Embed Size (px)
Citation preview
Business Continuity Planning Checklist for a Pandemic
Background
Business Continuity Planning is an essential strategic management planning process used to
enhance business resilience in the event of an emergency or disaster. The completed Business
Continuity Plan (BCP) provides guidance to workplace parties and stakeholders so that the
business can continue to operate during an adverse event e.g., provide products and or delivery
of services to clients or customers during an emergency. Having a plan may also assist to:
Ensure businesses have the timely information and guidance they need to operate
Ensure compliance with legislation, standards and government directives
Reduce business interruption, maintain and or protect critical business functions
Minimize job and revenue loss
Enhance procurement and maintenance of resources e.g. equipment / critical supplies
Optimize human resources, communications and efficiencies before, during and after
the event
Protect clients, customers and worker health and safety
Utilizing a framework can help guide businesses in establishing an effective BCP. There are five
key steps to business continuity planning as outlined Figure 1. A BCP can be adaptable to any
emergency or disaster such as a pandemic. It is essential that plans are developed,
communicated and tested regularly.
1. Establish Governance
2. Conduct A Business Impact Analysis
3. Develop A Business Continuity Plan
4. Communicate / Implement / Prepare
5. Evaluate and Improve Plan
Figure 1. Business Continuity Planning Framework
(Adapted from Canadian Centre for Occupational Health and Safety, n.d.; Centre for Disease Control, 2006; Canadian Chamber
of Commerce, 2020; City of Toronto, n.d.; Government of Canada, n.d.; Department of Homeland Security, 2020; International
Labour Office, 2009; Niagara Public Health 2006; World Health Organization, 2017)
Who should use this tool?
This tool was designed for those with oversight of an organization’s BCP for pandemic events
e.g. senior management committee or pandemic business continuity planning committee or
working group.
How to use this tool
1. Review the section on business continuity planning background to become familiar with
the five step framework.
2. Become familiar with legislation and guidance information sources related to
emergency and pandemic management for example:
a. Emergency Management and Civil Protection Act, Ontario Regulation 380/04,
Occupational Health and Safety Act and related regulations
b. Federal, Provincial, Municipal Standards, Frameworks, Directives, Pandemic
Plans e.g. Public Health Agency of Canada, Public Health Ontario, Emergency
Operation Centre. Ministry of Health, Ministry of Long Term Care, Ministry of
Labour Training and Skills Development, Emergency Management Ontario etc.
c. International Guidance e.g. World Health Organization (WHO) including
pandemic risk assessment, phases and planning; Centre for Disease Control
(CDC) and National Institute for Occupational Safety and Health (NIOSH) etc.
3. Be prepared to gather, review and analyze business information, capabilities and
processes to identify business continuity risks and gaps. This may include but is not
limited to:
a. Business Functions
b. Existing organizational policies, procedures, protocols, training related to
pandemic e.g. infection prevention and control; human resources; health and
safety; occupational health services; procurement; emergency management;
pandemic plan; security during pandemic; laboratory; risk communication etc.
c. Human resources
d. Information technology
e. Internal and external communications
f. Logistics and infrastructure including inventories of equipment, materials and
supplies; and lists of existing and alternative vendor options
4. The committee or those assigned to conduct the business continuity planning should
review the items on the checklist and determine whether each line item:
a. has been completed
b. is in progress; or c. has not been started.
Place a check mark beside the correct choice. If the item line does not apply place ‘not applicable’ or ‘N/A’ in the action plan section.
5. For those items ‘in progress’ or those that ‘have not been started’, develop an action plan to identify and address the identified gaps, assign responsibility and target dates. Additional items can be added to the checklist as the organizations sees fit.
6. Report checklist findings, the action plan with dates, and assignment of responsibility to
the planning committee/working group and senior management for review and
approval. Be prepared to make adjustments.
7. Communicate the action plan and target dates to those identified to be responsible for
items in the business continuity planning checklist. Identify any barriers, facilitators and
where required coordinate resources. Where barriers exist that cannot be mitigated,
report the circumstances to the planning committee for resolution or alternative action.
