How To Write A Business Continuity Management Policy For Thanet Health Trust

Transcription

1 i Business Continuity Management Policy Version: Version 1.0 Ratified by: Governing Body Date ratified: July 2013 Name of originator/author: Alison Fox Name of responsible committee/individual: Head of Governance Date issued: July 2013 Review date: July 2014 Target audience: All CCG staff Related policies/tor Contact for Queries Head of Governance i

2 1 Document Control ii Amendment History Version Date Amendment History July 2013 Initial policy for approval Review History This policy has been reviewed by: Name Title Date Version Samantha Proctor Associate, Business Resilience, KMCS Alison Fox Head of Governance Approval Name Signature Title Date Version Tony Martin Clinical Chair 2 July 2013 NB. The version of the policy posted on the intranet must be a PDF copy of the signed approved version. Document Status This is a controlled document. Whilst this document may be printed, the electronic version posted on the intranet is the controlled copy. Any printed copies of the document are not controlled. Related policies Ref No Title Version ii

3 iii Contents 1 Document Control... ii 2 Statement of Intent The Policy Introduction Scope Accountability Implementation Roles and Responsibilities Governing Body Head of Governance Designated Leads Communications and Awareness Maintenance Testing and Training Equality Impact Assessment... 7 iii

4 4 2 Statement of Intent Business Continuity Management (BCM) helps to reduce the risk of interruption to the delivery of Thanet CCG (TCCG) services in the event of a disruption to normal operations. These disruptions may be external, such as severe weather or loss of utilities, or internal such as IT system failures or the loss of key staff. BCM provides the framework to enable TCCG to identify its critical functions and maintain these during a disruption, allowing the delivery of services to continue whist recovery is in progress. The TCCG Business Continuity Management System ensures that the organisation fulfils its responsibilities in respect to BCM as both a Category 2 organisation as defined by the Civil Contingencies Act and as an NHS body. The TCCG Business Continuity Management System is based upon the framework set by NHS England and is aligned to the British Standard BS25999 and the International Standard ISO NHS England requires that: NHS organisations and providers of NHS funded care must therefore be able to maintain continuous levels in key services when faced with disruption from identified local risks such as severe weather, fuel or supply shortages or industrial action. Business continuity management (BCM) gives organisations a framework for identifying and managing risks that could disrupt normal service. An organisation s business continuity management system (BCMS) helps it to anticipate, prepare for, prevent, respond to and recover from disruptions, whatever their source and whatever part of the business they affect. This policy provides the framework for the TCCG Business Continuity Plan to be developed, implemented tested and reviewed. We believe that this work is essential in order to ensure that any impact on patient care is reduced in the event of a disruption to TCCG operations. Hazel Carpenter Accountable Officer 4

5 5 3 The Policy 3.1 Introduction NHS England requires TCCG to have prepared to continue to provide its critical services and functions in the event of an internal or external disruption The TCCG BCM Policy will be implemented through all departments of the organisation and premises it operates from The process of BCM is owned by the whole organisation, and is driven by the Governing Body The overall goal of the TCCG BCMS is to ensure that patient services are not unnecessarily interrupted by internal or external disruptions affecting the organisation. 3.2 Scope The scope of this document is limited to the activities of TCCG. Any staff directly employed by, or contracted to work for TCCG are covered. It does not cover activities related to providers premises, processes, staff or systems where they are not related to a core contractual term with TCCG Each area of TCCG has responsibility for managing its own business risk and business continuity arrangements. These are brought together under a corporate Business Continuity Plan which establishes how the Governing Body will oversee the response to, and recovery from, any business interruptions. 3.3 Accountability The person with senior level responsibility for BCM is the Accountable Officer The day to day managerial responsibility for BCM is provided under contract by KMCS, who have staff with the relevant qualifications and will oversee the production of the Corporate Plan and support the development of individual team plans Designated leads in each team are responsible for delivering the information required for the area s business continuity plan. Professionally qualified Resilience Associates contracted from KMCS are involved in the process and available to provide specialist support to all parts of the organisation. 3.4 Implementation TCCG will maintain a corporate business continuity plan to enable it to respond to business disruptions. This plan will be scalable, enabling an individual directorate to manage low level disruptions whilst also providing a framework for the Governing Body to manage disruptions that affect the whole organisation. 5

6 3.4.2 TCCG will undertake a Business Impact Analysis to determine which are its critical services and functions and to identify the Recovery Time Objective for each. The Business Impact Analysis will also identify key stakeholders for each activity The Business Impact Analysis and Business Continuity Plan will be reviewed at regular intervals to ensure that they continue to reflect the organisation s needs The Business Continuity Plan will be tested at regular intervals and training will be provided to staff where required to ensure that disruptions can be responded to effectively. 6 4 Roles and Responsibilities 4.1 Governing Body Act to ensure/monitor the overall strategic direction of Business Continuity Management across TCCG. Ensure that the Business Continuity Management Policy and development plan is enforced and resourced appropriately. In the event of a serious or widespread disruption to the activities of the CCG may be necessary to invoke the Business Continuity Response Team. In this case the Governing Body may need to lead the response or delegate incident management coordination to named officers 4.2 Head of Governance Undertake leadership and sponsorship of the Business Continuity Management framework under the direction of the Governing Body. Act as a point of tactical leadership in support of the staff. Liaise with the KMCS Business Resilience Team to ensure that the delivered BCMS meets the needs of TCCG. Manage, monitor and report on the progress of the Business Continuity Management System as required Ensure that where appropriate, sections of Business Continuity Plans and Policy are published and accessible to the public. Nominate one manager/staff member who will have specific responsibility for business continuity in their area. 4.3 Designated Leads Undertaking of a Business Impact Analysis for their area of responsibility Preparing a Recovery Plan for critical services in their area in partnership with the KMCS Business Resilience Team. Report on service continuity performance as required 6

7 7 5 Communications and Awareness The Business Continuity Management Policy, the Business Continuity Plan and other supporting information will be placed in an appropriate place on the CCGs intranet site and will actively be promoted to both new starters as part of the induction process and existing staff. 6 Maintenance The Head of Governance will be responsible for ensuring the BCP is reviewed and updated at regular intervals to determine whether any changes are required to procedures or responsibilities. A complete BCP will be distributed annually to each senior staff member In addition, any unscheduled changes, for example a change to an Incident Co-ordination Facility, will be conveyed to all areas concerned and updates circulated to each senior manager. 7 Testing and Training The Head of Governance is responsible for identifying appropriate levels of training and awareness sessions for all TCCG staff to ensure business continuity becomes part of organisational culture and daily business routines, improving the organisations resilience to the effects of business disruptions KMCS are contracted to provide regular training and awareness sessions for all staff on the overall business continuity strategy and on specific roles in plans The on-going viability of the business continuity program can only be determined through continual tests and improvements. The Head of Governance will be responsible for ensuring regular tests and revisions are made to all plans to ensure they provide the level of assurance required If there is a major change to the TCCG roles and/or structure, plans will be tested and revised once a settling-in period has been achieved, to allow for a confident level of recovery. 8 Equality Impact Assessment The organisation aims to ensure that its policies meet the needs of its staff and customers and ensure they do not disadvantage any groups or individuals Equality Impact Assessments (EIA) or Equality Analysis provides a systematic way to ensure legal obligations are met and are a practical way of examining new and existing policies and practices to determine what effect they may have on equality for those affected by the outcomes. 7

8 8.1.3 The purpose of EIAs is to identify and address real or potential inequalities resulting from policy and practice development or service change. Through this process an organisation gains a greater understanding of its functions and is more able to be an equitable employer and service provider 8 8