What is your organization doing to assess the impact? Are you tracking your traveling workforce and helping them find alternate travel arrangements? And making alternate business operations plans such as having non-impacted staff step in to take the lead? Do you even have a workforce continuity management program in place? (Gartner clients can read my research notes on the topic: Workforce Continuity Defined and Workforce Continuity: Best Practices for Workforce Management.)

Of even greater impact is the supply chain – critical goods may not be able to arrive when needed by the customer due to the cancellation of flights. Are you assessing your supply chain and determining the impact on meeting contractual obligations? Given that this a force majeure event, your business insurance coverage won’t apply most likely.

And what would happen in the US if something of this magnitude happened? The US doesn’t have the extensive ground transportation network that Europe does – at least for passenger travel. US firms would be impacted to an even larger extent most likely.

How many of you are looking to expand your remote work programs? How much of your business operations can be managed remotely? Ata  minimum, senior executives not able to return to the office should be equipped with remote work capability such as PDAs and wireless Internet access for remote system access into your firm’s VPN. The Prime Minister of Norway is doing just that -  Norway Prime Minister governs with the iPad.  (Gartner clients can read our research notes on telecommuting and remote access: Gartner’s Telework Action Plan is Key to Successful Implementations and Critical Questions to Ask Your VPN Provider About Rapid Licenses Capability.)

Many independent energy experts say that alternative energy and new scientific discoveries for turning shale, waste water, biomass etc. into the amount of energy we need to run our current lives is magical thinking. We don’t have the alternative energy generation infrastructure already in place to run our economy at current levels. And, we can’t possibly have it in place in the timeframe and at the supply levels needed because it takes oil to develop and maintain those systems. What runs the backhoe to dig the wind turbine site foundation, the trucks, trains and airplanes to get solar panels to the site, the furnaces to keep the factory heated during winter, the power systems that provide electricity to run those factories and so forth? OIL!

According to the experts, we are close to, or even past, the midpoint of how much oil we can safely and economically extract from the ground. Therefore, oil shortages, and price spikes, are in our future. As a result, there are social and political implications, not to mention nation state implications – China will be a huge consumer of oil to run their expanding economy and can easily run up the price of oil and make it out of reach for poorer nations. The cheap oil business model is not sustainable in the long run. Strategically, businesses must become less dependent upon the global supply chain.

In order to become less dependent on a supplier half way around the globe, supply chain managers must redesign the product fabrication and logistics processes to include local suppliers. In doing so, you help the economy in the process by creating jobs at home and stopping the blight of small towns. Large, big box retailers must start buying/leasing local, existing real estate and put in place mini stores instead of building brand new massive buildings. The franchise model could then be used to further ignite the local economy. Yes – we will be paying more for goods in a local supply chain business model.

BC managers must be aware of the added risk of a local supply chain: local suppliers are likely to experience the same regional disaster as you do, making it harder for the business to continue during such a crisis. Therefore, businesses need to:
1. Include the supply chain in the development of recovery time frames.
2. Brush off your business resumption plans – the manual and non-technical workaround procedures – that allow some part of the business process to continue when a business interruption occurs.

If you don’t start addressing the oil price issue now, you could risk going out of business in the near future.

Are you following the price of oil as part of your BCM program? If not, why not?

1. How do you determine when to invoke pandemic preparedness plans such as workforce isolation and social distancing? Is it by absenteeism rate? Some other data point? If absenteeism rate, are you monitoring the change between the normal rate of say 5-7% and the pandemic influenced rate?

2. How are you invoking your plans – by enterprise, by location, by department? Are you conferring with your pandemic crisis management team in doing so?

3. How do you determine when you will issue a stand down order?

You need a management champion, and that’s where key business performance indicators come into the picture. If you translate availability/resilience risk to on-time delivery, supply chain performance, R&D success, customer retention and so forth – leading indicators of future business performance, then management can understand the impact to the business of a risk being exploited. It’s an educational and iterative process – few get it out of the gate unless perhaps they have been personally involved in a prior event.

BCM has to move from a FUD operation to a business enablement operation – tying risk to performance is the way to get there.

Read my latest research note “A New Approach: Obtain Business Ownership and Investment Commitment for Business Continuity and Resilience Management Through Key Performance and Risk Indicator Mapping” – free to clients or for a fee to non-clients: http://tinyurl.com/yjfcmpz .

On 15 October 2009, the U.S. Department of Homeland Security (DHS) announced three proposed standards that would be used by the Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) program, which enables private-sector businesses, nonprofit organizations and universities to receive emergency preparedness certification. The public can submit comments on the standards and the program at www.regulations.gov in Docket ID FEMA-2008-0017 by 15 November 2009.

Improving recovery capabilities will benefit all businesses and humankind globally. But certification is not a guarantee that an organization can recover from a disaster. Organizations should go slowly when starting down the path toward organization certification.

Read the rest of my First Take at: http://tinyurl.com/yjhwz3u.

At today’s general session, DHS, Cisco, Radian Compliance and I spoke about what PS-Prep and BCM organization certification are and what they aren’t, the value of it, how in the long-term it will likely be a mandatory requirement to do business – through market pressure rather than the voluntary program put forth through US Public Service law 110-53, and what organizations should be doing now to prepare for the time when your larger customers and partners will start assessing your ability to recover.

