On 27 April 2009, governments and public health authorities worldwide were preparing for the anticipated spread of AH1N1 influenza (swine flu). The outbreak is currently centered in Mexico, where AH1N1 influenza is believed to have caused more than 100 deaths, but the disease is known to have spread to the U.S., Canada, Europe and elsewhere.

The swine flu outbreak is not yet a pandemic — and may never become one — but the media attention paid to it is already affecting enterprises. For example, declining oil prices are being attributed to fears of a disease-driven slowdown, and the European Union has issued travel warnings for the U.S. and Mexico. A true pandemic could cause absenteeism rates of 40% or higher for enterprises and their business partners and suppliers, resulting in severe operational disruptions. For this reason, enterprises must recognize the urgent need to develop and implement pandemic response planning.

Enterprises, governments and regulatory agencies should not make panic-driven moves — for example, closing down operations — in response to possibly overblown media reports. But business continuity management (BCM) and disaster recovery (DR) professionals and other stakeholders should use the widespread concern over the swine flu to increase enterprise awareness of the potential business impact of a widespread outbreak of disease. A recent Federal Financial Institutions Examination Council (FFIEC) study found that only 12% of participating institutions had "very effective" plans in place. Nonetheless, financial services is one of the few industries that have undertaken serious pandemic response planning, and the FFIEC study is the only large-scale testing of such plans yet conducted.

Enterprises in all regions and across all industries should review their BCM/DR pandemic response plans. Senior executives, line-of-business managers and other high-level decision-makers should be made aware of the seriousness of this pandemic preparation, to ensure a broad, ongoing commitment to this effort. (The FFIEC after-action report, available at www.fbiic.gov/public/2008/jan/Pandemic_flu_Jan08.pdf , is a useful tool.) IT managers should plan, test and add capacity to ensure the sustainability of what is likely to be a predominantly work-at-home environment.

Enterprise BCM/DR professionals, security professionals, IT managers, line-of-business managers and other stakeholders:

• Monitor www.pandemicflu.gov and other government and public-health sources to determine what actions are appropriate to ensure workforce safety and continued business operations.
• Review pandemic response plans to:
  • Identify existing and projected critical skills shortages
  • Initiate necessary cross-training, testing or certification of personnel
  • Ensure that cross-trained personnel have the appropriate system/applications access rights
  • Determine which business operations are sustainable, and at what level, and the likely downtime for normal business operations during periods with absenteeism rates of 40% or higher
• Immediately initiate rigorous, ongoing and well-documented testing to isolate and remediate identified problem areas.
• Prepare for travel restrictions to be significant in the event of an epidemic and near-universal in the event of a pandemic.
• Implement a communications program that ensures that all personnel are aware of the enterprise's pandemic response plans, as well as measures they can take to limit the spread of disease — including practices as simple yet effective as regular hand-washing.

• "New U.S. Guidance on IT in Pandemics” — New FFIEC guidance stresses the central role of IT in enabling operations and requires extensive testing of preparations. By Richard De Lotto
• "Workforce Continuity: Best Practices for Workforce Management” — Use these best practices to address and manage the implications of a disaster on workforce members. By Roberta Witty

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)