An HR director of a leading bank recently asked his business continuity adviser to predict the number of body bags he should buy in. HR’s role in risk management is varied and challenging and requires not only military precision but dedication and a fair dollop of patience. Annie Hayes reports.

Noah’s Ark is the oldest example of a contingency plan, described in the Hebrew Scriptures as a great boat designed to save Noah, his family and a fair few animals from the great flood. It’s nothing new, therefore, to plan for the unexpected whether that is natural or man-made disasters.

And there are plenty of examples to glean lessons from, including the Buncefield oil depot blaze in Hertfordshire, the recent flooding across the UK, the 7/7 London bombings and, further afield, the US terror attacks of 9/11, the Tsunami tragedy and ongoing terrorist threats.

Andy Tomkinson, a former director of the Business Continuity Institute (BCI) says that IT recovery first sparked interest in the subject in the 1960’s and 70’s when businesses that had previously relied on paper-based and manual systems began to move over to computer filing.

Disaster recovery

“IT disaster recovery began to move along at that time and really took hold in 1999/2000 when lots of work was done in an attempt to mediate the threat of the Y2k millennium bug,” he remarks. It was at this point that the area of business continuity began to open up.

IT aside, the threats most commonly faced by businesses include fire, electrical outage and burst water mains, but, says Tomkinson, what is most likely to keep chief executives and HR directors awake at night are: “Terrorism, widespread regional flooding and the threat of negligence.”

Adding to the merry-throng of real and potential threats is avian flu, with its potential to mutate into the human virus and become a full blown pandemic. Both Dr David Cook, a medical director at International SOS and Alison Brown, chief executive officer at Healthcare Connections (HCC) warn that it is not ‘if’ but when it will happen.

With disasters such as this on the horizon it is no wonder that the world of business continuity is really taking off. Cook suggests that HR’s role in all this is very real, providing a critical and pivotal part in being both manager and facilitator.

Deliberate, plan and execute

Brown says that where avian flu is concerned, plans need to be mobilised sooner rather than later.

“The UK is relying on the NHS to provide all the medication that is required but they don’t have enough of it. The plan in the UK is largely post-pandemic. The decision therefore for companies, is to decide whether to invest in it or not and if so how far to extend provisions.”

Many of the FTSE 100 companies, says Brown, are putting elaborate plans in place with dedicated risk managers and continuity officers to boot but many organisations are behind.

“Many companies would spend more on the Christmas party per head then they would on fighting this – it costs £57 per head to put in place a private doctor to patient relationship with the related anti-viral drug prescription.”

Cook says that the companies that are doing well are those that have a foothold in South East Asia, parts of Africa and Indonesia, where the pandemic is already being felt. “Many people are ‘pandemic-ed out’ – it’s a slow burn rather than a crash, it reveals itself over time but the number of cases is increasing and stretching forever westwards.”

A detailed risk assessment is the starting point, he says, followed by plenty of education and plans for ensuring the business survives when it strikes. The World Health Organisation predicts that in the case of a flu pandemic, over 25 per cent of the population may fall ill, and businesses will need to be prepared for at least 50 per cent absenteeism.

The fallout via sickness, therefore, is the real threat to business survival. Cook says businesses need to make a decision whether to take on board prophylaxis to reduce the risk of key employees being affected by pandemic flu when it hits.”

Don’t forget we’re humans

Medical and technical plans aside, Tomkinson comments that what most companies are missing is investment in the human aspect of disaster recovery. “We learnt a lot from 7/7 about dealing with the human side of things. It’s all very well having elaborate plans to back up data and a spare office for workers to go to but what happens with mopping up the workers that are too traumatised to relocate or want to go home, resulting in a lag in performance?”

Tomkinson suggests that HR has a vital role to play in managing the psychological fallout of such events. “It’s outside the normal frames of reference for most HR departments – dealing with bereavement for example.”

Plans need to be in place to deal with the detailed issues that may arise, such as what will happen about workers that need to pick children up from school, collecting DNA samples and extracting the messages of a key director who is a fatality?

“Companies should consider having hotline numbers and PR strategies in place as well as simulation exercises to evaluate how robust the plans are,” he advises.

A common mistake, says Tomkinson, is HR’s belief that it is their responsibility to inform family members of disaster. “This is the role of the emergency services. Even if an HR director witnesses one of their HR staff being injured they shouldn’t inform the next of kin.”

The dangers of grapevine communication is far too damaging, warns Tomkinson, who advises HR to focus on offering support after notification has kicked in. “I never see anything in the plans about offering a helping hand after the event. Business continuity is not just about reviving the payroll and informing the next of kin – that is the mistake HR can make.”

Like Cook, Tomkinson says that the companies that are performing well are those that have already been exposed to the real dangers. “McVitie’s, the biscuit producers, were hit a couple of years back by flooding; this time around HR were much sharper when the floods hit at their other locations.”

Of course the larger companies tend to be the ones with the resources, in terms of both time and money, to nurture well-thought out plans but, says Brown, it is the smaller businesses that causes greater concern.

Jonathan Senior, a member of HR Zone, says that what SMEs often face are the disasters that happen on a smaller but no less insignificant scale: “You work in an office of 30 people and the first 25 calls in the morning are from staff suffering food poisoning from the social/presentation/prize giving buffet/whatever happened yesterday. So you have five staff to do all the usual jobs – answer the phone, deal with orders, complaints etc. How on earth do you prioritise what has got to be done?” Senior says this is when the plans really come into play.

But surviving the everyday dramas is not enough to satisfy the real threats, however, companies that are prepared can ride the storm.

According to the BCI, less than a week after the US terror attacks of 9/11, the major financial institutions in Manhattan that had been severely affected by the terrorist attacks were reopened for business. This was due largely to sophisticated business continuity planning. Tomkinson says that businesses could do worse than pay attention to the three P’s – ‘People’, ‘Premises’ and ‘Process’ – but this in itself is not enough; survival of the fittest is about not only having robust logistical plans in place but preparing for the psychological debrief and fallout from traumas that such situations inevitably bring.