Are your business continuity plans over-optimistic when it comes to employee availability?
- Published: Monday, 22 August 2016 08:21
Can I really rely on my entire workforce to support a recovery? Robert Clark advises business continuity managers to revisit employee availability assumptions in business continuity plans.
My attention was recently caught by a UK press article which reported that Portsmouth City Council had lost more than 33,000 days last year to staff sickness. With a workforce numbering around 3,600 the article estimated that this was the equivalent of each employee taking an average of 8.42 days’ sick leave during the year 2015/16. At first glance, the figure of 33,000 may seem staggering and it certainly beats the UK’s average figure of 6.9 sick days as established by a Chartered Institute of Personnel and Development survey. Even so, with the survey suggesting a median cost of £554 for each sick day taken, the cost to the council in lost productivity would have been in excess of £18 million.
But let’s add some perspective to this and just consider for a moment how often can we expect 100 percent of an organization’s workforce to actually be at work. Staff can be absent for any one of a number of perfectly justifiable reasons: business trips, vacation, jury service, reserved armed forced training, maternity or paternity leave; not to mention sickness. The list goes on. In an attempt to quantify this, I refer back to the five-year period when I was Fujitsu Consulting’s Resourcing Director for Northern Europe, a position which came with responsibility for a pool of around 1,500 consultants. For planning purposes, I worked on the basis that the average number of consultants available to assign to client activities would be 80 percent which took account of the various acceptable reasons for absenteeism. I would expect other organizations that have been through this type of exercise to have come to a similar conclusion.
I raise this issue because from time to time I come across business continuity plans and IT disaster recovery plans which explicitly document expectations that every employee will be available to support any appropriate recovery activity following a disruptive incident. Yet, as you cannot rely upon your entire workforce to be consistently present for 100 percent of the time, this could be a very dangerous planning assumption to make. Moreover, if faced with a serious incident that is also life threatening, organizations need to be prepared for a loss of employees due to injury, trauma and even fatalities. It will also be fate that dictates whether any key employees, perhaps considered vital to a recovery, actually number amongst those ‘lost employees’ statistics.
Following the destruction of its head office in 2005 when the neighbouring Buncefield oil depot erupted with an explosion measuring 2.4 on the Richter scale, Northgate Information Services responded with a text-book IT disaster recovery. However, Business Recovery Director Mark Farrington later remarked: “Had we lost any of the thirty core support staff that knew the systems best, we would have been stuck.”
Fortunately for Northgate, despite the disaster being described by emergency services as apocalyptic, fate was kind that day as the incident occurred around 6 am on a Sunday morning and, remarkably, injuries were slight with no fatalities. Had this event instead occurred during the working week, a very different and tragic outcome would have been highly likely.
Such scenarios equally apply to an organization’s suppliers and, in fact, Northgate was a vital supplier to many high profile clients. It was also responsible for processing the payroll for around one-third of the entire UK workforce and yet despite the disaster occurring just a few days before Christmas, everybody received their salary remittance on time. Conversely, in another incident I can recall, a supplier on a 24/365 two-hour response time contract was requested by a client to participate in a live unannounced exercise for which provision had been made in the contract. A rather embarrassed supplier manager had to admit that the entire company had literally just sailed off across the English Channel on a 48 hour Christmas jolly to France. During this time had the client been faced with a genuine incident, the supplier could not have met its contractual obligations as its entire workforce was legitimately absent from work with nobody left to respond to any client demands.
As part of their business continuity plan validation, organizations need to consider scenarios dealing with recoveries that are deprived of those key employees who would normally be an automatic choice in resolving incidents. Ideally these key individuals will have named backups and simulations of life threatening scenarios can provide these backups with invaluable opportunities to get hands on incident recovery related experience. One such exercise I was involved with randomly selected 50 percent of the employees to act as ‘lost employees’ following a life threatening incident. The exercise proceeded with ‘survivors’ endeavouring to demonstrate that they could recover without being able to refer to those ‘experts’ who were amongst the victims.
But how often are organizations statistically going to be faced with the prospect of losing up to 50 percent of its employees in one incident? Admittedly, not often and organizational risk assessments are likely to reflect that. Even so, it does happen: and certainly the increasing threat from terrorism needs consideration especially in the aftermath of 9/11 and the more recent attacks including the targeting of the Charlie Hebdo offices in Paris. There are certainly organizations out there that consider themselves as potential terrorist targets not to mention others that realise that they are located in close proximity to a potential target and face the prospect of collateral damage. Nonetheless, while individuals involved with civil emergency planning will almost undoubtedly have terrorism on their radar they will also be aware of the looming threat from pandemics. The UK National Risk Register records the probability of a serious pandemic occurring within the next five years as being between 1-in-20 and 1-in-2 with the expected impact rated as ‘catastrophic’. Current estimates show that as many as 50 percent of the UK population could be infected with as many as 750,000 resultant fatalities. Such an occurrence is likely to make Portsmouth City Council’s sickness absenteeism record diminish into insignificance.
History has also taught us that influenza pandemics usually come in waves and can last for up to two years. They also present a multifaceted threat and organizations need to be prepared to deal with the impact of not just their own workforces suffering the effects of a life threatening contagion but also those of its suppliers and customers alike. In addition to a likely increase in sickness with potential associated fatalities, the reasons for absenteeism from work could also include bereavement, fear, transport disruption, and caring for sick relatives or children (if kindergartens and schools are closed). In the case of the 2002-3 outbreak of Severe Acute Respiratory Syndrome (SARS) circa 25,000 people were quarantined in Toronto with a further 18,000 in Beijing. To add a further degree of complexity, we must not forget that during a pandemic there will be no moratorium on other serious incidents occurring and for the likes of fires, floods, cyber-attacks, terrorism and natural disasters et al; it will be business as usual. Consequently, organizations can still expect to have to deal with these incidents with the likelihood of being dependent upon a seriously depleted workforce.
So, in conclusion, how should organizations respond to the question ‘Can I really rely upon my entire workforce to support a recovery?’ Even when faced with a non-life threatening incident, I believe it would be unwise to make such bold assumptions and organizations should plan accordingly. However, in addressing serious incidents that could well have a detrimental impact on the health and safety of the workforce, being prepared to respond with limited resources and possibly even without your most experienced staff being available could make the difference between survival and total catastrophe.
Robert Clark MSc, FBCS, FIBCM, MBCI, MSyI has multi-national and multi-cultural experience, having worked in ten different countries. His communication and mentoring skills are excellent and he has a track record of engaging at all levels of organizations including board members for large organizations plus two Prime Ministers.
Robert has directed large, high profile programmes and projects including business continuity initiatives for prestigious financial services organizations and for two central governments. Between 1999 and 2004, he was the Head of the Project Management Practice for DMR/Fujitsu Consulting. For a two-year period, Robert held the position of Resourcing Director for Fujitsu Consulting Northern Europe managing around 1,500 consultants across 5 countries.
Editor and co-author of the book ‘In Hindsight – a compendium of Business Continuity case studies’, published by IT Governance Publishing which reached No 1 spot on Amazon best sellers lists. His second book, ‘Validating your business continuity plan’ was published in November 2015 while his third book “Business continuity and the pandemic threat” is due to be published in 2016.
This article was first published as a BC Training Ltd blog.