Most organizations that had a pandemic plan in January 2020 had one written for influenza, sized for a few months, and last opened around 2009. The plan was not useless. It answered a different question from the one COVID-19 asked. It assumed a severe but short event, a workforce that would mostly keep coming to the office, and supply chains that would bend rather than break.
Every infectious-disease event of the last two decades has taught planners something, and each lesson was a little different. Taken together, they describe what a durable pandemic plan needs to cover.
Four outbreaks, four lessons
SARS, 2003: geography and travel
SARS emerged in southern China in late 2002 and spread through air travel in early 2003, with major outbreaks in Hong Kong, Toronto, Singapore and Hanoi. Hospitals amplified transmission, and health-care workers made up a large share of cases. The World Health Organization counted roughly 8,000 probable cases worldwide before the outbreak was contained in mid-2003, and briefly advised against nonessential travel to Toronto that April.
Lesson: a location can be disrupted by quarantine, travel advisories and public fear long before (or without) widespread local disease. Toronto-area businesses dealt with cancelled visits and quarantined staff even though transmission there was concentrated in hospitals.
H1N1, 2009: severity is a variable
Planning in the mid-2000s was built around a severe avian influenza scenario. When H1N1 appeared in the spring of 2009 and the WHO declared a pandemic that June, it was far milder for most people than the H5N1 planning scenario, though it hit children and younger adults harder than seasonal flu usually does. In the United States, vaccine supply was still limited when the autumn wave peaked.
Lesson: a plan written for one severity tends to be applied all-or-nothing. Plans need graduated responses, and they should not assume a vaccine will arrive in time for the first wave.
Ebola, 2014: low risk, high fear
The West African epidemic of 2014 to 2016 was devastating in Guinea, Liberia and Sierra Leone. In the United States, a handful of cases were diagnosed in the fall of 2014, and a few states imposed mandatory quarantine on health workers returning from the region. The actual risk to most American workplaces was negligible. The anxiety was not.
Lesson: the hard questions were HR and communications questions. What can you ask an employee returning from travel? Can you require someone to stay home? Who decides, and who explains it? Organizations that had a policy and a spokesperson ready handled it calmly. Those that improvised made the fear worse.
COVID-19, 2020 to 2023: duration and waves
The WHO declared a public health emergency of international concern on January 30, 2020, and characterized the outbreak as a pandemic on March 11. The emergency phase did not formally end until May 2023, when both the WHO declaration and the US public health emergency expired. In between came repeated waves, office closures, remote work at a scale nobody had tested, school closures, shortages of protective equipment and, later, freight and component disruptions.
Lesson: for many firms, the second-order effects mattered more than staff illness. Childcare, demand swings, supplier failures and the sheer length of the event broke plans that had only modeled absenteeism.
Why a pandemic plan is not a site-loss plan
Most continuity plans are built around losing a place: a building, a data center, a city block. A pandemic takes people instead, and it behaves differently in almost every respect.
| Site-loss event | Pandemic | |
|---|---|---|
| What is lost | Facilities, equipment, systems | Staff availability, across every location |
| Onset | Sudden | Gradual, with warning |
| Duration | Days to weeks | Months to years, in waves |
| Geography | Local or regional | Everywhere at once |
| Recovery site | Usually works | May be equally affected |
| Mutual aid and suppliers | Usually available | Facing the same problems |
| Decision basis | Damage assessment | Uncertain and changing science |
The gradual onset is a trap. Warning time should be an advantage, but it also lets leadership defer decisions because "it isn't here yet."
Planning assumptions
Write assumptions down, date them and revisit them. A reasonable starting set:
- Absenteeism. US federal pandemic influenza planning guidance from the mid-2000s told employers that, in a severe pandemic, absenteeism could reach 40 percent during the peak weeks of a community outbreak, driven by illness, caring for sick family members and fear of infection, with lower rates before and after the peak. Treat that figure as a stress test, not a forecast. Apply it by team: a five-person team can lose everyone.
- Duration. Plan for at least 12 to 18 months with multiple waves, each lasting weeks in a given community.
- Suppliers. Assume key suppliers face the same absenteeism you do.
- Government action. Closures, travel restrictions and quarantine rules may arrive with only days of notice and change frequently.
- Demand. Some products and services will spike while others collapse.
