Answering ourclients’ questions on

Pandemic Risk
Management
How ISO 45001 and ISO 22301 cansupport your organization’s response
to pandemics such as COVID-19

Has your businessbeen impacted by
the Coronavirus?

As COVID-19 continues to spread globally,
many of our clients have been asking whatsteps they should be taking.

Risk management approacheswith ISO 45001 and ISO 22301:•

Many clients certify to one or bothof these standards. ISO 45001 or
the occupational health and safety
management system standard(OH&SMS), helps identify hazards andrisks to your workforce such as thosearising from pandemics. ISO 22301 is
the business continuity management
system (BCMS) – this helps
organizations prepare and deal withdisruption, such as the global spread ofa pandemic, like COVID-19.

•Both standards follow the same highlevel structure (HLS) which enables
them to be integrated effectively.
Although these standards are designed
to help organizations anticipate and beprepared for a variety of situations, ourclients have asked us for information on
how they can be used for pandemic riskmanagement.

First and foremost is to follow the trusted sources of advice
and information that are being given by governments and theWorld Health Organization. Then your internal risk management
approach can be applied. This should consider both proactive andreactive requirements within your occupational health and safety
management and business continuity management systems to help
build resilience when managing a pandemic event.

It is essential that any risk management is proportionate andthat any actions and controls to manage risk do not introduce
stigma and discrimination into the workplace. Recent diseases
such as Ebola, SARS, MERS, and COVID-19 have stemmed from
specific countries. Unfortunately, this has often led to racial
abuse and discrimination within workplaces and in the wider
public. Do not make determinations of risk based on race or
country of origin – use only risk guidance from credible sources
such as government health authorities and the World HealthOrganization and be sure to maintain the confidentiality ofpeople confirmed with infections.

Below is a summary of some of the key
elements to consider

Risk management approaches with ISO 45001 and ISO 22301
HLSDefinitions

Clauses

ISO 45001 OH&SMS

ISO 22301 BCMSInjury and ill-health: adverse effect on physical,mental or cognitive condition of a person

Disruption: incident, whether anticipated orunanticipated, that causes an unplanned, negative
deviation from the expected delivery of products andservices according to an organization’s objectives

Hazard: source with a potential to cause injury
and ill-health
Incident: Occurrence arising out of, or in thecourse of, work that could or does result ininjury and ill-health

Incident: event that can be, or could lead to, adisruption, loss, emergency or crisisImpact: outcome of a disruption affecting objectives

Note: Pandemics clearly fall within the scope ofthese definitions.

Note: Pandemics clearly falls within the scope of
this definition

ISO 45001 OH&SMS

ISO 22301 BCMS

Organizations must identify internal and external issues that are relevant to its purpose and that affectits ability to achieve the intended outcome of the management system (MS). Pandemics are one such
issue, that should be identified.

Context

The needs and expectations of workers and other interested parties must be considered. Workers will
have direct needs, concerns, and expectations with regard to pandemics, as will stakeholders such as
patients, clients, suppliers, the Public, and even health authorities and regulators. Additionally, withpandemics, it will be necessary to consider families, particularly those with vulnerable dependents who
may be at increased risk of becoming infected, or may require extended care if they become ill.
This will then inform the risks and opportunities in Clause 6, Planning.
Top management must demonstrate leadership and commitment, ensuring that the MS is integrated
with other business processes, that the necessary resources are in place, the importance of the MS iscommunicated, and continual improvement is demonstrated. All of these elements apply equally when
considering the risks from pandemics, such as COVID-19.

Leadership

Top management also need to ensure that roles, responsibilities and authorities are assigned. In relation topandemics, there may be specific roles, responsibilities and authorities. This may be additional authority
provided to line managers to let employees work from home during an incident; liaison with healthauthorities; or even a specific ‘COVID-19’ management team bringing together necessary expertise inoccupational health, business continuity, communications, operations etc.
ISO 45001 also includes requirements with regard to the consultation and participation of workers –this would need to include pandemic risk management activities.

