What Should Business Continuity Professionals Do In Response to the Coronavirus?

As of February 5, 2020, there have been over 20,000 cases of the coronavirus reported and over 400 deaths.1 The global response to this disease has been swift:

Outside of the health and safety implications of this disease, several of our clients have expressed concern over the business impacts that this disease is causing (and could begin to cause) for their organizations.

So what can you do?

As business continuity professionals, there are four main things that you can do to prepare your organization for the potential impacts caused as a result of the coronavirus:

  1. Talk to your organization’s leadership about the situation
  2. Assess your dependence on China 
  3. Review and update plan documentation
  4. Socialize precautionary and business continuity-related strategies and procedures


It can be hard to have a conversation related to business practices when an incident threatens to affect the health and wellbeing of so many people. Common hesitations include coming off as crass and focusing on an issue that is not currently present. However, if your organization uses Chinese-based employees or suppliers or is dependent on global supply chains and the movement of people, it is critical to have this conversation.

During this discussion, you should focus on:

  1. Preemptively preparing your organization: Consider instituting a work from home policy, if applicable, and procuring masks and extra sanitation supplies.
  2. Reviewing current business continuity strategies: Present leadership with the current strategies that are documented for responding to people and travel incidents. If there are gaps within your strategies, be upfront about them and discuss how the organization should address these. During this conversation, key products and services should be reviewed and validated to ensure that documented priorities are accurate.
  3. Identifying an individual or team to track potential impacts to the organization: Determine who should monitor the situation and notify executives of potential impacts. Additionally, consider defining triggers for taking various levels of action to prevent the organization from harm. These are normally based on reported or confirmed cases involving employees or their families.
  4. Determining past and future travel arrangements: The organization should consider creating a list of locations that employees should not travel to while this disease is still prevalent. Additionally, a list should be comprised of any individuals who have traveled to impacted areas. For these individuals, the organization should determine if they can work remotely or if they should receive a medical exam.
  5. Gaining buy-in to refresh and socialize plans: Work with leadership to gain any necessary approval to work with business units to update and improve plans and strategies. Determine if leadership should help communicate the importance of these updates prior to initiating refresh efforts.


It is important to work with your organization to determine areas with the highest risk of interruption due to the coronavirus. Major considerations include the risk of your suppliers (and their suppliers), personnel, customers, and supply chain systems being impacted. For each of these areas you should:

  • Identify Current and Future Impacts: Consider how the previously mentioned stakeholders and systems are being impacted and where likely disruptions may occur in the future. These disruptions may be a direct result of the disease or as a result of government-imposed policies and regulations. Of note, the World Health Organization is tracking high-risk and affected areas, here.
  • Communicate Impacts: After the current and potential threat of the disease is determined, the organization should draft communications regarding the impacts. These communications should be streamlined and approved by Human Resources and Legal. Messaging may contain information on how the organization has been impacted and what it is doing to respond effectively. Additionally, the designated team or individual that was identified with leadership should continue to track the spread and impacts of the coronavirus until the threat of the disease is mitigated.

The following section will discuss how to update your plans and strategies as a result of dependencies being identified as “at risk.”


If it has been a while since your organization’s plans have been refreshed or if you are being impacted by the coronavirus, you should request that each business continuity team reviews its plan. Key areas that teams should review include:

  1. Team Members: Update roles and responsibilities to reflect the current recovery team. Minimum staffing numbers should be included for each role. If alternate team members are not in place, be sure to document these individuals.
  2. Strategies and Procedures: If the documented systems, vendors, personnel, or facilities have changed, the associated strategies and recovery procedures should be updated. Recovery procedures should be reviewed to ensure that they reflect how the team would recover from an incident.

Strategies and procedures related to single points of failure (especially employees and suppliers) should especially be reviewed. The organization should determine if there are any employees or contractors that do not have alternates identified. If so, the organization should determine what precautions can be taken to ensure that its operations can continue if these individuals or organizations are impacted. For employee single points of failure, you may consider cross-training employees, instructing individuals to work remotely, identifying if there are alternate locations with a lower threat level for individuals to work from, or identifying a third-party that could provide support on an as-needed basis. For supplier single points of failure, you may consider identifying an alternate vendor or procuring a safety stock (if applicable) of needed products.

The organization should also determine who is able to work from home and whether additional individuals should be added to this list. Additionally, phone and network connection, along with remote access, should be tested and validated by the IT organization.

From a communication perspective, the Crisis Management Team should determine when communications should be sent to different stakeholders. For customers, the CMT should determine if updates on facility closures should be sent and if meetings should be canceled or rescheduled. For employees, an email or FAQ section on the company website may be beneficial (more on this to come). Additionally, the organization should test its mass notification system to ensure that employees can be quickly updated on urgent notifications.


After policies, strategies, and plans have been reviewed and updated, you should socialize these details and decisions with all employees. Key focuses should include:

  1. Safety is the Number One Priority: Provide instructions on how individuals can prevent the spread of disease, along with any new policies or precautionary measures that the organization has taken.
  2. Business Continuity-Related Expectations: Inform employees about the organization’s business continuity program and recovery strategies. Be sure to focus on the role employees play in sustaining operations.

The coronavirus has already impacted thousands of organizations around the globe. It’s during these times that business continuity planning is most important. We encourage all organizations to review their program structure, strategies, and plans and to take precautionary steps to mitigate the impacts related to this disease.

If you have any questions or need hands-on assistance with preparing to respond to the coronavirus, please book a meeting with our team. We are here to help.

Ready for some hands-on help? Let’s discuss how to best achieve your resilience goals.