ELMBRIDGE BOROUGH COUNCIL BUSINESS CONTINUITY PLAN

Transcription

1 ELMBRIDGE BOROUGH COUNCIL BUSINESS CONTINUITY PLAN Author: Gill Marchbank Date of Original: May 2012 Date of issue: Version Number: Authorised by: 1

2 CONTENTS Page 1 INTRODUCTION 1.1 The need for a business continuity plan Principles Emergency affecting business continuity 3 2 MISSION 2.1 Aim Objectives 4 3 CRITICAL BUSINESS FUNCTIONS 3.1 Key functions Impact of not carrying out key functions 5 4 RECOVERY PRIORITIES 4.1 Service priorities IT priorities 6 5 EXECUTION 5.1 General outline Tasks 8 6 COORDINATION 6.1 Alerting Meeting point for staff Allocation of accommodation and ICT resources Emergency Centre Return to normality 14 7 TRAINING AND VALIDATION 7.1 Training, Validation and Review 14 APPENDICES A Appendix A Speed sheet Incident Management Team 15 B Appendix B Infrastructure Business Recovery Team 16 C Appendix C Administration Business Recovery Team 17 D Appendix D Service Business Recovery Teams 18 2

3 SECTION 1 - INTRODUCTION 1.1 THE NEED FOR A BUSINESS CONTINUITY PLAN The Civil Contingencies Act requires the Council to have in place up to date business continuity arrangements so that it can continue to deliver its key services in the event of an emergency. For more information on the Council s obligations, and how this plan links in with the Council s other emergency planning and response plans see Elmbridge Borough Council s Integrated Emergency Management Strategy. 1.2 PRINCIPLES The Chief Executive ensures that business continuity is incorporated into the Council s processes and structure. The Head of Finance manages the business continuity processes through the Corporate Risk Group. The Corporate Risk Group monitors the ability of the Council to respond to a disruption to its business. At regular intervals and at least annually, it gives the Directors reassurance that there are satisfactory processes in place or, when necessary, identifies any weaknesses that could interfere with the Council s ability to maintain its critical services. Heads of Service are responsible for their own service business continuity planning. Individual building managers are responsible for keeping tenants within their buildings informed of the Council s business continuity arrangements. Unless otherwise agreed, tenants are responsible for their own business continuity arrangements including loss of premises, utilities, etc. 1.3 EMERGENCY AFFECTING BUSINESS CONTINUITY An emergency affecting the Council s business continuity is: An incident that causes severe disruption to, or additional pressures on, the working environment of a business or organisational unit which results in an inability to function or to provide service to internal or external customers. The Council s activities can be interrupted for a number of reasons (e.g. fire, flood, pandemic flu, fuel crisis). In essence, though, its ability to deliver parts or all of its service will be affected by: a. Inability to access accommodation or loss of key utilities (e.g. water, electric, etc.) b. Loss of ICT and communications c. Loss of staff d. Loss of contractor / suppliers Incidents are considered as: a. Low level Incidents (short term, lower impact) 3

4 2.1 AIM b. Moderate level Incidents (short term, higher impact or longer term, lower impact) c. High level Incidents (medium/high impact, medium/long term) In addition, there could be incidents in the community: a that do not impact directly on the Council s ability to function, but where the Council is involved in supporting the response (see the EBC Emergency Plan) b that do impact directly on the Council, where, in addition to implementing the appropriate Business Continuity arrangements, will also involve the Council in supporting the response. In both these situations there will be an additional drain on the Council s resources. The Council will endeavour to provide key services, as well as support the response to the incident. Details of the Council s responsibilities are detailed in the EBC Emergency Plan and supporting documents, and this plan, if activated, should have full regard for the requirements of these plans. SECTION 2 - MISSION The aim of this Business Continuity Plan is to give guidance so that the Council can recover or maintain its activities in the event of a major interruption affecting normal business operations. The Council also needs to be able to respond to a major incident in the borough (which will draw on staff and resources) and maintain key services. 2.2 OBJECTIVES The Business Continuity Plan should be read in conjunction with the Council s Emergency Plan and any other plans (see the Council s Integrated Emergency Management Framework) depending on the nature of the disruption to the Council s business. The Council s objectives are: a. Its staff s safety and welfare b. The community s safety and welfare c. Minimising the risk to people and property d. Minimising the effect of any incident on the Council s ability to provide services e. Resumption of critical business functions as soon as possible f. Provision of information to both staff and residents, as well as other stakeholders g. Keeping the community s confidence and maintaining the reputation of the Council h. Supporting the response to any incidents impacting on the community 4

