The purpose of a business continuity plan is to ensure that your business is able to survive a critical incident. It permits an immediate response to crisis in order to shorten recovery time and mitigate impact. This pandemic has presented a "critical incident" for the world like no other. With unknown reach and duration, worldwide implications and no precedent to accurately base projections, it is fair to say we are in unchartered territories.

As the world reacts to COVID-19, it is likely not an ideal time for management to focus on developing complex business continuity plans. However, some key business continuity planning points may help your organization enhance its recovery time and trajectory. Once you are on your way through the recovery phase of this pandemic, you can then begin the exercise of reviewing and renewing your business continuity plan - using the lessons learned from COVID-19 to bolster your plan, increase efficiencies and allow you to respond more efficiently to future critical incidents.

While you consider the basics of business continuity planning - keep in mind that in order to succeed, you should prioritize critical business activities, stabilize cash flow, extend financial resources to keep operational and maintain your reputation.

How do business continuity plans help

A business continuity plan functions in phases:

Prevention is built upon the risk management principles of identify, analyze, evaluate and treat your risks. Preparedness focuses on analyzing the impact of events on an organization. It helps prioritize key functions, personnel, equipment, offerings and activities that could be impacted by a critical incident. Response is a plan detailing the list of steps to take immediately before (if possible), during and following an incident in order to contain, control and minimize impacts. Finally, recovery planning is the organization's roadmap to minimize disruption and reduce the amount of time it takes to achieve recovery.

Although it is reasonable to conclude that we are in the response phase of the COVID-19 pandemic, for many organizations, the stages of the crisis associated with this pandemic are just picking up speed. Meaning, there is still time to consider all four of the phases - prevention, preparedness, response and recovery.

1. Prevention

Consider the risks that your organization could face in the months ahead - do not stop with the obvious ones; dig deep, speak to employees and to stakeholders, look at competitors and at similar industries. For example, if your business has been designated an essential service, you have likely considered the health and safety concerns and may have provided staff with personal protective equipment (PPE); however, the use of PPE also creates additional risks like the issue of its acquisition - is there sufficient supply of PPE? Do you have multiple distributors in case one source is not available? If not, can you find alternate sources?

As you identify your risks, review your service lines one by one and consider how they might operate in this COVID-19 environment. Think critically about what might go wrong so that you are prepared should those eventualities occur. It is also important to have a plan in the event that one of your employees show symptoms of/tests positive for COVID-19 - including, employee self-reporting, income compensation programs or availability, corporate reporting obligations, self-isolation requirements, notification protocols. The employee self-reporting requirements should be communicated to all employees and updated in accordance with PHAC guidance.

While it may seem like a simple or obvious task, it can be quite difficult to identify all the risks that your organization may be facing - particularly in the first months of a global pandemic that could impact the world economy beyond anything we have experienced in our lifetimes.

When thinking about your risks, you can use various risk identification tools to help with the brainstorming. One such tool is the risk quadrant. As you identify your initial strategic, operational, financial and hazard risks, you can then consider how each of these individual risks will snowball to create others. Each risk that you identify can trigger multiple secondary risks, each of which need to be considered. We have prepared a non-exhaustive list of risks organizations could be facing as a result of this pandemic, which can be found here. This is a general list and does not reflect all of the risks that your organization may be confronted with. It may also include risks that are not applicable to your organization. It is meant purely as a list to provoke thought and assist you in the development of your own list of corporate risks.

Once you have identified your risks, analyze them for likelihood and impact. Make a heat map, list every risk you have identified on your map and continuously update it as you move forward. This exercise will help you determine which risks you should address first and prioritize your focus moving forward.

Evaluate the consequences of these risks materializing and think of ways you can mitigate - or treat - these risks. For example, do you rely entirely on one supplier? What happens if that supplier closes its doors? Can you start diversifying your supply chain now so that if one supplier is impacted you can rely on others? Have a clear plan of action for every identified risk. This will help you navigate the unpredictable.

Given that one of the key risks facing all organizations is the financial implication of the pandemic, look at your short-term liquidity. Become more disciplined in your cash flow monitoring so that you can react quickly to reduce unnecessary exposures. Reduce or eliminate all non-essential expenses and look at ways to raise capital. Monitor supply chain issues that could result in operational and financial exposures that could cripple your business unless remediation measures are implemented. If you would like more information regarding government funding programs please go here.

As you are addressing risks during COVID-19, look to your existing contracts, leases and insurance policies. In your contracts and leases, look for force majeure, delay, relief and excusable conditions clauses. As you work with stakeholders through this process, renegotiate contracts wisely - be on the alert for cost escalations, long-term obligations and contingencies that may be out of your control.

2. Preparedness

What is your organization's critical business activity? Who are your critical personnel? What are the vital elements of your supply chain? Answering these questions is critical to conducting a business impact analysis.

