Business Continuity Planning

1
Business Continuity Planning

• Debbie Brown,
• Emergency Planning/ Business Continuity Lead
  Officer,
• NHS Nottinghamshire County

2

• What is Business Continuity?

3

• Definitions

BS 25999 Business Continuity Planning
Strategic and tactical capability of the
organisation to plan for and respond to incidents
and business disruptions in order to continue
business operations at any acceptable pre-defined
level.
Business Continuity Management
Holistic management process that identifies
potential threats to an organisation and the
impacts to business operations that those
threats, if realised, might cause and which
provides a framework for building organisational
resilience with the capability for an effective
response that safeguards the interests of its key
stakeholders, reputation, brand and
value-creating activities.
My Definition
The processes, procedures, decisions and
activities that enable your business to continue
to function through an operational interruption.
4

• Do I have to do it?

5

• Civil Contingencies Act 2004

• Business Continuity Management
• (The requirement of all Category 1 and 2
  responders and their contractors as per CCA 2004)
• Business Continuity Promotion
• (The responsibility of Local Authorities to
  promote operation of Business Continuity to
  businesses)

6
But why else would I bother?

• Good Business Continuity practice identifies
  weaknesses and potential points of failure in
  service delivery,
• It allows your business the opportunity to reduce
  risk and develop robust recovery procedures,
• It provides your business the potential to
  increase reliability of service delivery and
  helps protect your reputation.

7

• What are operational interruptions?
• What operational interruptions have you been
  involved in?

8

• Fire
• Flooding
• Burst pipes
• Gas leaks/explosions
• Loss of premises
• Loss of IT or telecommunication systems
• Utilities failure (electricity/water/gas)
• Staff absence/sickness
• Supplier failure
• Burglary, vandalism
• Terrorist threat
• Etc

9
So how do I write a Business Continuity Plan?
10
What makes it tick? Knowing your business
Does it work? Running Exercises
What might happen? Completing BIAs and risk
assessment
What do you need to put in place? Preparing BC
Plans
What are you going to do? Agreeing your strategy
11
Step 1 - Analyse
Understanding your businessWhat makes your area
of work tick?

• Identify and list the functions/process undertaken

• Accurate assessment of critical / essential /
  non-essential functions

Critical activities which have to be performed
to deliver the key services which enable an
organisation to meet its most important and
time-sensitive objectives

• Ask yourself Qs what is crucial to keep
  operating (utilities, staff etc)

• Identify staff with critical roles

• What are our strengths and how resilient

• Are there any contingency plans in place

Ensure to involve all staff in your areas of
activity
12
Step 2 Assess the Risks

• Identify the risks that pose a threat to the
  performance of critical functions. Why?

• Assist with planning and help focus resources in
  the right area and develop appropriate plans

Considerations

• How likely will the risk happen?

• What effect would it have?

Risk threat that an event/action will affect day
to day activities

• Risks will vary dependant on area of activity

• Consult the Community Risk Register to ensure all
  risks are identified (via Local Resilience Forum
  Website www.nottsprepared.gov.uk)

13
Step 3 Strategy
For each risk identified you will have to decide
which of the following options to apply to that
risk

• TOLERATE accept risk and do nothing

• TREAT introduce further controls apply
  business continuity contingencies

• TRANSFER contract the risk out or use insurance

• TERMINATE replace with lower risk solution or
  no longer undertake activity

Nature of risk likelihood / impact will decide
which strategy is appropriate and action if any
to take
14
Step 4 Develop your Plan
Plan when implemented will prevent or minimise
operational interruptions and help the
organisation to quickly return to a state of
Business as Usual.
The plan provides the framework from which to
mobilise the response to an emergency
Points to consider

• Simple and understood by everyone

• Tick boxes against every action

• Clear, direct instructions / actions

• Communicated and understood by all

• List of plan holders

• Keep plans updated

15
Step 5 Rehearse the plan
A plan is a living document, weaknesses are
discovered when put into action
Rehearsal helps you confirm that the plan is
robust an a good way to train your staff with
their business continuity responsibilities
Ways to rehearse your plan

• Paper based exercises

• Telephone cascading

• Full rehearsal of live simulation exercises

• Real time tests

• Test essential systems (e.g. power supply)

• no warning tests

Frequency of tests will depends on activity to be
tested staff / organisation change
16
Where can you get further information?

• Emergency Preparedness Website
• (www.nottsprepared.gov.uk)
• (www.ukresilience.gov.uk)
• Business Continuity Institute Website
  (www.thebci.org)
• Notts PCTs Emergency Preparedness Team
• Debbie Brown 01623 673168/167
• Rowan Tebbutt 0115 883 9407
• Nicola Ryan 01777 863321

17
Any questions?