Lessons Learned: A Business Continuity Case Study
Business continuity planning helps executives “expect the unexpected” and prepare their organizations to perform seamlessly – and perhaps even excel – when the going gets tough. While the once-in-a-century COVID-19 pandemic took most Americans by surprise, PULSE® was among the companies that have been preparing for the possibility of a pandemic for years.
Residing in the Operations Department at PULSE, business continuity planning always has been a high priority. Both Discover and PULSE have made it a practice to stage mock drills across all business units and both organizations allowing the continuity plans to be tested and executed at a moment’s notice.
In January 2020, when images of health workers in hazmat suits started to emerge out of Wuhan, China, the PULSE team was already starting to monitor what was simply known at the time as the “novel coronavirus.” By mid-February, it had become clear that the virus and its resulting illness – COVID-19 – had spread beyond China, with infections reported in Italy and other European countries.
PULSE was already making arrangements for the possibility that some or all of its workforce could need to work from home.
By the time the World Health Organization declared that COVID-19 could be characterized as a pandemic on March 11, 2020, PULSE was ready.
Planning for the Worst
When something as simple as a power cord can be the difference between an employee being sidelined or being able to remain productive away from the office, the importance of planning cannot be overstated. At the heart of PULSE’s business continuity plan are two key teams: the Emergency Response Team and the Business Resumption Team.
Emergency Response Teams – Examination of the Ripple Effect
As the name implies, the role of the Emergency Response Team is to respond when something happens that could threaten normal business operations and/or the health and safety of employees. The captain of the PULSE Emergency Response Team (ERT) is Jim Lerdal, Executive Vice President, Operations. Under Jim’s leadership, the ERT assesses a situation and its potential impact on employees. The team’s actions often revolve around deciding whether to close the office, as is often necessary in serious weather events. Yet, even a well-intentioned decision to close the PULSE office could have unintended consequences that must be considered.
“Every decision has ripple effects, and we work to anticipate what those ripples might be and make appropriate accommodations before there’s another set of problems,” said Lerdal.
In one example, METRO shut down bus service throughout the Houston metropolitan area when a sudden rain storm caused flash floods, which left a large number of employees stranded at work. The Compliance Department engaged Jim Lerdal, and requested approval for a plan to coordinate with Discover’s Strategic Intelligence Operations Center (SIOC) to match the home locations of employees who drive to work with those employees stranded by METRO’s decision.
In a few short hours, car-pools were organized to facilitate safe travel home for all but a handful of those stranded employees. The company made other arrangements and these employees were able to commute home the next day when METRO resumed service.
Having the ability to instantly alert employees was the result of planning, investments in communications services, commitment of resources, and most importantly, tone at the top under the leadership of PULSE President Dave Schneider. This reflected the practice of planning and support throughout Discover as well. Key learnings from past business disruptions prompted PULSE and other employers to adopt technologies that enable the company to instantly transmit messages to employees.
The Business Resumption Team – also captained by Lerdal – is focused on taking the necessary actions to maintain business operations with minimal disruption. This team takes over where the ERT leaves off.
For PULSE, a core task is ensuring cardholders have access to funds through their debit cards. Having a clear understanding of these core tasks – the things that are absolutely critical to the business – is essential. When planning, PULSE identifies all core tasks, the number of people needed to perform those tasks, who those employees are and who is designated as their backups. Aligned with this analysis is determining the technology infrastructure necessary to perform core tasks, and whether the employees who perform them have access to everything they need and can perform the tasks while working remotely.
It may be unpleasant to think about, but catastrophes such as a devastating fire can and do happen to businesses nearly every day. Thinking in advance about how long it would take to get operations up and running after such an event can identify potential gaps, which can help the company to prioritize investments to help fill these gaps.
The Dress Rehearsal
A final element of the planning process is testing the organization’s ability to respond effectively to a serious problem. Russell Lessard, Director – Compliance with PULSE, recommends rehearsing a mock event at least annually. This should include pandemic-specific training which PULSE has done for several years. For financial institutions, it makes sense to stretch beyond relatively predictable natural disasters and conduct a drill for how to respond to events such as a ransomware attack or other cyber security event, a prolonged power outage, an instance of workplace violence, or an event such as a fire that unexpectedly renders the offices unavailable.
As part of a drill in 2019, PULSE tested how the company would respond to an overnight fire. The company surprised every single employee with an alert at 5 a.m. instructing all employees that they were not to report to the office. This allowed us to test the ability of the entirety of the workforce to set up remotely at a moment’s notice and to test all of our systems at scale. The drill revealed numerous areas for improvement, such as:
- In such an event, the company would need to understand how it would quickly account for employees who worked in the building overnight;
- The company’s notification service was unable to reach some employees based on certain options selected in the system, or contact data (i.e. mobile phone vs. home phone) provided incorrectly by employees;
- The notification system contained an automatic system timeout, creating uncertainty around message delivery if employees did not respond prior to the timeout;
- Many employees had taken their laptops home, but did not take home the power cord or phone headsets.
