Business continuity management (BCM) is a term used to describe the ability of an organization to provide uninterrupted business operations in the case of "extra-ordinary" operational risk events. Traditionally, BCM has concerned disaster-related events such as fires, floods, hurricanes, and so on, but with the advent of IT systems, such things as security breaches, system faults, or almost any event that could interrupt an organization's operations are also included in the BCM sphere.

One potential BCM event that I have highlighted over the past few years but one that does not get much serious consideration by companies is the increasing likelihood of a flu pandemic. The World Health Organization (WHO) has stated that a flu pandemic is inevitable and the world is woefully unprepared to deal with it. Whereas a typical flu season results in about 36,000 flu-related deaths and 200,000 hospitalizations in the US alone, a pandemic could easily result in 500,000 deaths and over one million hospitalizations — if not double or triple that. If a repeat of this year's flu-vaccine production fiasco occurs during a pandemic year, even those numbers might be low.

What makes WHO and other health officials worried is that at best, the amount of flu vaccine that could be created world-wide to stem a pandemic is currently about 300 million doses. That's assuming that health officials could identify a pandemic virus sufficiently early enough for a vaccine to be successfully created. While antiviral medicines could help treat about another 10 million people (these drugs don't prevent the flu, but are effective in treating the flu), no one is really sure how well they would work on a pandemic flu virus.

To understand some of the BCM issues that might appear, let's assume the best case: that health officials have been able to identify a virulent flu virus similar to the 1918 Spanish flu, which killed even healthy adults in less than 48 hours, early enough to create the 300 million doses. Given that it takes a few months to identify a potential pandemic flu virus and about six months to create a vaccine, organizations (and governments) will likely have about 9-12 months at best to prepare for what might happen. Now the fun starts.

First: who is going to receive vaccinations? Some 300 million doses barely covers half of the combined populations of the US and the EU. We've already seen the panic the loss of vaccine production produced in the US without a pandemic -- now multiply that panic across multiple countries. And what about Asia or other parts of the world too poor to vaccinate their populations? If Asian countries get the flu first, will they demand that all the available vaccine be sent to them? And if it isn't, will they restrict the exportation of anti-viral drugs that are made in their countries due to the health emergency (most of these drugs are made outside of the US or Europe)?

Second: while the flu vaccine would be targeted, of course, against the pandemic flu strain, it would not necessarily be against the other existing flu strains. This could mean that while the pandemic flu virus is stymied, one or more of the others flu strains would be allowed to run its "natural" course -- think of a flu season in the US without any vaccinations available.

Third: even if the pandemic doesn't take root in the US, for example, things could still get extremely messy very quickly anyway. In the flu season 2003-2004, for example, many US hospitals were very close to turning away patients because too many of their hospital staff and emergency workers themselves had the flu. A local hospital where I live had so many emergency room people out that if a major car accident had occurred, they could not have handled the situation. In a pandemic, where panic levels are high, the hospitals will almost certainly be overloaded as people with flu-like symptoms would flood the emergency rooms.

We could go on, but I think you can imagine the chaos that might occur if a pandemic does hit. What does all this mean for companies? For a starter, companies better start putting a pandemic scenario in their BCM plans.

Look at your current BCM plans that cover a major hurricane, flood, major fire, or biological terrorist attack — this is the type of event you are likely facing. Separate your BCM plan into three phases: preparatory, duration, and aftermath, with best- and worst-case scenarios defined.

Use the time during the preparatory phase — which is now — to understand the specific issues involved and what you plan to do during and after the pandemic hits. For example, read the US Department of Health and Human Services draft Pandemic Influenza Response and Preparedness Plan as well as the WHO site on influenza. Area quarantines and travel restrictions are high in the list of actions considered to keep a pandemic from spreading. Another good site is http://www.pbs.org/wgbh/amex/influenza, which describes the 1918 pandemic — it will give an idea of what we may be in store for. Also, note that pandemics normally come in two waves — the second about 6 to 9 months after the first. This means that your BCM plan will need to span about 18 months of activities.

Use the time now to work out a risk communication plan for what employees should do in case of a pandemic occurrence in their area. Rest assured that television and other media outlets will play up a pandemic flu outbreak to the hilt — think SARS but magnified about 50 times.

Be prepared to clearly and comprehensively inform your employees on organizational policies in the case of a pandemic. Should employees who feel that they are coming down with a cold stay home, just in case it is the flu? What about customers who want to visit you, or your employees who want to visit customers? Furthermore, employees with the flu may be gone for two weeks or more, and they may require (or demand) additional time at home to care for their sick loved ones. Do you have a liberal sick leave policy to deal with such an emergency? How many people can be out and the company's operation still be viable?

Moreover, if you outsource to countries where the pandemic takes hold, plan for your operations there to come to a screeching halt. While the US and Europe are underprepared to deal with a pandemic, other parts of the world are totally unprepared. If your BCM services are located overseas (like back-up IT service operations), will they still be operating during a pandemic?

Be prepared for deaths occurring among your employees, their families, or among your partners, customers, or suppliers. This will be a very difficult BCM issue to deal with during the aftermath phase of a pandemic, especially if the number of deaths is high, but it is one that should be thought about now.

A flu pandemic may be one of the hardest BCM issues for a company to fully prepare for, since the issues are so overwhelming, many seem outside the company's control, and there is no visible danger to confront nor near-term experience to draw upon. Yet the WHO, US Department of Health and Human Services, and other health organizations say one is long overdue. If there isn't a pandemic scenario in your BCM plan, now would be a good time to define one.