By Ann Wyganowski, CBCP, CBRM, MBCI

Will I get my paycheque? How well prepared is my payroll team?

Paying employees, pensioners and contractors is a high priority in the development of any business continuity plan, as part of the business impact analysis phase. Without a paycheque, employees may refuse to work, and without a workforce, the business cannot continue. In addition, the supporting human resources may question the ability of their employer to continue to pay them in the future, further undermining their confidence in organization.

Loss of any key business area (facilities, information technology, people, and business processes including supply chain) in the activation of a holistic continuity plan can have significant negative repercussions. Not fully assessing the risks associated with such losses and addressing possible recourse is a major plan weakness.

In the spring of 2009, a pandemic suddenly moved from risk to reality when the threat of the influenza A (H1N1) became immediate and very real. Many organizations had not previously considered the development of a business continuity plan a priority when they suddenly had to ensure that this new risk was properly addressed. However, many of them had also never developed in-house expertise to develop a continuity plan or the associated pandemic plan.

A pandemic plan is a subset of a business continuity plan and part of a business continuity management program. Without proper business continuity management programs in place, many organizations scrambled to develop pandemic plans, including continuity plans for payroll operations. Human Resources departments were directed to take charge of an area in which they had little expertise other than routine health and safety practices.

For those tasked with development of a pandemic plan, confusion reigned. What was needed to prepare a pandemic plan that was sufficient to “deliver to the Board” without taking on the larger task of implementing a business continuity management program? Would the pandemic plan work without the other supporting pieces and parts?

Preparing Your Organization

In November 2009, the Canadian Payroll Association (CPA) held a well-attended web seminar on pandemic planning for its members. The seminar explored the importance and necessity of business continuity and pandemic planning, as well as best practices among payroll practitioners and organizations. The goal was to help attendees be better prepared if the H1N1 pandemic becomes worse or employee absenteeism impacts their ability to deliver a timely and accurate payroll. Over 700 people attended the seminar.

As part of the web seminar, the CPA conducted a survey to assess pandemic readiness among participants. The following results are revealing, illustrating the state of readiness of most organizations as a whole, as well as in a business process sector such as payroll, which is considered critical.

Does your organization currently have a corporate-wide business continuity management program to ensure plans are developed and kept current?

Yes: 41%

No: 40%

Do not know: 19%

The majority (59 percent) of survey respondents say either their organization does not have a business continuity program or they do not know.

Does your organization currently have a specific payroll continuity plan?

Yes: 40%

No: 49%

Do not know: 11%

More telling is that the only 40 percent of respondents are confident that their organizations have a business continuity plan for payroll, despite it being a mission-critical function in all organizations.

Has your organization developed specific measure for pandemic planning or major loss of human resources?

Yes: 37%

No: 42%

Do not know: 19%

Not applicable: 2%

Only 37 percent of respondents indicate that they are certain that a pandemic plan is in place and that it deals with a major loss of human resources in the workplace. Particularly in light of the H1N1 pandemic, continuity planning is a pressing issue that organizations should address.

Which of the following does your payroll continuity plan and/or pandemic planning measures address? (Check all that apply.)

Business processes that produce services or products: 122
Personnel: 135
Physical facilities: 91
Information technology: 109
Outsourced providers or suppliers: 61

The good news is that of those organizations with plans, most indicate that it is a comprehensive plan, addressing many interdependent functions as well as outsourced providers and suppliers.

Information technology is a particularly significant area for risk assessment. With the immense amount of automation in financial processes and procedures, the process required to enact a full recovery and validate information should be explored in depth.

If you use an off-site payroll provider, are you aware of their payroll continuity plan and/or pandemic planning measures?

Yes: 16%

No: 60%

Do not know: 24%

Transfer of risk is often a strategy employed by many industries and governments. In the payroll process, this normally involves transferring part of the process to an outside vendor, such as time and attendance management, benefit deductions and calculations, production of deposit slips, and gross-to-net calculations.

A staggering 60 percent of respondents state their outsourced providers or suppliers do not have a business continuity plan or pandemic planning measures in place. Only 16 percent are aware of their providers’ plans and can be confident that they will be able to deliver a timely and accurate payroll in the event of a pandemic.

Does this mean the majority of organizations are not transferring risk responsibly or are burying their heads in the sand? This lack of communications between organizations and their payroll providers represents a huge gap in many business continuity plans.

Have you had to utilize your payroll continuity plan and/or pandemic planning measures?

Yes: 6%

No: 56%

Do not know: 7%

Do not have a plan or in the process of developing one: 31%

When asked whether they have used their payroll plan or pandemic plan, only 6 percent indicate yes. Over a quarter (31 percent) say they do not have a plan or are still in the planning process. This lack of planning indicates the low priority some organizations are placing on business continuity process; they risk being caught unprepared.

Current business continuity management thinking is that pandemic plans should be activated commensurate with the level of impact and risk to the organization, rather than based on World Health Organization (WHO) alert levels. For the 56 percent who have not implemented their plans, are they relying on the WHO for the signal? If so, is it a good decision to associate their plans with another organization or should they be defining internal risk monitoring and management triggers instead?

Did you provide any information sessions for employees with respect to H1N1/pandemic planning?

Yes: 39%

No: 42%

No, but there is a plan to do so: 12%

Do not know: 7%

Communications is a fundamental portion of any comprehensive pandemic plan, and once again, the results are a bit alarming. Well into our second wave of the H1N1 pandemic, only 39 percent of respondents have held employee information sessions; 12 percent are still planning to do so. This lack of communication does not help inspire employee confidence in corporate leadership.

Planning for Future

Taking a step back, there is still much work to be done in developing continuity plans for the payroll process. A cookie-cutter approach is not effective, as every organization has its own way of doing business and managing risk. Payroll continuity plans, like corporate-wide business continuity plans, can be quite different depending upon process design. A standard template will not really give you an effective plan.

Business continuity management is an ongoing process, and it is seldom a high priority until it is too late. Day-to-day activities and demands eclipse the need to effectively manage risk and do a good job on those quality management areas like business continuity planning.

However, many unexpected events, such as infectious diseases, forest fires, floods, criminal activity and power outages, can impact payroll and other business processes. Organizations must be prepared if they intend to prosper.

So take business continuity planning off the bottom of your to-do list and start the process today!

Ann Wyganowski is a Master Business Continuity Professional (MBCP), and Certified Business Resilience Manager (CBRM) and Member of the Business Continuity Institute (MBCI), all of which are internationally recognized designations in the field. Ann sits on various emergency management and business continuity boards as a volunteer and is the Treasurer of the Disaster Recovery Institute Canada. She is a recognized senior consultant in the industry with a prosperous consulting practice. You can contact her at ann@bcphelp.com or visit bcphelp.com.