5 3.1. KEY FUNCTIONS SECTION 3 - CRITICAL BUSINESS FUNCTIONS The Council s Services have identified their key functions within their Service area. Services have also identified, in the event of them being unable to carry out these functions, whether there would be: a. An impact on the Council s emergency response b. Damage to the community's welfare or a significant impact on the community c. Damage to the environment d. Loss of income or reputation e. Legal implications / statutory obligations 3.2 IMPACT OF NOT CARRYING OUT KEY FUNCTIONS Services have also identified: a. Activities that have peaks, for example during the week and year b. The impact of not carrying out the most important tasks c. Other risks d. Their ability to cope without: (1) Telephones (2) Access to ICT (3) Office space / utilities (4) Transport (5) Staff e. Any mitigating procedures that they have in place. The details of this analysis is in the individual services Business Continuity Plan/s. Summaries of this analysis informs the Business Impact Analysis. 5

6 4.1 SERVICE RECOVERY SECTION 4 RECOVERY PRIORITIES In most cases Services will be able to recover their own functions as set out in their Service Business Continuity Plans. In the event of a major interruption to the Council s critical activities, the decision on priorities for resuming the business functions will be made by the Incident Management Team and will depend on external as well as internal factors (e.g. weather, imminent elections, end of financial year, etc.). The table below shows the ranking of the services from the Business Impact Assessment. critical critical critical Pers HB EH Support to the Council s response to an emergency impacting on the borough Frontline claims and housing advice function for callers with urgent housing needs Investigation of infectious disease cases/outbreaks, food hazards/ complaints and serious workplace accidents/ incidents critical CP&P Communications critical ICT Telecommunications critical ICT Network and Server Infrastructure critical BC Dealing with reports of dangerous structures critical CS Community Alarm high Pers Provide advice and guidance on general personnel and employee relation issues high high HB HB Ongoing payment of housing benefit to existing live claims for tenants and landlords Assessment and payment of new claims from tenants in private rented accommodation high Leis Cemeteries - burials high AM & PS Management of Statutory Planned Preventative maintenance (eg Gas, Electric, Water Hygiene etc) high AM & PS Emergency Response (eg collapsing walls) high AM & PS Management of Civic Centre high AM & PS Issuing of cheques high AM & PS Estate Management of the Councils Property Portfolio high EC Refuse / Recycling Collections high LT Billing & Collection of Council Tax & business rates (high at key times) high ICT Website high Fin Payroll high Fin Accounts Payable 6

7 high BC Carrying out site inspections in relation to building work high CS Centres/Meals on Wheels high CS Transport medium HB Phoneline claims and housing advice function for callers with urgent housing needs medium AM & PS Community Funerals medium AM & PS Answering all non direct dial telephone calls to the Council medium AM & PS Reception function / information point for callers to the Council medium EC Cash Collection medium EC Street Cleaning medium EH Private drainage blockages/ disruptions medium Fin Treasury Management medium Fin Accounts Receivable medium Fin Insurance medium ICT Service Desk medium BC Admin functions such as: Input of submissions into computer system, production of consequential documentation, making up files and dealing with solicitor queries medium CS Elmbridge Relief Carers Scheme Details of lower priorities are in the Business Impact Assessment 4.2 ICT RECOVERY Services should have arrangements in place to cope without ICT for a limited time. Priorities for resuming the ICT systems are outlined in the ICT Services Business Continuity Plan, but are subject to amendment depending on the Incident Management Team s priorities (see 4.1) 5. EXECUTION 5.1 GENERAL OUTLINE Preparation Preparation of the Council s business continuity activity is managed by: a. Risk Management Group The Risk Management Group: Confirms the impact of, loss or disruption to the business and the potential exposures which have been identified by the Services. Reviews the continuity requirements to ensure they reflect the needs of the business. 7

