Business continuity is the new normal: tips on moving forward


Covid-19 has been testing global preparedness to a major crisis. Thus, it is of the uttermost importance that the lessons learned from this dark page in history are not forgotten. The aim of this paper is not just to provide a critique of the work of both institutions and organizations but to highlight concentrations of risk and possible single points of failure for both the public and the private sector.

By definition, a crisis requires crisis management, which is considered as part of a business continuity management system (BCMS), as according to international best practices. A BCMS is not a nice-to-have but a must-have, it is not an additional tool you might decide to use, it is the prime solution; however, knowledge of such international best practices has proved scarce during the Covid-19 emergency. As far as Italy is concerned, in the latest presidential decree called “Cura Italia”, there is no single mention of business continuity, let alone of a BCMS. This is not to say that the Italian government’s reaction was entirely unsuccessful, but it would be irresponsible not to bring up the areas for improvement, given the heavy health, social and financial consequences of Covid-19.

It is important to stress that this report looks at the levels of preparedness both in the public and the private sector, since in order to achieve true resilience a country cannot only rely on its institutions but needs to embed certain principles at the very core of its society. In this regard, business continuity management is a key discipline, which cannot be considered as an additional tool anymore but rather as an essential function. In other words, business continuity needs to become the new normal.

PANTA RAY has been running a webinar series during the pandemic, to provide practitioners with advice on business continuity and resilience. During these events, our team has surveyed the audience several times, gathering insightful knowledge on the level of preparedness both in public and private organizations. Thus, we have decided to examine that data and build a report to provide guidance for organizations. While the nature of the webinar series itself is international, for this specific report we have decided to focus on the Italian response to Covid-19, hence the sample includes professionals operating in Italy.

Executive summary

 190 participants overall;

  • Professionals from:
    • Business continutity
    • Risk
    • Cyber and information security
    • Physical security
    • Top management
    • Health and Safety
    • Information technology
  • 62% believe their top management is dedicated enough to crisis management;
  • 60% have not considered mental health issues as having a serious impact on recovery;
  • 32% rank Italy’s response to the crisis as either good or excellent;
  • 39% believe a public-private partnership is in place but it does not always work;
  • 20% believe Italy’s resilience won’t improve despite the current crisis;
  • In 46% of organizations, top management does not have an active role in crisis communications.

 The role of large organizations

 The very first panel discussed the role of large organizations, with speakers from the food retail and mental health fields who analysed the response to Covid-19 both from an organizational and social point of view. More than eight out of ten attendees (82%) came from the private sector, which is in tune with the overall theme of the discussion. Only half of them stated that they had a sufficient level of knowledge regarding medical equipment in the workplace, which revealed a concentration of risk early on. This lack of awareness reflected average levels of crisis management culture, as only 62% believed their organizations were invested enough in such discipline.

A further red flag consisted in low concerns for mental health issues and their impacts on a social and financial level. Only 40% deemed fear and anxiety related to Covid-19 to be an obstacle in terms of financial recovery, while the remaining 60% appeared not to worry about them. In particular, 37% thought fear and anxiety would not be a substantial hindrance to business, 21% had not raised these issues internally at all, and the remaining 3% considered them not relevant. Unfortunately, reality has proved much harsher than such optimistic responses, with an 80% drop in consumption for the hospitality sector and a 75% contraction in the cosmetics and personal care industry, among others.

A thought from an expert: Dr Vittoria Pietra, Psychologist.

Here is the essence of Covid-19 resilience: our deformation. If we had been resistant, a term dear to the psychoanalytic tradition, we would have rejected change with all our strengths, trying to oppose it to the limit, thus maintaining our life habits unchanged or postponing its occurrence. An example was offered to us by those who continued to carry on with their previous lives, going out without precautions, violating globally established rules in order not to give up or change old habits, those who preferred not to work or study remotely or use new technologies because change, the de-formation, was really unacceptable. Some put a great effort into keeping the same smile, the same expression, the same verve as well as the same indignation, without giving themselves the opportunity to experience new emotions, new states of being: boredom, terror, helplessness, surrender, struggle, hope. Other simply gave up because “if life can’t be the same then it’s not worth it”, because no change appeared acceptable or adoptable in one’s own life dimension.

