Wayne Middleton sees that the current Coronavirus is a unique test of resilience
As venues and events internationally come to terms with the impact of the COVID-19 virus shutdown, it’s a difficult to see many positives out of all this uncertainty. Mandatory closures of small outdoor and indoor mass gatherings, compulsory self-isolation for overseas travellers, as well as social distancing; these are becoming the new norm in the workplace vernacular - at least in the short term. We are still forced to keep businesses operating with, in many cases, our workers operating remotely.
At this point you are hopefully dragging out your well-rehearsed Business Continuity Management Plan and putting into place the contingency plans you have trained for. But if you haven’t tested them for some time, or worse still - you don’t have a BCM Plan, now is a very good opportunity to document these processes while implementing home-based work.
‘Denial of Access,’ or being unable to work from your office, is one of the most common scenarios that require a continuity response in business. Whether it’s an act of terror, a power failure, a failed sewer main in a neighbouring building, a motor vehicle accident on an arterial road nearby, or the Corona virus; denial of access should be the starting point for disruption scenarios in your BCM Plan.
COVID-19 - A Test of Resilience
For those who’ve attended Year Two of the Venue Management Association’s (VMA’s) Venue Management School, dust off those notes from Year Two’s lesson on ‘Business Risk & Resilience;’ because now more than ever, you need a plan for major operational disruption. This area of risk management relates to resilience planning. Resilience Plans help deal with major operational disruption; to prepare, respond and recover from a major incident or situation.
The Oxford Dictionary says that Resilience is “the ability of people or things to recover quickly after something unpleasant, such as shock, injury, etc. He showed great courage and resilience in fighting back from a losing position to win the game.”
The terms Risk Management and Risk Assessment are used frequently in our industry. Most commonly these terms are applied to safety, security and emergency management, yet there is risk in almost everything we do. Every organisation that operates in the venues and events industries has a different level of risk maturity. Organisations with a low risk maturity focus largely on safety, security, emergency planning and insurance in risk management. Organisations with a higher level of risk maturity apply risk management concepts to other parts of the business including those above, plus legal liability, compliance and resilience-based plans.
Resilience-Based Risk Plans
Organisations that are risk mature may have an established Enterprise Risk Framework that ties all facets of risk together. An Enterprise Risk Framework provides a structured and systemised approach to managing all risks (including disruption-based risks); is commissioned by the Board, led by the Executive, and implemented by the workforce. The successful management of all risks to the business is underpinned by a structured approach to risk assessment.
The suite of Resilience-based risk plans and their current role in a venue’s response to the Corona crisis are below:
Risk Assessment (RA)
The Risk Assessment involves an analysis of risks in terms of consequence and the likelihood that the selected consequence will occur.
Risk categories for consideration include:
• Health & safety
• Disruption
• Reputation
• Financial
• Legal
• Technology
The assessment should exist in a risk register (table of risks) and use agreed definitions for consequence and likelihood, and contain evaluation criteria to determine the magnitude of the problem and an appropriate course of action.
For health & safety risks you should use the hierarchy of controls to help guide appropriate actions: Eliminate, substitute, isolate, engineer controls, administrative controls, personal protective equipment (PPE).
Role of Risk Assessment in the Current Crisis
In the current crisis the role of risk assessment is to focus on the following risk categories:
• Health & Safety risks -
• Impact on people’s health from communicable disease - (staff, contractors and patrons)
• Eliminate - temporary closure of venue
• Substitute - N/A
• Isolate - home-based work, self-isolation
• Administrative - social distancing, split-shifts (combined with home-based work), cleaning program
• PPE - gloves, sanitizer, face masks
• Disruption risks -
• Critical business functions affected
• Consequential impact on other business functions
• Timing of critical functions
• Reputation risks -
• Stakeholder communications
• Who are the stakeholders affected? (staff, patrons, owners, neighbours, suppliers, clients)
• How are they affected?
• Financial risks -
• Lost income
• Accrued leave
• Additional costs
• Legal risks -
• Venue hire agreements
• Ticket refunds
• Insurance - cancellation, forced majeure
• Sponsorship
• Technology risks -
• Information systems integrity
• Software and hardware capabilities
• Remote systems access
• Cybersecurity
Emergency Management Plans (EMP)
An Emergency Management Plan (EMP) should help guide an initial response to an incident or situation to protect people and property from harm.
It is a written document containing the emergency arrangements for a facility, generally made during the planning process. It consists of the preparedness, prevention and response activities and includes command and control structures, roles and responsibilities and specific emergency response procedures.