“Even when things seem to go great when conducting a drill, I make a point to dig deeper into unknown or underlying issues. It helps ensure there will be fewer potential surprises when we have a true emergency,” said Lessard.
PULSE Responds to a Pandemic
Years of planning, preparation and drills positioned PULSE to be able to prevent business disruption related to COVID-19.
Ever since the SARS outbreak of 2003, the possibility of a pandemic has been on the radar of business continuity experts. The accepted best practice is to test pandemic planning at least every three years to determine an organization’s readiness.
By late-February 2020, the global spread of COVID-19 seemed inevitable. PULSE’s core team responsible for business continuity assessed the organization’s readiness to work from home. It was already standard operating procedure for most employees to have the technology necessary to work remotely, but the assessment determined that many administrative staffers and contract workers presented a gap in the capabilities. While some of these workers lacked laptops, many also lacked the RSA tokens needed to log in to the company’s virtual private network from home.
“In early March, we scheduled times to meet with those users, provided token assistance, helped them install it and complete setup. We then required them to go down to the lobby of our building, out of WiFi range, and test the connection to ensure it worked,” said Danielle Wells, Senior Manager, Compliance and BCP Planner with PULSE.
PULSE had also learned in the past, and this lesson was reinforced during the 2019 fire rehearsal, that employees should be reminded to take home all necessary equipment when a disruption is possible, such as a pending hurricane. Mission critical employees have always been required to take home their devices on a daily basis as most events come unexpectedly. As it became more evident that the pandemic would force PULSE employees to work remotely, PULSE began sending reminder notices to its employees, asking them to prepare each day for the potential that the next day could be the start of working remotely.
Flipping the Switch
Once the decision was made to ask the workforce to work from home in March, employees were allowed to go to the office to pick up any needed items such as a mouse or keyboard. Aside from technical support, facilities and security personnel, and a small group of employees who have to periodically perform key encryption activities, PULSE switched to a fully virtual workforce. All employee travel was cancelled, and all internal meetings and client-facing events were converted to virtual gatherings.
To emulate the collaborative work environment that otherwise could be lost when working remotely, PULSE increased its use of Webex and Microsoft® Teams. When some employees expressed concerns about poor connectivity, especially when children were competing for bandwidth when schools were virtual, PULSE recommended accessing Webex meetings and email via mobile phone or tablet.
When this all began, few could have predicted that many companies – including PULSE – would shut down their offices for the remainder of 2020, and beyond. The goals of maintaining a positive workplace culture and keeping teams motivated emerged as priorities. To keep employees engaged and connected, PULSE President Schneider made his quarterly all-employee meeting virtual and sent weekly emails to connect with employees, share success stories and describe best practices. PULSE also quickly created and managed communication to clients through the Pandemic Response Resource Hub. Up-to-date trends in debit that were seen across the PULSE Network were shared with clients to help them understand and navigate the radical changes in spending that were happening as much of the U.S. went into lockdown.
As the work-from-home arrangement stretched into weeks and then months, the company empowered managers to be more creative and flexible in how employees put in their eight hours per day. Some working parents logged in and worked early in the morning, such as 5 a.m. to 8 a.m., then spent time with children, logged on for a few hours in the middle of the day, and then back on again from 5 p.m. to 8 p.m. Discover hosted webinars for working parents to help them manage the stress of working full time and taking on the role of school teacher.
From a business-continuity perspective, the transition to working from home was an unabashed success. PULSE clients (and their customers) experienced no disruption in service. In the spring of 2020, when there was uncertainty about the resilience of the economy to withstand the potential economic fallout from the pandemic, PULSE Network lived up to its promise to keep money moving by providing fast, convenient and reliable access to funds.
Moreover, the company’s quick action to keep employees safe and healthy by transitioning to a work from home model is credited with keeping infections among employees to a minimum.
The pandemic is still not behind us, and it will likely be years before its true impact on our personal and professional lives can be accurately measured. But as we reflect on the months of this crisis, the key takeaways are clear: devote the time and resources to plan ahead, have capable and engaged leaders who take business continuity planning seriously, don’t hesitate to take early and decisive action to protect employees, and remain flexible to adapt as circumstances continuously change.
We can hope that we won’t experience another pandemic for many decades, but these takeaways will remain applicable regardless of the nature of the crisis your organization could face.
Recommendations for Financial Institution:
- Create the correct “tone at the top”
- Have a plan that is documented clearly and covers a multitude of scenarios
- Identify emergency response and business recovery team members and their backups
- Prioritize potential emergencies
- Understand core tasks
- Regularly test your ability to respond through drills and surprise events
- Don’t just focus on foreseeable emergencies – be creative and think about unforeseen emergencies