BCM’s COVID-19 Challenge: Coping with Chronically Degraded Capacity

The pandemic has created a new challenge for business continuity management: the need to cope with potentially degraded systems and capability. In today’s post, we’ll look at what this BCM COVID-19 challenge means, the threats it poses to organizations, and the steps BCM professionals can take to successfully adapt to the new reality.

Related on MHA Consulting: Emerging from the Lockdown: 6 Things to Think About for the Next Phase

Two Longstanding Assumptions

In the days before the COVID-19 pandemic, business continuity management (BCM) was marked by two assumptions:

1. The main problem BCM programs had to deal with was coping with full-blown crises and outages; BC was not about operational efficiencies.
2. The pace of risk assessments and plan updates at most businesses could be on an annual or every other year basis because the pace of change was slow.

These assumptions permeated everything BCM professionals did, from how they scheduled their year to how they talked about their needs with senior management.

Upsetting the Apple Cart

In the past six months, the pandemic has upset the applecart regarding the threats facing businesses. This includes changes to business processes, and the resulting adaptations needed by BCM programs.

The pandemic has introduced two new elements that are almost the opposite of the previous assumptions. In the new environment, the following are true:

1. It is the potential reduction of our capabilities over time or in spurts (rather than the heavy blow of a crisis or outage) that is the striking new reality of business life.
2. The new steady-state is not steady: it is a condition of constant change and the need for frequent adjustments.

The COVID-19 Challenges for BC

The new situation calls for some new thinking and actions on the part of business continuity professionals.

The new challenges haven’t replaced the old ones. The former threats remain and we must still be ready to respond to them. The new reality calls for an additional, new level of activity—and perhaps a new pace of working—to adapt. This will ensure the business can carry on its core functions no matter what.

BC programs need to get comfortable working in the middle ground between normal operations and a full outage.

Death By a Thousand Cuts

The new situation poses a unique threat to business. It has the potential to cause companies to suffer death by a thousand cuts.

Because the pandemic and its knock-on effects can impede normal operations and impact employee availability, business is vulnerable to a deterioration in its ability to function.

Suppose only 75 percent of the workforce is available for a period of time or only 75 percent of the normal supply of a certain strategic material is available. This level of reduction of functioning might not bring the business to its knees, but it is a performance drag. Such a drag might pose a significant danger to the company over time.

These are the kind of problems BC programs need to begin looking into and planning for.

Two Ways to Adapt

There are two steps BCM offices can take to adapt to the new challenges to BCM during COVID-19:

Step 1: Increase the Frequency of Risk Assessments

Businesses traditionally conduct risk assessments once a year or even less frequently. This is no longer sufficient. For the foreseeable future, most businesses would benefit from conducting updated risk assessments once a quarter, with a focus on:

• Issues or risks that may be smoldering.
• Known issues that are being ignored or “hoped away.”
• Changes to people, supplier/third party, and business environment risks.

In doing the assessments, look at the ways the pandemic might reduce the company’s access to staff, critical supplies, or capacity. Could any of those problems seriously degrade the functionality of the business? For example, I’ve heard from several companies that are concerned about the continued impact of remote schooling or rapidly changing student schedules on the availability (or focus) of their staff.

Once the BC team identifies vulnerabilities, the business departments have the responsibility of devising plans and strategies to meet them.

Such changes might include making scheduling changes or making arrangements with alternative suppliers. It may also require adjustments to technology access or use.

Conducting quarterly risk assessments is the best way to keep on top of the dangers that functional degradation could cause your organization in the new environment. (See this post for more on conducting threat and risk assessments.)

Step 2: Update BC Plans Promptly

In the days before COVID-19, businesses tended to conduct risk assessments and make a list of the changes required, then wait months or more to update their BC plans and strategies. It’s no longer safe to wait this long before making adjustments.

Companies need to get in the habit of rapidly adjusting their BC plans and strategies in response to threat assessments. This is the best way to build resilience in the current environment of constant, unprecedented, and unpredictable change. (See this post for more on choosing strategies to mitigate risk.)

Meeting the New Challenge

In the past most BCM programs operated on two assumptions: that their job was coping with outages and that the pace of change would be slow. The COVID-19 pandemic has upended both of those assumptions. The pandemic poses a new danger to business in the form of degradations in functioning caused by problems such as reductions in staff availability and curtailed access to critical supplies.

To meet the new BCM COVID-19 challenge, companies should increase the frequency of their risk assessments and be prompt in updating their recovery plans and strategies.

Further Reading

For more information on BCM during COVID-19 and other hot topics in business continuity and IT/disaster recovery, check out the following recent posts from MHA Consulting and BCMMETRICS:

• Vaccinate Your Business: Devise a Pandemic Plan
• The Plan that Time Forgot: The Importance of Protecting Your Business Processes
• Weighing the Danger: The Continuing Value of the Threat and Risk Assessment
• Don’t Just Hope: Choosing Strategies to Mitigate Risk
• Back in the Saddle: Resuming Regular BCM Activities
• Emerging from the Lockdown: 6 Things to Think About for the Next Phase