8 Develops, maintains and tests the Council s overall business continuity arrangements. Monitors the Services business continuity plans. b. Heads of Service Heads of Service maintain their service business continuity plans. These plans include: Impact assessment of loss of functions/services Staff contact details and telephone numbers Identification of key staff, their responsibilities in respect of Business Recovery and alternative accommodation needs, including number of workstations Essential ICT requirements, including specific systems/packages Provision for the recovery and continuation of service provision Key external contacts, including contractors, partners, etc. Prioritisation of functions and services assurance that written procedures / protocols are in place 5.1 Responsibility for Implementation Overall responsibility for implementing the Corporate Plan will be by the Chief Executive and Corporate Management Board. Activation of Plan There are 3 elements to the response to an incident impacting on the Council s operations: 1. Managing the impact of the incident (strategy, communicating and supporting staff, residents, Members, the media, etc.) 2. Addressing issues to enable Recovery (ICT, accommodation, etc.) 3. Maintaining / restoring functions and services, prioritising key aspects (possibly using alternative methods, as outlined in the Service Business Continuity Plan) In addition, there are protocols for specific incidents (e.g. pandemic, severe weather) Not all 3 elements will necessarily be activated this will depend on the type, scale and anticipated duration of the impact of the incident: In many cases where business activity is disrupted locally, it is likely that a Service will respond to such incidents using its own service business continuity plans keeping the appropriate Director and Chair of the Risk Management Group informed until the incident is resolved. If it is necessary to invoke all or part of the Council s Business Continuity Plan, an Incident Management Team will manage the Council s response. Alternatively depending on the scale/impact of the incident CMB may choose to appoint an Incident Management Manager, who would be expected to implement the detailed provisions of the plan and liaise closely with CMB. It might be necessary to activate a business continuity response during an emergency affecting the community (e.g. transport related incident, flooding). In this case the Business Continuity Plan should be read in conjunction with the Council s Emergency Plan: 8

9 Incident Management The management of a business continuity incident will be managed in a similar way to an emergency. a. Managing the Incident (managing the acute phase, ensuring the safety of all affected individuals and containing the incident to minimise further loss and communicating with staff, public, Members and other stakeholders). b. Recovering the business (bringing back facilities / services in a planned way) c. Maintaining, wherever possible, key functions (alternative methods of delivery are outlined in Service Business Continuity Plans) Incident Management Team Administration Business Recovery Team Infrastructure Business Recovery Team Service Recovery Teams Figure 1 the structure for managing the incident 5.2 TASKS Suggested roles in the response/recovery are listed below. However the composition of the teams and their roles/responsibilities could be influenced by a number of factors, including the nature of the incident, availability of senior staff and whether the incident has impacted on the wider community and the Borough Emergency Control Centre has been established to co-ordinate this. Appendices A-D contains speed sheets for each of teams to use as a prompt at the time of an incident. Incident Management Team a. Membership The Chief Executive and/or Director Head of Corporate Policy and Partnership Head of Executive and Member Services b. Responsibilities Assess the disaster and invoke the Corporate Business Continuity Plan. Select the emergency centre. Determine the strategy of the response and making this strategy known to staff, Members and the public. Authorise the ICT recovery contract. 9

10 Manage and co-ordinate the response to the incident through the business recovery teams. Agree any extra funding that may be required Liaison with the emergency services, other local authorities and other partners Provide the interface with other external organisations and agencies. Coordinate the transition from the acute phase of the incident to the more controlled project phase Ensure all decisions / actions are logged and that all records, procedures/ checklists are retained for the post-incident review process. Agree appropriate messages on the incident and recovery operation for staff, Members, the public, partners, contractors and the media. Ensure appropriate liaison with the media, and monitor their output Restrict those who will speak to the media to the Chief Executive or Directors. Consider whether return to normal is the most appropriate course of action or whether the event is an opportunity to change how the council operates / provide services in a different way Business Recovery Teams The Business Recovery Teams will carry out the detailed recovery operations working under the direction of the Incident Management Team. Administration Recovery Team (1) Membership Head of Finance Head of Personnel Head of Legal Insurance Officer Senior Admin Officer AMPS member of Corporate Policy and Partnership Community Transport Manager (2) Responsibilities Providing next-of-kin and contact information for all personnel. Advising on HR policy and staffing issues. Dealing with next of kin. Arranging professional counselling and financial support. Providing information for staff, their relatives and friends. 10

