Tag Archives: business continuity

Pandemic Planning

By Ann Wyganowski, CBCP, CBRM, MBCI

Will I get my paycheque? How well prepared is my payroll team?

Paying employees, pensioners and contractors is a high priority in the development of any business continuity plan, as part of the business impact analysis phase. Without a paycheque, employees may refuse to work, and without a workforce, the business cannot continue. In addition, the supporting human resources may question the ability of their employer to continue to pay them in the future, further undermining their confidence in organization.

Loss of any key business area (facilities, information technology, people, and business processes including supply chain) in the activation of a holistic continuity plan can have significant negative repercussions. Not fully assessing the risks associated with such losses and addressing possible recourse is a major plan weakness.

In the spring of 2009, a pandemic suddenly moved from risk to reality when the threat of the influenza A (H1N1) became immediate and very real. Many organizations had not previously considered the development of a business continuity plan a priority when they suddenly had to ensure that this new risk was properly addressed. However, many of them had also never developed in-house expertise to develop a continuity plan or the associated pandemic plan.

A pandemic plan is a subset of a business continuity plan and part of a business continuity management program. Without proper business continuity management programs in place, many organizations scrambled to develop pandemic plans, including continuity plans for payroll operations. Human Resources departments were directed to take charge of an area in which they had little expertise other than routine health and safety practices.

For those tasked with development of a pandemic plan, confusion reigned. What was needed to prepare a pandemic plan that was sufficient to “deliver to the Board” without taking on the larger task of implementing a business continuity management program? Would the pandemic plan work without the other supporting pieces and parts?

Preparing Your Organization

In November 2009, the Canadian Payroll Association (CPA) held a well-attended web seminar on pandemic planning for its members. The seminar explored the importance and necessity of business continuity and pandemic planning, as well as best practices among payroll practitioners and organizations. The goal was to help attendees be better prepared if the H1N1 pandemic becomes worse or employee absenteeism impacts their ability to deliver a timely and accurate payroll. Over 700 people attended the seminar.

As part of the web seminar, the CPA conducted a survey to assess pandemic readiness among participants. The following results are revealing, illustrating the state of readiness of most organizations as a whole, as well as in a business process sector such as payroll, which is considered critical.

Does your organization currently have a corporate-wide business continuity management program to ensure plans are developed and kept current?

Yes: 41%

No: 40%

Do not know: 19%

The majority (59 percent) of survey respondents say either their organization does not have a business continuity program or they do not know.

Pandemic 2

Does your organization currently have a specific payroll continuity plan?

Yes: 40%

No: 49%

Do not know: 11%

More telling is that the only 40 percent of respondents are confident that their organizations have a business continuity plan for payroll, despite it being a mission-critical function in all organizations.

Pandemic 4

Has your organization developed specific measure for pandemic planning or major loss of human resources?

Yes: 37%

No: 42%

Do not know: 19%

Not applicable: 2%

Only 37 percent of respondents indicate that they are certain that a pandemic plan is in place and that it deals with a major loss of human resources in the workplace. Particularly in light of the H1N1 pandemic, continuity planning is a pressing issue that organizations should address.

Pandemic 6

Which of the following does your payroll continuity plan and/or pandemic planning measures address? (Check all that apply.)

Business processes that produce services or products: 122
Personnel: 135
Physical facilities: 91
Information technology: 109
Outsourced providers or suppliers: 61

The good news is that of those organizations with plans, most indicate that it is a comprehensive plan, addressing many interdependent functions as well as outsourced providers and suppliers.

Information technology is a particularly significant area for risk assessment. With the immense amount of automation in financial processes and procedures, the process required to enact a full recovery and validate information should be explored in depth.

Pandemic 7

If you use an off-site payroll provider, are you aware of their payroll continuity plan and/or pandemic planning measures?

Yes: 16%

No: 60%

Do not know: 24%

Transfer of risk is often a strategy employed by many industries and governments. In the payroll process, this normally involves transferring part of the process to an outside vendor, such as time and attendance management, benefit deductions and calculations, production of deposit slips, and gross-to-net calculations.

A staggering 60 percent of respondents state their outsourced providers or suppliers do not have a business continuity plan or pandemic planning measures in place. Only 16 percent are aware of their providers’ plans and can be confident that they will be able to deliver a timely and accurate payroll in the event of a pandemic.

Does this mean the majority of organizations are not transferring risk responsibly or are burying their heads in the sand? This lack of communications between organizations and their payroll providers represents a huge gap in many business continuity plans.

Have you had to utilize your payroll continuity plan and/or pandemic planning measures?

Yes: 6%

No: 56%

Do not know: 7%

Do not have a plan or in the process of developing one: 31%

When asked whether they have used their payroll plan or pandemic plan, only 6 percent indicate yes. Over a quarter (31 percent) say they do not have a plan or are still in the planning process. This lack of planning indicates the low priority some organizations are placing on business continuity process; they risk being caught unprepared.

Current business continuity management thinking is that pandemic plans should be activated commensurate with the level of impact and risk to the organization, rather than based on World Health Organization (WHO) alert levels. For the 56 percent who have not implemented their plans, are they relying on the WHO for the signal? If so, is it a good decision to associate their plans with another organization or should they be defining internal risk monitoring and management triggers instead?

Did you provide any information sessions for employees with respect to H1N1/pandemic planning?

Yes: 39%

No: 42%

No, but there is a plan to do so: 12%

Do not know: 7%

Communications is a fundamental portion of any comprehensive pandemic plan, and once again, the results are a bit alarming. Well into our second wave of the H1N1 pandemic, only 39 percent of respondents have held employee information sessions; 12 percent are still planning to do so. This lack of communication does not help inspire employee confidence in corporate leadership.

