Notes on how to complete the workbook
Introduction
This workbook has been developed to assist you in preparing your organisation for a crisis, such as a potential human influenza pandemic. It provides some practical tools, templates and information to assist you in thinking about and developing your business continuity plan.
The workbook should be used in conjunction with the resources in the ‘Being Prepared’ folder. The resources will help you understand what a human influenza pandemic is, the impact a pandemic could have on your organisation and the community, and how important it is to have a plan in place to help your organisation manage the crisis.
What is business continuity?
Business continuity is about identifying the risks that might affect your organisation’s key activities and developing strategies to reduce the impact of those identified risks. It also includes developing an action plan should the risk event occur so that you can continue delivering your key services or producing your key products.
What is a crisis?
A crisis is an adverse event that is not part of the usual operations of an organisation, community or country. A crisis can result in:
- additional resource requirements (e.g. people, equipment, finances) to manage the event
- an organisation operating at different levels of capability (with different levels of staff and volunteer capacity)
- changes in the demand for services that are offered to the community
- use of alternative working conditions or financial means to continue to provide services.
Crisis, risk and business continuity planning will all help ensure your organisation is capable of managing and responding to different demands during a pandemic.
Your organisation needs to plan how to continue operations (or when to stop or scale back ‘non-essential’ services) and how to support the response and recovery activities of individuals, communities and other businesses that are crucial to your operations.
Your plans and actions will become critically important during a pandemic as community members may rely on your services for their recovery.
Building resilience through business continuity and pandemic planning
Governments all around the world have been investing significantly in planning for a response to an influenza pandemic. History supports the fact that it is ‘more likely than not’ that a pandemic will occur. Although it is difficult to predict the full extent of the impact of a pandemic (or when and where it may occur), it is a certainty that the more time and thought invested in the preparation for a pandemic will ensure a more effective and stronger recovery.
Why plan NOW for a pandemic? “So what does it mean to me?”
Every organisation will benefit from a business continuity plan to improve its organisational and community resilience to adverse events such as natural disasters, terrorist threats, human error, product recall or an influenza pandemic. A business continuity plan provides you an opportunity not only to plan for, respond to, and recover from specific events, but to develop more robust operational processes to improve your overall business operations and processes.
It is important to acknowledge that effective business continuity planning is not just about crises, but can also be about recognising the smaller day-to-day risks that your organisation faces.
By taking the time to assess what key services your organisation delivers, you might find you can improve your everyday management and achieve stronger outcomes for the community.
No one can plan fully for a crisis. However, through risk and business continuity planning, you can develop plans for events that could affect the viability of your operations.
To ensure you are prepared to meet the challenge of a pandemic, it is vital that you plan and prepare in advance for such an event. You may not have staff or volunteers during a pandemic to do this work, so the more you do now the less you will have to do in a crisis.
Developing a business continuity plan now will help you and your organisation, if a pandemic does occur, and will also assist you in the recovery phase.
Seven key steps in planning
Seven steps towards business continuity and organisational resilience
When your organisation is preparing for a crisis, there are a number of common questions and actions that should be considered, regardless of the type of event. The following flow chart and steps detail the processes an organisation might follow in developing a business continuity plan to improve organisational resilience.
Step 1—Understand your organisation’s business
The objective of this step is to identify your key business activities/services.
Using the Step 1 template:
- List (in order of priority) your organisation’s key internal/external business activities/services
- Identify whether these are essential services
- What your organisation depends on, in order to undertake these activities.
Key business activities/services
Your organisation may provide a range of business activities/services – key activities/services are those that you spend the most time or resources on and that contribute the most towards meeting your overall objective (e.g. home delivery of meals or your payroll).
Rank your key business activities/services in order of priority.
Things to consider:
- Priority should be assessed in terms of ability to meet your organisation’s key objectives
- The priority of activities may differ at various times during the year.
Essential and non-essential activities/services
- Distinguish between essential and non-essential activities/services during a pandemic or other crisis. For example, essential services might include provision of food to vulnerable people, while non-essential services might include social outings.
| Question (example) | Yes | No |
|---|---|---|
| a. Is the individual, family, group or community likely to be vulnerable in the event of an influenza pandemic? |
Y | |
| b. Will they be at significant risk if the service or infrastructure is not provided? |
Y | |
| c. Is there any alternative to provide the service? | N | |
| = Essential Service | ||
If you answer yes to (a), yes to (b) and no to (c), the service or social/community infrastructure is likely to be essential.
If you answer yes to (c), then the service may be non-essential (for your organisation) as the activity/service can be provided elsewhere or can be met in another way.
If your organisation provides essential services it is important that plans are established to continue these services and the operation of your organisation.
