article banner
From Where We Sit

Business unusual

Michael C. Gallego Michael C. Gallego

As the coronavirus disease 2019 (Covid-19) pandemic continues to worsen, business and government leaders are called upon to establish a systematic response to the public health crisis. The recent Taal volcanic eruption and the current actions of civil society, companies and other organizations to help frontline health workers, security and support personnel show that we can have a united response. These events, however, demonstrate the importance of having and stress-testing the effectiveness of your organization’s business continuity plan (BCP). Do you have one? Is it measuring up against Covid-19?

A pandemic is not your normal business disruption, according to human resources research from Gartner. In the 2019 London Risk Register, the British capital lists emerging infectious diseases and an influenza pandemic as among its high- and very high-risk events. Unlike a cyberattack or natural disaster, these two can affect operations for months and threaten the workforce directly — and it becomes a problem of both business and public governance leaders. Hence, the need for joint cooperation.

In risk management circles, it is always good to identify and prioritize your risks, and develop appropriate responses. However, there comes a point when what we are trying to manage (i.e., a disaster to not happen) occurs. At this point, the company should be able to switch immediately to its disaster recovery and business continuity management process.

Businesses of all sizes and across industries must have a robust and current BCP that addresses exactly how they will respond, how they will resume after an operational disruption and how they will integrate their learnings to improve the plan.

Planning is imperative, as resources will not be available if a pandemic such as Covid-19 strikes. It minimizes the impact of disruption on staff, supply chain, service delivery and information technology (IT) infrastructure. Moreover, it protects the company’s reputation, reduces financial impact and allows the organization to return to normalcy sooner.

If your organization has a BCP, including one that will cover pandemics and similar community-wide incidents, you should be able to adapt it for 2020 and minimize disruption to your business. Otherwise, we share the following information to gauge your organization’s preparedness and see what aspects of your business operations need to prepare and respond.

A business continuity management program should reduce the impact of both internal and external volatility to your business, enabling the organization to reliably and consistently achieve its strategic objectives even amid disruption. A comprehensive program covers the response and resilience of IT operations, supply chain, workforce and more.

Successful business continuity programs have four components:

 Business recovery and continuity. This component focuses on the recovery of critical business processes. These include resuming regular operations, recovering work areas and building resilience among your people. Define and align senior management on potential scenarios and run financial stress tests for all situations. Understand where operations can continue with reduced staff, which need to be augmented to operate and which need to be suspended due to a lack of healthy employees. Establish a plan for handling the backlog of work once your organization is back to the “new normal.”

 IT disaster recovery and service continuity management. This component limits the impact of downtime, specifically for IT services and systems, whether from planned (such as infrastructure maintenance) or unplanned disruptions (such as a cyberattack). Keep extra IT inventory on-site in case of resource failures. Implement remote data center management solutions. Implement or review “work at home” or remote work programs, especially issues around employees bringing their own devices (BYOD), company-issued laptops and prioritized access. Investigate alternative voice and chat communications, and implement web-based video conferencing.

 Supplier risk and contingency management. This component addresses the risks associated with using external parties as part of delivering products or services. It also plans for how the business process would continue if the supplier had a business disruption of its own. Map your organization’s exposure to suppliers and estimate the impact. Identify whether key suppliers or third parties are located within affected areas. Confirm inventory levels, identify backup suppliers and manage stock levels to support delivery to the most critical customers. Do you need to inform your clients and customers of any changes to your services? With international travel and export hit by Covid-19, have you assessed the strength of your supply chain and do you have alternatives in place if you need to source another provider? Which suppliers might require different arrangements? Liaise with your suppliers to determine how they can support you.

 Crisis and emergency management. This component establishes authority, control, communication and coordination in an emerging event, including internal and external communications, to limit damage and reduce uncertainty and doubt. During these difficult periods, proactive stakeholder management becomes extremely important, particularly with financiers, shareholders, customers and employees. Communicate with these groups early and often, keeping in mind the company’s tone of message. Provide clear policies and guidelines, and track the adherence to such policies. Establish a communications program with pre-approved message templates and scripts addressing multiple stakeholders. Establish an internal business continuity management portal with links to related resources and leverage automated mass notification services. Monitor social media posts about your \ company. Do you have a clearly communicated policy on what your people should do if they are feeling unwell? What will this mean for colleagues and clients if you suspect a case of Covid-19?

As global issues impact local businesses, it is a must for organizations to establish and execute their business continuity management system. It is no longer a concept, but a tough reality.

Without formal processes and guidelines, ad hoc responses will likely extend downtime and business loss. Plans must be tested to ensure that they will enable the organization to steer through disruption.

In assessing your business’ continuity program, put people first. Senior management needs to be involved in any preparation and response plan, as well as to work closely with leaders from risk management, safety and security, communications, human resources, finance and IT.

 Improve the organization’s overall capabilities. Emergency situations such as the spread of Covid-19 provide an opportunity to review where the company is exposed and which business activities may not go as planned in the coming weeks or months. Document your business’ response, and take note of assumptions that turned out to be wrong. Work with employees by releasing targeted surveys or organizing focus group discussions to assess the effectiveness of the response and any areas where people wished they had more support. After all, crisis planning doesn’t stop once a crisis is over.

Mhycke C. Gallego is a Partner and Head of Knowledge Management of P&A Grant Thornton. P&A Grant Thornton is one of the leading audit, tax, advisory, and outsourcing firms in the Philippines, with 23 partners and more than 900 staff members. We’d like to hear from you! Tweet us: @GrantThorntonPH, like us on Facebook: P&A Grant Thornton, and email your comments to or For more information, visit our website:


As published in The Manila Times, dated 25 March 2020