When Roberta Fox was in high school just outside London, Ont. in the 1970s, she and her schoolmates were once snowed in for four days until the military rescued them.
“I got an early introduction to (disaster) planning,” says Fox, senior partner, Fox Group Consulting. “It was stressful. We had food in the school until Day 2. By Day 3 we were running out of toilet paper and water. Parents couldn’t communicate with their kids.”
Fox, whose IT consultancy helps businesses with their continuity plans, says that experience — and growing up on a farm where power outages were a routine part of winter — helped impress upon her at an early age the importance of being prepared for unforeseen events. That’s why her business, which is based north of Toronto, has a gas generator and extra food, water and blankets, just in case her employees get stuck there for whatever reason.
But while the SARS crisis and the power outage of August 2003 might have been unforeseen, the same can’t be said of an avian flu pandemic, which is expected if the H5N1 virus one day mutates into something that is easily transmitted from person to person. It’s hard to avoid the low, ominous rumble from sources such as the World Health Organization, which has been warning of a pandemic for two years now and has advised all countries to develop preparedness plans and stockpile antiviral drugs, although few have done so.
If — or when — a pandemic breaks out, experts say, 25 to 35 per cent of the population will get sick; 2.5 per cent will likely die, based on projections from past pandemics.
That’s why all organizations, public and private, need to develop business continuity plans now — before it’s too late. And IT has a role to play like never before.
For one thing, says Richard Cocchiara, chief technology officer for business resiliency at IBM, transportation will likely be interrupted. As well, people won’t want to congregate, meaning organizations will need to develop virtual workplaces.
“Where historically companies have been able to work in a very consolidated environment, if a pandemic occurs you’re going to see probably a distribution of companies out to different locations,” says Cocchiara, an IBM distinguished engineer who helped develop IBM’s recently launched Contingency Planning Assessment service.
“It’s not like you should get on the bandwagon because it makes good business sense — I won’t even go there — but if you want to prepare for this you’d better start thinking about enabling your employees to work remotely.”
IT will also play a major role not just in enabling telecommuting and virtual private networks, he adds.
“Working from a remote location is an enabler that IT can help with but at the same time, that’s not the only answer,” he notes. “We’re talking about human capital here, so you’re going to have to have the ability to track employees and track their ability to work.”
In addition, IT will need to facilitate new business processes to accommodate new ways of working during a pandemic, he says.
“So we see technology as an enabler but we want to be clear that we don’t think technology is going to be able to solve all the company’s problems.”
Despite the groundswell of advice from all quarters for organizations to get their business continuity plans in place, however, a relatively low number has done so, according to the Conference Board of Canada. The board found that while almost 80 per cent of the 75 organizations who responded to a recent survey said they were concerned about the impact of a pandemic on their organization, only four per cent have completed a preparedness plan; more than 40 per cent said they had not yet considered how they will communicate with employees during a pandemic outbreak. Nor had they worked out key details such as dealing with quarantined employees, compensating individuals covering for absent colleagues, and responding to employee refusals to work in a potentially unsafe environment.
The federal government has taken many steps to communicate the need for citizens to prepare for a pandemic, most notably by posting its pandemic plan on its gc.ca portal, which links to a site site dealing entirely with the avian flu. The Ontario government www.gov.on.ca makes visitors work a little harder – you actually have to search for the term to find pandemic-related content. A search on www.toronto.ca takes you to the Toronto Pandemic Influenza Plan.
But while it’s clear what government is doing to inform citizens of the flu facts, less obvious are the steps the public sector is taking to ensure it is able to continue delivering government services should a pandemic fell 30 per cent or so of the people who make sure old-age pensions are paid, social services are delivered and taxes continue to be collected (although there is likely little danger that activity might ever be interrupted, it seems).
That doesn’t mean nothing is being done. The Canadian Revenue Agency, for example, signed a memorandum of understanding with Treasury Board in 2001, which requires all of its offices develop, communicate, test and maintain business continuity plans.
The CRA has a long history of being prepared for the worst, says Jocelyn Malo, director general, security risk management and internal affairs at the CRA. Although it hasn’t developed specific a BCP specific to a pandemic, “the effort we’ve invested has in our view positioned us well,” he says.
The BCP is updated every year, and while there is no budget specifically targeted to a pandemic plan, management is made aware of the need for BCP and must allot for it as part of their annual budget envelope, says Malo.
The organization has conducted BCP tabletop exercises in all of its offices to look at the impact of various types of interruptions ranging from natural disasters to terrorist attacks, he says, but it’s difficult at this point to model the potential impact of an avian flu pandemic because there are so many unknowns yet to factor in.
One regional office is in the preliminary stages of planning a tabletop exercise related to a pandemic, but there are some details to be worked out before that can happen. “The thing we don’t have is the planning assumptions for such (an event),” he says.
The CRA has representatives sitting on various pandemic working groups who are charged with providing that guidance, he adds.
If a pandemic were to hit, the CRA already delivers many of its services over the Internet, leaving it less vulnerable than other organizations that require face-to-face contact to conduct business.
“As we confirm our assumptions and plan based on those it is likely we will look at different options, those that are already there and what else we might do,” says Malo.
Remote access is one possibility, he says, as is the ability to transfer work from one office to another in the region.
“We just don’t know yet what would be best suited for what scenario or condition but we do have a lot of capacity.”
Comment: info@itbusiness.ca