Identify what support your essential business activities/services depend on
- Consider key equipment, transport, IT systems, volunteers, and communications
- Consider circumstances that may require an increase, decrease or adaptation of services (e.g. Internally—number of skilled staff, access to your IT systems, authority for decisions and access to finances, purchase of stores. Externally—availability of service contracts, access to facilities and venues, purchase of medical supplies).
Step 2—Identify the risks
The objective of this step is to identify risks that might impact on your organisation’s ability to meet its key objectives (in the event of an influenza pandemic).
Using the Step 2 template:
- Identify risks
- The impacts they may have on your organisation
- The likelihood of their occurrence
- Rank the risks in order of priority.
Things to consider:
- Key source of risks (e.g. personnel, economic, financial, commercial/legal, IT, Occupational Health & Safety, business interruption, security, fire, flood, storms, product recall, sabotage, terrorism, explosion, vehicle accident, etc)
- In a pandemic, consider what may happen in the community in terms of increased demand on your services, decreased workforce, reduced availability of childcare, transport etc
- Consider the implications of not delivering essential services or losing supplier services and support (during a pandemic) and the effects on your organisation
- Consider how limited funds may affect your operations
- Does the organisation have cash reserves (e.g. access to money could become problematic if credit facilities are limited)?
- What arrangements do you have in place to protect staff from becoming ill, or offer services through new channels (e.g. face to face counselling replaced by phone counselling)?
Impact on your organisation
- Analyse the impacts of a pandemic on your organisation. What areas would be affected first? How severe would the effects be?
- What impacts will the risk events (e.g. absenteeism) have on your organisation, if they do occur?
- Will they also affect others in the community—your suppliers, your customers/clients, other community organisations? If so who will be affected and how (e.g. an inability to deliver a service may lead to increased pressure on other community organisations)?
Likelihood of occurrence
- How likely is it that the risks will occur (e.g. high, medium, low)?
- What could happen, when, how and where could a risk occur?
Rate in order of priority
Rate your risks in order of priority from highest to lowest (e.g. 1, 2, 3, etc), taking into account the impact it would have on your organisation. The order of priority is likely to change as the impact (of the risk) increases or decreases.
Risk Management
Risk management is about identifying potential risks to your organisation and assessing their likelihood and consequences. All organisations including non-government organisations should include risk management as part of their planning cycle. There are many models of risk management available and most follow the Australia/New Zealand Standard AS/NZ4360:2006. You can find more information at www.standards.org.au
Step 3—Minimise the impact of the risks
The objective of this step is to identify what actions you can take to reduce the risks and their impacts before the event occurs.
Using the Step 3 template:
- List the prioritised risks identified in Step 2
- Identify what actions/treatments your organisation can take to minimise the impact of the risk before the event occurs
- Identify what key documents/resources you require and who’s responsible.
Action/Treatment
When considering the risks and impacts identified and prioritised:
- Analyse the degree of control you have over their impact
- Consider stakeholder needs
- Identify the acceptable levels of risk
- Can you put arrangements in place to reduce the impact on people, facilities, telecommunications and information systems before the risk event occurs (e.g. if the risk is loss of critical information [due to fire], you could store key documents in a fire proof safe. If the risk is bad publicity you could put a communication plan and media spokesperson in place; or if the risk is loss of facilities you can plan for an alternative location)?
When
- Consider putting plans in place to minimise the impact of risks in advance of any occurring (e.g. high absenteeism due to influenza is a ‘risk’ which may lead to an inability to deliver services, which is an ‘impact’.) This is more likely to occur in the winter months so you want to minimise the impact by increasing casual staff/volunteers during the winter months as well as providing the flu injection
- Consider the appropriate time to activate various plans for minimising the impacts of risks.
Supporting documents/resources
- What documents do you need and where are they kept?
- Who has access to them?
- Is there a hardcopy, if so, where is it kept?
- Are documents up to date and checked regularly?
Who’s responsible?
The delivery of services may rely on other organisations or individuals
- Who is responsible for what tasks?
- Who is the back-up person?
- Who needs to be informed and what effect will your action have on other service areas?
- A phone list can be a useful tool to have ready.
Things to consider:
- Updating sick, personal and carers’ leave policies so employees know their entitlements during a pandemic
- Enhancing IT capability may provide potential for employees to work from different locations and at flexible times. What would the impacts be if these key support mechanisms were not available for a period of time?
- Planning for a sudden 30 to 50 per cent reduction in your staff or volunteers? In a pandemic you should plan for staff absences due to personal and/or family illness, quarantine, government, school, business and public transportation closures.
Step 4—Identify response actions if risks occur
The objective of this step is to identify response actions your organisation can take if the risk event occurs.