Risk management approaches with ISO 45001 and ISO 22301
Clauses

ISO 45001 OH&SMS

ISO 22301 BCMS

The risks and opportunities associated with pandemics need to be addressed, so that
the MS accomplish its intended outcomes; reduces or prevents undesired effects, and achieves
continual improvement.
Hazard identification: Pandemics should be identified during this phase.

HLSISO 45001 OH&SMS

ISO 22301 BCMS

Planning

Assessment of risk and opportunities:
COVID-19 will pose a number of health andsafety risks, as well as risks to the OH&SMS.
Additional risks may arise such as delayed orlimited response from emergency services
where an incident unrelated to the pandemic
arises. Increased handwashing will increase
the likelihood of dermatitis. There will also be
opportunities such as introducing home working
and reducing seasonal flu sickness rates asworkers follow improved hygiene routines.

After the organization has identified the context inwhich they operate and therefore the needs andexpectations of interested parties, they need todetermine the risks and opportunities that need tobe addressed to give assurance that the BCMS canachieve what it’s supposed to achieve. Business
continuity objectives need to be established toensure that the effectiveness of the BCMS can bemeasured.

SupportThe necessary resources, competency, awareness, and communication will be required in relation to
the pandemic. This may mean additional alcohol-based hand sanitisers, licences for remote accessto computer systems, repatriation mechanisms, access to additional health expertise, emotional
and psychological support, etc. Resources, in particular people, should be carefully reviewed. Criticalworkers should be identified, and the implications of their absence assessed. This may include top
management, safety critical workers or key contractors. Consideration of emergencies during holidays,
shut down or other times when there may be reduced resourcing should also be considered. This shouldtake account of any travel restrictions. Workers who use public transport may not be able to attend
work if travel restrictions are in place. Where remote working is required, access to computer systems
is prone to outside attacks and threats, especially with regard to fraudulent COVID-19 scams. Everyorganization needs to review their information security awareness program and ensure the necessary
resources to provide regular updates / training to everyone working remotely.
Organizations should also investigate MFA (Multi-factor-authentication) usage and review if systemaccess needs to be limited, e.g. by time-of-day or IP address. Many risk assessments don’t address alarge scale remotework force and therefore organizations are not always implementing suitable controls.

Risk management approaches with ISO 45001 and ISO 22301
Clauses

ISO 45001 OH&SMS

ISO 22301 BCMS

Organizations will plan, implement, control, and maintain the processes necessary for the MS system.
This will include any specific to pandemic risk management.
Temporary changes associated with pandemic
risk, such as changes to working patterns, or
temporary closure of sites need to be managed
effectively.

Operation

The impact on procurement and the supply
chain needs to be carefully assessed. There maybe a range of health and safety implications.
Existing hazards and risks (unrelated to thepandemic) could increase if key contractors orresources are unavailable; for instance if water
treatment experts and chemicals for managing
Legionella are unavailable, Legionella risk could
increase.

Every organization needs documented business
continuity plans (BCP) that describe what to do incase of disruptions, addressing internal and externalinterdependencies. These BCPs may include detailed
descriptions of the response structure for each teamand the relationships between teams.
The process / protocols for internal and external
procedures need to include what, when, with whom,and how to communicate.
The organization must also have plans in place forthe recovery phase, where business activities arerestored, and replacing any temporary measures
adopted during the disruption.

There may be urgency to find temporary
contractors or outsourcing but procurement
processes should not be circumvented – newhealth and safety risks could be introduced
and reputational risks may increase if the new
supplier is not carefully vetted.
Emergency preparedness:

The organization has to identify and select business
continuity strategies that consider options forbefore, during, and after disruption.

Processes for dealing with emergencies need
to be put in place which include establishing
The business continuity arrangements have to beplanned responses, training people on theevaluated. A pandemic event, such as COVID-19, isresponse, and checking that the plan will work
an opportunity to evaluate the plan and strategies.
by testing it regularly. An effective way ofensuring the emergency plan is fit for purpose, isto use ISO 22301 as this represents global goodpractice in managing disruption.

Find out More
Call: + 44 345 080 9000
Visit: bsigroup.com