11 Providing information to the public. Ensure that pertinent information is made available via the Council s website. Advising on financial implications. Liaison with insurers and loss adjusters. Advising on legal implications / statutory obligations. Advising on contractual implications. c. Infrastructure Recovery Team (1) Membership Head of Asset Management and Property Services Head of ICT Facilities Services Manager Head of Building Control (if appropriate) (2) Responsibilities Arranging accommodation for services. Damage and salvage assessment. Security. Manage the ICT service in order to help it achieve its priorities and maximise operational efficiency. Supervising recovery contract. Support the systems provided. d. Services Each Service has its own arrangements to maintain / reinstate their services/functions, with an identified Service Recovery Team Keeping the Incident Management Team informed of the impact of the emergency in their Service areas. Recovering critical business functions as set out in their Service Business Continuity Plans or as directed by the Incident Management Team. Maintaining key services, as outlined in their Service Business Continuity Plans Keeping staff in their service area informed. 11

12 SECTION 6 - COORDINATION 6.1 ALERTING Staff will be informed of an incident affecting the operations of the business: a. During Business Hours (1) As a result of a building evacuation (2) Verbal / by telephone (through managers) (3) Through Bridge-It (4) By b. Outside of Business Hours (1) Key officers through telephone cascade notification: (a) (b) The Borough Emergency Plan Service Business Continuity Plans (2) Other staff by their Head of Service (e.g. if not able to access their place of work). 6.2 MEETING POINT FOR STAFF If staff are unable to gain access to their normal place of work they should: a. in the first instance, telephone their line manager, or call the Staff Emergency Line on , or look at the staff page on the website for instructions b. If staff arrive at the Civic Offices to find it inaccessible, they should got to Sandown Race Course, or if that is also not accessible, to the Xcel Centre 6.3 ALLOCATION OF ACCOMMODATION AND ICT RESOURCES A limited number of desk spaces will be available at: - Cobham Centre - other Boroughs / Districts (under the Mutual Disaster Resilience Contract) In addition, some staff will be able to work from home, but may require Citrix Allocation of these places will be the responsibility of the Incident Management Team at the time of the incident. The number of desk spaces required to provide a minimal service is listed in each Service Business Continuity Plan and summarised below: 12

13 Allocation of desk spaces requirements listed in Service BC Plans AM & PS BC High - Management of Statutory Planned Preventative maintenance High - Emergency Response (eg collapsing walls) High - Management of Civic Centre High - Issuing of cheques High - Estate Management of the Councils Property Portfolio Medium Community funerals Medium answering all non direct dial telephone calls to the Council Medium reception function / information point for callers to the Council Critical - Dealing with reports of dangerous structures High carrying out site inspections in relation to building work Medium admin functions, inc input of submissions, consequential documentation CP&P Critical - Communications 2 CS Critical - Community Alarm High Centres / meals on wheels High Transport Medium Elmbridge Relief Carers Scheme 6 EC EH Fin HB High - Refuse / Recycling Collections Medium cash collection Medium - street cleaning Critical - investigation of infectious disease cases/outbreaks, food hazards/ complaints and serious workplace accidents/ incidents Medium private drainage blockages / disruptions High Payroll High Accounts payable Medium Treasury management Medium Insurance Medium Accounts receivable Critical - frontline claims / housing advice function for callers with urgent housing needs High ongoing payment of HB to existing tenants / landlords High assessment/payment of new claims from new tenants in private rented accommodation Medium phoneline claims and housing advice for callers with urgent housing needs Critical Telecommunications ICT Critical network and server infrastructure High website Medium service desk Leis High Cemeteries - burials 2 LT High (at key times) - Billing & Collection of Council Tax & business rates 7 Pers Critical - support to the Council s response to an emergency impacting on the borough High provide advice and guidance on personnel/employee relation issues EMERGENCY CENTRE A business continuity incident will be managed initially in the same way as any emergency from: a. Borough Emergency Control Centre in the Civic Centre b. alternative centre in Cobham Centre c. facilities at another Borough / District desks/ PCs 12 (9 PCs) 6 0 (6 after 20 days)

