From disaster to recovery – optimizing the return to full operations From disaster to recovery – optimizing the return to full operations From disaster to recovery – optimizing the return to full operations

The COVID-19 outbreak has, to many organizations globally, been a full-scale test of business continuity and disaster recovery preparedness. But even though the current crisis is far from over, how can you begin now to optimize your return to normal operations post-corona? And also, how can you ensure a more resilient business in the future? 

The coronavirus pandemic has affected the world in ways very few could have imagined or anticipated. When talking with clients and reading various studies it’s clear that only a minority of businesses were prepared for the impact of a large-scale pandemic. The lack of confidence and preparedness shows us that risk management practices in many organizations are both outdated and ineffective.

This pandemic and its implications will eventually fade. However, the next disruptive large-scale risk scenario to be dealt with is not a matter of “if” but rather of “when”.

So, how can the current situation help companies become more future-proof?

Organizations practicing a proactive and enterprise-wide risk management are better at responding to severe risk scenarios. The better prepared a business is, with robust risk and crisis management practices in place, the more advantages it will have compared to less prepared competitors. It will also be a safer workplace for its employees; as well-prepared organizations are better off in minimizing disruption and are even managing to turn challenges into opportunities.

Below is a short example to demonstrate the difference between Traditional vs. Pandemic Business Continuity Planning (BCP).

Traditional Business Continuity Planning:

• Incident/physical location focused – fire, flood, system outage etc.
• Relocating critical staff to offsite-location either in-country or abroad.
• Critical employees contactable even if not able to re-locate.
• Assumes defined physical area of impact.
• Employee care focused upon HR and stress relief.
• Assumes supply chain available.
• Most BCP are focused upon Disaster Recovery - restoration of business within a short timeframe; not more than 30 days.

Pandemic Business Continuity Planning:

• People focused – How to keep operational if critical staff / significant numbers of staff are unavailable?
• Quarantine rules stopping travel – repatriation of all employees.
• Critical employees may be too ill to communicate.
• Assumes global impact.
• Employee care requirements – isolate, decontaminate and communicate.
• Supply chain under quarantine and deeply impacted.
• Recovery timeframes and length of quarantine, travel bans etc. are unknown.

As we can clearly see, the difference between the two is profound, which makes it even more important to move from traditional risk management and crisis plans to a broader spectrum. Being truly resilient and future-proof requires your organization to prepare for any scenario, including pandemics, and ensure the capacity of individuals, teams and systems to survive, adapt and thrive, no matter what kind of disruptions they experience. 

At this time, we also urge companies to actively try and think ahead. Even though it feels far away, there will come a time for “normal” business, and to optimize that comeback, businesses need a Disaster Recovery Plan on how to best return to full operation. 

Below are a few things to consider:

Returning to standard operations and controls

• Are there permanent operational changes due to COVID-19?
• Do BCP/Pandemic procedures / routines need updating?
• Were there control gaps, and if so which transactions / processes need to be reviewed?
• Additional IT-review for possible malware; ensure all systems updated to latest versions.

Review of activity during COVID-19 incident period

• Was there unusual activity during the period that should be reviewed / evaluated?
• For any new supplier relationships started, review of contracts / terms & conditions?

Identified efficiencies or process improvements

• Are there control or process efficiencies identified due to operational changes?
• Are control or process changes required to enable easier transition in future pandemic events?

The KPMG framework for Enterprise Wide Operational Resilience (EWOR) entails methods and best practices within several areas including e.g. crisis management and business continuity. We can assist you in evaluating existing operations and help you to build for the future.

KPMG can assist your organisation in evaluating the response to the COVID-19 outbreak and even more importantly taking on a proactive approach, by positioning your business to be resilient in the face of future risk events.

Want to know more about risk management, operational resilience and BCP?

Don’t hesitate to contact us:

Karin Wickström Stümer, Director Risk Advisory, karin.wickstrom.stumer@kpmg.se

Jennie Wallin, Enterprise Risk Management Specialist, jennie.wallin@kpmg.se

Jodi Andersson, Operational Risk Specialist, jodi.andersson@kpmg.se

Pontus Winstén, Operational Resilience Specialist, pontus.winsten@kpmg.se