Role of Emergency Management Plans in the Current Crisis
Set out prevention and response procedures for communicable disease outbreak:
• Venue lock down, access control and head count; indoor and outdoor limits to gatherings, staff & visitor sign in and out
• On-site health and medical care
• Sanitization - cleaning program, contaminated waste removal
• PPE requirements
• Reporting and recording requirements
• Emergency service and communicable disease testing
• Links to state pandemic plans
• Department of Health, Federal Government Policy and other important information sources
• Venue’s Communicable Diseases Policy
• Staff welfare - Employee Assistance Program
Crisis Management Plan (CMP)
Crisis Management Plans (CMP) are for responding to incidents or situations that threaten the organisation and its reputation.
A CMP provides a coordinated strategic executive management response to the immediate, short term and long-term effects of the situation.
They are characterised by:
• Scenarios that are (generally) unforeseen and that occur rapidly
• Require quick decisions
• Not necessarily impacting upon critical business functions but can affect achievement of the organisation’s mission, goals and objectives
• Potentially resulting in real or perceived risks that invoke outrage and media attention
• Information traveling fast due to electronic media
Role of the Crisis Management Plan in the Current Crisis
Preparation of the Crisis Management Plan should involve:
• Establishing a Crisis Management Team
• Understanding potential impact risks (see above)
• Develop a Crisis Management Plan
• High impact foreseeable risks
• Crisis management team
• Roles, responsibilities, contact details
• Action plans and checklists
• Where do we meet?
• What will we need?
• Who do we call?
• Training and testing schedule
• Crisis Communications Plan
The Crisis Communications Plan should include:
• Clear, concise, honest and timely information
• A nominated competent media spokesperson with a clear and consistent voice
• Targeted audience identified
• Pre-scripted communications
• Appropriate responses - provide brief explanation of approach, regular updates, future preventative actions
• A desire to nurture goodwill now with important stakeholders
Disaster Recovery Plan (DRP)
Disaster Recovery Plans (DRP) usually integrate with the Business Continuity Plan, given an organisation’s heavy dependence on information technology and telecommunications equipment.
The DRP is a technical document that sets out details of information systems, back up arrangements and cybersecurity protections in place to ensure the efficacy and resilience of information access and sharing.
Role of the Disaster Recovery Plan in the Current Crisis
The DRP is important for documenting IT and telecommunications arrangements for the hosting of data backup, secondary remote office sites, and home-based work.
Business Continuity Management Plan (BCM)
Business Continuity Management involves the integration of the organisation’s planning and management processes to provide operational resilience.
It involves developing a plan for the:
• Ongoing management of disruption-based risk
• Building a resilient and sustainable business
• Achieving business goals and objectives
It should cover:
• Continuity response
• Resources, processes and controls provided
• Focus on maintaining critical business functions
• Recovery response
• Resources, processes and capabilities restored
• Implement improvement
Role of the Disaster Recovery Plan in the Current Crisis
There are a number of stages to achieve Business Continuity Readiness. They include:
1. Vulnerability (Risk) Assessment (as set out above); and a Business Impact Analysis (BIA)
The BIA should explore:
• Critical business functions. These may involve:
o Important/critical people
o Key facilities, infrastructure or equipment
o Core services that you deliver for the next 3-6 months
o Key information - from meetings, databases, server access
o Resources - what systems, funding or tools are heavily relied upon to deliver critical business functions?
• Impacts to other parts of the business
• Dependencies on IT applications
2. Developing response strategies -
a. Who is the Business Continuity Coordinator?
b. What is the process for determining the crisis?
3. Developing resources and interdependencies - contact lists, checklists, hardware needs, software needs, WHS/OHS requirements for home-based work. Link to other source resources such as:
a. State or national Pandemic Plans
b. State Hazard Plans
4. Continuity plans/contingency plans - what are the workarounds for each critical business function, and who will do it? How do we recover back to normal business? -
THIS IS HAPPENING NOW
IN THE CURRENT CRISIS - DOCUMENT YOUR WORKAROUNDS/CONTINGENCY PLANS FOR EACH CRITICAL BUSINESS FUNCTION AFFECTED.
5. Communications strategy - linked to the Crisis Management Plan. Communications matrix - who speaks to which stakeholder and when.
6. Training and testing - THIS IS HAPPENING NOW. WE ARE BEING TESTED
7. Evaluation and Review - Document what you can, as it is happening and conduct a formal review once it’s over. Make further changes and use the opportunity.
How do all these Plans fit Together?
