Organizations around the globe have never been afforded the luxury of standing still, as the world constantly changes and competitors react to gaps and opportunities that have increased through physical and virtual environments. Business Continuity is a far cry from being a new management tool for much of the Western world. However, in the Gulf Countries, BC was a new concept until several years ago. This article presents a post-Covid case study for power and water generation in the UAE.
Globalization and technology have modified our environment, meaning both rapid proactive and reactive response. These depend on whether the organization wants first mover competitor advantage. An organization needs to be resilient and adapt to new environments or be cut from the marketplace.
Whilst organizations adapt and evolve to marketplace behavior, Business Continuity is constantly evolving as processes, risk and their resilience changes over time. The same theory can be applied to projects during stages from initiation to execution, including construction risks, responses to legislation, environmental impacts and so forth. Since the management of business continuity sets the tools to allow organizations to respond, resume and recover, an organization needs to know ‘how’ to respond to a disruptive event.
Panic Questions (reactive)
- Where do we begin?
- What do we have to consider?
- How long will the organization be disturbed?
Healthier Questions (proactive)
- What could my business survive? (risk tolerance level)
- How long until the risk cannot be tolerated?
- What alternative strategies could the organization consider?
For government entities in the United Arab Emirates, it was mandatory to develop a BCMS. Although this has positives as a line of defense, it was felt by many as just another set of documents and reports and not a management decision.
CASE STUDY – When dismissing risk becomes a reactive measure. Power and Water Generation in UAE, February 2020
In many instances where an unplanned event extends beyond the organization, critical sectors play a vital importance in the protection of people, property and the environment. In the case of COVID, utility companies were critical in providing vital resources to ensure continual country support (especially for the health sector and the wellbeing of citizens). Close cooperation with regulators throughout the crisis was paramount.
At the organization in question, a BCMS was implemented in 2014 and has been maintained since, under instructions from the government to implement it across all critical industries. Additionally, for organizational good practices and to maintain ISO certificates, the organization has policies, plans, procedures and working instructions. Business Continuity requires senior management commitment, risk tolerance appetite and cooperation with department managers to ascertain and own processes that exist within the plant. Some importance in processes are contained within Business Impacts, Risk Assessment and Strategy Plans. Departments own their business impact processes and risks; whilst natural external risks are assessed by the Health and Safety Manager. The purpose of the BIA is to identify and assess Recovery Time Objectives to ensure the process can be recovered before disruption causes further complications, whilst the risk assessment assesses fundamentals in the process to see if a risk can be treated, tolerated or terminated based on the organization risk appetite.
In 2019, 38 key processes were identified. Those processes were undergoing yearly review in February 2020 through the BC Manager. All was on track for completion of interviews for Business Impacts and Risk Assessment reports to be completed by end of March. However, a global pandemic hit. It would be fair to say no one could have predicted the devastation that was due to follow. That being said, planned responses were necessary.
Pandemic Illness Control Measures
- Cover your mouth and nose to stop spreading germs / stop touching your eyes, nose and mouth
- Clean the shared equipment before using it
- If you feel sick and you at home, stay at home and check with health care provider when needed
- Cancel mass gatherings, close the canteen, cancel meetings and consider remote communication
- In case of employee’s absenteeism for a period of time due to sickness, each department head is responsible for identifying those essential persons required to continue the operations
- Employees are encouraged to avoid public transportation and avoid recreational or other leisure activities
- Company to establish quarantine facility within the site and manage the access restriction.
The pandemic control measures noted above focused on general sickness and did not consider illness of critical staff or remote working capabilities. A key risk was missing in all the processes and risks identified, and mitigation strategies along with it.
The Risk Not Considered: Remote Working Capabilities
The risk was not considered under the reasoning ‘we generate power and water; how do we work remotely?’.
It’s a fair reasoning under the classification of critical infrastructure. However, that is at entity level and was applied across the board, covering all staff. There are critical staff to generate power and water. They include control room operators, chemists, fork lift drivers, shift managers that can only be utilized onsite. Other departments could have had the ability to set up remotely when needed, although only senior managers had the infrastructure and capability to do so. The risk became evident when the energy regulator asked for urgent reports on a weekend. The reports included remote working capabilities and critical staffing positions. The request highlighted to the Business Continuity Manager remote working had to be addressed at the earliest and required senior management involvement.
Once the BC manager had submitted the reports, the crisis committee team convened to reconfirm the information was correct and discussed remote working. At the time, remote working capabilities were limited. IT were included in the meeting to understand capabilities, allowing the BC Manager to move forward with:
- Bypassing procurement processes
- Obtaining additional laptops
- Scheduling configuration deadlines
- Obtaining tokens
- Laptop roll out plan
- Communication and awareness to staff
Since COVID was complex in nature due to its upheaval on the global economy, working remotely was the start of one of the many, many challenges faced. A few days later, only one day after the meeting, and in parallel to obtaining and configuring laptops, a Senior Manager’s wife tested positive. All close contact personnel had to obtain a COVID test at the earliest and isolate until receiving a negative result. Results showed the leading manager of the plant was positive! Rapid action was required, as this was before virtual meetings and information via telephone and email were the chosen communication methods. The decision was made to shut down the administration building with immediate effect. Since most administration staff did not work over weekends, this was easier to control. However, this left staff with no ability to retrieve hard documents. It also led to exposure by leaving critical staff vulnerable in control room and key areas of the plant without senior management’s physical presence.
Initial steps taken included (but not limited to):
- Communication to majority of staff to stay at home until further notice
- Communicate to Government entity on the positive case and building shut down
- Awareness campaigns
- Protection of critical staff onsite
- Ensure staff telephone numbers were up to date
- Work around procedures to include receiving vital chemicals to site and PPE
The key message here is remote working should have been considered as a risk, with control measures in place to reduce the residual risk. In hindsight, there are other reasons to consider remote working. The majority of 100 staff and over 300 contractors are expatriates, and the power plant is situated on a protected site where gate access and security clearances are in place.
The organization had over 100 positive cases, with no deaths. The management of COVID was a complex process which saw activities enforced that could never be imagined. The crisis committee’s decisive decision making led to successful work during the pandemic and ensured no disruption in generating power and water. Needless to say, the BC manager will be ensuring tests and exercising throughout 2021 will involve remote working.
On a lasting note, organizations, governments, countries and individuals have shared information and knowledge, whilst crisis and incident training providers responded to the Business Continuity awareness need. The key word at the end of 2020 has become resilience: cyber resilience, organization resilience, business continuity resilience. Like a game of cards, play the best hand where possible, however, think of other options that could be presented and know when to treat (play the risk), tolerate (the hand dealt) or know when to bail out and terminate the risk. Unplanned events are just that – unplanned, but, the risks could be mitigated.
May 2021 be kinder to us all! Stay safe!Recommend0 recommendationsPublished in