The COVID-19 pandemic continues to raise the awareness regarding the need for effective business continuity planning. The challenges that nonprofit managers have faced during the past few months exemplifies the need to integrate business continuity efforts into an enterprise risk management program.
Research from organizations such as Disaster Recovery Institute International (DRII) and Business Continuity Institute (BCI) indicate that organizations where robust business continuity plans are in place recover faster and more efficiently as leadership manages through an incident. This level of preparedness, for some organizations, is the difference between survival and permanently closing their doors.
Statistics paint a grim picture. According to the Federal Emergency Management Agency (FEMA), between 40 percent and 60 percent of small businesses, a category in which many nonprofits fall, that have not put proper planning in place fail within three years after a major disaster, and some never reopen.
The good news is that because of the skillsets of their senior leadership team and with the help of the board, steps have been taken to implement some level of business continuity planning at nonprofits. The lessons learned from COVID-19 will result in more comprehensive recovery planning, including evaluating strategies and assumptions made about all facets of the organization — people; business process, including reliance of business partners; and, technology. In doing so, you will be able to enhance your capabilities and work toward promoting the positive value of business continuity across your organization for the future.
The goal of an effective business continuity program is to promote a state of resiliency across the organization. For clarity, International Standard Organization (ISO 22316) defines organizational or business resiliency as “the ability to absorb and adapt in a changing environment to enable an organization to deliver its objectives and to survive and prosper.” This needs to be done, of course, with the goal of safeguarding people and assets.
The Challenges and Lessons From COVID-19
Business continuity planning is based upon projecting for the most likely threats and risks. For many, pandemic threats have not been considered because the likelihood was deemed relatively low. The considerations that must be made for pandemic-related disruptions are distinct from those typically considered as part of traditional business continuity planning. Further, many organizations focus their business continuity efforts on technology recovery to ensure system availability after an outage. COVID-19 highlights the need for a synthesis among workforce, business process continuation and technology.
Let’s review some considerations specific to pandemic planning and how your organization can adapt. According to the Centers for Disease Control and Prevention (CDC), a second wave of COVID-19 is likely to occur in the fall, which should prompt nonprofit leaders to address the following areas.
A pandemic has systemic impacts because of the regional, national and global impact to your people, process and technology. It is not just happening to you and your organization. It is a widespread event. Many nonprofits have been challenged by this because existing business continuity plans either focused entirely on a system outage and the strategies for technical recovery or on a scenario that was limited to a “localized event,” such as the unavailability of the building for a short period of time.
Going forward, business continuity planning should be based upon risk assessment of the most likely worst-case threats that might impact your organization, which will now include pandemic planning. This includes not only technology, but unavailability of people and the inability to continue business processes either due to lack of people, dependencies on third-party systems or manual processes that could not be completed because of remote work arrangements.
Nonprofit managers should perform a “COVID-19 postmortem evaluation” to understand what capabilities were in place, determine which assumptions were valid and the appropriateness of the recovery strategy, if one was defined. They should also consider what decisions and strategies were considered to respond to events as they were unfolding and their success. For example, before COVID-19, many managers would not have considered that a remote workforce could remain productive and collaborative. This new work model might not only have positive ramifications for planning purposes, some managers might now consider this work environment model to reduce operational costs and expenses.
A nonprofit’s greatest asset is its workforce. Managers had the challenge of addressing a reduction in staffing while maintaining daily operations. Decisions were required and many times revisited based upon the daily events related to COVID-19. This included updating policies related to paid time off (PTO), medical and family leave, as well as flexible schedules that some employees requested because of family obligations.
The need for effective crisis management across the organization is essential. It is necessary to involve representatives from Human Resources, Legal, Compliance, Finance and other key stakeholders so that standard policies and procedures to address the issues above can be defined and communicated to all the workforce. Given the fluidity of COVID-19, these policies will need to be revisited continually and should become part of standard operating procedures.
Managers will also need to consider how to invest in the cross-training of staff. COVID-19 highlighted gaps due to the unavailability of people, either because of illness or family obligations. Succession planning is necessary for critical business functions. Managers need to anticipate that a key team member might not be available and have someone properly trained to do the work so that operations can continue.
The final consideration related to this is technology. Many nonprofits are using internally supported systems or staff is doing tasks manually. Due to the geographic disparity, combined with unavailability of people, managers should consider migrating to cloud-based systems with automated workflows.
Traditional business continuity plans are developed based upon scenarios that assume a defined duration for a disruption. With an event like COVID-19, managers cannot forecast how long this might continue. While certain states are beginning to lift “stay at home orders,” there still is inconsistency in timing and how “non-essential” businesses will be transitioned back into the business ecosystem.
It is never too early to begin planning and considering the strategies for how your organization will return to work. Because of the ongoing concerns relative to the COVID-19 virus, the workplace is going to look quite different. Leaders need to consider how to promote the wellbeing of their employees as well as strategies for how to stagger the return of the workforce for critical process teams.
Considerations will need to be made for how offices will be configured to maintain proper social distancing. What will be the method for distribution of personal protective equipment (PPE) and the guidelines for PPE? What policies will be in place for screening and tracking health, especially if employees are presenting symptoms of illness? What employee assistance programs, including mental health offerings, will be in place?
The premise of business continuity is planning based upon the most critical aspects to operations. In the nonprofit world, grants, donations and fundraising are the “bread and butter” when it comes to revenue sources. The ability to maintain services to people who rely on them most is also critical from a health, safety and well-being perspective.
Providing a safe and secure work environment for employees is paramount. Lastly, the timing around any fiduciary and regulatory requirements needs to be considered. These areas should be the catalyst for decisions as to the level of spend to promote resiliency.
There is a silver lining to this for many nonprofits. The work already done around business continuity planning and adapting the lessons learned from COVID-19 will enable you to further mature your capabilities for responding to a business disruption. Realizing that operational expenditures will be scrutinized even more, there might be concern that effective business continuity will be cost-prohibitive. These efforts do not have to break the bank.
Planning for and addressing the most critical aspects to your nonprofit will enable you to make smart and cost-effective strategy decisions, which might include contracts, business arrangements and technology needs. If those areas are addressed beforehand, it will help minimize costs because you will not have to compete with other organizations also trying to get a product or service, resulting in peak demands and increased costs. This is not to discount other areas within the organization; however, when a nonprofit is dealing with an event that impacts its operations, it is not “business as usual.” The spend to promote resiliency for the organization is predicated on operational criticality.
It is essential that your employee base is aware of what your organization is doing to stay operational. They need to understand that decisions have been made and strategies are in place. They need to have continuous communications on how business will continue even in the toughest of times. Communications need to set the right tone from leadership and dispel ambiguity, while setting clear expectations.
Nonprofit managers have been faced with significant challenges resulting in financial and day-to-day business operation impacts. COVID-19 has highlighted the importance of business continuity to promote a state of resiliency. Heightened awareness will drive questions around the level of preparedness going forward.
As a next step to advance business continuity efforts, nonprofit executives should be assessing how to leverage the lessons learned in managing through COVID-19 to promote a resilient state of the organization that will be able to continue to deliver value to its employees, customers, communities and other key stakeholders.
Melissa Ouari, CISA, CBCP, is senior manager, technology services, at Marks Paneth. Her email is firstname.lastname@example.org
As we celebrate our 36th year, NPT remains dedicated to supplying breaking news, in-depth reporting, and special issue coverage to help nonprofit executives run their organizations more effectively.