When a power outage struck part of Silicon Valley on a Thursday morning in early October this year, Andrew Peterson, director of finance and accounting at Cartridge World North America, sent his accounting staff home with succinct instructions. "We're still completing our month-end close, as scheduled, by noon tomorrow," he announced. "If you need anything, call me."

The power failure gave the Emeryville, Calif.-based global franchiser of printer-cartridge refilling stores a good opportunity to test its business continuity and pandemic preparedness procedures. "In the event of a pandemic, we would send as many employees responsible for key processes home as possible," Peterson explains. "We would also activate other processes, including scanning and e-mailing critical mail to them ... An important part of business continuity and pandemic preparedness is having employees who are willing and able to work from home. We've given them the tools to do that."

Cartridge World's response to the power outage may have served as valuable preparation. The U.S. Centers for Disease Control and Prevention (CDC) describes the occurrence of a pandemic as "highly likely, if not inevitable." A similar description comes from epidemiologists with the World Health Organization (WHO), who declare that the occurrence of a human pandemic influenza is a matter of "when" rather than "if." A pandemic will likely disrupt organizations on a much longer and more widespread basis than a Category 5 hurricane, a terrorist attack or most other kinds of natural or man-made disasters.

Peterson's company is on the right track: Preparedness planning for such a major upheaval boils down to "people, not just infrastructure," says Barbara Hawkins, manager, corporate health and safety, for E.ON U.S., a global energy-services company headquartered in Louisville, Ky. The next pandemic will leave buildings intact, but it could keep up to 40 percent of an organization's entire workforce off the job. Moving crucial functions and processes to other work locations will not be an option.

Rather than focusing on returning to full operations as quickly as possible, businesses should expect to operate at reduced capacity for 18 months or more. Although it appears likely that a vaccine will be developed after a pandemic emerges, it could take a year or more for one to be ready. Further, once a vaccine becomes available, countries and communities will face the challenges of procuring and distributing it. For those and other reasons, most traditional business continuity plans need enhancements that strengthen an organization's pandemic defenses.

The WHO has pegged the current pandemic alert level at Phase 3 on its six-step scale. "That means there has been very limited human-to-human transmission of a possible pandemic virus," explains Lisa M. Koonin, chief, private and public partners branch, and director of business partnerships for the CDC in Atlanta. "The good news about that is that there is still time to plan."

Planning Needs A Shot In the Arm

As recently as last spring, the vast majority of U.S. companies appeared ill-prepared to respond to a pandemic. In March, a Watson Wyatt Worldwide survey of 90 multinational companies found that only 15 percent of U.S. companies had plans in place to address the consequences of the most likely source of a pandemic: a strain of avian (bird) flu that mutates into a human-to-human flu.

Results of a July survey of 553 companies conducted by The Conference Board suggested that pandemic preparedness planning is advancing, although most of that progress has taken place at larger companies. In that survey, 93 percent of executives at companies with annual revenue of $10 billion or more indicated that their organizations have completed pandemic preparedness plans or were in the process of doing so. However, that proportion steadily decreased according to the size of a company's revenue. Less than 60 percent of companies in the $100 million to $1 billion range said that they had completed or were in the process of completing pandemic-specific continuity plans. Worse, only about 35 percent of companies with annual revenue less than $100 million indicated that they were in the process of developing pandemic preparedness plans -- and none of those companies had completed the plans.

In many cases, CFOs possess the final responsibility for business continuity management and pandemic preparedness efforts. Although the same Conference Board study indicated that only 2.5 percent of CFOs have primary responsibility for planning and implementing their organization's pandemic preparedness, most functional areas that own that primary responsibility -- including risk management, business continuity, procurement and supply chain -- typically report to the CFO.

Worst-Case Scenarios?

If your corporate directors, fellow executives or anyone else needs additional motivation for jump-starting pandemic planning efforts, the following figures might help:

• The World Health Organization estimates that 2 million to 7.4 million people might die.

• The Centers for Disease Control estimates that the economic impact of a pandemic on the country will range from $71.3 billion to $165.5 billion.

• The U.S. Congressional Budget Office reports that a pandemic will cause a recession while reducing U.S. gross domestic product by more than 4 percent.

• The U.S. Department of Homeland Security, the U.S. Department of Health & Human Services (HHS) and the U.S. Department of Commerce report that illness rates will be highest among school-aged children and that an average of 20 percent of working adults will become ill when a pandemic appears in their community.

• HHS and Commerce project that workforce absenteeism rates could reach as high as 40 percent during the peak weeks of an outbreak due to illness, fear of infection and the need to care for stricken family members or school-aged children.

Beyond Traditional Continuity Planning

Traditional business continuity plans are insufficient defenses against a pandemic, but companies with the most advanced pandemic preparedness plans typically use existing continuity plans to build a strong pandemic defense.