Have contingency plans in place for modifying your activities going forward. You may not be able to offer services the way you previously did - virtually instead of in person? delivery instead of on-site? Maybe you will change the services that you offer entirely - producing hand sanitizer instead of beer? building ventilators instead of vacuums? Consider these eventualities so that you are positioned to transition when necessary.

Should you need to transition, be aware of the added risks that come with these changes, update your heat map and re-evaluate your mitigation steps to ensure that you are protected once these changes come into effect.

Also, ensure that you identify and source all the resources necessary to support these key activities. If possible, do so before you need to transition.

Should you be unable to perform your key activities (or source alternatives), consider what the impact would be on your business. Is there any mitigating measure you could put in place to reduce that impact? Are there any forms of assistance that you can make use of to prolong your business' survival?

As for your key personnel, make sure that you have delegates who can step in should they become incapacitated. Have key information, including plans (business continuity, incident response, recovery), policies (insurance, corporate), financial data, key agreements and contact lists available, such that the delegates have access to the key information necessary to keep your business running. This information is often found in a corporate emergency tool kit. If you do not have an emergency tool kit in place already, start compiling one such that should a key personnel handoff become necessary, the emergency tool kit can act as the delegate's guidebook forward.

3. Response

Your incident response plan is your roadmap of what to do in the face of a critical incident. These plans vary based upon the triggering event, your organization's size, structure and business activity.

First is activation: who has authority to activate the plan and in what circumstances.

Second is team: who is involved in the response. Depending on the size of your organization, this may range from all hands on deck to a select portion of the leadership team. Large organizations may have sub-groups charged with various elements of the plan. The key personnel should also have alternates in the event they become incapacitated. If your organization has various departments, it is important to have representatives from the legal, finance and human resources departments. It is also helpful to have a person appointed as secretary to record discussions and track all action items.

Third is communication. This is both an internal and external issue. On the internal side, the plan must address how all members of your organization receive communication in various circumstances. Do you have an emergency communication mechanism (like "Send Word Now") to send updates to employees in a crisis? Is there a contact list with all employees' personal phone and email addresses? Externally, you should have a list of all emergency services you may need to reach, all customers and clients who you might need to access and all suppliers and producers who you may be relying upon.

Fourth is recording. You should have an event log to record all relevant information, decisions and actions taken during the crisis. This will be an invaluable tool when addressing any liability concerns raised during the crisis (breach of contract, employment disputes, health & safety allegations, privacy breaches, etc.) but also as a debriefing tool to use once the dust settles and you are able to reflect on what was done well and what could have been done better. This log will prove very important as you create or renew your business continuity plan post-pandemic.

4. Recovery

As we push through this crisis, think of the recovery phase. Your recovery plan will assist you to respond effectively so that you can minimize loss and reduce the time necessary for recovery. The basic question asked in your recovery planning is "how will you get your business back in line after a crisis".

Timing: Consider the realistic amount of time it would take your business to recover from being unable to engage in its critical business activities (as identified in the business impact analysis). You may have multiple critical business activities depending up on the nature of your operations and, if that is the case, each one should have its own recovery timeframe.

Strategies: Consider what your business needs to operate and develop strategies that prioritize the key elements of your operation. Some sample strategies:

  • Retrieve your emergency tool kit (or collect all of the information that should be in the kit);
  • Identify a recovery team or teams: identify key people who are tasked with focusing on the recovery of individual aspects of the business;
  • Communicate: keep communication open, frequent and transparent with internal and external stakeholders;
  • Identify Alternatives: look at what you need to keep your operation running and identify alternative suppliers, distributors, manufacturers, locations, facilities, equipment, etc. that you could use in order to keep operational;
  • Keep operational: consider ways to reduce operating costs and/or increase alternate sources of cash flow so that your business can survive through the crisis;
  • Monitor the process using a checklist: this checklist reminds you to do all the things you should be during the crisis (recording information, communicating information, contacting the right people, seeking support from all available resources, obtaining tax advise and assistance, and reviewing your recovery). Gowling WLG's checklist can be provided to you upon request to Gowling WLG partner Jahmiah Ferdinand-Hodkin.

As it pertains to COVID-19, this recovery plan will gear you towards the questions of when and how you will be returning to normal business operations and what that "new normal" may look like for your organization. As there are so many unknowns at present, this plan may include multiple contingencies that you can narrow as various government decisions and funding programs are announced.

What to do now

If you do not have a plan or your plan isn't working, please do consider these steps, tricks and tools to help you navigate this crisis. These tools can be implemented by organization presently closed as well as those operating as essential services. For additional information regarding how to bolster your business continuity plan and manage incidents as you move though this pandemic, please do not hesitate to contact us.