8. Enter completion dates after each item is achieved and ensure the entire planning
committee and senior management are updated regularly.
9. To ensure the organization is always prepared for a potential pandemic or other
emergency, senior management should review the BCP at least annually or sooner in
light of changing information, situations, standards, best practices, legislation or other
directives.
Business Continuity Planning Checklist 1. Establish Governance
Complete In Progress
Not Started
Statement Actions Responsibility Target Date / Completion Dates
Management Commitment Senior Management is committed to the development, implementation and maintenance of a business continuity plan and has provided the necessary human and fiscal resources
Governance (oversight) Senior Management has formed a governance structure or committee with a chair or co-chairs to oversee the development, implementation and maintenance of a pandemic BCP.
Coordinator or Lead A coordinator or program lead(s) has been assigned to oversee the planning who has policy and program development authority and ability. The lead reports directly to senior management.
Terms of Reference and Reporting Structure A BCP reporting structure and terms of reference, including roles and responsibilities for senior management and the committee members are in place e.g. planning oversight, initiation/activation, termination, business impact analysis, planning, decision-making, approval, testing and auditing of the BCP.
Other
Business Continuity Planning Checklist 2. Conduct A Business Impact Analysis (BIA) – Analyze the Business
Complete In Progress
Not Started
Statement Actions Responsibility Target Date / Completion Dates
Describe the purpose of the business For example: XYZ business is a community-centred organization that provides programs and services to vulnerable Ontarians with physical and intellectual disabilities.
Products and Services Products and services are described e.g. services for each business unit For example: Business Unit is Finance and Services include Accounts Payable and Accounts Receivable
Critical Business Services/Functions Critical (and time sensitive) business service/functions and operations have been identified and listed. For example for a Medical Clinic these may include:
Reception and Appointments
Vaccination clinic
Diabetic clinic
Mental health services
Other
Description of Critical Business Services/Functions Each critical business service/function* is named and described: Name of Business Function
Employee in charge
Timeframe, deadlines etc.
Mandated or Optional service or function
Who performs the function (employee, vendors, key contacts)
Who provides input to those who perform the function (employee, vendors, key contacts)
Business Continuity Planning Checklist Who uses the output from the function
(patient, employee, vendors, key contacts) – may include population type.
Other relevant information *Critical business/service function is:
One that when not delivered creates an impact on the health and safety of individuals
One that may lead to the failure of a business unity if activities are not performed in a specified time period (Niagara Region Public Health, 2006)
Business Impact Analysis (BIA) The impact of a pandemic interruption on each of the critical business services/functions is evaluated. This considers the effects on the following parameters:
Customer/client/patient service and health outcomes e.g. no change, delayed recovery, disease, illness, potential death
Revenue impact
Expenses e.g. operating, supplies/equipment
Insurance
Intangible losses e.g. stress, reputation
Legislation and Regulations e.g. professional obligations and liabilities
Contracts and business commitments e.g. implications of non-performance or payment
Other, such as internal and external interdependences (see the next below)
Consider scenarios that are likely to affect each business functions.
Internal Interdependencies and Impacts Internal interdependencies have been identified and their impacts on critical business services/functions:
Employee availability e.g. staffing, hours
Business Continuity Planning Checklist Employee position and competencies (roles
and responsibilities)
Equipment and facilities availability
Computer applications
Data
Tools
Vehicles
Support Services such as HR, security and information technology support
Other These have been considered.
External Interdependencies and Impacts External interdependencies have been identified and their impacts on critical business services/functions:
Suppliers
Contractors
Laboratory
Diagnostic Imaging
External assets such as equipment and facilities not belonging to the business
Computer applications
Data
Tools
External supports such as facility management, utilities, communications, transportation, government services, health and safety services
Other These have been considered.
