Do not fret if your organization was not completely prepared for COVID-19. Many weren’t and it’s not too late to implement good planning for immediate needs and for the future. The analysis of preparation and response to any crisis, such as a health epidemic, includes two primary, yet parallel, tracks: (1) internal planning, and (2) external planning.
Much of the discussion surrounding the spread of the COVID-19 virus has to do with the internal planning and preparedness of organizations and the primary obligation of protection of employees. Less, however, has been mentioned in news reports and journals about the external planning for a crisis once it occurs and an organization’s role in protecting itself, including its actions towards clients, customers, vendors, partners, service partners and stakeholders.
The board of directors of any organization (or managers or members in the case of an LLC) have statutory duties owed to its shareholders, members and constituents that are well-defined in state laws and cases that have been reported over the years. After every crisis, however, the company and its leadership is evaluated as to how it dealt with the crisis and, where possible, mitigated its effects. Preparedness for a crisis is key for board members and senior leadership of organizations. Yet, effectively managing a crisis and planning for its effects is also important.
A few practical steps should be taken as part of an organization’s business continuity planning:
- Identify Potential Risks. An exhaustive list of every possible malady known to humankind is not necessary to encompass the spectrum of risks to an organization. Rather, risks, in any form, that impact an organization’s ability to conduct business on a regular basis, even with interruption, should be considered as a likely risk that requires planning. As part of that analysis, determine if there are risks particular to the organization’s industry, geography or demographic that would have broad impact (e.g. a prolonged power outage or an epidemic) or narrow impact (e.g. being on a coastline that has a history of hurricanes).
- Identify the Business Continuity Team. In many cases, senior leadership of an organization will make up the team. However, in times of a crisis that occurs quickly, a direct channel to the board of directors as well as a cross-section of constituents within an organization and outside advisors should be identified to keep communication channels clear about assessing evolving risks, initiating the Business Continuity Plan to address those risks, controlling external messaging, measuring the impacts of external messaging, and assessing the effectiveness of the plan. The Business Continuity Team will have the additional responsibility for taking point on internal and external communications, including having a spokesperson who speaks on behalf of the company.
- Form a Business Continuity Plan. The Business Continuity Team should be tasked with updating and evaluating, in real time, a high-level Business Continuity Plan that can be summarized in a page or less, which includes the primary Business Continuity Team contacts and action items in the event of a crisis that develops quickly. The comprehensive plan should be developed to include robust planning regarding key aspects of the business, including, but not limited to:
- Departmental planning
- Critical systems
- Stakeholder impact
- Fulfillment
- Finance
- Legal
- Supply chain and customer impacts
- Contingency planning
- Escalation in the event of a prolonged or heightening crisis
For public companies, the duty to inform shareholders will take shape in the form of press releases and regular and periodic filings with the SEC, including action items by the company to address risk and the impact to shareholders. Because much of what the company does is in the public view, close attention to what is messaged and when should be addressed carefully with the company’s outside legal counsel.
For private companies, while not subject to the same reporting requirements of public companies, they have many of the same aspects of communicating decisions to their stakeholders. This is especially true for companies that have a substantial impact in specialized markets or smaller communities or those that provide critical products and services to the public.
Whether the company is private or public, fiduciary duties of the board still apply and those duties are most scrutinized during a time of crisis and almost always through the lens of hindsight. The board should have an active role in giving insight and requiring accountability on Business Continuity Planning. Accordingly, executives and senior management should expect their boards to have an active role and should rely on the board to give the guidance, feedback and accountability.
In a crisis, the prospect of needing to improvise along the way is necessary. This is why having the right team reviewing, updating, amending and testing the plan on a regular basis is necessary.
