FOLLOWING THE WORLD HEALTH Organization's declaration in June 2009 that the global H1N1 pandemic is underway, the real possibility of significant workplace shortages in the near-term due to H1N1 or another future infectious disease outbreak is cause for organizations to have a business continuity plan (BCP) in place. The first outbreak of the H1N1 "swine flu" virus at the end of 2008 caused many Mexican businesses to lose money and market share because their employees could not come to work. Earlier this decade, Severe Acute Respiratory Syndrome threatened primarily Asian countries, and H5N1, the "bird flu," caused worldwide concern. However, an incapacitated workforce due to sickness is not the only threat to an organization's stability: Other threats include man-made events such as biological terrorism, and natural disasters such as hurricanes and tornados.
Co-workers and customers are not the only source of business-disrupting incidents. With more processes and customers moving away from brick-and-mortar places of business to online business transactions and communication, organizations face an exponential increase in the threat of electronic viruses, identity theft, and other online intrusion risks.
The risk of pandemic, natural, and technology disasters illustrates why a BCP should be at or near the top of any organization's internal audit risk assessment, yet many internal auditors are stymied by the implementation of such a plan. Although management understands that it should have a plan, many say, "we will get to that next year"--yet it never happens.
Downtime due to unexpected disasters not only affects the businesses themselves, but it also can affect the local, regional, or worldwide economy if the business is sufficiently large or critical. Organizations do not operate in a vacuum; they are held accountable by customers, vendors, and owners to operate as expected. Moreover, the extent of the impact on businesses depends on the products or services it offers. Having an updated, comprehensive, and tested BCP can help organizations mitigate operational losses in the event of a disaster or major disruption. Whether it is advising the organization or reviewing the different elements of a BCP, the internal audit function can help the organization get a plan in place and operating efficiently.
DEVELOPING A PLAN
Many organizations do not have a formal BCP. Some may have limited plans that address only a few scenarios, such as localized...