Key Findings

• The earthquake and tsunami that struck the Tohoku district in March, and the power plant failures and other infrastructure problems that followed, continue to disrupt communications, transportation and other infrastructure.
• The Japanese government and Tepco have implemented a plan for rolling electrical blackouts across Tepco’s coverage area, designed to reduce power usage and avoid total power failures.
• These blackouts present serious challenges for Japanese enterprises, particularly in maintaining the operational integrity of their data centers and offering alternative system access to remote workers.

Tepco has said it will not carry out its planned rolling blackouts this summer, but electrical supply continues to present challenges for Japanese enterprises. Gartner has developed a set of best   practices for various scenarios and affected parties for IT organizations in Japan and worldwide. The appropriate response to the rolling blackout depends heavily on whether or not the enterprise’s data center has its own dedicated backup power generator.

Read more about the best practices – if you are an organization impacted by the earthquake/tsunami or not – in the full report by my colleagues  Masahiko Ishibashi, Eiichi Matsubara, Nagayoshi Nakano and Katsuo Hori.  Being a Gartner customer may be required.

The findings in this research are based on a joint Gartner and Business Continuity Institute (BCI) survey of business continuity management (BCM) consulting firms conducted during the first quarter of 2011. The survey objective was to better understand the breadth and depth of BCM service offerings. It was sent by BCI to its self-identified consultant membership and by Gartner to members on its BCM consultancy list that opted to participate. The survey closed on 4 March 2011.

Key Findings

• Many firms say they cover many BCM disciplines, but terminology varies across industries and countries, and so, misunderstandings are common.
• There is an increased need for consultants with specific skill sets:
  • Strategic program development
  • Tactical program improvements
  • Pragmatic, situation-based expertise
• A strong BCM program cannot be run by consultants alone. Therefore, BCM expertise must be brought in-house to ensure its continuing success.
• Due to the 2008 global financial crisis (GFC), consultant ranks have risen due to the layoffs of BCM professionals, and many of these people have taken jobs as consultants while waiting for a full-time BCM practitioner position.
• Fifty percent of BCM consultancies are small, with one to four full-time consultants onboard.
• Organization certification support is low — 13% of firms surveyed have BS 25999 Lead Auditor certification — in alignment with the existing low level of organizations that have such certification.
• Ninety-two percent of BCM consulting engagements are for planning services.
• Only one-quarter (24%) of BCM consulting firms offer a guarantee for services rendered.

Read the full report here: BCM Consultancy Survey, 2011. You may need to be a Gartner client to access the report.

I’m wondering what tools your firm is using during such events? They have to be hosted by the vendor since your data center is down. What about Yammer, SocialCast, SocialText Signals, Sametime/LotusLive from IBM, Lync/BPOS from Microsoft, Google Apps? Is anyone using them or another tool for emergency purposes, and if so, how?

Business Continuity Management Governance Defined, 2010

Without a governance framework in place, BCM programs will not progress as needed in the desired time frame. Use Gartner’s BCM governance framework to establish governance oversight according to your organization’s business model and availability needs.

Toolkit: BCM Governance and Implementation Responsibility Decision Matrix, 2010

Without a governance structure in place, business continuity management programs will not progress or succeed in the time frame desired. Use the BCM Governance and Implementation Responsibility Decision Matrix to document the governance oversight according to your organization’s business model.

Toolkit: Business Continuity Management Charter Best Practices and Template

A BCM charter is one of the most-effective tools for establishing and communicating effective preparedness, recovery and resiliency practices. Make the Gartner best-practice-based charter the foundation of an enterprisewide BCM program.

Toolkit: Business Continuity Management Policy Template

A business continuity management policy is an important component of the operational model for BCM governance. Combined with a BCM charter, BCM governance responsibility and implementation matrix, and the BCM activity cycle, it completes the Gartner BCM governance framework.

Not only is it National Preparedness Month, it’s prime time hurricane season in the northern hemisphere.  Watch for alerts about the status of storms at NOAH’s National Hurricane Center.

The American Red Cross has excellent advice about preparing your home and family for a disaster.