Ranking and Prioritization Critical business services/functions have been ranked and prioritized considering how essential they are, and the impact of time and duration if the service/function is suspended. For Example
Business Continuity Planning Checklist Priority A – essential services/functions
where time is likely critical or very important
Priority B – services/functions that can be suspended for a short period of time e.g. 1 month
Priority C- services/functions that can be suspended for a long period of time e.g. several months
(Resource Tools and Forms References: City of Windsor, 2015; Department of Homeland Security, 2015; Government of Canada, n.d.; Niagara Region Public Health 2006)
Suppliers Supplier list and contact information is in place including alternate suppliers for:
Supplies and equipment e.g. medical, clinical, service delivery
Personal protective equipment
Pharmaceutical supplies if any
Materials and controlled products
Skilled Trades Contractors
Other
Supply and Equipment Procurement Identify supplies and equipment needs for pandemic. Establish inventory required for a pandemic and plans to obtain supplies, equipment and storage e.g. stockpile. Consider the impact of shortages and sharing agreements with other organizations.
Skills Sets and Competencies Employee skills sets and competencies have been identified for the each critical service/function. Transferrable skills are also considered.
Forecasting New Critical Business Services/Functions Identify any additional services/functions that may occur or be anticipated as a result of potential
Business Continuity Planning Checklist pandemic scenarios and the associated pandemic impact e.g.
Surge activity due to increase cases/severity
Staff shortages due to absenteeism
Virtual Care (not in person) and technologies
Directives or Emergency Policy Changes e.g. call before coming in, telephone screening, testing protocols, use of personal protective equipment etc.
Other
Business Continuity Planning Checklist 3. Develop Business Continuity Plan
Complete In Progress
Not Started
Statement Actions Responsibility Target Date / Completion Dates
BCP Initiation and Termination There is a notification process for initiation/activation and termination of the BCP. This includes that appointment of a Senior Manager or alternate with decision making authority assigned to activate/terminate the BCP based on pre-set criteria.
Reporting, Roles and Responsibilities An ongoing reporting/communication mechanism is in place to keep all workplace parties, board officials and business continuity planning committee apprised of pandemic phases, activities, directives and responses. All personnel are knowledgeable of line management and or decision makers and their roles and responsibilities during the pandemic event.
Emergency Preparedness Plan The BCP is part of the emergency preparedness plan and there is a clear delineation regarding who is in charge of the Pandemic Response and who is in charge of the Business Continuity Plan initiation and oversight.
Emergency Contact Lists Lists are undated and readily available
Business Continuity Planning and Collaboration The planning committee involves internal and external parties that discuss planning and collaboration on the BCP development and review as needed, e.g.,
Logistics
Information Technology
Human Resources
Finance
Laboratory/Diagnostics
Procurement
Business Continuity Planning Checklist External officials
Local healthcare agencies
Community Partners
Public Health
Labour Union
Joint Health and Safety Committee (JHSC) Worker
Legal Counsel
Others The planning committee considers findings from the Business Impact Analysis (BIA), staff and stakeholders, legislation, multi-level government guidance and directives, best practice and other relevant sources to develop the BCP. Also see governance section.
Policies and Procedures The business develops policies and procedures for implementation during the pandemic and where applicable for the phases of the pandemic. These include and are not limited to the following topics:
Human resources – staffing, deployment to alternate positions or external agencies, cross training, lay off, sick leave post exposure, return to work criteria post infection or quarantine, hours of work, flexible work hours, flexible worksite, use of contract or agency workers, use of unregulated professionals, temporary employees and volunteers, child care, attendance, work refusal for unsafe work, support services (such as EAP, meals, daycare, grief counselling)
Alternative working arrangements e.g. work remotely, video conferencing, telecommunications etc.
Working at limited employers or worksites
Business Continuity Planning Checklist Restricted travel
Emergency Management including Pandemic
Infection Prevention and Control (Hierarchy of Controls)
Physical distancing
Medical Surveillance / Attendance
Equipment Cleaning and Maintenance
Psychological and Occupational Health and Safety (Hierarchy of Controls)
Respiratory Protection and Fit Testing
Personnel Protective Equipment
Occupational Health Services
Surge Capacity
Reciprocal agreements
Restriction of meetings
Information Technology – work from home, disruptions, applications
Finance
Transportation as appropriate
Logistics and Procurement of Supplies and Equipment (shortages and back up)
Security – patrol, monitoring, access control
Training e.g., mandatory, competencies, cross training
Other
Development and Delivery of Critical Services / Functions A plan is developed for each critical business service/function based on the BIA that minimizes impact to the services and is provided with the available resources. This includes determining how critical services / functions will be modified, enhanced, reduced or potentially eliminated.
