Business Continuity Plans (“BCPs”) and Disaster Recovery Plans (“DRPs”), which are nearly universal in today’s business environment, face an extraordinary test from COVID-19’s dramatic impact on all aspects of daily life and the economy. Most, if not all, BCPs and DRPs have proven inadequate. Nearly all businesses are discovering numerous gaps that pose varying degrees of risk in plans that are simply not designed to cope with such broad and deep social and economic disruptions. Moreover, these gaps are emerging as businesses themselves face mounting financial pressures.

Understandably, there is a strong temptation for businesses to focus on mitigating current crises and managing day-to-day affairs. With resources already strained, it may seem prudent to leave tomorrow’s problems for tomorrow. But now is in fact the best time to take advantage of lessons learned from the current crisis in order to optimize your firm’s recovery and make changes to existing plans that will save time and money when the next crisis comes.

What should your firm be doing now?

• Ensure implementation of existing plans and monitor compliance effectiveness.—Have communication plans been effective from the start? Are leaders leading? Are plan deficiencies being escalated promptly to key decision-makers?

• Prioritize gap remediation by severity of risk.—What changes need to happen today, and who decides?

• Response teams must track and document event details.—Did teams “pivot from plan” during the crisis when it was deemed necessary to do so? Were these pivots made with input from appropriate decision-makers so that changes could be coordinated across the business? Were pivot results better than Plan?

• Initiate readiness for After Action Analysis (“AAA”) by tasking particular members of dedicated response team with responsibility for documenting all Plan successes and failures in sufficient detail to support further review, including the who, what, where, when, why, and how.

• Ensure that such documentation and any supporting evidence are maintained in secure, stable environments.

• Require real-time risk assessment of Plan successes and failures so that review and analysis can be prioritized appropriately.

• As soon as practicable, establish the AAA team to organize event data and realistically assess the Plan’s effectiveness as informed by their review.

• Revise the Plan to capitalize on successes, enhance effectiveness, and reduce risks.

Charting out how your business will move from its current Plan through gap status to the Plan’s future state should begin now, while the urgency of the moment can help drive the critical changes needed to ensure that your business is optimally prepared to face the next crisis.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact us at 201-896-4100.