Ready.gov – a FEMA sponsored web site – is another great resource for family disaster preparedness.

Gartner has a cornucopia of research and advice including templates, vendor analysis, best practices, sample RFPs and more for organizations that are developing, maintaining and maturing their BCM programs. Read our note:  Research Roundup: Business Continuity Management and IT Disaster Recovery Management, 2Q10 to see the breadth and depth of our coverage on all things BCM.

And watch for a new BCM tool coming from Gartner in the coming weeks. Can’t say too much about it now, but organizations are so primed for it!

So take this time to promote, assess, enhance and EXERCISE your recovery plans and procedures. If you don’t, you are missing an opportunity to get management’s attention and commitment in protecting its workforce, customers and partners from disaster events.

I’m going to check and update my Go Bag today. I found a great First Aid kit through www.melaleuca.com. I’ve already used it once at a local retail outlet.  Who knew it would come in handy so quickly after purchase!

One last thing: have you given a friend or family member a list of your user IDs and passwords for personal web sites such as healthcare, insurance, online banking, investments, email, social media applications and so forth – just in case – well you know why.

The issue of how BCM will survive as a profession is one that is on the minds of many in the profession. Management is starting to see that BCM is another component of enterprise risk management, and it is expected that some mature BCM programs will become integrated into these efforts, and ultimately become centers of business operations strategy – the reason being is that BCM is the only place in the organization where all activities related to the day-to-day operations of the business are documented.

BCM professionals have a unique opportunity to transform their programs into this new position, but only if they transform themselves and their skills first. The skill sets needed to make this transition a successful one include: general management, project management, supply chain management, crisis/emergency management, business operations, workforce management, EH&S, business process management, sustainability management and risk management.

How do you see yourself managing your career in BCM? Do you expect that you will move u pin the organization? If so, how? To what position?

1.      We started the workshop by viewing the video “Business Not As Usual: Preparing for Pandemic Flu” from Seattle-King county.  Use it internally to educate your workforce (and senior executives) on the value of being prepared. You can request a free copy (you must pay for shipping) from NACCHO.

2.      Most of the workforce absences are expected to be a result of school closures.

3.      You must have a pandemic management process (or infrastructure) in place to handle the event as it occurs because plans are a necessary thing, but they don’t often reflect the reality of the specific situation. Policies decided upon on Monday may not apply to the facts of Tuesday’s situation.

4.      Some firms are talking to public health officials about hosting vaccine programs in their work facilities, or at least trying to secure the vaccine for their critical workers, e.g. electricity generation operators. However, some are concerned about the legal liability issues if they haven’t engaged in this type of public health activity in the past.

5.      On the point of electricity generation operators – If these folks get the flu, and the generation facility is on the small side, they could shut it down because they don’t have enough staff to operate.  That shutdown means blackouts – or “rotating feeder outages”.  We could see more power outages as a result of H1N1 – a connection that most folks aren’t making, but for pandemic planning would be covered under the traditional BCM plan.

6.      Organizations are struggling with human resource policies regarding how to compensate workers if they do have the flu, especially if the worker has already used their allotted personal time off days or sick days. Some are offering extended time off options, but not everyone.

7.      Work-at-home solutions are at a high risk of failure if the work-at-home population in any given area reaches anywhere close to the 40% absentee rate. Internet bandwidth supply is not adequate to meet the demand. (Gartner is publishing a research note on this topic specifically.)

8.      Similar to the results of my June/2009 survey, many firms are not including IT vendors or IT service providers in their efforts. See my note: A Perilous Practice: Not Planning for IT and Data Center Operations Support During a Pandemic, G00169949. (You may have to be a Gartner client to view it.)

9.      Most firms expect to implement workforce travel restrictions once a pandemic strikes.

10. Most firms are trying to balance their protective mask usage policy between protecting the workforce and not offending customers. The firms who have direct and frequent contact with the public (for example retail operations) request that workers wear a mask when escorting a sick person out of the building only. Those firms that don’t have direct public contact public allow their workers to wear masks based upon their personal comfort level.

11. Those firms that have public congregation areas plan to close off those areas once a pandemic strikes. For example, bank branch lobbies will be closed and only the drive-up window will be open.

