How can organizations make a smooth recovery from a major disruption such as the COVID-19

pandemic?

It has been two months since Metro Manila was placed under community quarantine and we are seeing
at least two more weeks of extended ECQ1, but many areas in the country are already preparing for
their return to normal, or at least what we call the ‘new normal’. This return to normalcy, however,
would not be swift and the IATF1 has released a phased plan which included a modified GCQ1 before the
quarantine protocols could be lifted.

In the same manner, organizations would also benefit from following a documented recovery plan when
returning to pre-disruption condition. Organizations certified to (or at least conforming to the
requirements of) ISO 223012 would know that a documented recovery plan is a requirement of the
standard, the latest version of which was released in October 2019. The clause, however, consists of just
one short sentence basically saying that the organization needs to have documented processes for
returning to normal from whatever measures that were adopted as a result of the disruption. ISO
223133, released in February this year, provides additional guidelines on the creation of a recovery plan.

It would help if the recovery plan is created before the disruption when people can devote adequate
time in an environment that is free from distraction and the unwanted pressures brought about by the
disruptive event. Presumably, the calm environment can help teams come up with sound decisions and
ensure that all relevant people are consulted. Developing a recovery plan from scratch during a
disruption may not be feasible at all as most efforts and resources would most likely be allocated to
addressing the immediate consequences of the disruption whether that be containment, mitigation, or
other actions to reduce the impact of the disruptive event. With the current pandemic, it may be more
difficult to organize a team that will create a recovery plan given the social distancing protocols.
However, virtual conferencing would be the next best alternative, provided that team members are
connected online.

At this point in the COVID-19 pandemic, organizations have already activated their business continuity
plans (I hope!), so the recovery plan’s primary goal is to restore operations from the temporary
measures adopted during the disruption. The temporary measures adopted may have included work-
from-home protocols, transfer to an alternate location, or scale down (or partial, even total stoppage) of
operations.

When returning to normal from highly destructive incidents such as fire, floods or earthquakes,
organizations may first have to repair any damage to their infrastructure. In cases where the business
continuity plan (BCP) included migration to an alternate location, the process of returning and restoring
operations at the primary location will have to be an essential part of the recovery plan. In the extreme
scenario where the primary location would prove to be inaccessible for reasons of safety to employees,
the recovery plan will have to include movement to a new location that may be permanent or at least
capable of housing operations for the long-term.

Hopefully, organizations did not sustain any physical damage during the ECQ. Otherwise, any damage
that could prevent organizations from operating normally will have to be repaired. Some organizations,
however, have converted their facilities into temporary warehouses, or even quarantine areas, during
the lockdown. In this case, the recovery will have to consider how these locations can first be restored
to normal, if this is at all possible or whether the recovery process can still be started despite the
changes in these locations.

Another consideration would be the legal restrictions that may prevent us from recovering as quickly as
we want. For example, the IATF has listed down specific industries that may start operation during the
modified ECQ and GCQ and in some cases, are only allowed to operate at maximum 50% normal
capacity until such time that quarantine rules are further eased down. Should operations resume at half
the normal capacity, there is also the major decision from top management on the financial feasibility of
lowered level of operations. It is possible that operating at 50% capacity would prove to be more
expensive rather than profitable.

Given that the necessary infrastructure and systems are in place (i.e. permanent location,
communications and utilities) the recovery plan can indicate the prioritized activities that would be the
first return to normal. These prioritized activities should have been already identified in the business
continuity strategies and need to be protected by the organization from all types of disruptions. The
recovery plan should also consider the interdependence of the prioritized activities with support
processes. To do this, I advise my clients to come up with a network diagram showing the sequence and
interdependencies of critical processes within their organization. The network diagram can be the
starting point when conducting PERT-CPM4 to determine the length of time that the recovery process
can be accomplished as well as to determine bottlenecks. The end goal of doing PERT-CPM is to make
the total recovery time as short as possible. A Gantt Chart is another useful tool to show the timeline
and sequence of activities that need to be done to be able to return to normal.

Consultant’s Key Points

 Recovery of organizations from any type of disruption should be done according to a

documented recovery plan.
 Activities that precede the return to normalcy include easing down of temporary measures
adopted during disruption, checking the availability of essential resources such as infrastructure
and utilities, and top management decision to start recovery based on financial feasibility and
legal restrictions.
  Prioritized activities and their interdependencies with support processes should be
predetermined. Recommended tools to be used in the recovery plan are PERT-CPM and Gantt
Chart.

Visit courses.eddams.com for elearning courses on ISO management system standards.

Get in touch with the author at info@eddams.com.

Notes
1
ECQ = enhanced community quarantine; GCQ = general community quarantine; IATF = inter-agency
task force
2
ISO 22301: 2019 Security and resilience – Business continuity management systems – Requirements
3
ISO 22313: 2020 Security and resilience – Business continuity management systems – Guidance on the
use of ISO 22301
4
PERT-CPM = Program evaluation and review technique – critical path method