"Pandemic planning represents a very broad challenge," notes Michael C. Evangelides, a principal at Deloitte Consulting LLP in Chicago. Evangelides and other pandemic- planning experts point to several areas where the impacts of a pandemic on an organization differ most acutely from the impacts of other disasters and business interruptions:

The Human Challenge. A pandemic will affect employees within every business unit and pose severe challenges. The finance function and IT department will need to address cash-flow and system-overload problems, respectively, with greatly reduced staffs. A seriously truncated HR group will face complex and highly stressful benefits, healthcare and procedural demands. At the same time, employees will bombard them with pressing questions such as, What happens when my sick leave runs out? Can I come to work if my spouse or child is infected? Is my life insurance policy still in effect? Should we let visitors into the building?

"Succession planning and cross-training are vital components of effective planning efforts, because a pandemic will affect so many people," Evangelides says. "This is not a matter of being able to shift key operations to a backup location in the event of a fire." In a highly blogged Law.com article, Baker & McKenzie lawyers Brian Arbetter and Peter Gillespie presented a long list of legal considerations a pandemic would spark, including Occupational Safety and Health Act claims, wage-and-hour laws, Family and Medical Leave Act questions, union contracts, workers' compensation and short-term disability policies, foreign-legal requirements and more.

E.ON U.S is offering annual flu shots, as it does every fall, as part of its corporate wellness program. This year, the company's communications group developed pandemic education notices to accompany the flu-shot program. The communications plan emphasizes the importance and value of basic disease-prevention steps, such as the covering of mouths when coughing, good hand-washing and other such practices that would also serve as valuable defenses in the event that a pandemic influenza occurs. "We're going to use that seasonal flu clinic, as the CDC has suggested, as an opportunity to push that information out to our employees," Hawkins says.

Supply Chain Continuity. In a pandemic, says Evangelides, "the supply chain is only as strong as its weakest link." A typical weak point in prevailing business continuity management has been supply-chain preparedness. "That's where tradi- tional business continuity often falls off a cliff," says Karen Avery, leader of the national continuity risk practice at Marsh Inc., a risk consulting firm in New York City. "Either the plans don't sufficiently identify critical internal and external people or they don't take a deep enough look at their supply chain or 'value chain.' The plans tend to only look within a company's own four walls."

Aon, a Chicago-based risk management and insurance brokerage firm, has asked its major vendors to fill out a pandemic-planning questionnaire. "Most of them are giving us information that we think is reasonable," reports Karl Bryant, director of business continuity. "We don't expect a supplier to have every 'i' dotted and 't' crossed in the documentation of every conceivable pandemic situation ... We're primarily looking for the fact that they have thought this through and have a reasonable level of planning and process in place."

Finance Function Flexibility. Finance and accounting staffs rarely consist of large numbers of telecommuters. That will need to change in the event of a pandemic. Cartridge World and other businesses are now laying the groundwork for more mobile staffs by designing processes that can be conducted remotely. The company strives to work with vendors through electronic billing and payment methods. "We're not very far from running a paper-free office," says Peterson. Plus, the majority of the Wells Fargo banking services the company regularly uses involve electronic exchanges conducted through an Internet connection.

The franchiser and its payroll partner, Paychex, are "working together to ensure that we can process payroll even when our servers are down," says Peterson. "We are developing alternative methods of uploading our payroll numbers to them. We also make sure that we have multiple finance and HR people who can ensure that the payroll process operates in case the people normally assigned to the process are unavailable."

IT Stress. Cartridge World also uses a hosted enterprise resource planning (ERP) system from NetSuite, which includes features that contribute to business continuity, according to Peterson. "They provide us with a data-integrity and data-backup system as well as guaranteed up time that is simply unachievable for most small and mid-sized companies trying to run their own servers," he explains. The hosted solution also can be accessed through a Web browser, the same interface Cartridge World's finance and accounting employees use to access the system within the office.

Telecommuting features prominently in most pandemic plans. However, as Electronic Data Systems Corp. (EDS) fellow Kas Kasravi points out, "IT is young and has never lived through a world-changing event." EDS, based in Plano, Texas, provides IT and business process outsourcing services. Not only are most corporate IT infrastructures "untested," but so are external telecommunications and IT infrastructures. Whether corporate and public systems can support a surge in home-to-office data and voice transmissions represents a crucial pandemic-response question. Forward-looking companies and IT functions have begun trial work-from-home days in which large numbers of employees put virtual private networks through their paces.

Local Relationships. CDC's Koonin affirms that public-sector responsibilities for pandemic responses largely reside with state and local health-services agencies. Those officials will be responsible for decisions on school closures, transit restrictions and the distribution of medicine. "The worst time to exchange business cards is in the middle of a crisis," Koonin says. "It's really important to get to know the local emergency and public-health planners right now."