Business Continuity Planning Checklist Scenario: Booking and scheduling patients/clients/customers appointments is a critical business function however during a pandemic the impact of infected patients/clients/customers coming into the workplace office is deemed unsafe. It may result in adverse health outcomes. The process needs to be modified. The BCP for this service/function may include:
Additional staff to answer phones that includes deployment of an office worker to help with phone calls (training expense)
Restricted access to the workplace office and installation of a doorbell/speaker to enter
A new written protocol to be developed for those requesting a consultations, meetings or appointments
Communication of the new the process to patients, clients and others to call and not to come into the office e.g. voice mail, signage, social media, community announcements
Application of a telephone-based screening protocol and implementation by reception
Booking process for a virtual online or telephone meetings with office professionals and communication of a service plan versus face to face consultation or meeting.
Additional considerations should include:
Who is in charge and responsible for decision making including reducing or cancelling services or approval for equipment and supplies
Ensuring there is a person with signing authority to sign for expenses incurred and/or arranging maintenance and repairs
Staffing capacity due to shortages or workload surge for the service
Business Continuity Planning Checklist Availability and assignment of alternative
and/or cross trained employees or volunteers while ensuring appropriate competencies and qualifications
Worker and client/patient safety e.g. occupational and infection prevention and control
Communications to customers, clients, patients and stakeholders when service delivery levels change
How to best deal with concerns and complaints
Processes for vulnerable populations
Other
Attendance and Surveillance There is a process in place to monitor attendance and surveillance of employees during a pandemic with a responsible person(s) appointed to oversee the process. The person is also knowledgeable of public health requirements and government directives.
Resources: Equipment and Supplies Procurement The organization has a procurement process for:
identifying pandemic equipment and supplies
developing inventories
obtaining and replacing equipment / supplies
stockpiling and storage locations
back up options or reciprocal agreements
Resources: Agreements with Agencies and Businesses Where the business has agreements or understandings with other organizations or agencies, they are clearly defined and communicated. The agreement or letter of understanding outlines the roles, responsibilities and limitations of the commitment under the circumstances e.g. facility use, accommodation, equipment/supply, human resource sharing etc.
Business Continuity Planning Checklist Coordination with External Organizations / Agencies
The business collaborates and coordinates activities with local facilities, agencies, public health and others to share the BCP and processes.
Human Resources Human resources maintains:
training matrices and training records
a repository that compiles worker competencies, training, skills and abilities
identification of work positions requiring professional licenses, registrations, certifications or other qualifications
job descriptions including roles and responsibilities
the ability to match workers competencies, skills and abilities to jobs where deployment may be needed
updated employee contact information
list of modified, casual, retired, agency or other workers that may be able to work during a pandemic
processes and authority to address staff shortages and replacement
accessible human resources, occupational health and safety policies and procedures
process to monitor absenteeism and occupational health and safety injury/illnesses
processes for concerns, complaints and/or work refusals
processes to report injuries, illnesses or exposures to the appropriate authorities as per legislation e.g. Public Health, Workplace Safety and Insurance Board, Ministry of Labour Training and Skills Development and/or Police
Business Continuity Planning Checklist Communication and Information Technology
IT infrastructure has been implemented to support remote working conditions, telecommunications and other requirements or needs.
Training Program Development The organization has robust training matrix and program to training staff on necessary policies, measures, procedures, safe work practices and equipment safe operating procedures in preparation for the pandemic. The training program is for all newly hired staff and existing staff. This includes but is not limited to:
Emergencies procedures including roles and responsibilities e.g. pandemic
Infection Prevention and Control including Routine Practices and Additional Precautions and/or standards and directives
Occupational Health and Safety including hazard identification and controls
Respiratory Fit Testing Requirements
PPE training on fit, safe use, care, inspection and limitations
Human Resources policies/procedures and requirements
Hazard, Incident, Accident Reporting
Cross training opportunities to improve flexibility and enhance competencies
Other
Records and Document Retention The organization has a record and document retention and archiving policy, procedures and auditing process to ensure documents and records are maintained and retrievable.