12. Firms with workers who must make home visits have equipped those workers with protective gear such as masks, sanitizer fluid for the hands and steering wheels of their cars/trucks, disposable gloves and so forth.

13. You can’t build your preparedness plans using workers’ personal information that has been gathered through the normal social networking in the work environment.

14. Some firms are concerned about law suits as a result of family members getting the flu from the firm’s employee.

15. You can’t expect to get resources from your local neighbors, partners and so forth because everyone will be in the same situation when the pandemic strikes.

16. Your plans and handling process must include actions that will assist you to return to normal operations once the pandemic is over.

17. You must include cultural differences in your plan activities. For example, blood transfusions may be refused if they are not from a person with the same national origin as the intended recipient.

Gartner always advises businesses to review their pandemic preparedness planning from the perspective of 40% absenteeism – some of which is going to be workers staying home in order to care for children who are home due to school closures.  This particular point was considered in the June/2009  Harvard survey and the results are:

• 51% of US workers would be likely to stay home and miss work in order to care for children,
• 43% would be likely to lose pay or income and have money problems as a result, and
• 26% would be likely to lose their job or business as a result of staying home to care for children.

These survey results are something that businesses should take notice of and respond to in order to provide the workforce with as much information as possible regarding their approach to compensation and HR practices during a pandemic.   Not every business can afford to pay workers for time off during a pandemic – but providing the information to the workforce ahead of time means that they can plan for the event, and potentially have some of their fears allayed.

There are many areas where HR policies come under review for pandemic preparedness planning:

1. Paid time off;
2. Facility closures and quarantines;
3. Bereavement time;
4. Short-term and long-term disability;
5. Flexible work options; and
6. Sick workforce handling procedures.

There are no standard answers to these issues because HR laws are different by jurisdiction, and HR policies vary by organization and worker type (exempt and non-exempt).  Every organization must review its policies with internal and possibly external HR and compensation experts to find the right approach that is based on their business practices and their culture.

Finally, pay attention to privacy issues when developing sick workforce handling procedures.  Never disclose the name of a sick worker to the rest of the organization.  That said, most people in their work group already know who they are.  Therefore, regularly educate the workforce about their own need to maintain the privacy of their colleagues.

As expected at this phase of event, the top actions organizations are taking revolve around protecting staff from infection at the workplace – 95% are communicating to staff regarding H1N1 and the precautions to be taken to avoid infection, 81% made hand sanitizers available in all public areas, 46% stepped up cleaning activities in public areas and 91% encourage staff to stay home if they are sick (23% require a doctor’s note to return to work if they had flu symptoms).  Buying personal hygiene supplies such as masks, hand sanitizer, single-use thermometers, single-use visitor badges and the like are common steps at this point in implementing a pandemic response plan. 

There is a large difference in how organizations handle that sick time: 70% require the employee to use their own sick time versus 21% who do not.  Addressing policies such as sick time and requiring an employee to leave the workplace if sick and the resulting handling of the time away from work is an area that organizations need to work through with HR and Legal departments.  One organization commented that  they extended their sick time allowance to accommodate more time off due to a pandemic.

Travel restrictions are being implemented as well: 70% of survey participants require approval to travel from the US to other countries and 22% require approval to travel from other countries to the US.  Reactions from organizations at large are asking staff to curtail all non-essential travel for the time being.

Working from home is another area that the NEDRIX survey participants, and organizations at large, are instituting at higher rates - for essential staff as well as those staying home due to school closures.   Now is the time – before a pandemic strikes – to test work-at-home technical and business procedures set up as part of the pandemic response plan.  If you haven’t set up these procedures and solutions, it can be too late for your organization if a pandemic strikes soon.

One survey participant commented that they issued anti-viral medication to its workforce.  No attribution was given for that organization, but best-guess is that it is either a healthcare provider or government agency.

Finally, one survey participant commented that they have business operations in Mexico; therefore, their pandemic response plan implementation is further along due to Mexico being the foci of the event.

Read the entire survey report for more nuggets of information to enhance your organization’s pandemic response plan.