Hundreds of examples come to mind, they have filled the pages of online newspapers for months, maybe we have not thought of them as resistant individuals but only as determined, controversial or rigid; rigid, in fact, not resilient.

We lack a very important piece, however, in addition to deformation, without which we cannot really speak of resilience, that is the continuity of purposes.

Perhaps not everyone knows that in its purest form resilience implies that the goal that must be achieved. The final goal remains the same; if I change my purpose, even if only slightly, if I choose to do something else, then I’m doing something else. In that case, I am not resilient, but opportunistic, I evaluate the opportunities at stake and choose the ones that can be realized. I change my goals because my previous ones are difficult to achieve.

I do not mean that being resilient means being stubborn, but that to be resilient you must stay with your goal; and this is how resistance, being always in the same place to the end, combined with deformation, hence the change of oneself but not of their goals, produces resilience, in its proper meaning.

Now look around and ask yourselves: how many individuals, how many companies, how many ideas, have proven to be truly resilient in this emergency?Vittoria Pietra, Psychologist.

Rating the response

 Italian practitioners showed mixed feelings about the nationwide response to Covid-19, as two-thirds of them (67%) considered it either poor (16%) or sufficient (51%), with only a minority deeming it good (27%) or excellent (5%). Looking ahead, practitioners did not have their hopes up when considering future disruptions, as 66% believed this crisis might improve the nation’s resilience either in a very limited way (46%) or not at all (20%). Respondents also proved to have a similar consideration of the public-private partnership as a solution, since only 5% stated it works effectively. In addition, some acknowledged the partnership is in place but it does not always work (39%) and others recognised the effort but did not appreciate the results (42%).

Looking at the numbers of ISO 22301 certifications across the world, it is easy to appreciate that the levels of compliance towards this standard (and therefore towards business continuity best practices) in Italy are quite average. In a 2018 survey, ISO reported the estimated number of certified organizations in that year across 69 countries and Italy represented only 2% of the ISO 22301 certifications, ranking 14th behind both larger countries such as the US, China and India but also similar or smaller ones such as the UK, UAE, Spain and Singapore. Based on these premises, the future looks extremely challenging as businesses are likely to face a GDP plunge of 9.5% in 2020 without a proper business continuity management culture.


Communication is a key aspect of a crisis, which is why we delved into the matter with a dedicated webinar, featuring different experts. As we polled the audience, it became clear that communications are another aspect that needs significant improvement in the case of a disruptive event. Only 54% of the respondents stated top management is clearly involved in crisis communications, with 25% clearly saying that crisis communications are not top management’s task as they belong to different departments. In addition, only 10% use emergency notification software, while an additional 45% either have it, but did not use it during the pandemic (20%) or they do not have it despite thinking they should (25%).

However, current arrangements seem not to trigger particular worries among some practitioners, as 32% believe that the response to this crisis will not heavily affect the reputation of their company and 5% confide that it will not be a factor at all in terms of branding. Differently, 63% do concern about how the response to this crisis might impact their company’s reputation. It is hard to evaluate the full consequences of the response to Covid-19 at the moment, as we are still navigating the storm, but judging from previous – even softer – crises it is safe to say that sending out the wrong message could cost an organization key human and financial resources.

It is no surprise then that according to Edelman’s Trust Barometer employees consider their employer as one of the least trustworthy sources, ranking 12th out of 15. Furthermore, only 63% would trust their employer to implement a proper response during the Covid-19 outbreak, and while this is the majority it cannot be ignored that a significant minority do not confide in their management.

Key takeaways

 In light of the findings of this report, it is possible to draw the following takeaways: 

  • Crisis preparedness levels in Italy have serious shortcomings both in the private and in the public sector;
  • Business continuity management’s basic best practices have often been inexplicably disregarded;
  • There is a lack of awareness and consideration of mental health issues that is worrying;
  • Communication in a crisis is key and it was not handled properly during this crisis by organizations in Italy;
  • There is a number of organizations that despite not adopting best practices during the Covid-19 crisis they do not consider them useful in the future;
  • There is a number of organizations that do not believe the response to a crisis such as Covid-19 affects an organization’s reputation;
  • The conversation on mainstream channels regarding business continuity management in Italy continues to be next to inexistent due to a serious lack of awareness.