Introduction to a pandemic
Recently there have been concerns over avian influenza highlighted in the media as Swine Flu and more recently Bird Flu and whilst neither has really lived up to the hype and media hysteria, there is a real threat as each variation is more resistant than the last. The latest threat, Ebola whilst not currently designated as a pandemic has the potential to be more invasive than any of the previous influenza viruses. The World Heath Organization (WHO) defines a pandemic as a disease which must be infectious and spread through the human population over a large region. The key word on the definition is ‘infectious’. Cancer is a disease and infects a large number of the population over a large geographical area but as it is not ‘infectious’ therefore it is not by definition a pandemic disease. In recent years the H1N1 Flu pandemic reached the World Heath Organization highest level of threat, making it the first pandemic to achieve this status since 1968. Sooner or later one of these will become a real concern to us, planning now will not stop the inevitable but it will help mitigate the effects.
World Heath Organization (WHO) categorisation
The World Heath Organisation recognise six phases in the life of a pandemic disease, these are:
- Phase one – Animals have a virus but there has been no human infection.
- Phase two – An Animal virus is known to have caused infection in humans. This is considered a potential pandemic threat.
- Phase three – The virus has caused a small number of cases in humans and limited human to human transmission may have occurred.
- Phase four – Human to human transmission confirmed and sustained disease outbreak occurring in a community.
- Phase five – Human to human spread of the virus into at least two countries.
- Phase six – Large scale outbreaks in at least one other country, level six indicates that a global pandemic is imminent.
Surviving a pandemic
The United Kingdom has been fortunate in as much as all of the recent influenza pandemics have up to now not had a material impact on businesses. This trend does not look likely to continue, the recent outbreaks of Bird Flu, Swine Flu and more recently Ebola all show that we are heading towards a period of uncertainty. How prepared we are and how flexible we have made our systems will undoubtedly make the difference between surviving and disaster. From a small business with a hand full of staff through to a major conglomerate no one will be immune, so planning and preparation is everything.
Is it just another disaster recovery exercise?
The question which most interested parties ask is why should a pandemic be treated differently to any other disaster? There is no easy answer to this question and it depends on the organisations planning and strategy. In essence a pandemic is just another issue to be dealt with; however, where it differs from most disasters is in the length of time it can potentially continue and the number of people who may either be ill or absent from the work place. Additionally unlike other disasters it rarely affects the organisations infrastructure which means that all of the organisations data and systems are available even if it is difficult to access them remotely. In Asia and other regions where they have first hand experience, the procedures are often well defined and at the first outset of an issue, the staff are split, some to the disaster recovery site some work from home and the remainder continue to work from the office. Here in the United Kingdom we appear to be less well prepared and often our reaction to issues is borne out of necessity rather than planning. However, unlike other disasters we may not be able to contact our local PC supplier to deliver the necessary equipment to enable us to conduct business remotely. Our telephony providers may not have the capacity or personnel to upgrade our Internet connections and we may not be able to get staff to go to the office to install additional hardware. To combat this threat we need to look to at a new more flexible approach which can be modified to fit the evolving situation. The remainder of this document is about creating the necessary insurance policy, to deal with any type of situation in the most cost effective way.
Preparation and planning
The question which has still not been answered; and will not be fully understood until we have large numbers of people working remotely is “not do we have a suitable remote access policy; but will the Internet be able to sustain the numbers of people working remotely?” Thin client solutions will help to an extent as they only send the screen refresh which reduces the bandwidth of each client to approximately 30kbs per client. Theoretically this will enable 500 users to connect and work on an Internet connection of approximately 20mb. Note: These figures will always be vague, as printing and any other network traffic will take up bandwidth so whilst we could calculate the theoretical maximum it will always be unrealistic. Printing in Citrix has to traverse the network clear and uncompressed so a large 20mb document printed remotely will send 20mb of data. However, this will still not address the problem of large numbers of users trying to access the Internet over home ADSL links, which may become over subscribed.
Coordination and planning
The first stage is to identify the critical people in the organisation; this is not necessarily the senior people. Often the critical people are the individuals that are customer or supplier facing and focused. These are the people who bring in the money and keep the company working. Every organisation will have different priorities and requirements but as a general guide, try to always have at least two people from each of the core areas of the business, educated and set up to be able to conduct business as usual. Identify your needs and requirements. This may seem obvious, but redirecting calls to homes or mobiles will quickly become unworkable as it takes two lines for every call, one in and one back out.
Communicate, educate and test
Communication before, during and after is the key to surviving a pandemic. Without adequate procedures in place which are clearly documented and understood by everyone in the organisation, it will be almost impossible to successfully navigate the pandemic unscathed. How communication is conducted, centralised, departmentalised, is not important but having a well-rehearsed documented policy which takes account of people being unable to perform a function is vital.
Impact on staff, customers and suppliers
Travel is going to be a major problem for any pandemic even if the transport system is working, people will be wary of congregating in confined areas where they could become exposed to any influenza type illness. “Fear often has a greater impact than the issue itself” and this has been seen on many occasions not just during pandemics. A fuel strike will often cause panic buying at the supermarkets, a rail strike will often stop people attempting to go to work Providing the ability to work and function externally whilst giving the appearance of business as usual is essential. Number redirection and home working will help but nothing will replace good well documented procedures which are understood or can be easily accessed when required.
External / Internal Communications
Having a well communicated strategy which is understood by all stakeholders will not only help the organisation to cope with the crisis, it can, if managed correctly enhance the company’s reputation.
Communication needs to be more that just an initial chat, it has to be on-going, people need to know when and where to go to get updates. To get through this crisis, organisations need to ensure they use every medium available to keep staff, customers and other interested parties updated on the organisations trading position. Communication needs to be filtered down from top to bottom, with no single point of failure, every communication should be checked and if not sent by the primary contact it should be sent by a nominated back up. All too often organisations have a single person dependency which is not always realised until the crisis happens.
Policies and procedures
At what point do you consider your organisation and employees to be at risk? This will change as circumstances change, however; unlike a lot of other crisis this one normally develops over time and should enable an organisation to plan their response in line with the rising crisis. However, having worked with a number of organisations during the Asia crisis, what became very apparent was that organisations rarely have a defined response, which is located: in a known, easily accessible, location and describes what is expected from each user. The reality is the procedure and policies are often written as a response to the crisis, which means that people are often unaware of what is expected of them or who to contact.
IT provisioning
During any pandemic one of the hardest aspects to control will be communication and getting people to keep the systems running. If you have someone who lives near the office and is willing to go into work, the problem is less serious. If not then you need to start thinking about how you will deal with hardware issues, can you use security or other resources, do they need training and are they competent or willing to take on this responsibility? Hopefully, people will be able to resolve issues remotely or willing to travel in and do any work, the main thing to remember is to be consistent. If your plan has sent one person home don’t ask him to come back in because you have a problem this defeats your planning. Have key people in different locations i.e. one at the main location, one at the disaster recovery location and one working from home etc. Spreading the risk will definitely help to ensure continuity but this does rely on your communication plan being effective and understood by everyone in the organisation.
Conclusion
The impact of any disaster can be mitigated if the time and effort has been put in upfront to ensure that control, co-ordination and communication is well documented and understood throughout the organisation. It time consuming and can cause issues but conducting live and walk through sessions really does help. No one wants to do this but time spent now will pay dividends if the unthinkable happens. However, if this is not the case, having a good remote access solution and a centralised repository for information may just be your get out of jail card. Trying to develop a strategy and communication channel during a crisis may be challenging, so if nothing else ensure that you have contact details for all of your key staff.