14 Committee Rooms 1 and 2 are used as the Borough Emergency Control Centre (BECC), and could be used to co-ordinate the response, providing the incident does not impact on the borough, with the BECC being used to oversee that response. The EP Cupboard in CR2 has decision logs, action logs and message forms that could be used to assist and document the response. 6.5 RETURN TO NORMALITY It is important to ensure that the return to normality is achieved as quickly and smoothly as possible. It is likely that different services/functions will return to normal at different times, and over the course of the recovery the level of corporate input should adapt to reflect this. It is therefore important that the Incident Management Team regularly review the purpose and need for the Recovery/Service Teams and identify when the incident is deemed over (ie when services are operating normally, or as close to normal as is considered achievable in the circumstances). SECTION 7 - TRAINING, VALIDATION AND REVIEW 7.1 The Business Continuity Plan is validated by tabletop exercise and reviewed at least every two years, or when necessary. Members of the Incident Management Team will receive appropriate training to fit them for their roles. Directors and Heads of Service are to make sure that staff who have subsidiary roles in supporting the emergency response receive adequate training. 14

15 Speed sheet Incident Management Team Appendix A Primary functions Oversee the invocation and implementation of the Corporate Business Continuity Plan Co-ordinate the activities and monitor progress of the Recovery and Service Business Continuity Teams Agree service re-instatement prioritisation and allocation of resources Ensure relevant stakeholders (including staff, Members, partners) are appraised of the situation agree appropriate media messages Suggested membership The Chief Executive and / or a Director Head of Corporate Policy and Partnership Head of Executive and Member Services First Response Start log of all decisions, communications and actions taken Appoint a staff officer to the CE/Director leading the Incident Management Team Decide whether to invoke the Corporate Business Continuity Plan Determine the response strategy, and inform Heads of Service If the Civic Centre not available, decide the location of the Incident Management Team and the Recovery Teams (see 6.3 for possible options) Consider need for, and identify appropriate Emergency Control Centre Agree appropriate Recovery Team/s, confirm membership and instigate Agree reporting procedures between the Incident Management Team and Recovery Team/s Identify and quantify any damage to the organisation, including staff, public, premises, reputational damage, equipment, data, records (paper and electronic), including the extent of the disruption Agree key service resumption priorities (using the Business Impact Assessment 4.1) If necessary, allocate desk space (see 6.4) Agree key messages for the media, staff, Members, the public (inc website), service users, suppliers/contractors, partners, etc. If appropriate, identify alternative venue/s for the Civic Centre and in liaison with the Infrastructure Team allocate desk spaces Authorise the ICT recovery contract and other costs if appropriate If appropriate, liaise with the Emergency Services Consider whether a change of shift is needed (if the initial response is going to be longer than 8 hours), and identify officers to take over On-going Manage the incident whilst the Business Recovery Teams focus on the recovery, and the individual Service Teams focus on re-instating / maintaining key services Co-ordinate and monitor progress of the Recovery Teams Review prioritisation of services, taking into account reports from the Service Teams Maintain liaison with the Emergency Services, if appropriate Monitor responses from, and review key messages to the media, staff, Members, the public (inc website), suppliers/contractors, clients, etc. Consider whether return to normal is the most appropriate course of action: consider taking the opportunity to change how the council operates / provide services in a different way In liaison with the Recovery Groups/Service Teams decide when they are no longer required Identify when the response is winding down, and agree process for return to normal 15

16 Speed sheet - Infrastructure Business Recovery Team Appendix B Primary functions to provide support and advice to the Incident Management Team and the other Recovery Teams as appropriate identify long term issues and short term solutions: provision of accommodation for services with ICT access / support and telecommunications, as appropriate to supervise recovery / reinstatement of facilities/resources/ict protection of resources Suggested membership Head of Asset Management and Facilities Services Manager Property Services (or Senior Surveyor) Head of ICT Head of Building Control (if appropriate) Initial Response Start log of all decisions, communications and actions taken Inform partners in the Surrey Disaster Recovery Mutual Aid arrangements Implement the ICT Business Continuity Plan Identify and list long term problems Identify and list short term solutions General Continue to identify / monitor long term problems Continue to identify / consider short term solutions, including desk space location and IT requirements In liaison with the Incident Management Team: Implement short term solutions, including as outlined in the Surrey Disaster Oversee Recovery Mutual Aid arrangements ICT / Telecommunications Manage and co-ordinate recovery of: telephone services network recovery invocation of recovery contracts systems reconstruction hardware replacement supervise recovery contract and provide and support short term IT solutions Property Services identify all available desk space (see 6.3), and list (plus whether phone, PC, internet access, etc.) and pass to the Incident Control Team carry out a damage and salvage assessment as soon as practicable, and establish likely period of disruption secure the site against theft / the weather organise salvage and storage of equipment and records organise repairs organise re-building works organise temporary accommodation if needed provision of necessary services to support officers (eg cleaning, mailroom, etc) 16

