Last reviewed 12 August 2020
As reopening businesses consider how best to implement the Covid-19 secure guidelines, certain activities become problematic. Mike Sopp advises on how to decide if that particular activity is required for your business to operate.
As the UK economy restarts after the pandemic lockdown, many organisations are making plans for employees to return to some form of normal working, albeit with Covid-19 risk mitigation measures in place.
Government guidance for employers in England in respect of Covid-19 secure measures requires employers to work through a number of steps in sequential order.
This includes considering whether a work activity needs to continue for the business to operate where social distancing guidelines cannot be followed and risk mitigation measures are required.
The discipline of business impact analysis from business continuity best practice can assist employers in making a considered decision as to whether the activity is required for the business to operate.
Covid-19 and business continuity
In England, all employers are required to manage the risks from Covid-19 and “reduce risk to the lowest reasonably practicable level by taking preventative measures, in order of priority”.
The hierarchy includes the application of social distancing arrangements. The guidance then states that:
“where the social distancing guidelines cannot be followed in full, even through redesigning a particular activity, businesses should consider whether that activity needs to continue for the business to operate, and if so, take all the mitigating actions possible to reduce the risk of transmission between their staff.”
It should be noted that similar guidance will apply in the respective home nations but that guidance should be referred to for specific detail.
The key phrase here is “whether that activity needs to continue for the business to operate”. The challenge for employers is how to interpret this aspect and determine whether the activity is required for business operations.
Although the control of risks in relation to Covid-19 are seen as coming under the health and safety regime, it can be argued that this aspect of the required risk control hierarchy also comes under the influence of business continuity.
Under business continuity management, employers should be looking from a strategic level at the impact the Covid-19 epidemic would have on their operations as a whole.
This includes undertaking a business impact analysis. This process can help organisations determine if the work activity needs to continue for business operations.
The business impact analysis process
Business impact analysis (BIA) is defined as “the process of analysing activities and the effect that a business disruption might have upon them”.
More succinctly, the BIA “identifies the urgency of each activity undertaken by the organisation by assessing the impact over time caused by any potential or actual disruption to this activity on the delivery of products or services”.
The Business Continuity Institute (BCI), in its Good Practice Guidelines, suggests there are four types of BIA that progressively provide greater detail and understanding of the organisation.
Initial BIA: a high-level analysis to develop a framework for more detailed BIA.
Product and service BIA: identifies and prioritises products and services, and determines strategic business continuity requirements.
Process BIA: identifies processes required to deliver prioritised products and services.
Activity BIA: identifies and prioritises activities that are needed to deliver prioritised products and services including the necessary resources (eg people).
Organisations therefore initially should be determining how their products and services can be impacted by a disruption over time until that disruption becomes unacceptable. In terms of impacts, these would typically be:
financial: such as fines, penalties, lost profits, or diminished market share
reputational: such as negative opinion or brand damage
legal/regulatory: such as litigation liability and withdrawal of licence to trade
contractual: such as breach of contracts or obligations between organisations
strategic: such as failure to deliver on objectives or take advantage of opportunities.
Determining when such impacts become unacceptable (or intolerable) over a period of time can be challenging, particularly if the outcome is uncertain, but in general terms impacts will increase the longer the disruption continues.
Although the maximum tolerable period of disruption is important, more important is the target recovery time, which should be within the maximum tolerable period and form part of the overall business continuity strategy.
Having completed the product/service BIA, the organisation can then undertake the process and activity BIAs that will identify the functions necessary to support the delivery of products and services.
The delivery of products and services requires processes, which in turn, require activities to be undertaken. Activities will require resources including people not only in terms of numbers but also with the knowledge, skills and qualifications required by the activities.
As we have already seen, under Covid-19 secure guidelines, employers are required to determine whether work activities need to be undertaken for the business to operate, where social distancing is not possible. Business operations can therefore be linked to priority products and services to be delivered.
An activity BIA will identify the people activities necessary to continue to operate and deliver the products/services identified as being a priority, ie those it needs to operate as a business. The activity BIA process will include:
the identification and prioritisation of the activities contributing to the processes that then deliver the prioritised products/services
an understanding of the activities details and specific recovery time objectives
a breakdown of resources required to maintain the activities to an agreed level within requirements
consideration of additional activities that could be created during a disruption
impacts on people, eg physical or mental health.
To give a simple example, a utilities company may provide an emergency response service to customers to respond to a broken boiler. In this case, the service being delivered is a response to remediate a customer's equipment failure.
To deliver this service, processes will include the customer reporting the fault (eg by telephone to a call centre or online), an operator arranging for an engineer to visit the customer and then an engineer physically travelling to the site by vehicle and attending the customer's house.
This in turn will require various activities and associated resources such as:
a call centre with associated communications technology
an operative to arrange the visit and a bookings system
a vehicle to enable an engineer to attend the site
a qualified engineer to undertake the work activity.
Impacts of disruption could be significant with a very short time frame and as such the service would be a priority. Certain support functions could be delivered remotely at home away from the call centre (if the ICT enables this) but the engineer attending site may be unable to maintain social distancing if travelling with another engineer and when in the domestic property.
Even if that is the case, this activity could be seen as a priority due to the significant impacts and risk to the occupants of not repairing a faulty boiler.
As such, the organisation could deem this activity as being necessary for the business to operate.
If the activity needs to continue, the employer must mitigate the risks. There is a requirement to reduce the risks to as low as reasonably practicable and put in place measures that will limit potential exposure to the Covid-19 virus.
The application of Covid-19 secure guidelines requires careful thought and consideration.
This includes the need to determine whether an activity should continue where social distancing requirements cannot be applied.
In doing so, employers must consider whether or not the activity is required to enable the business to operate. This can be achieved through business impact analysis.
This requires a careful examination of the organisation's products and services and an identification of the processes and work activities necessary to deliver those products and services.
By taking a considered and well-planned approach via an activity BIA, employers can make decisions on how it can successfully meet the requirements of the Covid-19 secure guidelines.
The Good Practice Guidelines, Business Continuity Institute.
ISO/TS 22317:2015 Societal Security. Business Continuity Management Systems. Guidelines for Business Impact Analysis (BIA), International Organization for Standardization.