What is your organization doing to prepare for it? Have you already been approached by your customers and partners to show some level of maturity around business continuity management before they sign a contract with you, or when renewing a contract?

Information on the PS-Prep Program can be found at the FEMA web site.

Linda Tavlin of Tavlin Training a crisis communications firm based in Paris (you can see the fruits of her work by watching how the Air France Flight 447 disaster is being managed in the press), asked the attendees a thought-provoking question: “Are you a commercial firm selling safety to your stakeholders, or are you a safety firm selling a commercial product/service?” Depending on your answer, your approach to crisis communications will be vastly different — and the impact on your brand and reputation will be damaged, preserved or enhanced as a result. Those that seeing themselves as safety firms have a crisis communications program focused on addressing the intangibles of a crisis — the emotional and the investigation/fact-based side of the incident. I didn’t have to think too hard to understand Linda’s basic point: that an enterprise that says, “We’re sorry this happened” immediately after a crisis is addressing the emotional needs of everyone involved, including employees and their families, customers, business partners and the community at large. (I admit I do struggle with the idea that saying you’re sorry about something means implying that you’re at fault. Maybe that’s a female trait?)

Linda made another important point: that a crisis communications program should focus more on investigating and remediating a crisis than on public relations. Lawyers, executives and other key stakeholders will inevitably want to put the firm in the best possible light following a crisis, but their efforts to do that may run counter to what really needs to be done from a formal and perhaps regulatory perspective. Misleading or insensitive statements can put your firm in a precarious position, so the inevitable media questions should be referred to authorized investigators. (Remember, every country, region and jurisdiction has its own approach to these issues, so make sure you have the necessary legal and regulatory knowledge before moving ahead.) Taking this approach achieves several key goals: It lets everyone know that there are many parties involved in the crisis, its impact and its investigation, and it diverts some of the media attention away from the firm to other parties. Perhaps most important, it focuses attention on fact-finding activities that can determine conclusively why the crisis occurred and lead to the implementation of mitigation controls to prevent it happening again.

One more thing: Pay keen attention to your executives and their ability to act as spokespersons for the firm. Their interpersonal skills may not be the type you need during the initial crisis and its aftermath. (You may need to shift spokespersons over the course of the investigation, based on their skill sets and your communication needs.) Empathy and respect for all involved — especially members of the community, the jurisdictional investigators and political leaders — will serve you better than bravado and posturing.

Immediate steps for organizations to take include:

• Go to www.pandemicflu.gov to find out the actions the US government recommends to ensure workforce safety and continuous business operations.

• Download and examine the FFIEC’s “Pandemic Flu Exercise of 2007 After Action Report” immediately, and disseminate their findings across your organization. To the best of our knowledge, this is the only large-scale testing of business pandemic plans ever conducted.

• Download Rick DeLotto’s research note “New U.S. Guidance on IT in Pandemics” dated March 3, 2008.

• Emphasize the urgency of performing personal hygiene disciplines that will inhibit the spread of the virus.

• Identify existing and projected critical skills shortages; and initiate staff cross-training, testing and certification. Make sure that cross-trained personnel are also given the appropriate access rights in your applications. This is the longest lead-time and most disruptive of the improvements.

• Determine which business operations are sustainable, at what level, and likely durations of downtime for normal business operations with staff absentee rates of 40%. Test for various combinations of leaders and skilled staff.

• Testing should start immediately to isolate and remediate problem areas. Testing should be rigorous, inventive, ongoing and documented.

Gartner has many research notes related to pandemic planning and we will continue to update you as to the severity of events and actions you should take as the situation evolves. Please visit our business continuity blog for more information.

Rick DeLotto and Roberta Witty

On Tuesday, Rick DeLotto and I were briefed by the Sahana Project, an award winning, free and open source, web-based disaster relief management system designed to “Help alleviate human suffering and help save lives through the efficient use of IT during a disaster”. It was first developed by the open source community, and is maintained by volunteers, with support from IBM, Google, NSF and Sida. You should run right over to Sahana and get a look at it, tell your friends, and spread the word. It might be just what your home town needs to keep YOU safe.

So far Sahana has quite a track record since its introduction in 2005; it has helped manage disaster outcomes in Sri Lanka, The Philippines, Indonesia Peru and Myanmar. It has been selected for use by the City of New York, Pakistan’s National Database and Registration Authority, The Disaster Management Bureau of Bangladesh, the Disaster Management Center of Sri Lanka and Indonesia’s NDCC and by various agencies across the EU, South America, Australia and China. It is available in 30 languages, has very limited infrastructure requirements, and can be run effectively on systems ranging from a simple laptop (with data exchange by USB drives) to satellite-linked client server.

As shown to us it has 4 main modules:

* Organization Registry, which helps maintain data (contact data, services offered, region, etc) of organizations, groups and volunteers working in the disaster
* Missing Persons / Disaster Victim Registry, which helps the authorities track and find missing, deceased, injured and displaced people and families
* Shelter Registry, a central repository for data on all temporary shelters setup following the disaster, and
* Request Management System, which tracks all requests and helps match pledges for support, aid and supplies to fulfillment.

Other modules include inventory management, volunteer coordination and situational awareness for incident managers, with more in the pipeline.

This is a non-profit, volunteer organization—and you or one of your professional organizations might have some skills, resources or spare time to help.