17 Speedsheet Administration Business Recovery Team Appendix C Primary function To provide support and advice to the Incident Management Team and the other Recovery Teams as appropriate, including ensuring insurance requirements are met, appropriate financial arrangements are in place, ensuring legal requirements are in place and providing advice and practical support. Membership Head of Finance Insurance Officer Head of Legal Senior Admin Officer - AMPS Head of Personnel Community Transport Manager Member of Corp Policy & Partnership First Response Start a log of all decisions, communications and actions Specific Roles Finance Provide financial support including purchasing and setting appropriate financial authority limits, etc. Ensure funds are readily available to meet immediate needs such as payment for the purchase or hire of emergency equipment, other materials, temporary staff at short notice Ensure the availability of pre-printed cheques and the payroll service Legal Services Advise as necessary on liability issues and any legal implications such as H&S matters arising out of the implementation of all stages of the recovery procedure. Put in place all necessary agreements and contractual arrangements relating to the use of premises and the drafting and completion of contracts for the supply of goods, services and temporary staff. Personnel - Advise on HR policy and staffing issues - Support staff and NoK impacted by the incident, and provide NoK contact details - Arrange professional counselling and financial support - Provide information for staff, their relatives and friends (with CP&P Officer) Insurance Keep the Council s insurers fully informed of the nature and extend of the emergency and any damage sustained. If necessary, call in the loss adjuster, etc. Ensure appropriate claims forms are completed and submitted on time Facilities Management In liaison with the Infrastructure Recovery Team, ensure the provision of switchboard/ reception services as appropriate Arrange alternative postal arrangements if/as necessary Identify and provide supplies as needed (inc furniture, janitorial, personal hygiene and medical suppliers, water coolers, stationery) Transport Assess transport needs (e.g. movement of equipment, desks, staff, etc.) identify transport resources (vehicles and drivers) available / divert from other duties Identify and cost alternative sources if needed Corporate Policy & Partnership - In liaison with IMT provide information to the public using appropriate methods - Provide information for staff, their relatives and friends (with Head of Personnel) 17

18 Speedsheet Heads of Service / Services Business Recovery Teams Appendix D Primary function To enable your Service to maintain / reinstate key services following an incident To identify needs and feed these in to the Incident Management Team, Infrastructure / Administration Recovery Teams To assist in the Corporate-wide recovery To enable a smooth transition to normality Suggested membership As outlined in each Service Business Continuity Plan First Response Start a log of all decisions, communications and actions taken Ensure all staff are safe and accounted for Assess the impact of the incident on your service identify, quantify and report to the Management Team any damage to your service, including staff, public, premises, possible reputational damage, equipment, data, records (paper and electronic), including the extent of the disruption. Decide whether to invoke your Business Continuity Plan, and inform the Incident Management Team If implementing your Business Continuity Plan, establish your Recovery Team and also allocate staff to provide key services, as outlined in your plan. List key actions for your Recovery Team, and allocate responsibility Take an active role in the Admin Recovery Team or Infrastructure Recovery Team, if required Invoke call out arrangements for additional staff support to assist the response If appropriate, inform other staff of incident and advise action to take On going Continue to maintain decision, action and communication logs Ensure the well being of staff at all times Report any issues to the Incident Management Team, including staff concerns Identify any spare resources (including staff) and inform the Incident Management Team Consider adapting services to ensure best use of resources Look ahead, and identify any issues that could arise if not dealt with promptly Consider whether mutual aid from another LA/organisation would be useful, and raise with the Incident Management Team Liaise with members of the Administration Team regarding insurance, legal and financial issues, as appropriate Liaise with members of the Infrastructure Team regarding ICT and accommodation issues 18