Phased triggers
Official declarations lag. The WHO's pandemic characterization of COVID-19 came after many companies had already restricted travel and tested remote work. Tie your phases to what you can observe locally, including your own absence data.
| Phase | Trigger you can observe | Actions |
|---|---|---|
| 0: Watch | A novel pathogen with human-to-human spread reported anywhere | Assign a monitor; brief leadership; review the annex and stock levels |
| 1: Alert | Sustained spread in several countries, or cases where you operate overseas | Restrict travel to affected areas; confirm remote capacity; contact critical suppliers; draft employee messages |
| 2: Prepare | Cases in your region; public health warnings | Split critical teams; test remote work at full scale; finish cross-training; publish sick-leave and pay rules |
| 3: Respond | Community spread at your sites, or government restrictions | Activate the crisis team; remote work for everyone who can; protective measures for on-site roles; daily absence tracking |
| 4: Sustain | Prolonged or repeated waves | Rotate staff; manage fatigue; re-rank priorities; re-source supplies; revisit financial plans |
| 5: Recover | Sustained decline in local cases | Phased return; restock; after-action review; prepare for the next wave |
Essential functions and cross-training
The business impact analysis already tells you which functions cannot stop. The pandemic question is different: who performs them if a third of the people are out? For each essential function, aim for three trained people, documented procedures that someone other than the expert can follow, and at least one person who can do the work remotely.
For roles that must stay on site (plant operators, lab staff, data center technicians, some trading and operations functions), split teams so one exposure does not take out everyone. Separate shifts, separate floors or separate sites all work. Several large financial firms split trading and operations teams between primary and backup sites in 2020 for exactly this reason.
Remote work
COVID-19 exposed capacity limits that never showed up in tests: VPN concentrators, license counts, laptops, multi-factor authentication tokens and contact center telephony. Test remote work at full scale once a year, not just with a pilot group. Our article on continuity planning for hybrid work covers what changes when the office stops being the default recovery site. Remember the security side too: pandemic-themed phishing rose sharply in 2020, and a dispersed workforce is easier to target.
Supply chain
Map tier-one suppliers and the critical tier-two suppliers behind them, and look for geographic concentration. Hold safety stock of protective equipment and critical spares, with expiry dates tracked. Qualify alternates before you need them, because qualifying a supplier during a shortage means competing with everyone else doing the same thing.
Travel
Set thresholds for restricting travel, name who can approve exceptions, and plan for employees stranded abroad when borders close. Decide in advance what happens when someone returns from an affected area: whether they work from home for a period, and who pays for any quarantine lodging.
Communications: turning outbreak news into decisions
Assign one person to monitor authoritative sources: the CDC, the WHO, and state and local health departments. Ready.gov's pandemic preparedness page is a useful baseline for employee guidance. Give leadership a short weekly note with three headings: what changed, what it means for us, and what decision is needed. For employees, keep a fixed cadence, one source of truth, talking points for managers, and strict confidentiality for anyone's health information.
Return to work
Return is a phase, not a date. Set criteria, bring people back in stages, and handle accommodation requests consistently. Check the building: water systems in buildings left idle for months can develop Legionella risk, and public health guidance after 2020 recommended flushing and testing before reoccupation. Expect to reverse course if a new wave arrives.
Between pandemics
The hardest part is keeping the annex alive when nothing is happening.
- Keep pandemic planning as an annex to the main plan, not a separate binder; our annotated sample plan table of contents shows where it fits.
- Preserve the COVID-19 record: decisions that worked, contacts, templates, and the after-action review.
- Run a tabletop every year or two that jumps forward in weeks, so long-duration problems actually surface.
- Track protective equipment stock and expiry dates.
- Watch emerging threats. The spread of H5N1 avian influenza in US dairy herds since 2024 is a reminder that the next event may not look like the last one.
- Check insurance assumptions. Most commercial policies paid little or nothing for pandemic losses; see our briefing on business interruption insurance and continuity planning.
Frequently asked questions
How is a pandemic plan different from a regular business continuity plan?
A regular plan usually assumes you lose a place and recover somewhere else. A pandemic plan assumes you lose people, everywhere at once, for months, with suppliers and recovery sites facing the same problem. That shifts the focus to staffing depth, remote capacity, communications and long-duration decision-making.
What absenteeism rate should we plan for?
Federal guidance from the mid-2000s suggested planning for absenteeism as high as 40 percent at the peak of a severe wave. Use that as a stress test applied team by team, rather than an expected average. Small teams and single-person roles are where the real exposure sits.
When should we activate the pandemic plan?
Earlier than feels comfortable, and in stages. Use local, observable triggers such as cases in your region, public health warnings and your own absence data, rather than waiting for official declarations. A partial activation that turns out to be unnecessary costs far less than a late one.
Do we still need a pandemic plan after COVID-19?
Yes, though it can be leaner. Remote work capability and much of the policy work already exist; what tends to decay is the documentation, the supplier list, the protective equipment stock and the memory of what worked. A short annex, reviewed annually and exercised occasionally, keeps those from disappearing.