Pandemics and Business Continuity Plans (BCP) [2026 Updated Edition]

The COVID-19 pandemic that struck the world from early 2020 had an enormous impact on the global economy and society for approximately three years, until the World Health Organization (WHO) declared an end to the emergency in May 2023. Many companies were forced to scale back operations or even went bankrupt due to this pandemic. Employment retention became difficult, and there were also cases of job offer cancellations.

However, the lessons learned from this experience are immeasurable. In particular, many organizations have come to recognize the importance of Business Continuity Plans (BCPs) and have worked to improve their development and effectiveness.

Do your organizations have effective business continuity plans in place, with regular reviews and updates?

Two Types of BCPs

In fact, there are two main types of BCPs. One is the “Severe Disaster Edition” and the second is the “Pandemic Edition.” These are also distinguished as different scenarios in the international standard ISO 22301 (Business Continuity Management Systems).

Severe disasters refer to natural disasters such as earthquakes, tsunamis, typhoons, and floods, as well as large-scale fires and terrorist attacks. Pandemics, on the other hand, refer to worldwide outbreaks of infectious diseases.

The critical point is that the response methods for the “Severe Disaster Edition” and “Pandemic Edition” are completely opposite. Without understanding this difference, creating a uniform BCP may prevent appropriate responses during an actual crisis.

Severe Disaster Edition

Characteristics of Severe Disasters

Severe disasters have the following characteristics:

Geographic Localization: Damage is concentrated in specific regions. For example, during the Great East Japan Earthquake (2011), the Tohoku region suffered devastating damage, while western Japan was spared direct impact.

Unpredictability: Accurate prediction of timing and scale is difficult. Earthquake prediction is scientifically extremely challenging, occurring suddenly without warning.

Immediate Infrastructure Damage: Communication infrastructure (mobile phone networks, internet connections), transportation infrastructure (roads, railways), and lifelines such as electricity and water are damaged simultaneously in multiple locations.

Loss of Physical Resources: Physical assets such as buildings, equipment, and inventory are damaged or destroyed.

Response Principle for Severe Disasters: “Consolidation”

The basic principle when a severe disaster occurs is “how quickly people and resources can be consolidated.”

At a safe alternative site away from the disaster area, pre-designated in the BCP (e.g., a suburban office away from the disaster zone, facilities of affiliated companies), key members should gather within 72 hours of the disaster to establish a disaster response headquarters. This 72-hour timeframe is considered a standard target in crisis management practice, as it represents the period when initial chaos subsides and damage assessment becomes possible.

The following items should be stockpiled in advance at alternative sites:

• Information and communication equipment (laptop computers, satellite phones, mobile Wi-Fi routers, chargers, backup batteries)
• Office supplies (whiteboards, writing instruments, printing paper, etc.)
• Food and drinking water (minimum 3 days, preferably 1 week)
• Sanitary supplies (first aid kits, medicines, masks, disinfectants, etc.)
• Bedding and daily necessities (blankets, sleeping bags, change of clothes, flashlights, etc.)
• Backups of important documents (both electronic data and paper media)

For manufacturing companies, it is essential to pre-determine alternative production sites and establish systems that can continue manufacturing key products. Companies dealing with products related to lifelines, such as pharmaceuticals, medical devices, and food, are recommended to maintain strategic stockpiles of approximately 90 days.

Priority for Recovery

System recovery should be implemented in the following priority order according to business impact:

First Priority: Basic Infrastructure (email, internal portals, core communication systems)

Second Priority: Accounting and Sales Systems (accounting systems, customer management systems, order processing systems)

Third Priority: Manufacturing Systems (production management systems, quality control systems, inventory management systems)

Fourth Priority: Development Systems (R&D systems, design support systems)

However, this priority order should be adjusted according to the industry and business characteristics of the company. For example, for pharmaceutical companies, manufacturing systems should be elevated to second priority.

Pandemic Edition

Characteristics of Pandemics

The COVID-19 experience has clarified that pandemics have the following characteristics:

Predictability: Infectious disease transmission follows certain patterns. For example, with COVID-19, there was approximately a 2-3 month period from the confirmation of the first case in Japan to the peak of infection spread. This grace period can be utilized for preparation.

Geographic Extensiveness: In today’s globalized society, infectious diseases spread rapidly nationwide and even worldwide. Rather than localized damage, simultaneous multi-point impacts occur.

Long-term Continuity: Long-term impacts lasting from several months to several years are anticipated. COVID-19 affected socioeconomic activities for approximately three years.

Predictability of Containment: The timing of containment can be predicted to some extent through vaccine and treatment development, and acquisition of herd immunity.

Infrastructure Maintenance: Unlike severe disasters, physical infrastructure such as communications and electricity basically maintains functionality.

