Published: 06 February 2020
Analyst(s): Audit Research Team
Pandemics aren’t your usual business disruption. These events require an extra set of activities that include consultations with epidemiologists, critical role identification and third-party evaluations. Audit leaders should review this guidance to evaluate the business’s crisis response plan.
Unlike a cyberattack or natural disaster, pandemics can affect operations globally for months and threaten the workforce directly.
A new coronavirus strain that emerged in Wuhan, China, last month is the latest reminder — like SARS, MERS and H1N1 before it — that companies need to plan and prepare for large-scale outbreaks of dangerous diseases. Even before the World Health Organization (WHO) declared a global public health emergency on 30 January 2020, companies had already begun taking steps to reduce their exposure. They restricted travel to China, closed stores and factories and ordered employees in affected regions to work from home.
Preplanning is essential during any crisis, but pandemics require extra activities. That includes keeping close contact with epidemiologists as well as monitoring and modeling the impacts over months. Check that your leadership has a business continuity management (BCM) plan for pandemics, perhaps formulated to manage the impact of the 2009 H1H1 outbreak. If so, you should be able to review it. If not, you can scroll to the bottom of this article for a checklist to gauge your business’s preparedness and see which actions it still needs to pursue.
Below, we’ll share important basics for assessing the risk of a pandemic, identifying critical roles and vetting pandemic preparedness plans of important third parties. But first, any response should be based on two guiding principles:
It’s the smart thing to do as an employer (and the right thing to do for the species). When SARS (also a coronavirus) spread to four continents in 2003, executives at seven companies told us that managing employees’ concerns and questions was one of the most time-consuming associated activities. Even when a disease’s impact is limited, uncertainty can create fear and anxiety. If employees think that they could be exposed at work, morale will suffer as well. In addition, companies face potential for poor public opinion of company actions and of employee lawsuits.
Even if the new coronavirus is contained and suppressed in the coming weeks, it still provides an opportunity to see where the company is exposed and which business activities may not go as planned during the spread of infectious disease. After all, more common medical disruptions can be more costly over the long run. For instance, seasonal influenza cost businesses $21 billion in lost productivity in 2018 — not to mention the inconvenience to workers (and sometimes severe health impacts). Document your business’s response this time around; note surprises or assumptions in the plan that turned out to be wrong.
Business leaders should talk to epidemiologists to inform their analysis. This can be as simple as picking up the phone to get advice. Ideally companies will have consulted them ahead of time to prebuild pandemic risk models. Companies should also monitor updates provided by the WHO and government health agencies in all affected regions. The media often overhypes pandemics and misses nuances in epidemiological analyses.
The information gathered should feed into the impact analysis and determine triggers for action. American Express set up criteria to validate the threats of the next pandemic, informed by their experience managing the impact of the outbreaks of avian flu, H1N1 and SARS. The company included both the impact on the business and the community to determine thresholds for action (see Figure 1).
Check that the relevant business unit has established these thresholds as triggers for each new phase of the predetermined crisis response plan. Take a look at how another company set these thresholds and required local HR managers to monitor and report on their conditions during a swine flu outbreak (see Figure 2).
A pandemic strikes directly at companies’ most valuable asset — workers. If there’s a risk of a prolonged outbreak, check that business leaders have a plan to deal with absent workers. The impact analysis should determine which roles are necessary for the organization to function.
To prepare for an avian flu outbreak in 2006, Goodyear outlined three steps to make sure it would have the right personnel available to continue operating.
First, Goodyear tasked each business unit or region to identify roles that had:
Functions directly linked to business priorities in that part of the world.
Functions directly linked to mission-critical products in that location.
Relationships with contractors and customers that the company needed to prioritize for as long as possible.
Functions that will dramatically increase activity to respond to a pandemic.
Next, the company prioritized roles and functions into three categories:
Essential: must be completed under all circumstances.
Temporary Suspension: may be suspended for a short time.
Extended Suspension: can be suspended for an extended period.
Then, Goodyear used this analysis to train additional employees in critical roles where there was an existing scarcity of the required skills. This helped build operational resilience in case of a future outbreak.
The new coronavirus is putting pressure on supply chains as factories shut down in China. For instance, Bosch CEO Volkmar Demmer said that his company, with two plants in Wuhan, will face supply chain disruptions “if this situation continues.” Analysts have also been examining the vulnerability of Apple, with its heavy dependence on Chinese manufacturing, and of the pharmaceutical industry. Make sure there is a process for vetting your third-parties’ crisis response plans if they are impacted by pandemics.
The business unit responsible for this should segment third parties by risk level, including pandemic-specific criteria, like proximity to the outbreak’s origin, paired with standard criteria like contract value and types of services provided.
When evaluating a plan, the assigned business unit should look for the following indicators (see Figure 3).
This article hereafter highlights questions to ask during an outbreak, once an outbreak becomes a pandemic and activities to perform regularly to prepare for the next pandemic.
Information and Communication Concerns
What is the nature of the disease? How is it transmitted?
What are its symptoms, and what healthcare precautions are appropriate?
