Planning for the People Side of Risk Management

Preparing for and Managing Pandemic, Epidemic or Infectious Disease Outbreak

Business Resumption Planners Association

July 15, 2008

Aon Risk Services and Aon Consulting Ken Groh, Vice President Communication Consulting

People at Risk

2

Agenda

People at Risk

Issues

Developing a Strategy

Questions

3

People at Risk

4

Sarah Smith’s Story On December 13, 2007, Sarah landed at O’Hare’s

International Terminal on an American Airlines flight from New Delhi, India Sarah grabbed dinner at a restaurant on her way to Terminal 3 where she grabbed a flight to San Francisco.

A week after landing in San Francisco, she showed up at Stanford Hospital with a high fever, chest pains and coughing up blood – she was diagnosed with XDR-TB, the abbreviation for extensively drug resistant tuberculosis, a rare form of TB that is highly contagious and difficult to treat.

After months in isolation, Sarah was recently released where she will remain quarantined in her home for weeks. She will need to stay on drugs for at least two years to eradicate the disease.

5

Sarah Smith’s Story Although the name is not real, the story is true.

But it’s not over. Sarah knew she had TB in India but traveled anyway.

After identifying 44 people who were at risk to exposure to XDR-TB during Sarah’s flight to Chicago, the CDH tested about half of them and uncovered a second case of XDR-TB, a woman who sat next to Sarah.

But what about the people she interacted with at O’Hare or during the week before she went to Stanford Hospital?

Source: wwwfoxnews.com

6

Infectious Diseases Put People at Risk

Various infectious diseases can impact an organization’s employees and productivity

– SARS (Severe Acute Respiratory Syndrome)

– Norwalk-like viruses (NLVs)

– Legionnaires Disease

– Avian flu pandemic

– Seasonal flu

What if one third to one-half of your workers didn’t show up to work?

– For several weeks?

7

Infectious Diseases Put People at Risk

Consider what’s at risk

– Employees who can’t come to work because of illness or need to care for family

– Customers who can’t or are reluctant to access products or services

– Supply chain unable to function at optimum or even minimum levels

– Business continuity

8

People at Risk

SARsEpidemic

FluPandemic

Spread Local. An epidemic spread by an airline passenger

Global. A pandemic by definition infects 25% globally – about 3 a century

Mortality Low. 8,500 cases and 800 deaths

High. Smallest pandemic killed 1 million; largest killed 26 million in 26 weeks

Time Period One wave, nine months Three waves, longest pandemic lasted three years

Transmissibility Low, with high fatality. No human immunity

High with high fatality. No human immunity

Impact on Air Travel

Minor. Hong Kong delayed 80% of flights over 10 weeks

Major. Global transportation limited or shut down in some countries

9

Issues

10

Some Questions

Do you have a business continuity plan?

Do you have a crisis communication plan?

Do you know who owns these plans in your firm?

Do you know if your key partners have either or both plans?

Do you know the impact of value chain disruptions?

Does your crisis management and business continuity plan address large-scale absenteeism or is it more focused on facility disruption?

Have you tested or piloted your crisis management plan if one-third to one-half of your work force couldn’t be at work?

11

The Impact of a Pandemic Absenteeism

– What if 30% to 60% of your work force can’t or won’t come to work?– How would your suppliers and vendors be affected?

Supply chain/infrastructure interruptions– What if supply chain is disrupted? What are your alternatives? – What if supplies of water, food, medical products, fuel are limited? – What if utilities were disrupted?– What if machinery and equipment break down? Do you have a

stockpile of key parts? What about service alternatives? Business continuity

– What products/services would be affected? – How would you continue operations/services to maintain revenue

stream?

12

Planning Assumptions

Worst-case scenario: About 30% of the population will be affected; higher is some areas than others

Schools and public facilities will be closed

Transportation will be restricted

Health care facilities will be overwhelmed

Limited assistance from state and federal governments due to nationwide impact

Pharmaceuticals may be restricted or unavailable

Who will help?

13

Developing a Strategy

14

Risk Management Process

1. Create a task force of stakeholders

2. Research: Consider the issues and create scenarios

3. Conduct a risk assessment and gap analysis

4. Confirm enterprise-wide

5. Create recommendations

6. Train and test

15

Develop a Task Force

Supply Chain/

Distribution & Sales

Executive Mgmt

Security/Safety

Risk Mgmt

Legal

IT

HR / Medical

Mfg. Facilities/

Operations

BCP/Crisis Planning

Discovery Process

Communication

16

A Few Critical Issues to Consider

Critical Issues

Employee Health and Welfare

Brand Image & Value

Supply Chain Disruptions &

Associated Impact

Revenue & Cash Flow Erosion

What staff functions can be performed at home?

What skill sets are essential? Who can be cross trained to prepare for absenteeism?

How can you protect your brand? What is the message to shareholders and the business community?

What assurances do you have from your supply chain? What is essential? What should be stockpiled?

What non-essential functions can be suspended? What revenue stream needs to be protected?

17

Potential Project Steps

1. Risk Assessment & Gap Analysis

2. Deep Dive – Enterprise-wide Confirmation of Risk and Solutions

3. Recommendations and Action Plan

a. Business Continuity

b. People Element (Human Resources Policy and Communication Plan)

c. Documentation

d. Training and Testing

18

Risk Assessment and Gap Analysis

Identify risks – Employee Safety: Uncover threats to human health

– Business Continuity: Identify business interruption

Conduct gap analysis for risk mitigation– Review existing documentation

– Interview key stakeholders

– Audit current HR policies and crisis communication plan

Outcome: High-level risk identification and solution strategy

Step 1

19

Deep Dive – Enterprise-wide Confirmation of Risk and Solutions

Model risk impact and mitigation strategies

Prioritize on an operations basis

– Meet with key managers

– Conduct group exercises to build consensus

Outcome: Prioritize business risks and action steps to mitigate risk and support business continuity

Step 2

20

Step 3

Recommendations and Action Plan

Develop Business Continuity Planning Recommendations

– Once exposure areas are prioritized, create recommendations for existing or new business continuity and crisis planning strategies

– Discuss with BCP owners and policy makers to confirm

Outcome: Business continuity plan, people management plan, risk-specific crisis communication plan, documentation and training/testing strategy

21

Case Study

Situation A Life Sciences company with a critical product asked for

assistance in developing a pandemic preparedness plan

Approach Created a task force representing sales, operations,

corporate communication, Human Resources and risk management

Assessed the current risk exposure to a pandemic and business continuity issues through focus group process (absenteeism and supply chain disruption)

Prioritized action steps to develop strategy for pandemic preparedness

22

Case Study Approach (continued) Developed a pandemic supplement for crisis communication

plan Created a local and global simulation to test pandemic crisis

response Developed management and employee communication to

create awareness of pandemic preparedness and corporate/local response

Outcome Identified exposure and current preparedness/response

gaps Developed a crisis communication plan Trained responders

23

Why This Process Works

People-focused solution

Research-based solution

Comprehensive, covering – Risk identification and management

– Business continuity and recovery and

– Crisis management and communication

Clearly identified ownership and roles for rapid response

Consensus-based, enterprise-wide strategy

Global crisis communication plan with local elements

Tested model accelerates recovery

24

Questions