Planning for Future

Taking a step back, there is still much work to be done in developing continuity plans for the payroll process. A cookie-cutter approach is not effective, as every organization has its own way of doing business and managing risk. Payroll continuity plans, like corporate-wide business continuity plans, can be quite different depending upon process design. A standard template will not really give you an effective plan.

Business continuity management is an ongoing process, and it is seldom a high priority until it is too late. Day-to-day activities and demands eclipse the need to effectively manage risk and do a good job on those quality management areas like business continuity planning.

However, many unexpected events, such as infectious diseases, forest fires, floods, criminal activity and power outages, can impact payroll and other business processes. Organizations must be prepared if they intend to prosper.

So take business continuity planning off the bottom of your to-do list and start the process today!

Ann Wyganowski Treasurer Director at Large
Ann Wyganowski is a Master Business Continuity Professional (MBCP), and Certified Business Resilience Manager (CBRM) and Member of the Business Continuity Institute (MBCI), all of which are internationally recognized designations in the field. Ann sits on various emergency management and business continuity boards as a volunteer and is the Treasurer of the Disaster Recovery Institute Canada. She is a recognized senior consultant in the industry with a prosperous consulting practice. You can contact her at ann@bcphelp.com or visit bcphelp.com.

Why use a consultant?

By Ann Wyganowski, CBCP, CBRM, MBCI

A consultant in our unique industry is often faced with many major challenges.  As a person usually versed in the risks and issues understood by the business continuity and emergency management community how do we convince others that those risk might actually be real, prevention measures are in order, and an action plan needs to be in place should they occur.

Key areas that need to be addressed at the start of any contractual obligation however informal include:

  • Support within the customer organization (visible and senior level)
  • Understanding of the project objectives
  • What might constitute a good project plan – how detailed do our goals and deliverables have to be?
  • How well prepared the sponsor is to work across the entire company or organization to assure plan integration and synergy (? A bottom up push?)
  • How the consulting engagement is introduced to all of the participants and what senior level backing it has
  • Clear project scope and timelines

What the consultant needs to consider is also unique to each engagement. Your reputation is at stake. How well positioned are you to succeed and complete the assignment with a happy customer and good reference for future work? If your customer is not willing to support you in the needed areas, the resulting outcome could impact your reputation in the industry.

Key success factors

Many small to medium sized business folks who need to engage a consultant are not quite as familiar with working with an industry expert or “outsider” as those people with the same roles within a large multinational group who might regularly use consultants. How you work together to position the project to succeed may also impact your reputation.

How ready are you to back out of an agreement, or accept you have taken the wrong direction? Contractually how easy is it to say goodbye?

Each customer environment and concerns are very different. A consultant has to be flexible and creative. Typical project activities and templates need to be adapted to the unique environment that you are working in.

Typical areas that need close analysis include the risk assessment / business impact analysis process. Each customer is totally different. How you might prioritize their business can have totally different drivers. This can range from facilities and IT dependencies, to the key human resources and knowledge holders who are essential to business or organization survival.

What makes a consultant different?

Usually a consultant has an objective view point, without an interest in company or organization politics. As an expert, it’s necessary to distance your report from “opinions” and those internal politics.

A consultant must be neutral, but fair. Opinions expressed should reflect a balanced and judicious view, based on industry best practices. This report as a distanced individual reflects on your ability as a professional.

Tact and measure must be the consultant’s constant companion; however the obvious plan faults and shortcomings must be highlighted and prioritized. All key areas that are the customer’s main concern must be addressed in a diplomatic way. These should be identified up front with the customer and a framework for the report outcome defined.

Why use a consultant?

Each customer has its own corporate culture and communications environment. How they will want to craft key messages to push out across their organization may also be quite different from customer to customer. Some will be “high tech” and prefer to communicate in a web based fashion, while others might feel the most effective messaging might be through direct manager communications or hard copy desk drops.

Can you make business continuity tools and template repeatable? Can a consultant come in and just implement their existing tools and templates to make it easy for us?

There are some degrees that approach and methodology can be deployed in multiple environments. However, that must be tempered with the fact that every environment, organization, business and group of people is totally unique.

Consultants can use an existing framework that they may have successfully deployed in the past to facilitate your BCP implementation. However, the unique set of priorities considered by one organization may not fit the next group the consultant works with.

The consultant may have a cross business viewpoint which can help their customer understand how to model their business impact analysis and process prioritization; however BCP is not a “one size fits all” exercise.

No typical workgroup has that cross functional view, or breadth of experience. That is where a consultant can provide some deep understanding of what is going on across the industry or country.

In summary,

I’m a consultant and I love the variety, the challenge or working across many customers, the variety of customer environments and the need to analyze how BCP can best become a competitive advantage to support their team. In selecting a consultant, I hope that presenting the various dilemmas faced by the contractor and the consultant will help all to work together more cohesively.


Ann Wyganowski Treasurer Director at LargeAnn Wyganowski is a Master Business Continuity Professional (MBCP), and Certified Business Resilience Manager (CBRM) and Member of the Business Continuity Institute (MBCI), all of which are internationally recognized designations in the field. Ann sits on various emergency management and business continuity boards as a volunteer and is the Treasurer of the Disaster Recovery Institute Canada. She is a recognized senior consultant in the industry with a prosperous consulting practice. You can contact her at ann@bcphelp.com or visit bcphelp.com.