Other
Business Continuity Planning Checklist 4. Communicate / Implement / Prepare
Communicate Complete In
Progress Not Started
Statement Actions Responsibility Target Date / Completion Dates
Communication Process The organization has a robust communication plan, processes and resources to ensure timely communications and dissemination of information regarding the pandemic plan and activities The organization has identified those who will ensure communication is accurate, credible and determine target audiences and dissemination channels. Various media are used to keep staff, clients, JHSC, patients and others informed e.g. newsletters, email, social media, hotlines, website etc. Communication plan:
provides factual and consistent updates, protocols, directives
reduces fear and misinformation
is consistent with multi-level government messaging
Other
Implement and Prepare Complete In
Progress Not Started
Statement Actions Responsibility Target Date / Completion Dates
Implement and Coordinate BCP There is a comprehensive implementation plan to introduce necessary
policies and procedures
communication processes
agreements and understandings
resources and procurement (IT, supplies, equipment, staffing etc.)
Business Continuity Planning Checklist essential and critical services/functions plans,
processes changes and adaptations
training and education
Provision of Training Program and Mock Drills Instructors and facilitators are identified. Training and mock drills are scheduled and provided to all staff e.g. internal, regional (table top exercise) Knowledge, skills and abilities are evaluated, and documented Debriefing sessions are conducted for all mock drills. Lessons learned from mock drills to be reviewed by training coordinators, Pandemic Response Team and BCP committee. Where appropriate changes are made to the BCP. Changes are also communicated to appropriate workplace parties. Records are maintained.
Other
Business Continuity Planning Checklist 5. Evaluate and Improve Plan
Complete In Progress
Not Started
Statement Actions Responsibility Target Date / Completion Dates
Evaluation BCP is reviewed, tested and audited. Lessons learned and quality Improvements are recommended to the planning committee with input from staff and stakeholders. The committee reviews and summarizes the changes for senior management. The evaluation is scheduled for regular review at least annually or when changes are necessary,
Quality Improvement The planning committee makes quality improvement recommendations to senior management who approve accepted changes. A plan to implement changes is conducted by the committee. Communication of changes is shared with those who are affected both internal and external to the business.
References
1. Canada. (2018). Canadian Pandemic Influenza Preparedness: Planning guidance for the health sector. Retrieved from https://www.canada.ca/en/public-health/services/flu-influenza/canadian-pandemic-influenza-preparedness-planning-guidance-health-sector/table-of-contents.html
2. Canadian Centre for Occupational Health and Safety. (n.d). Business continuity plan: Infectious diseases. Retrieved from https://www.ccohs.ca/products/publications/busn_cont/
3. Canadian Chamber of Commerce. (2020). COVID-19 │ Pandemic Preparedness for Business. Retrieved from http://www.chamber.ca/resources/pandemic-preparedness/BusinessPrepGuidePanPrep2020
4. Center for Disease Control. (2006). Business Pandemic Influenza Planning Checklist. Retrieved from https://www.cdc.gov/flu/pandemic-resources/pdf/businesschecklist.pdf
5. City of Toronto (n.d.). Guide to business continuity planning: Preparedness …Protect your business. Office of Emergency Management. Retrieved from https://www.toronto.ca/wp-content/uploads/2018/01/94bf-Guide-to-Business-Continuity-Planning.compressed.pdf
6. City of Windsor (2015). Business Partners Disaster Preparedness and Business Continuity
Guide Retrieved from https://www.toronto.ca/wp-content/uploads/2018/01/94bf-Guide-to-Business-Continuity-Planning.compressed.pdf
