Buildings intact, workforce gone: the scenario continuity plans skipped
As markets fell and federal health officials warned of community spread, most continuity plans still assumed the loss of a building. A pandemic removes people, suppliers and remote capacity at once, and plans had to be rebuilt and tested around those three losses.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In the week of February 24, 2020, US stock markets fell sharply as the coronavirus spread in Italy, South Korea and Iran, recording their worst week since the 2008 financial crisis. On February 25, a senior official at the Centers for Disease Control and Prevention said publicly that community spread in the United States was expected. Businesses, schools and families, she said, should begin preparing for disruption. On February 26, a case in California with no known travel history or contact with a known case was reported, suggesting the virus was already spreading locally. Many banks, health systems and agencies began reviewing pandemic and business continuity plans that week, often for the first time in years.
Most business continuity plans in regulated organizations were built around a familiar scenario. A building becomes unavailable because of fire, flood or power loss, and staff relocate or work from home for a few days. A pandemic does not fit that model. It removes no building, yet it can remove a large share of the workforce, affect every supplier at the same moment and require the whole organization to work remotely for months. The gap divides into four parts. Three are losses that plans rarely modeled: the loss of people, the loss of suppliers and the loss of the usual tools. The fourth explains why the gaps went unnoticed: how plans were tested.
The loss of people
Site-based plans assume the staff are fine and the place is not. In a pandemic, the reverse is true. Absence comes from illness, caring responsibilities and school closures, and it is uneven. A small team running a critical process can be badly depleted while the rest of the organization is largely unaffected. Examples include wire operations at a bank, pharmacy informatics at a hospital or payment file transmission at an agency.
The planning unit therefore has to be the critical process and the named people who can perform it. For each process, a plan should record the minimum number of qualified staff, the people currently able to do the work, and the backups who have actually performed it within the last year. Where the list of qualified people is one or two names long, cross-training needs a budget line and a deadline.
Documentation completes the picture. Procedures written so that someone outside the team can follow them, and access rights granted to backups in advance, turn a list of names into real capacity. Plans should also say which tasks can be paused, so that scarce staff are spent on what matters. Many organizations discovered that critical knowledge sat with one or two people because those people had never been unavailable at the same time.
The loss of suppliers
Continuity plans usually assume that if one supplier fails, another can step in. A pandemic hits all suppliers together, including the alternates. Offshore service centers faced their own lockdowns, sometimes with less notice than US operations. Call center vendors, managed service providers and hardware suppliers were stretched at the same moment, and laptops and webcams were scarce within weeks.
The practical question for each critical supplier is what it would do if its own staff could not reach their sites, and whether its plan depends on the same constrained resources as yours. Few organizations had asked, and fewer had contractual rights to an answer. Supplier continuity plans were often filed as documents rather than tested as commitments.
Fourth parties, the suppliers of a supplier, sat outside most programs entirely, even when a single offshore site supported several of an organization’s vendors at once. Mapping where critical vendors’ people actually work, by city and country, shows correlations that vendor-by-vendor reviews miss.
The loss of the usual tools
Remote access in early 2020 was sized for a minority of staff working remotely on a given day. VPN concentrators, licenses for remote desktop and collaboration tools, and help desk capacity were all set for that assumption. Moving most of the workforce home at once multiplied demand on each.
Some roles also depended on equipment or paper that could not easily leave the office: check scanners, secure printers, wet-ink signatures, and specialized clinical or case management workstations. For each, someone had to decide whether to redesign the process, move the equipment or keep a small on-site team, and what control changes each choice required.
Remote capacity therefore belongs in the continuity plan, with its own owner and test. That covers license headroom, network capacity, a supply of managed devices and clear policies for handling regulated data at home, including printing, disposal and the use of personal equipment.
How plans were tested
Continuity tests are usually short and site-based: fail over a data center, relocate a team for a day. None of those would have revealed the three losses above. A credible program tests at least one scenario each year that removes people rather than places, for weeks rather than days, across the supplier base as well as the organization.
Such tests need not be elaborate. A tabletop exercise can ask each critical process owner two questions. Who would do the work if the team were halved for a month? Which supplier would they call if the main provider stopped answering? Those questions surface most of the gaps in an afternoon. The output should be a short list of single points of failure, each with an owner and a date.
Tests should also run long enough to expose fatigue. Remote operations that work for two days can fail over six weeks, as overtime builds, informal workarounds harden into practice and supervisors lose sight of who is doing what. A scenario that steps forward in time, asking what has changed after one week and after one month, catches those second-order effects that a single-day exercise never reaches.
With hindsight
Within three weeks of this point, most office-based staff in banks, health system administration and government agencies were working from home. Organizations that had invested in cloud-based collaboration, laptops rather than desktops and modern remote access coped better than those relying on VPN capacity sized for a few. Small specialist teams, rather than networks, were often the hardest constraint to relieve, because capacity could be bought and expertise could not.
Regulators have since broadened their expectations sector by sector. For hospitals, CMS had added emerging infectious diseases to its all-hazards emergency preparedness guidance in February 2019, and in March 2021 it expanded that guidance with pandemic considerations for staffing, surge capacity and supplies. Bank supervisors moved toward operational resilience, a thread picked up later in this series. Scenario-based, people-centric testing is now a more standard part of continuity programs, though many organizations still test the easy scenarios more often than the hard ones.