Ebola risk: from epidemic to pandemic?

In our latest From the Archives piece, The Risk Universe columnist Annie Searle examines the spread of Ebola and lessons for financial sector planning. This article originally appeared in issue 33 of The Risk Universe magazine in September 2014.

We have been watching the spread of Ebola in West Africa since spring. The stories are frightening to read. How can poor countries get in front of such an outbreak? What is their governments’ role in communicating the types and sources of risk citizens are facing? Can they actually force citizens to drop cultural practices that span centuries? How is it that the World Health Organisation’s budget is so reduced at such a time? Why is it that most of the alarm and pressure to take action has been raised by on-the-ground global organisations like Doctors Without Borders?

Seven years ago, it was a different matter when I first wrote on US financial sector planning for pandemic flu, specifically H5N1, for the British Journal of Business Continuity & Emergency Management (Volume 1, Number 3, March 2007). A year later, as the situation seemed to worsen, I wrote on additional pandemic planning steps taken by the US government and the banking and financial sector (Volume 2, Number 4, March 2008). A lot has changed in seven years. I believe that, based on the 2009 H1N1 pandemic flu campaign launched by the US Center for Diseases Control, we now understand that no plan to handle a public health crisis can be cast in concrete and issued with a user’s manual, whether epidemic or pandemic. If you’re overseeing your firm’s contingency plans, there are some practical steps you can take in anticipation of a virus that just may jump continents.


Take a fresh look at your existing programme. What critical processes do you absolutely have to  maintain in light of an assumed absentee rate of up to 40% at any given time? Which processes can you suspend during the event? Which processes can you perform less frequently, or on a reduced basis?


This is literally one of the most challenging aspects of a worst case plan. You have to assume that your senior executives are just as vulnerable as your most valued front line or IT support employees. At Washington Mutual in 2006, we created a “delegation of authority” form in which every executive and manager wrote down the names of  2-3 designees, in case he/she was out ill. We also identified the eight-member crisis management team as the manager of the pandemic event, with each member having an alternate.


Some organisations may have email addresses for employees, but no cell phone numbers. This precludes good use of text messaging during such an event. Obtaining a personal cell number may  require that you explain and then explain again why you need it.


Under what conditions will you ask an employee to travel to West Africa? Or through an airport that services West Africa? Do you have a programme that tracks locations of all employees flying on behalf of the company? What assistance would you provide to an employee who inadvertently was quarantined? If you don’t now have such policies, you still have time to create them.


Despite what’s in the contract, how can your firm be sure you’ll be made a priority during a  pandemic, when your vendor will be equally disadvantaged as you are? Check to be sure the vendor has a pandemic plan. We actually ended up writing it into our critical vendor contracts.


Assume you can’t do it all during a high impact event. “Identify customer-facing offices, administrative support facilities and ATM locations that will be kept open in main markets, and establish mechanisms to inform both customers and employees” [Searle, 2007]. At Washington Mutual, we took a strategy developed during hurricanes in Florida and applied it across the country, setting criteria for the “hub branches” that would remain open, and communicated it in advance, so employees knew where to report and customers would know where they could get money.


Once you have a plan, then begin testing it quarterly, sizing the impact of such an event up or down. This is how you continuously improve your plan; make it more flexible and applicable to situations outside public health crises. Holes still exist in most institutions’ plan to have large numbers of employees telecommute. The assumption that the Internet would be available at a time when your  children might be home from school playing games or watching movies is not well thought out.


Work now with regulators, country by country, to establish which business processes you normally use to communicate with them could be suspended or reduced during the event. Even the regulators will need to create plans around how they will continue to keep the cash moving. These steps can be considered as good for your all-hazards plan as well as a pandemic plan. There are several specific steps you can take for better preparation in case Ebola jumps continents.


As far as we know, Ebola is not currently an airborne virus. But it could mutate. But body fluids get attached to hands, which use door knobs, common utensils, office supplies, etc. Along with washing your hands frequently, try to keep your own workspace sanitized as well.


I remember reading a study that indicated that those who had a flu shot each year had built up a certain amount of possibly useful immunity against infectious diseases.


Will you pay people some amount of their salary even if they are sick and/or have exceeded the number of sick days available? At Washington Mutual, we had determined to either extend  everyone’s amount of sick time by seven work days; or to pay them at the going disability rate. Ironically, the executives did not want employees to know that this would be the plan. Like so many other decisions, that was shortsighted. Had employees known, they would have been informed and worked together to help cross train their fellow employees so that the institution would survive such an event. All eyes are on the rapidly evolving situation in West Africa. The World Health Organisation is short of funds, supplies and personnel. Organisations like Doctors Without Borders are currently carrying the load. It is going to get much worse before it gets better, and it is going to take a long time to contain Ebola. First steps are underway now on trial vaccines or the use of Ebola survivors’ blood. The cultural challenges are profound: what right do we have to tell them what to do? In the name of what? Nowhere have we ever seen the Digital Divide manifest itself so clearly as we are observing right now in West Africa. To those who say, “Don’t worry, it won’t affect us,” I say tighten up your plans while you have time.

Annie Searle is an Associate Teaching Professor at the University of Washington’s Information School, where she teaches risk, cybersecurity, privacy information ethics, policy, and law. She is a former senior executive at Washington Mutual Bank, heading its Enterprise Risk Services and Crisis Management Team for 10 years.  ASA, her private risk advisory firm, focuses primarily on advocacy around critical infrastructure policy and on research publications.