7. Department of Homeland Security. (2015) Business Impact Analysis. Retrieved from
https://www.ready.gov/business-impact-analysis
8. Government of Canada. (n.d.). A guide to business continuity. Office of Critical Infrastructure Protection and Emergency Preparedness. Retrieved from https://www.gov.mb.ca/emo/pdfs/bcont_e.pdf
9. International Labour Organization. (2009). Business continuity planning: Guidelines for
small and medium-sized enterprises. Retrieved from https://www.ilo.org/wcmsp5/groups/public/---ed_emp/documents/publication/wcms_115048.pdf
10. Niagara Region Public Health. (2006). Business Continuity Planning Toolkit. Retrieved from https://www.niagararegion.ca/health/vaccinations/pdf/NR_Pandemic_WKBK.pdf
11. World Health Organization. (2017). Pandemic Influenza Risk Management. Retrieved from https://apps.who.int/iris/bitstream/handle/10665/259893/WHO-WHE-IHM-GIP-2017.1-eng.pdf;jsessionid=CE06AB0B8D18E9483A1C66EE75AAEDC1?sequence=1
Bibliography
1. Centre for Disease Control. (2019). Resuming Business Toolkit: Coronavirus Disease 2019 (COVID-19). Retrieved from https://www.cdc.gov/coronavirus/2019-ncov/community/resuming-business-toolkit.html
2. Department of Homeland Security. (2020). Business Continuity Plan. Retrieved from https://www.ready.gov/business-continuity-plan
3. FEMA (2014). Pandemic Influenza Template. Retrieved from
https://www.fema.gov/media-library/assets/documents/93250
4. FEMA (2014). Business Continuity Plan. Retrieved from https://www.fema.gov/media-library-data/1389019980859-b64364cba1442b96dc4f4ad675f552e4/Business_ContinuityPlan_2014.pdf
5. Hickeys Morley. (2020). Covid-19 Pandemic Preparedness Toolkit for Ontario Businesses.
Retrieved from https://occ.ca/wp-content/uploads/OCC-Pandemic-Preparedness-Toolkit-for-COVID-19_final.pdf
6. New Brunswick (2006). New Brunswick pandemic influenza plan: Appendix D, Pandemic
influenza planning for municipalities, p. 6. Retrieved from https://www2.gnb.ca/content/dam/gnb/Departments/ps-sp/pdf/emo/Pandemic_Planning-e.pdf
7. Ontario Ministry of Health, Ontario Ministry of Long Term Care. (2018). Ontario Health
plan for an influenza pandemic 2013. Retrieved from http://www.health.gov.on.ca/en/pro/programs/emb/pan_flu/pan_flu_plan.aspx
8. Queensland Government (2020). Business Continuity planning for a pandemic. Retrieved
from https://www.business.qld.gov.au/running-business/protecting-business/disaster-resilience/pandemic-risk-management/communications
9. Syed, Nurhuda. (25 February, 2020). Coronovirus: HR’s role in business continuity plans.
Human Resources Director. Retrieved from https://www.hcamag.com/ca/specialization/workplace-health-and-safety/coronavirus-hrs-role-in-business-continuity-plans/214863
10. United Kingdom Government. (2011). Pandemic flu checklist for business. Retrieved from https://www.gov.uk/government/publications/pandemic-flu-checklist-for-businesses
11. Workplace Safety and Prevention Services. (2011). Business Pandemic Preparedness Checklist. Retrieved from https://www.wsps.ca/WSPS/media/Site/Resources/Downloads/Bsnss_Pndmc_Prprdnss_Chcklst_FINAL.pdf?ext=.pdf
12. World Health Organization. (2005). WHO Checklist for pandemic preparedness planning.
Retrieved from https://www.who.int/influenza/resources/documents/checklist/en/
13. World Health Organization. (2020). Pandemic Preparedness: All publications and related documents. Retrieved from https://www.who.int/influenza/preparedness/pandemic/en/
14. World Health Organization. (2018). Global influenza program: Essential steps for
developing and updating a national pandemic influenza preparedness plan. Retrieved from https://apps.who.int/iris/bitstream/handle/10665/272253/WHO-WHE-IHM-GIP-2018.1-eng.pdf?ua=1
15. World Health Organization. (2018). A checklist for pandemic influenza risk and impact
management: Building capacity for pandemic response 2018 Update. Retrieved from https://www.who.int/influenza/preparedness/pandemic/influenza_risk_management_checklist_2018/en/
