Earlier in June ISO published ISO 22330, its latest business continuity standard. In this article, Dr Liz Royle explains what the new standard is, why it was needed, and what it contains.
A fire has ripped through the building. Although most people were successfully evacuated and sheltered, some remain unaccounted for and there may be fatalities. In the ensuing hours, people are shocked and distressed, rumours are rife about the cause and impact of the fire and the management team is working flat out to respond. Would you be ready to effectively manage the people aspects of this event?
It’s in everyone’s interests for the organization to recover quickly and its people are at the heart of this. However, it’s no good having arrangements for relocating operations if the people sitting in those alternative worksites are not able to function as usual, are emotionally distressed or angry about how the organization dealt with them, their families or their colleagues.
People may become negatively impacted by a wide variety of work-based incidents – fire, natural disaster, cyber-attacks, workplace violence or acts of terror commonly spring to mind. The event may affect the whole organization, a department, team or a few individuals. However, when it comes to managing the people aspects, there are basic principles that apply whatever the causal event or however many people we are managing. The long-awaited ISO 22330 ‘Guidelines for people aspects of business continuity’ was published at the beginning of June so this article offers a ‘hot off the press’ review and some ideas of how and why you might use it.
Although the ISO 22301 and ISO 22313 business continuity standards provide some guidance on managing people aspects, this new document expands on this with a clear, consistent, approach that is relevant to any size of organization that needs to prepare for, and respond to, events that are disruptive, challenging or distressing for its people. People are the greatest asset in any business and it’s encouraging that their safety and wellbeing is being placed at the heart of business continuity.
Most people would argue that a moral and humane duty exists to protect and support employees, but organizations vary in their motivation to address the people aspects. ISO 22330 sets out some of the negative consequences that can arise from not proactively considering these. ISO 22330 can therefore be used to build a convincing argument that resources need to be allocated to this area. It identifies the attributes of an organization that is committed to the people aspects of business continuity and the competences, skills and qualities of key personnel involved in the area suggesting a need to work at an organization’s cultural level.
It is not a definitive guide to managing an incident, but ISO 22330 does provide a useful starting point for considering where an organization currently sits in its people response. It will help answer questions such as
- What do we need to consider?
- Where are our blind spots – the things we don’t know that we don’t know?
- What do we need to add to existing policies and processes?
- What are we doing well?
- Where do we need to bring in additional technical expertise?
The guidelines begin with the usual definitions of terminology. Many people perceive people aspects, particularly the mental health aspects, as a bit vague or ‘woolly’ so it is important to remove the jargon and provide specific definitions of terms such as ‘psychological critical incident’ and ‘psychological education’. These are standard terms that specialists in the field would use and will help everyone involved to be clear on what is meant.
ISO 22330 details recommendations for the preparation, response, recovery and restoration phases. Topics you would expect to see such as evacuation, shelter in place, and alternative work sites are included; but there is also clearer guidance on strategies to support people and the use of communication. The document highlights the need for good communication and support strategies to run through the duration of the phases. Many organizations simply focus on the immediate response phase. The nature of communication and support may change as time progresses, but both will still play a crucial role in full recovery. A section on managing the impact of travel issues reflects the use of an increasingly mobile workforce, both nationally and internationally.
Producing a document that is worthwhile and comprehensive without being overwhelmingly long is no mean feat. ISO 22330 manages to encapsulate the basic principles of each topic whilst not getting caught up in too much detail. The subject areas are most useful as a checklist with each area then requiring further detailed analysis by the organization using technical expertise (that may be internal or external to the organization). In other words, the emphasis is on the ‘what to do’ leaving the ‘how to do it’ as beyond the scope of such a document.
Two informative annexes focus on psychological response management and relatives’ response teams.
The first Annex, along with the clear definitions at the beginning of the document, provide concrete advice on steps that can be taken to provide a continuum of care. In my experience, many organizations feel apprehensive when it comes to anything that begins with ‘psych…’ or related to emotions. How do you effectively manage the psychological impact? Who may need help, when, and what, should you actually do? A desire not to do the wrong thing can leave people paralysed and doing nothing or abdicating responsibility for employee welfare to human resources, employee assistance programmes, or other external mental health services.
Interestingly, the document is quite specific on some common actions not to take. Specialists in the fields of mental crisis and trauma support have long complained about organizations’ use of ineffective or inadequate qualified mental health services after an incident. There is good clinical evidence that early intervention requires a specific, directive approach yet many organizations still provide non-directive ‘counselling’ for employees after an event. Not only is this a waste of resources but it can actually cause harm. An organization could think they were doing the right thing, so it is very encouraging to see this difference highlighted. As someone who provided content for ISO 22330, I could be accused of potential bias here but I do believe it addresses some of the confusion and ignorance that abounds in the area!
Throughout, ISO 22330 encourages organizations to take a broader view of the ripple effect of an incident. It looks at the practical aspects of duty of care to the people involved and sets out the needs, expectations and demands of the different groups at different times. This includes the wider community and families and friends who may be affected where injuries or fatalities are known or suspected. How do you manage enquiries from families whose loved ones are unaccounted for, or worse, confirmed dead? The second Annex, looking at a relatives’ response team, is specific in its recommendations for the role and requirements for team membership.
Overall, ISO 22330 is a good framework for creating policies and procedures and clear pathways of care for any size of organization. Once they have identified the ‘what to do’, organizations can more effectively utilise existing internal resources and / or identify the areas of external expertise required to implement the ‘how to do it’.
When an event, or series of events, occurs that is distressing and destabilising for the people in a business, the response is often late or knee jerk. ISO 22330 empowers organizations to prepare a more immediate, effective response that will facilitate a faster recovery to people and business. The important issue of people certainly warrants its own standalone document.
To obtain the standard go to https://www.iso.org/standard/50067.html
The author
Dr Liz Royle is a director of KRTS International, a specialist company that helps organizations prepare for and respond to crises and trauma in the workplace.
ISO 22330 emphasises the need for immediate psychological education and management support. KRTS International has developed an App to allow organizations to do this simply, quickly and cost effectively. For more information, go to www.powertorespond.com
If you would like to learn more about managing the people aspects of business continuity, KRTS is offering Continuity Central readers a Masterclass at a discounted price of £120 to mark the release of ISO 22330. Find out more here.
