Moving to Level 2 in the Jersey Safe Exit Framework: can we embed resilience?

The COVID-19 pandemic demonstrated that no organisation is insulated from disruption in this modern, interconnected world. Risks are entangled, complex supply chains are the norm and events in far off locations have a profound effect.

As the pandemic rolled across the globe, the crisis management plans of companies large and small were initiated in response. Some worked well, some less well. Because it has lasted so long, many plans were stressed far beyond expected tolerance. It has not been a comfortable experience for Business Continuity practitioners, who have had to improvise and adapt to deal with issues as they arose under considerable pressure.

The immediate intensity of crisis response has now passed for many organizations, as thoughts turn to recovery. Although a ‘second wave’ of infection may trigger response plans once again and further test business and operational resilience and readiness for that should be a key part of that roadmap. But what to do now when planning for the ‘new normal’?

1. Establish a dedicated recovery team - plan the return to work

Organizations around the globe will enact multiple return-to-work phases, as restrictions are gradually lifted. This will impact both the capacity and the type of work that can be carried out.

As Jersey moves to Level 2 of the Safe Exit Framework, the GoJ has stated that businesses should plan to reduce the risk of spreading the virus during the course of operating and conduct a risk assessment as part of a return to work plan. Level 2 envisages a careful increase in business activity in the workplace and an increase of the number of employees beyond the number considered essential to business functioning, as was required in Level 3.

Working from home wherever possible remains the default operating model, but increased business activity in workplaces is now possible, within strict guidelines. Any prior risk assessments undertaken as part of Level 3 must be updated. The GoJ guidance states that this written plan and risk assessment must be “bespoke to your work environment, practices and services that you provide” and shared with staff. A record of the risk assessment and plan should be available for inspection by the relevant authorities, upon request.

In structuring your recovery team, consider establishing ‘tone-from-the-top’ from senior leadership to communicate the plan and ensuring a joined-up response among cross-functional teams in order to deliver the right outcomes. Everyone, from the top down, should know who is doing what.

Train the people involved in executing the plan to be sure they are moving toward a common purpose. Identify and work through the available guidance, the return to work triggers and the scenarios, with a view to ensuring plans are in place to cover all options. There may be a second wave of infections, will your planning consider the potential impact to your business if that happens? All of the stakeholders need to know there is a recovery plan to address their valid concerns. Reassurance and reference to your organizations' resilience plans will be helpful.

2. Review overall business strategy and enterprise risk assessment

The current situation is unprecedented, and strategy should be revisited in order to meet the current challenges. Strategy set in a pre-COVID-19 environment should be revisited with an additional lens of what actions are now required to succeed through uncertainty. It is very likely that your risk profile and appetite are likely to have changed. For example:

• Can your technology infrastructure continue to support extended remote working, with appropriate safeguards and controls against cyber threats?
• Can you identify and manage new risks and opportunities and recognise how previously existing risks have changed?
• Have you considered the resilience of your third-party vendors and how effective they have been during this period?
• How resilient have your teams been, particularly your crisis response teams who are likely to have been operating at high intensity for an extended period?
• Have lessons learned from the crisis been effectively captured and your existing continuity and crisis response plans updated? Were your people, plans and governance frameworks fit for purpose?
  

3. Embed Resilience as an organizational core competency

This too shall pass.... At some point in the future the pandemic will be behind us. What will we learn from it ? Resilience is a quality within organizations which allows them to manage crises and disruption to operations, resist sudden shocks and adapt to changes. It is a positive attribute to foster and develop. There are activities that can be undertaken now that will result in resilience becoming embedded as a real-life capability rather than an unfamiliar concept associated with stress and only seen during a crisis.

Ask yourself, is your organisational culture receptive to embedding resilience into everyday practice? And if not, why not?