Coronavirus: what can be done right now?

It is difficult to assess whether the epidemic will end soon or continue for a prolonged period. For now, many companies are overburdened or experience temporary stopovers in production and business operations, while their managers have to run the business according to the risk management system if it was implemented.

Our Asian colleagues were one of the first faced problems that pandemic caused, so they had time and possibilities to assess how business has been affected.

In this issue, the experts from Hong Kong BDO outlined key risks and measures that companies should take in the current situation.

It is critical now to assess the risks and systematically secure the data, and also reduce the time for the company to recover. If your company hasn’t done it yet, BDO suggests paying attention to the following risks.

Impact on sustainability

In terms of pandemics it is vital for company to maintain fiscal solvency: the critical element in any time of uncertainty is to ensure that the company’s liquidity position can be maintained and to buy time for the company to recover. Our colleagues from Hong Kong recommend establishing the working group to monitor the level of impact on the business and the status of the key performance indicators for critical business units. Companies may also consider the following actions, among others:

• Conduct a thorough risk assessment of business operations, taking a holistic approach across the globe rather than focusing on certain regions, to assess the level of possible interruption and formulate measures to mitigate potential impacts.

• Review the pace of expenditure in relation to the company’s expansion plans and existing development projects (if any), and slow down the cash burn rate. 

• Re-prioritise the allocation of resources to unaffected business lines.

• Explore and identify business transformation opportunities and models to reduce over-reliance on existing business segments.

• Identify measures for controlling budgets and making cost savings, such as assessing the possibility of outsourcing certain business processes in a cost-effective way.

• Explore opportunities for collaboration with new strategic business partners for new market development and to meet customers’ needs.

• Identify alternative solutions if forced to suspend operations at the business premises.

Impact on contract compliance

Companies may not be able to manage all the coronavirus-related issues resulting from business interruptions, whether they are caused by third-party default or within the company, and some may be unable to meet their contractual obligations because of supply-chain interruptions or unforeseen events beyond the company’s control hindering its performance.

Our colleagues recommend that companies consult their legal advisors and review their contracts to determine what, if any, rights and remedies they have as a result of the delayed performance of contracts.

• Take (and document) reasonable steps to mitigate the impact of the coronavirus as evidence for defence.

• If your company cannot fulfil its contractual obligations, you need to quantify the amount of financial damage and the impact on the longterm business relationships.

• Review their existing insurance policies to find out whether any losses the incur relating to the coronavirus can be covered under existing terms or whether you need to adjust the cover for maximum protection.

Impact on supply chain

Governments around the world have begun to take measures that limit the movement of goods and people between their borders and Chinese borders. As China is the factory of the world, it seems impossible to imagine a scenario in which the supply chain is not affected or disrupted.If a company is aware of a risk of disruption in its supply chains, it should take the following steps, among others, to mitigate the potential consequences of any disruption:

• Understand the behaviour of disruptive models applied to the supply chain and establish the time point at which such disruption is located.

• Consider re-prioritising the production line to respond to market impacts associated with the threat, increase safety stock levels and stockpile essential supplies and resources.

• Pre-qualify alternative domestic or international suppliers and outsourced vendors in case primary suppliers can no longer provide support.

• Formulate contingency measures, give first response and anticipate possible failures in the supply chain. For example, examine the capacity of other suppliers in other geographical areas, change the production mix, plan for new delivery methods to reach customers.

• Assess if suppliers have documented plans for business unit continuity and information technology disaster recovery, including for critical business.

• Take into consideration the absence of a large number of critical staff over an extended period.

• Estimate the recovery time for the supplier’s “mission-critical” business processes.

• Develop actions for business recovery. For example, finding and approving new suppliers, finding alternative modes of transport, identifying which of those options are available, and selling products on that basis.

Impact on health and safety

The coronavirus is an infectious disease. Gathering employees together at the workplace may put them at risk of exposure to the virus. The epidemic is making it challenging for companies to strike a balance between continually maintaining productivity and efficiency and providing a safe working environment for their employees. In any case, the early adoption of adequate preventive measures and maintaining an effective communicable illness policy can help ensure a safe work environment for employees, customers and clients.

• Remind employees about the importance of maintaining personal hygiene and wearing a mask at all times in the workplace.

• Establish a quick process to identify who will take charge at operational locations (and overseas locations) to oversee a crisis management plan and local employees.

• Disseminate information on precautions to stop the spread of the virus.

• Constantly update on records of travel, and monitor employees’ exposure to the source of the coronavirus.

• Adjust seating arrangements in the workplace so that a safe distance can be maintained between employees.

• Review and evaluate home office working policies and capabilities.

• Provide sufficient and accessible infection control supplies (e.g. supplies of masks).

• Establish procedures for regular body temperature checks for employees and visitors, and ensure these are followed.

• Comply with all compulsory reporting and quarantine requirements announced by the health authorities.

• Report on and monitor sick leave and symptoms.

• Anticipate fear, anxiety, rumours and misinformation among employees and plan communications accordingly.

• Develop a platform or communication channel (eg hotline) to communicate information about the pandemic inside and outside the organisation.

Impact on technology

The outbreak of the coronavirus has caused significant disruption to many businesses. As such, many companies have activated contingency and business continuity measures and have allowed employees to work from home to limit the spread of the virus. These employees are connecting to the company’s networks remotely. At the same time, with the popularity of smartphones and instant messaging applications, employees can communicate with colleagues, customers and vendors via mobile applications.

In general, it is important to ensure that network connections are secure and mitigate the data protection risk associated with communicating through mobile applications.

• Assess if the security settings for remote connections and secured individual access mechanisms are in place.

• Adopt multi-factor authentication for employees who are logging into the company network.

• Review communications and information technology infrastructures as needed to support employee telecommuting and remote customer access.

• Enhance user awareness of cyber-attacks and alerts on these.

• Monitor the use of unauthorised computers (especially for companies that have adopted a Bring Your Own Device policy) and their access to the network.

• Review the data backup policy and the frequency and adequacy of backup practices.

• Review the appropriateness of using social media and instant messaging applications for business purposes. Minimise or even prohibit the transfer of confidential and business-related files over social media applications.

• Communication over instant messaging applications should always involve at least two relevant key employees in order to avoid loss of correspondence for future reference.