March 19, 2020
Business Continuity Plans (BCP) are important part of risk management and can include scenarios such as pandemics like the coronavirus, government shutdowns, natural disasters and cyberattacks. Risk management planning for a pandemic involves identifying risks and assessing the impact and developing mitigation strategies to manage risks.
If your nonprofit does not have a plan in place, you are not alone. As you consider a BCP, begin by addressing these initial considerations:
- Establish how to respond (and whom you will notify) if an employee is diagnosed with coronavirus.
- Cross train employees in the event an employee gets sick or needs to care for a family member. As part of this process, document standard operating procedures for critical positions.
- Clarify how employees will access information when required to work from home. Test your IT systems to determine whether they can handle remote work with all employees working from home.
- Decide when to exclude visitors and how you will communicate with employees, customers, and vendors if you have to close your offices. Can you shift your meetings to virtual forums?
- Determine if you will close your office to employees for the recommended quarantine or longer. Which disinfecting procedures should be followed to clean your office before employees return?
- Conclude how long your nonprofit can survive without new donations, other sources of revenue and critical volunteers. Consider options for shifting fundraising to virtual sources along with communication and relationship building with donors, stakeholders and volunteers. Consider advocating for more support from your funders by asking them for additional funding to address the crisis.
- Determine if there are new or innovative ways you can assist the populations you serve in addressing the coronavirus. Can your organization repurpose existing resources for a period of time?
- Establish which third parties you should contact to discuss their coronavirus plans. Prepare for major disruptions relating to your key service providers. Determine whether you have alternate suppliers/third parties, if needed.
In addition to the steps above, small nonprofits should form a team that meets regularly to discuss the BCP and provide oversight for the organization’s response. See Interim Guidance for Businesses and Employers for additional guidance from the Centers for Disease Control and Prevention (CDC).
GRF CPAs and Advisors’ Risk & Advisory Services team is available to help the nonprofit industry navigate risk events like the COVID-19 outbreak. For more information, contact Melissa Musser, CPA, CITP, CISA, Principal, Risk & Advisory Services at mmusser@grfcpa.com.