Response Principle During Pandemics: “Dispersion”

The basic principle when a pandemic occurs is the exact opposite of severe disasters: “how to avoid gathering people and disperse them.”

Essential Workers and Business Continuity

Many industries exist that cannot shut down even during a pandemic. These are called “essential workers” and are indispensable for maintaining social infrastructure:

• Medical institutions (hospitals, clinics, pharmacies)
• Public safety (police, fire departments, coast guard)
• Government agencies (central ministries, local governments)
• Lifelines (electricity, gas, water, telecommunications)
• Logistics and transportation (trucking, railways, aviation)
• Food supply (supermarkets, food manufacturing)
• Financial institutions (banks, securities companies)

In these industries, maintaining 100% of normal operations is difficult, but minimum business continuity is socially required.

Practicing Dispersed Business Continuity

In business continuity under a pandemic, the following dispersed approaches are effective:

Dispersed Organizational Operations: Management and headquarters functions should primarily work remotely, concentrating on field operations such as manufacturing, logistics, and face-to-face services that require physical presence.

Staged Personnel Operations: Divide employees into multiple teams (e.g., Team A, Team B) and implement operations on a rotation basis. If an infection occurs in one team, that entire team is placed on home standby while the other team continues operations. This avoids the risk of the entire organization simultaneously ceasing to function.

Manufacturing Prioritization: When manufacturing all products as usual is difficult, concentrate production on socially important products such as pharmaceuticals, medical devices, and food.

50% Rule: It is important to establish a system that can operate with approximately 50-70% of normal manpower at all times. This serves as a safety margin that allows business to continue even when personnel unexpectedly decrease due to infection spread or close contact quarantine.

Practice and Challenges of Remote Work

The COVID-19 pandemic promoted the full-scale social implementation of remote work. Remote work, which was implemented only at some progressive companies in early 2020, has now become a standard work option at many organizations.

However, effective implementation of remote work requires preparation:

Technical Preparation: IT infrastructure such as secure VPN connections, cloud-based business systems, web conferencing tools, and electronic approval systems must be established.

Organizational Preparation: Formulation of remote work regulations, review of labor management methods, and adjustment of evaluation systems are necessary.

Individual Preparation: All employees, including managers, need to acquire skills to smoothly execute communication, work instructions, and approvals/decisions in remote environments.

Therefore, it is extremely important to regularly conduct remote work rehearsals before a pandemic occurs. For example, it is recommended that department heads and above conduct remote work drills at least twice a year, and all employees at least once a year, to identify and improve problems.

New Ways of Working After the Pandemic

The COVID-19 pandemic has significantly transformed social perceptions regarding work styles.

Establishment of Hybrid Work: “Hybrid work,” which combines both remote work and office attendance rather than being fully remote or fully in-office, has become the standard at many companies.

Acceleration of Digital Transformation: The transition from paper-based business processes to digitization has progressed rapidly. Electronic signatures, cloud storage, and online meetings have become everyday tools.

Evolution of Communication Infrastructure: 5G (Fifth Generation Mobile Communication System) service began in Japan in 2020 and is now widely adopted. The high-speed, high-capacity, and low-latency characteristics of 5G have made high-quality video conferencing and large-capacity data exchange possible even in remote environments, significantly improving the effectiveness of remote work.

Metaverse and Virtual Offices: Experiments with virtual offices utilizing VR (Virtual Reality) and AR (Augmented Reality) technologies have also begun, exploring new forms of collaboration that transcend physical distance.

Continuous Improvement of BCPs

International standards such as ISO 22301 require that BCPs not be created once and finished, but continuously reviewed and improved (PDCA cycle).

Regular Reviews: BCPs should be reviewed at least once a year, or when there are significant organizational changes (business content changes, new business launches, large-scale organizational restructuring, etc.).

Practical Training: It is important to regularly conduct practical training that actually switches systems or performs work at alternative sites, not just tabletop exercises (simulations).

Stakeholder Collaboration: BCP response across the entire supply chain is important. It is desirable to share BCP-related information with key suppliers and customers and establish systems that enable coordinated responses.

Conclusion

Having experienced the unprecedented crisis of the COVID-19 pandemic, we have learned the important lesson that response methods are completely opposite for severe disasters and pandemics. “Consolidation” is the basic principle for severe disasters, while “dispersion” is the principle for pandemics.

Furthermore, remote work and digital technologies are no longer temporary emergency measures but have become standard work options that should be utilized even during normal times. With the evolution of communication technologies including 5G, remote work and hybrid work will continue to advance further.

No one knows when the next pandemic or severe disaster will occur. However, by formulating appropriate BCPs, conducting regular training, and continuously improving them, organizations can enhance their resilience and build corporate structures that are resistant to crises.

I strongly recommend that your organizations also review your BCPs once again and evolve them into effective plans.