Business Continuity: 7 Health and Safety Gaps in Most Plans
Your continuity plan is probably good. It was written by people who understood the systems, it identifies critical functions, it has recovery time objectives, and in a regulated firm it has been tested and reported on.
It also almost certainly assumes that several hundred people will be somewhere else by tomorrow morning, and it is unlikely that anyone has assessed where. Continuity planning treats buildings as capacity and people as resources. Health and safety treats buildings as workplaces and people as people, and the moment a plan is invoked those two views collide.
Seven gaps, in the order they appear when something actually happens.
1. The alternate site has never been assessed as a workplace
The most common gap and the easiest to close.
A plan that names a recovery site, a second office, a serviced workspace or a partner's premises has identified a location. It has usually not established whether that location is suitable for the number of people who will arrive, or what its fire strategy, first aid provision and welfare facilities look like at that occupancy.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires assessment of the risks to employees, and it does not carve out the places you have planned to send them. An assessment of your normal office is not an assessment of the site you will occupy under pressure, at higher density, with people who have never been there before.
Ask three questions of any named alternate location: what is its assessed occupancy, who holds its fire risk assessment, and what happens to that assessment when your people double its headcount.
2. Evacuation and displacement are treated as one event
They are different problems and plans routinely conflate them.
Evacuation is getting people out of a building safely, and it is governed by established duties. Regulation 8 requires procedures for serious and imminent danger and the nomination of sufficient competent persons to implement evacuation, and regulation 9 requires necessary contacts with external services. Fire legislation adds its own requirements for emergency procedures.
Displacement is what happens over the following days: where people work, under what conditions, with what equipment, and for how long. Almost every plan covers the first thoroughly and the second not at all, which is odd given the first lasts twenty minutes and the second can last months.
3. Personal evacuation arrangements do not travel
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The gap with the most serious consequences and the least visibility.
If someone in your organisation needs assistance to evacuate, that arrangement was built around a specific building: its refuges, its evacuation lift, its designated assistants, its route. Move that person to an alternate site and none of it applies, and the people around them may not know it is needed.
Personal emergency evacuation plans should exist for every location a person may be asked to work in, including recovery sites. This is the item most likely to be missing and the one where the consequence of the gap is not administrative.
4. Homeworking at scale is a decision nobody assessed
Most modern plans default to sending everyone home, which is sensible and is also a change to where several hundred people work, made overnight, with no assessment.
The duty does not pause because the arrangement is temporary. Display screen equipment requirements attach to users, and HSE's guidance on display screen equipment addresses habitual home use. People who normally attend an office may have no suitable chair, no monitor, no dock and nowhere to work that is not a kitchen table.
The workable answer is decided in advance, not during: a short self-assessment ready to issue, an equipment position agreed with finance, and a route for people who cannot work safely at home to say so and be given an alternative.
5. Nobody owns duty of care during the disruption itself
The period between the incident and the new normal is where people actually get hurt, and it usually has no owner.
Consider what a plan invocation typically involves: people leaving a building quickly, travelling home at unusual hours, being asked to work extended shifts to recover position, attending an unfamiliar site, and doing so while anxious. Injuries during evacuation, travel incidents, fatigue from recovery working and acute stress are all foreseeable consequences of the plan itself.
Name someone accountable for people, separately from whoever is accountable for systems and premises, and give them authority to spend. Decisions about taxis, hotels, stand-downs and shift limits are made badly when they require escalation at two in the morning.
6. Incidents during disruption never reach the register
If someone is injured at a recovery site, or working from home during an invocation, that event has to be recorded and may be reportable.
In practice it frequently is not, because the normal reporting route ran through an office that is closed, and everyone is busy. The consequence is that the organisation loses exactly the data it needs to improve the plan, and a reportable incident goes unreported.
Agree the reporting route as part of the plan itself, and hold these records with your ordinary ones, which is where health and safety consultants and software are worth more together than either alone.
7. Multi-country plans assume the arrangements transfer
For groups, the final gap.
Emergency procedure requirements are national, and so is much of what surrounds them. Where employee representatives have statutory standing, a significant change to working arrangements engages consultation obligations even when the change is a response to an emergency, and a group that invokes a plan uniformly across eight countries may be procedurally correct in some and not in others.
Local arrangements also differ in substance: who must be notified, within what period, and by whom. A plan written to one national standard and translated will be adequate somewhere and wrong elsewhere. Periodic health and safety audits are the practical way to establish which is which before the plan is needed.
Testing the plan against the people question
| Element | The question to ask | Usual answer | |---|---|---| | Alternate site | Assessed as a workplace at the planned occupancy? | Identified, not assessed | | Evacuation | Procedures, competent persons, external contacts in place? | Yes, this part is usually good | | Displacement | Conditions for the following weeks defined? | Not addressed | | Individual evacuation needs | Plans exist for every possible location? | Home site only | | Homeworking at scale | Assessment and equipment position agreed in advance? | Decided during the event | | Accountability for people | Named, separate from systems, with spending authority | Nobody | | Incident recording | Route agreed for the invocation period? | Reverts to a closed office | | Other countries | Local emergency and consultation requirements confirmed? | Group plan translated |
The pattern is that continuity planning is strong on the twenty minutes of an evacuation and weak on the three months afterwards. That is the reverse of where the exposure sits.
For regulated firms specifically
Financial services organisations already carry operational resilience expectations and test against severe but plausible scenarios. That discipline is genuinely useful here, and it has a blind spot.
Resilience testing tends to ask whether a service can be delivered. It asks less often whether the people delivering it, in the conditions the scenario creates, are working somewhere that has been assessed, with equipment they have, for hours somebody has considered. Adding that question to an existing testing cycle costs very little and is considerably easier than building a separate exercise. HSE's introduction to risk assessment is a reasonable reference for the approach.
Where Arinite fits
Arinite assesses the places organisations actually plan to use, including the ones they hope never to need. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with finance and banking, insurance and legal organisations, where continuity planning is mature and its people dimension frequently is not.
Where plans span several countries, our global health and safety consultants confirm what each jurisdiction requires of emergency arrangements and consultation, and our international health and safety consultants keep that current as sites change.
If your plan names a recovery location that nobody has assessed, a free gap analysis will tell you what invoking it would actually involve.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
