10. People: workforce continuity and human resilience

Four days after the shock, the leadership team felt something close to relief. Core systems were back online, and most customer data was intact. The crisis, it seemed, was becoming a recovery. But on the same day, India announced it was aligning with the US sanctions framework.

Why did it matter ? Three years earlier, the company had offshored most of its IT operations to a managed services provider in Bangalore. The decision had been straightforward: deep talent pool, lower costs, round-the-clock coverage. The team in India had become the backbone of day-to-day infrastructure management: monitoring, patching, deployments, incident response. They knew the systems better than anyone in the Paris headquarters.  and the provider notified that services to EU-sanctioned entities would be suspended, the disconnection was immediate. No transition. No handover. The people who knew how everything actually ran were gone overnight.

At the same time, the New York subsidiary was falling apart. The CMO (an American hired two years ago to lead the company's expansion into the US market) had built his entire team locally. Seven direct reports, most based on the east coast, all employed through the US entity that had become sanctioned. By Wednesday, three had updated their LinkedIn profiles. The CMO himself had stopped responding to messages. His lawyer had advised him not to engage with a sanctioned European employer until the legal picture clarified.

The CEO stared at the org chart. Half of IT was in a country that had just cut ties. The entire US commercial team was gone. And the Head of People was trying to piece together who still worked for the company, from a spreadsheet she had last exported four months ago because the HRIS, a US-based platform, had been unreachable since the Shock.

Failure modes

Digital preparedness usually focuses on systems, data, and infrastructure. But every recovery plan ultimately depends on people: their availability, their legal right to work, their willingness to stay, and their ability to function under stress. When a systemic disruption hits, the workforce itself becomes a fragile dependency.

Several failure modes are specific to people and HR:

• European companies employing non-EU nationals or operating foreign subsidiaries face three distinct workforce risks. First, EU sanctions may directly restrict the company's ability to employ nationals of a targeted country, regardless of how long they have worked for the company or how critical their role is. Second, an employee's home country may revoke passports, mandate repatriation, or coerce its diaspora into returning. Third, foreign subsidiaries may be seized or shut down by their host country.
• Knowledge concentration. Most companies have at least a few individuals who are the sole holders of critical operational knowledge: how a particular system works, where certain credentials are stored, how a key integration was built. Under normal conditions, this is a manageable risk. Under disruption, it becomes acute, especially if the knowledgeable individual is also personally affected by the crisis. 
• Contractor and freelancer payment disruption. Companies that rely on contractors paid through US-based platforms face a specific risk: if those platforms become unavailable or freeze accounts, contractors stop being paid. Unlike employees, contractors have no contractual obligation to keep working without payment. Critical contractors may simply stop delivering, with no notice and no recourse.
• Benefits and equity inaccessibility. Employment contracts, health insurance details, and pension information are frequently stored exclusively in SaaS platforms. When these platforms are unavailable, employees cannot verify their entitlements, and the company cannot demonstrate its obligations. This creates anxiety and erodes trust at precisely the moment when trust matters most.
• Communication vacuum. In the absence of structured, honest communication from leadership, employees fill the silence with assumptions, and usually the worst ones. Rumors circulate. People begin making personal contingency plans. The best employees, the ones with options, are often the first to leave. A communication vacuum during a crisis is not a neutral state. It is an active accelerant of attrition.

Objectives

Workforce continuity ensures that the company retains the people it needs to recover, and that those people are legally, practically, and psychologically able to work. Specifically, the company must be able to:

• confirm who works for the company and in what capacity, without relying on a single SaaS platform,
• identify and mitigate immigration and visa risks before they become irreversible,
• ensure that critical operational knowledge survives the loss of any single individual,
• honour its obligations to employees regarding compensation, benefits, and equity,
• maintain payment paths for critical contractors and freelancers,
• and communicate with the entire workforce honestly, quickly, and through channels that actually work.

Solutions

Offline employee registry

The employee registry is the HR equivalent of the Critical Knowledge Map described in Chapter 1. It is a periodically exported, offline-accessible record of everyone who works for the company.

This registry should include, at a minimum: full legal name, role and department, contract type (employee, contractor, freelancer), jurisdiction of residence, jurisdiction of employment (if different), work visa or permit status and sponsoring entity, personal email and phone number, bank details for payroll, and emergency contact.

The registry should be stored independently of the HRIS, in a format that does not require proprietary software to read (a spreadsheet or a CSV file is sufficient). It should be accessible to at least two named individuals in the company, and its existence should not depend on cloud infrastructure.

This is not a replacement for the HRIS. It is a fallback that ensures the company knows who it employs when the HRIS is dark.

Immigration and visa exposure audit