can be made proactively, but at the same time, many of such decisions may have an outcome of risk acceptance. If we cannot use our alternate facility, what do we do? Of if a group of employees lose their work location (i.e. home) due to an earthquake, what’s our response?

We get now to truly know the meaning of good enough. Who determines how good is good enough? What is reasonable and how does that change over time? Will acceptance of risk today be valid in six months?

From my own experience, here are a few considerations that I hope some practitioners find useful:

Prioritize prioritize, prioritize. If your business impact analysis has been thorough, you should know what is first and what is second. Focus on that to manage risk as effectively as possible and to accept the risk that you can accept.
Divide and conquer. When approaching a monolithic problem, try to get a chisel and break it down into manageable chunks. What kind of additional disruptive events may occur? They’d vary depending on your location – what is in each local risk assessment?
Be broad. Even crazy ideas may not seem so crazy when it’s time to respond. Better to proactively put those ideas on the table than finding later they were not bad at all and trying to implement them in reactive mode.
Be granular. Working under the constraints of a pandemic should make us think not only of strategies to implement for corporate environments but also at the individual level. For an employee working from home a broken laptop is not replaced very easily nowadays – she must wait a few days for a new shipment to arrive, for example. An ISP loss in your neighborhood cannot be easily and proactively addressed by having two providers into your home. So, what can you do to manage similar events in addition to what you have been planning for at a corporate level?
There’s no small third party. Even your local ISP or a hydro loss in your neighborhood can be disruptive, more so for critical employees. Plan around.
Leverage connectedness. Many times, help is local, but many times you can leverage teams in other jurisdictions to carry your critical functions.
Consider local circumstances. Each regional government has enacted different measures at different levels (country – provincial – municipal) and on top of that each organization has their own response. Asking a team who is currently split and working at your alternate corporate facility to go to all back to the primary facility (in the event of facility loss, for example) may not be feasible under the local occupancy restrictions. All things considered which strategies make sense and which ones not?
Don’t fear risk acceptance. Just make sure everyone understands what it means and can justify it.

These are truly unprecedented times. This pandemic has certainly presented challenges for everyone and every organization, good or bad; technology has been a key enabler as almost all business processes need it.

As practitioners, we are used to plan for a single occurrence of a catastrophic event and accept the risk of a subsequent disruption. But under a prolonged response we must now think if we can accept two overlapping situations.

By now, everyone, even skeptical ones, probably understands how dynamic and important business continuity planning is. Let’s continue to add value by being ahead of the game and always remaining in a state of preparedness.


Crisis in Times of COVID Alvaro Orrantia Just short of 40 years ago my schoolteacher asked us to bring the most recent currency conversion rates between US Dollars and the Peso, my local currency. My dad used to work on imported goods, and he helped me. The most recent rate was one month old until I showed up with mine: it was “just” three days old. Today this is unimaginable. We all know in many cases three-day old information isn’t that useful anymore. It is considered “old news”. Information travels by the millisecond and the news spread so quickly that any situation rapidly turns into crisis. When it comes to events and crisis, it is quite common for BCM practitioners to say, “And I thought I’d seen it all”. Back in 2003 when we faced SARS in Toronto, we never thought a nurse with two police officers would be able to shutdown a corporate facility. Well, many of us probably never thought the COVID-19 pandemic would be so global and would last so long. As we get more and more connected, the news of disruptive events spread faster and impacts take less time to materialize. But the good news is that the dramatic connectivity increase also helps us all communicate and respond better ... potentially. Our approach to Business Continuity Planning has typically been aimed at addressing one event at a time; one event that comes and then goes. Yes, practitioners who are worth their salt say their approach is “all hazards” but I doubt many mean “all hazards at the same time”. As many organizations have activated their business continuity plans (or specifically pandemic plans, for that matter), they are also facing the reality of operating under new constraints. An alternate facility, for instance, may no longer be suitable due to new occupancy restrictions; working from home may be impaired as many homes are not “hurricane hardened” like a data centre would be, and all of a sudden a local ISP may become your own key third party for which you never planned a workaround. Many for their first time now experience the need to account for a “BCP on BCP” – a disruptive event that takes place while dealing with another disruptive event, not after – while. It is at this point where sound understanding of the business and its risk tolerance comes to add significant value to organizations. Many decisions can be made proactively, but at the same time, many of such decisions may have an outcome of risk acceptance. If we cannot use our alternate facility, what do we do? Of if a group of employees lose their work location (i.e. home) due to an earthquake, what’s our response? We get now to truly know the meaning of good enough. Who determines how good is good enough? What is reasonable and how does that change over time? Will acceptance of risk today be valid in six months? From my own experience, here are a few considerations that I hope some practitioners find useful: Prioritize prioritize, prioritize. If your business impact analysis has been thorough, you should know what is first and what is second. Focus on that to manage risk as effectively as possible and to accept the risk that you can accept. Divide and conquer. When approaching a monolithic problem, try to get a chisel and break it down into manageable chunks. What kind of additional disruptive events may occur? They’d vary depending on your location – what is in each local risk assessment? Be broad. Even crazy ideas may not seem so crazy when it’s time to respond. Better to proactively put those ideas on the table than finding later they were not bad at all and trying to implement them in reactive mode. Be granular. Working under the constraints of a pandemic should make us think not only of strategies to implement for corporate environments but also at the individual level. For an employee working from home a broken laptop is not replaced very easily nowadays – she must wait a few days for a new shipment to arrive, for example. An ISP loss in your neighborhood cannot be easily and proactively addressed by having two providers into your home. So, what can you do to manage similar events in addition to what you have been planning for at a corporate level? There’s no small third party. Even your local ISP or a hydro loss in your neighborhood can be disruptive, more so for critical employees. Plan around. Leverage connectedness. Many times, help is local, but many times you can leverage teams in other jurisdictions to carry your critical functions. Consider local circumstances. Each regional government has enacted different measures at different levels (country – provincial – municipal) and on top of that each organization has their own response. Asking a team who is currently split and working at your alternate corporate facility to go to all back to the primary facility (in the event of facility loss, for example) may not be feasible under the local occupancy restrictions. All things considered which strategies make sense and which ones not? Don’t fear risk acceptance. Just make sure everyone understands what it means and can justify it. These are truly unprecedented times. This pandemic has certainly presented challenges for everyone and every organization, good or bad; technology has been a key enabler as almost all business processes need it. As practitioners, we are used to plan for a single occurrence of a catastrophic event and accept the risk of a subsequent disruption. But under a prolonged response we must now think if we can accept two overlapping situations. By now, everyone, even skeptical ones, probably understands how dynamic and important business continuity planning is. Let’s continue to add value by being ahead of the game and always remaining in a state of preparedness.
DRIE Toronto Digest - Vol 29 Issue 2 October 2020