Using the Step 4 template:
- List the prioritised risks identified in Step 2
- I dentify what actions/treatments your organisation can take if the risk event occurs
- I dentify what key documents/resources you require and who’s responsible.
Action/treatment
- How would you respond immediately?
- What activities could you put on hold?
- Could you gain assistance from other community organisations or could you help them?
- If the organisation is not an essential service provider consider at what point it would be appropriate to scale back activities or to temporarily close
- Plan to stay open if providing essential services
- If remaining open business continuity planning might also include considering risks to employees and volunteers and your duty of care as an employer.
When
- What would you need to do within the first hours, day, week, or month?
Supporting documents/resources
- What resources are required for the treatments of risk?
- Document your plan and procedures to ensure those available know what to do
- Do you have a communication strategy ready?
Who’s responsible?
- Who is responsible for what tasks?
Things to consider:
- Modify activities to limit the spread of an influenza pandemic and communicate your new policies (e.g. avoid contact with sick people, stay home if you have flu symptoms and increase hygiene practices in the workplace such as washing hands, covering mouth when coughing etc)
- Ensure supplies of tissues, gloves, masks, soap or alcohol cleansers and hands-free disposal bins are available
- Restrict gatherings in staff rooms, stagger shifts, or conduct meetings via teleconferencing rather than face to face
- Increase hygiene and OH&S practices for staff delivering services outside the organisation and those with public contact
- Monitor the media for health and emergency advice.
Step 5—Prepare and implement an action plan
The objective of this step is to start preparing and implementing an action plan, using the information already identified in the previous steps.
Using the Step 5 template:
- Begin consolidating your plan.
Organisation Details
Fill in your organisation’s details.
Key Response Team—Contacts and Roles
- Gain support from the Board/Executive and identify who in the organisation will be in the response team
- Set up team, contact details and list their responsibilities and back-up support.
External contact details
Identify all external contacts/stakeholders your organisation deals with and ensure their contact details are up to date.
Team procedures
This template will help you prepare and implement your plan based on the information you have identified in Steps 3 and 4. Consider breaking your plan into groups/teams and have a template for each team. The team procedure identifies the action required, responsibility and the supporting documents and resources.
Step 6—Communicate your plan
The objective of this step is to ensure your organisation informs staff, volunteers and clients of your plan, including actions and policies.
Using the Step 6 template:
- Detail your communication plan for staff and volunteers and others who would benefit from knowing.
Things to consider:
- Tell your staff and customers/clients you have a plan
- How and when would you communicate the details of the plan to staff and volunteers and others who would benefit from knowing
- Ensure all communications about pandemic preparedness are appropriate for your employees, volunteers and clients so they can understand the arrangements. Identify those with special needs and address their requirements in preparedness planning
- Consider the physical location of plans, contact lists and key documents and ensure access is not restricted (within the boundaries of privacy limitations)
- Collaborate with other organisations and share learnings from developing pandemic continuity plans
- Consider assigning a point of contact with local and/or state and territory emergency, health and insurance agencies to maximise understanding and communication about other plans and what can be provided during a pandemic
- If other organisations depend on your functions or services, engage them in the plan
- Consult and provide feedback regularly to address any concerns of your staff or volunteers.
Step 7—Test and review your plan
The objective of this step is to put arrangements in place to test and review the plan on a regular basis to ensure it remains current and relevant.
Using the Step 7 template:
- Assess whether your organisation has appropriate plans and procedures in place to respond in a pandemic
- Identify what further steps may need to be taken.
Test the plan
Testing your plan will help identify if you have overlooked anything in your planning. It will also let
you know if your action plan is practical and will help ensure your staff are aware of their roles.
- Ensure staff understand the risks and treatments.
Things to consider:
- Are risk treatments effective in minimising the risk?
- Do staff know what your plan is should a risk event occur?
- If a risk event occurred would your plan ensure your business can continue operations?
Review
It is important plans are regularly reviewed including updating contact lists:
- How often do you need to review your plan (e.g. every 6 or 12 months)?
- If your services and external environment do not often change, you need to review your business continuity arrangements less frequently. If you operate in a changing environment you might need to review this more frequently
- Have your organisation’s key activities changed?
- Review your environment to see if there are any new or emerging risks or if there are any new ways to reduce the impact of existing risks (e.g. new software developed to protect your IT system).
Conclusion
This workbook aims to provide you with a practical and valuable start in preparing your organisation for a crisis, such as a potential human influenza pandemic. The tools, templates and information should assist you in understanding the impact a pandemic could have on your organisation and the community, and how important it is to start thinking now and developing your organisation’s pandemic plan.
If you have any further questions or would like any additional information please email piinfo@fahcsia.gov.au