A Six-Step Preparedness Program

Last spring, Aon initiated a program to retrofit the company's existing business continuity plans to address the unique challenges a pandemic would pose. The company treated the process as a greatly enhanced version of the normal business continuity planning updates that the entire organization conducts quarterly. Although Bryant emphasizes that the company is still in the process of adding many of those enhancements, its six-step approach, which follows, serves as a useful model. It also happens to reflect a similar approach that Aon's business continuity management consulting arm delivers to client companies:

1. Educate executives. Bryant wanted the company's leaders to develop a consistent, fact-based understanding of a pandemic's range of likely impacts. "We gave them some basic science about pandemic influenza," he says. "And then we worked through the planning assumptions in greater detail." For example, Bryant and his team explained that remedies would not be immediately available and that absentee rates could reach as high as 40 percent or more during peak infection waves. They also explained their reasoning behind linking important pandemic-response actions to the WHO's pandemic phases. For example, if Aon Americas needs to change certain terms in a supplier relationship, that shift would be initiated when the WHO raises its pandemic scale to Phase 5. "Relying on shifts set by the WHO is more reliable and more organized than having to negotiate the timing of changes during the actual pandemic," says Bryant.

2. Create "pandemic flu focus groups." Aon's business continuity planning function briefed subject-matter experts selected by each corporate function and business unit to serve as the point people responsible for guiding their groups through their own response plans.

3. Develop a communications plan. Each function and business unit scrutinized its existing continuity plans to ensure that all of the contact information for employees, customers, suppliers and other constituents was up to date.

4. Identify the company's most critical operating processes. "A pandemic flu plan has to take into account that almost everything, including schools, public transportation, may shut down for a period of time," Bryant explains. "Given that possibility, we identified our most critical functions -- those that directly affect the survivability of the business. The goal of the planning process is to figure out how to conduct those critical processes in the face of extremely challenging conditions." Policy administration, which includes renewals, binding coverage and certificates of insurance, and payment processing represent two critical functions at Aon.

5. Organize crucial processes. Aon divided important operating processes into those that can be suspended, those that can be maintained with remote access, and those that require human interaction in an office environment. For the first category, the company analyzed the impact of suspending processes, assembled a communication plan to alert all internal and external parties affected by the suspension, and determined how employees responsible for the suspended process can be reassigned to more important processes.

Next, the company drafted procedural guidelines for continuing to operate processes while responsible employees worked remotely from home. For crucial processes that cannot be operated remotely, the company drafted guidelines for conducting the processes during a pandemic. The guidelines include procedures for limiting direct contact among workers and for protecting employees (via protective gloves, masks and hand gel) who must closely interact with one other.

6. Coordinate an overall mitigation strategy at the corporate level. Finally, Bryant's corporate business continuity planning function reviewed all business-unit and functional plans to ensure that they were consistent with one another. "It is our responsibility to be the shepherds of these plans," he declares.

That shepherding has applications beyond pandemics. "Whether a pandemic ever comes or not, the planning is not a waste of time," Hawkins says. "[It] can apply to any situation in which large numbers of employees cannot get to work for whatever reason."

Just ask Peterson, whose staff met its noon deadline for the month-end close despite the power failure. "We endured no down time at all from the outage," he adds, "except for the time it took them to drive home."

Pandemic Planning Checklist

The U.S. Department of Health and Human Services (HHS) and the Centers for Disease Control and Prevention (CDC) have developed a "Business Pandemic Influenza Planning Checklist," available online at http://www.pandemicflu.gov/plan/businesschecklist.html. The checklist includes the four steps summarized below. Each step contains several action items.

1. Plan for the impact of a pandemic on your business. Understand how the workforce might be disrupted during a pandemic. Employees may fall ill. Or, they may need to stay home to care for sick family members ­ or even healthy children in the event of school closures.

2. Plan for the impact of a pandemic on your employees and customers. Unlike other disasters (with the exception of some forms of bioterrorism), pandemics are unique in that they are infections and jump from person to person through coughing, sneezing and touching. Examine the principles of "social distancing" ­ steps designed to limit close contact between people to prevent or reduce the spread of the virus. Lisa Koonin, chief of the private and public partners branch and director of business partnerships for the CDC, advises companies to consider restrictions on large meetings and, where possible, rely on telecommuting.

3. Establish policies to be implemented during a pandemic. Revisit sick-leave policies and related rules. For example, HR departments that normally require a sick note to support an extended absence should reconsider that rule in the event of a pandemic, when doctors will be overloaded.

4. Allocate resources to protect your employees and customers during a pandemic. For example, if telecommuting is offered as an alternative work arrangement, ensure that the supporting processes and technologies are in place.