business plan
LegalCorporateMarch 13, 2020

Beyond Business Continuity Planning – COVID-19

We all hope worst case scenarios for COVID-19 do not play out here in Australia but preparing your business will bring a sense of calm and purpose to your actions if something other than the best case scenario eventuates.
Michelle Bradshaw (Special Counsel) of Ash St. Legal and Advisory

The following information serves to provide some insights on what we know so far and what businesses should be doing now in order to increase the chances of weathering the storm.

Where a community is dealing with a novel virus such as COVID-19 the situation is very fluid. Due to the fact no one has seen or dealt with the virus before, researchers and health care professionals are providing information on their experience of the virus and dealing with it in real time. The real time information is then used by governments and their advisers to develop community action plans as they try to stay one step ahead of the virus and cushion the population from the worst of the potential outcomes.

The COVID-19 situation is requiring a significant amount of collaboration, analysis, problem solving and responsiveness at a domestic and international level given the constantly unfolding situation. This approach is exactly the approach that needs to be adopted by business as well. The purpose of risk management and business continuity planning is to identify potential business risks and prepare the business to cope with those risks in a way that aims to protect its long term viability.

We all hope worst case scenarios for COVID-19 do not play out here in Australia but preparing your business will bring a sense of calm and purpose to your actions if something other than the best case scenario eventuates. It also increases the chances your business will be able to weather the storm.

What do we know so far?

COVID-19 is extremely infectious and has a long asymptomatic period before a person may show signs of the virus during which time they are likely to be infecting others. Children seem relatively immune to the negative impacts of the virus but cannot be ruled out as carriers of the disease. By contrast, the elderly and the immune compromised members of our community are particularly vulnerable. Whether due to the exponential infection rate or a high ratio of serious cases, a relatively large number of individuals will require intensive care for secondary infections such as bacterial pneumonia. The virus poses a real and present threat to our health care system, not just because of the significant demand for specialised services which could outstrip availability but also because it crowds out patients with medical needs unrelated to COVID-19.

Pandemics present quite unique challenges in comparison to other types of business interruption events, not least of all the length of time that the disruption can continue and the way infections may come in waves. In addition, as we are witnessing, the location of an outbreak can move over time, potentially changing a business’ risk profile and vulnerability level. COVID-19 has raised real issues in terms of the urgent need to slow the spread of the virus in order to protect the availability of healthcare services and the immediate risk posed by concentrated and “just in time” supply chains.

What should businesses be doing now?

If you haven’t already done so, businesses should be reviewing their business continuity plans to ensure they are up-to-date.

Businesses may already have a schedule to their business continuity plan that deals specifically with pandemics but, if not, it would be worth ensuring that the unique features of pandemics are dealt with possibly in a separate pandemic checklist.

Consideration should specifically be given to leadership arrangements, employees (their working arrangements, health, absenteeism and need for information), supplier chains and customers. A business may also need to identify where it either operates facilities that could be taken over by a government to provide non-traditional health care sites, produces products or services that will be in critical supply possibly attracting government restrictions (e.g. export restrictions, exclusion from quarantine requirements) or simply has products/services that could suffer a surge in demand. These types of situations will require special analysis to decide how a business would meet such specific challenges and it may be advisable to commence conversations with third parties early.

Policies and procedures will need to be reviewed to ensure they are appropriate for a pandemic situation. It is important that policies and procedures encourage the right behaviour and it may be necessary to issue overriding directives to achieve that result or make amendments to the policies themselves. For example, sick leave policies need to encourage people to stay home when they are unwell and not feel like they must attend the workplace. A doctor’s certificate may be difficult to obtain if medical services are stretched and the business may not consider it necessary preferring people to stay home out of an abundance of caution. Other specific pandemic matters which will need to be considered include the availability of hygiene products and advice for employees, evacuation and deep cleaning procedures when a building is suspected of having been infected and return to work protocols. It is important to remember that quarantine can be challenging for employees. Some employees will feel quite isolated in this type of situation especially where they live alone, do not have close family nearby or already suffer from health issues. You may want to consider a daily telephone calling tree to ensure quarantined employees are safe, especially if the COVID-19 situation worsens.

Like in many other situations, businesses will be in a much better position to deal with the challenges a pandemic may generate if they have previously focused on simplifying business processes and documenting those business processes appropriately. Good record keeping, something that generally gets insufficient attention, is also important. Well documented business processes and good record keeping make it much easier for people to step into unfamiliar roles when there are sudden or sustained absences.

Lastly, keeping abreast of the unfolding situation is critical. Generally, a business’s response will be planned to happen in stages against official pandemic phase announcements. However, as APRA says in CPG 233 – Pandemic Planning, organisations may also escalate their planned activities ahead of official announcements if they have credible information from other sources of an increase in threat level. This statement highlights the need to take personal responsibility for managing the pandemic risk for your business. It is not an easy task but a necessary one. Implementing a response may have a negative effect on the business (e.g. cancelling attendance at trade shows) and therefore the response implemented at each stage needs to be appropriate and able to be sustained for the necessary period.

Some of the immediate actions which businesses should consider taking if they have not already done so are:

  • Undertake a risk and vulnerability assessment that identifies, amongst other things, possible pandemic scenarios;
  • Undertake a business impact analysis that identifies critical business activities that would need to be continued or restored during/after a business disruption event as well as the resources required to do so;
  • Prepare a business continuity plan;
  • Train staff in the requirements of the business continuity plan and test the plan; and
  • Work through the requirements of their pandemic response checklist or schedule.


This article was first published on the Ash St website and has been reproduced with permission.

Michelle Bradshaw (Special Counsel) of Ash St. is an author of Australian Legal Compliance — Making it Work and the compliance commentary and practical tools in Compliance and Business Law (on CCH Pinpoint).

Back To Top