Flu Season

Welcome to the age of the looming flu pandemic: What should a CIO do about it?

by / February 2, 2007
Imagine a scenario where key personnel become unavailable for lengthy periods. Some choose to stay at home; others have actually passed away. Public transportation is shut down. Quarantines are implemented. Suppliers are forced to close. A panic-stricken public reacts by looting pharmacies and doctors' offices. Hospitals are overrun. Law and order are lost. Absolute chaos results.

This is what can happen when a flu pandemic strikes. How will your government entity fare when it does?

Not a Question of "If"
Experts say it isn't a probability issue; it's going to happen. In addition to the 1918 pandemic, which killed nearly 50 million people worldwide, smaller-scale pandemics in 1958 and 1959, and again in 1968 and 1969 killed nearly 2 million people -- and the victims weren't only the very young and the elderly.

In fact, the most affected demographics were 20- to 40-year-olds who had the strongest immune systems. It seems that when a healthy body is confronted with a new, quickly multiplying virus, it goes into overdrive. Many succumb to the disease because their immune systems begin attacking them.

Clearly we don't know when the next pandemic will happen. But we do know that it will, and most businesses are ill-prepared for its arrival. As CIOs, it's quite possible that you will be charged with overseeing your entity's business continuity planning initiative.

What Can We Do?
Would you know where to begin if you were asked to drive the planning effort? Clearly it's not the same as the vanilla disaster-recovery planning we're accustomed to, and it's different from the Y2K project we all drove a few years ago.

Since we can expect our agencies to be extremely short-handed during a time when public outcry for help will be its most intense (think a nationwide Katrina), we must develop a solid, high-quality preparedness plan.

Here is a simple framework to address business continuity planning in the face of the impending pandemic. It includes the following six steps:

1. Raise Awareness
2. Develop a Plan
3. Establish Emergency Communication Methods
4. Enable Remote Work Capabilities
5. Account for Value Chain Disruptions
6. Appoint a Plan Coordinator and Deputies

STEP 1: Raise Awareness
First we must convince the rest of the senior management team that the pandemic threat is real and worthy of their concern. This can best be done through a deliberate awareness program that includes briefings, seminar attendance and inclusion of the topic in the organization's ongoing risk management agenda. Once a clear and present danger is acknowledged, the management team will want to ensure that a comprehensive business continuity plan is developed to address it.

But raising awareness does not stop there. Once your business continuity plan is completed and ready for publication, attention should be turned to educating the entire work force on the avian flu threat, and the steps your agency is taking to prepare for it. The project team that developed the plan should participate in this awareness-raising phase, and use all the corporate communication devices at its disposal -- newsletters, e-mail, bulletin boards and town hall meetings -- to provide ongoing status updates and progress reports on the organization's preparation activities.

STEP 2: Develop a Plan
Your agency's plan must be tailored specifically to its operation and circumstances. However, all business continuity plans must address the management of spontaneous disruptions to normal business activities, and should articulate procedures for business slowdown and startup through a pandemic occurrence.

As a public CIO, it is wise to encourage the establishment of a cross-agency or cross-department working group to develop the plan so that all related areas are properly represented and accounted for.

For planning purposes, government agencies should expect 50 percent absenteeism. Each plan should call for implementing an agencywide essential skills identification project, and determining the necessary cross-training and education required to ensure minimal operational disruption. Plans should also define and fully document alternate workflows and business procedures to be implemented in the event of an outbreak.

Because this plan will be referenced frequently during an emergency situation, it should be very accessible and easy to use. A comprehensive table of contents, indexes and chapter tabs can go a long way in helping readers find pertinent information. A conversational writing style, bulleted lists and summary sections can make your document more comprehensible.

STEP 3: Establish Emergency Communication Methods
Once the business continuity plan is in place, emergency communications methods that will be needed during a pandemic can be established. The communication mechanisms must account for two-way correspondence among staff, the public and other key stakeholders.

Intranet and Web-based solutions can form the basis of the communications strategy. However, alternate communication mechanisms should also be included because of the potential for failure -- human or otherwise.

With that said, it is important that essential contacts and relationships established with related local, state and federal government agencies, and local media outlets. These may provide important information in the case of an emergency and convey communication to your stakeholder community.

STEP 4: Enable Remote Work Capabilities
With communications accounted for, government agencies should then focus on enabling a mobile work force that can work from home or move to other selected "safe" locations in the event of an outbreak.

Certainly the financial investment in this capability may be more than some governments are willing to make. However, an economic case can usually be made that telecommuting provides other efficiencies that will pay dividends over time. Such capabilities can improve agency management, lead to more effective execution and position the agency for leveraging a more flexible work force. Regardless, without the implementation of remote work capabilities, failure may result during a pandemic.

STEP 5: Account for Value Chain Disruptions
Supply shortages, distribution difficulties and other challenges will likely abound during a pandemic. Authorities may limit or ban travel altogether. Agencies are well advised to create contingencies to address these possibilities.

Some options may include stockpiling essential materials, procuring provisional staff to service local areas, building customer self-service capabilities, and securing temporary processing hubs to extend agency reach and improve execution capabilities. Any steps that can be taken ahead of time to minimize value chain disruptions may separate the "winners" from the "losers" in a pandemic.

STEP 6: Appoint a Plan Coordinator and Deputies
The plan coordinator oversees the execution of the business continuity plan in the event of an outbreak. This individual and his or her deputies must provide the leadership needed during times of trouble.

Acting as a media point, the coordinator directs communication and ensures the government entity is kept abreast of any pandemic-related developments. Further, the coordinator administers the implementation of emergency procedures and policies to be used during a pandemic -- supervising workflow changes, managing staff reassignments and enacting fallback measures.

Because of the uncertainty of who will fall ill, it is essential that an emergency chain of command for the agency be established and publicized before an outbreak so that personnel understand who is in control at all times. The plan coordinator will be charged with working with senior leadership throughout the pandemic.

Avoiding Sickbay
No one can say for sure when a pandemic outbreak will occur. The experts predict that we are due. If followed, the steps outlined above will help your agency establish a business continuity management culture and a level of skill within the enterprise that will be essential in the management of any real crisis.

Remember, as senior IT executives who are often responsible for business continuity planning and disaster recovery, it is our obligation to our agency's staff and the public they serve to prepare and plan for the inevitable. It is our obligation to develop a business continuity plan in the age of a looming flu pandemic.
James M. Kerr Contributing Writer