The following diagram shows how these plans all fit together:
Other things to Consider
Functional Area BCM Plan
Each functional area within your organisation should have a BCM Plan that shows:
• Crisis Management Team Members & Lead Crisis Manager
• Chief Warden or person in charge of emergency response & back up person
• Business Continuity Coordinator & back up person
• Functional Area Recovery Team Leader & back up person for each functional area
• Alternate site if teams are separating - names of people/teams and IT requirements
• Procedure for invoking the Contingency Mode
• Procedure for returning to Normal Business Mode
• List of Critical Business Processes, Functional Area affected, Maximum Acceptable Outage - (how long can we afford to lose the function for?); risk rating, and impacts if it fails
• Employee IT hardware needs (laptops, tablets etc.)
• Functional Area Allocation - List each functional area and alternate site - Day 1, Day 2, Day 3, etc.
• Critical Business Function (CBF) - List the CBF - Day 1, Day 2, Day 3, etc.
• Functional IT applications needed
• Contact numbers - Crisis Management Team, Business Recovery Teams, Employee Contacts, Key Stakeholders, Key Suppliers, Emergency Services
Functional Contingency Plans
Contingency Plans are ‘workarounds’ given the denial of access/work from home scenario. They might include for example:
• Human Resources - Payroll system & superannuation
• Box Office - Ticket sales and refunds
• Compliance reporting
• Servicing key suppliers’ contracts
An example of Contingency Plans for Critical Business Functions might be:
Where can you get Help with Business Continuity Planning?
There are a number of international and Australian Standards available to help guide this process.
• ISO 22301:2012, Societal security - Business Continuity Management Systems - Requirements, will help organisations, regardless of their size, location or activity, to be better prepared and more confident to handle disruption of any type.
• AS/NZS 5050:2010 - Business Continuity - Managing Disruption-Related Risk - Describes the application of the principles, framework and process for risk management, as specified in ISO 31000:2018, to disruption-related risk.
• ISO 31000:2018 - Risk Management Guidelines - Describes guidelines for managing risk faced by organisations. The application of these guidelines can be customised to any organization and its context. It offers a common approach to managing any type of risk in the venues and events industries.
In Summary
So, while the current Coronavirus crisis appears to present few opportunities in the venues and events industries, it does allow us to consider all the activities we’ve been too busy to get to. This pending shutdown period could be the perfect opportunity to update Enterprise Risk Management & Resilience Plans. If you are a Graduate of VMA’s Venue Management School, review your Year Two Risk Management notes, and if you’re not a graduate, drop me a line, and I’ll try to steer you in the right direction.
We all hope this crisis passes swiftly and that our industry recovers to a place that’s even better than it already was.
About the author
Wayne Middleton
Principal, Reliance Risk
Wayne Middleton, CVE, is current Chair of the VMA’s Venue Management School. He has been a risk management instructor for over a decade at the School and is the Principal of Australian-based consultancy, Reliance Risk.
He has over 30 years’ experience in operating and consulting to public venue and events and has delivered projects across Australia, New Zealand, North America, South East Asia and the Middle East.
He holds a Masters’ in Risk Management, a Bachelor of Administration, a Diploma of Security Risk Management, and is an active member of the Venue Management Association (Asia and Pacific).
He be contacted on email wayne.middleton@reliancerisk.com, www.reliancerisk.com
Read more from this author
Related Articles
20th March 2020 - Reports indicate reopening of theme parks and museums in China
20th March 2020 - Stakeholders seek Government stimulus support for privately operated sports centres
20th March 2020 - LPA concerned over Government’s inaction in helping cultural sector survive Coronavirus crisis
20th March 2020 - Coronavirus crisis closes Auckland’s Rainbow’s End
19th March 2020 - Australasian Leisure Management and the Coronavirus crisis
19th March 2020 - Government issues Coronavirus guidelines for community sport, stating fitness centres and swimming pools need not close
17th March 2020 - Coronavirus fears delays opening of Etihad Arena
17th March 2020 - IOC’s Coates refutes claims Olympic organisers are ‘underplaying the challenge’ posed by Coronavirus
17th March 2020 - HOTA and MONA close to prevent spread of Coronavirus
4th December 2019 - Significant fall in New Zealand skiing and snowboarding injuries attributed to risk management and education
2nd October 2019 - The Royal Agricultural Society of NSW gets recognition for outstanding Risk Management Policies
15th May 2019 - Reliance Risk to provide event safety and risk management services at Brisbane’s Suncorp Stadium
1st February 2017 - Reliance Risk marks 10 years of helping sport, venues and major events manage risk