Do employees know what to do and who to contact if they are infected or may have been exposed to the virus?
How will the company communicate with its employees if they are not at work?
At what point do managers need to communicate to upper management that there is a potential problem?
How will potential problems be communicated to employees and clients? Can you use the name of the employee when communicating to staff?
Have call centers been set up to maintain contact with third parties, clients and employees?
Human Resource/Benefit Concerns
What is the company’s position if an employee wants to work at home?
What happens if an infected employee comes to work?
What if a non-native employee wants to be temporarily transferred to another region? What about his or her family?
Is the company prepared to provide family death support or additional paid time off — for instance to attend a funeral?
Can the company operate with 25% or greater absenteeism?
Can the company have employees work remotely?
Can the company increase flexibility and accommodation for liberal leave and compensation?
Will the company monitor or even restrict travel to high-risk regions?
What infrastructure support is needed to support a shift to an at-home workforce?
How does the company know that supply resources are not contaminated?
How will clients be assured that products are not contaminated?
Will there be disruption to the company’s supply chains?
What are the procedures to decontaminate the facility and its heating, ventilation, air-conditioning systems, electronic equipment and soft materials (blankets, curtains, etc.)?
What assurances need to be provided to the facility staff so that they are safe at work?
At what point does the company prohibit staff from traveling to certain geographic areas?
How will traveling employees be brought home, particularly if they are sick?
Are there escalation procedures to get additional resources?
Are employees cross-trained and able to perform multiple duties if the flu causes high absenteeism?
Is there a trained crisis management team that includes on-call staff?
Do the team members know what is expected of them? Are the correct personnel management and others designated to participate on the team?
External Communication Concerns
Are executives capable of delivering the right messages?
Have press releases been prepared that can be adapted to fit the situation?
Are mechanisms in place for managing external communications?
What if the current means of communication fail?
Are there trained spokespeople for dealing with the media and other stakeholders?
Is the crisis management team operating effectively? Does it have the necessary and readily available resources to support its activities?
Where will the team and its support resources stay if they have to travel or relocate to a different facility?
Has the team initially identified and monitored changes of the recovery time objectives for each of the critical business processes that may be interrupted?
Have pandemic-specific strategies been developed for each process? Does the organization understand how these plans will be put into action?
Have the strategies been integrated in an effective manner or prioritized, particularly if multiple facilities and regions are affected?
Have supply chain dependencies and alternative channels been identified and secured in case of disruption? What happens if the backup fails?
Are there alternative premises and facilities within and outside of an affected region that can be used?
Are transport links likely to be sufficient to get people and resources to the alternate sites?
Consider whether your organization is regularly conducting these pandemic preparation activities:
Review, update and test all existing plans based on the threat posed by any pandemic.
Consider establishing escalation trigger points based on warning levels issued by WHO, CDC, etc.
Maintain contact with governments, international agencies and industry groups about the availability of new guidance.
Tell employees what to do and who to inform if they identify a suspected infection among their colleagues.
Define responsibilities within the organization for pandemic planning and tracking the development of potential threats.
Reexamine the supply chain and assess what additional risks exist to the continuation of service from third parties through operations to customers.
Share pandemic preparedness and response plans with key third parties and service providers to increase transparency of responses and align activities.
Review or develop employee health procedures to minimize the potential for transmission of infectious diseases to other workers.
Evaluate current employee healthcare plans to ensure adequate coverage in the event of prolonged absence from work.
Consider building capacity for telecommuting.
Develop a plan to educate staff about possible consequences and preparation steps being taken by the company.
Test operations pandemic response plans regularly. Consider running a rehearsal using various outbreak scenarios.
Train senior managers in crisis management skills and/or give them access to crisis management resources.
Check whether facilities can support clean operating environments (e.g., filtration of air conditioning systems).
-Laura Reul contributed to this article
Avert long-term damage by checking for these features in crisis plans that help participants act quickly and decisively as a team.
Learn how to align audit’s limited resources to the dynamic risk landscape. Update your audit and resource plans as risks change throughout the year.
“Executives Try to Assess Financial Impact of Coronavirus Measures,” Wall Street Journal.
“Impact of Illness/Disease on Business Continuity Plans and Crisis Management,” Gartner.
“HR Policies and Contingency Planning in Preparation for a Possible Outbreak of the Avian Flu — Part II,” Gartner.
©2021 Gartner, Inc. and/or its affiliates.
All rights reserved.
Gartner is a registered trademark of Gartner, Inc. and its affiliates.
This publication may not be reproduced or distributed in any form without Gartner’s prior written permission.
It consists of the opinions of Gartner’s research organization, which should not be construed as statements of fact.
While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information.
Although Gartner research may address legal and financial issues, Gartner does not provide legal or investment advice and its research should not be construed or used as such.
Your access and use of this publication are governed by Gartner’s Usage Policy.
Gartner prides itself on its reputation for independence and objectivity.
Its research is produced independently by its research organization without input or influence from any third party.
For further information, see
Guiding Principles on Independence and Objectivity.