Business Impact Analysis

Transcription

1 APPENDIX 1 Business Impact Analysis Business Continuity Plan Templates To assist Service Managers in developing Business Continuity Plans

2 What are the key objectives of your service? List below:- 5

3 Identify your critical activities to maintain your service objectives. Identify actions for the following critical timescales 2 hrs / 2 hrs / 5 days or more. Guidance definition of critical activities: Critical operational or support activities without which your service would be unable to achieve its objectives. Critical activities usually include: Staff Supplies Equipment Buildings Utilities Transport 6

4 List the potential impact of failure of critical activities and apply risk analysis to each: On site: Off site: 7

5 RISK ASSESSMENT MATRIX In terms of assessing business continuity risks, the PCT has adopted the following risk categorisations: - IMPACT 5 LIKELIHOOD Probable Possible Unlikely Rare Negligible Catastrophic HIGH HIGH HIGH Major HIGH HIGH Moderate HIGH VERY Minor VERY Insignificant VERY VERY VERY In terms of rating risks, the PCT has attached the following Risk Rankings to particular scores within the matrix: - RED AMBER YEL GREEN - High Risk - Medium Risk - Low Risk - Very Low Risk 8

6 RISK ASSESSMENT DESCRIPTORS The following descriptors should be used when assessing the LIKELIHOOD of a potential risk event: - Likelihood Scoring & Descriptors Descriptor Probable Possible Unlikely Rare Negligible Likelihood of occurrence More likely to occur than not. Reasonable chance of occurring. Unlikely to occur. Will only occur in rare circumstances. Will only occur in exceptional circumstances. >50% >5% >0.5% >0.05% >0.005% >1 in 2 chance >1 in 20 chance >1 in 200 chance >1 in 2,000 chance >1 in 20,000 chance The following descriptors should be used when assessing the IMPACT of a potential risk event: - Impact Scoring & Descriptors Descriptor Catastrophic Major Moderate Minor Insignificant Severity of impact Permanent loss of core service or facility. Sustained loss of service which has serious impact on delivery of patient care. Some disruption in service with unacceptable impact on patient care. Non-permanent loss of ability to provide a service. Short term disruption to service with minor impact on patient care. Interruption in a service which does not impact on the delivery of patient care or the ability to continue to provide a service. 9

7 RISK MANAGEMENT OPTIONS LIKELIHOOD IMPACT Probable Possible Unlikely Rare Negligible 5 Catastrophic Major 3 Moderate 2 Minor 1 Insignificant REDUCE PLAN CONTROL ACCEPT 10

8 Record the Likelihood scores and the Impact scores. Multiply them together to determine the Risk scores. Record the risk management options. HAZARD OR THREAT L/hood Score Impact Score Risk Score RISK MANAGEMENT OPTION On site: Staff Supplies Equipment Buildings Utility failure on site Off site: Utility failure off site Flooding Road closure or emergency cordon Fire in adjacent building Transport Extreme weather 11

9 Risk Reduction Options Consider 3 variable risk treatment options to reduce the risk for each identified hazard or threat: HAZARD OR THREAT Option 1 (2 hours) Option 2 (2 hours or more) Option 3 (5 days or more) N.B. This list is not exhaustive and each manager doing the risk assessment may identify new ones. 12

10 Impact of each hazard or threat on each of the critical activities CRITICAL ACTIVITY Ability to deliver primary care Loss of systems/ medical data Ability to provide staff on site Patient access to building Loss of electric Loss of water Large fire Extensive flood Road closure N.B. This list is not exhaustive and each manager doing the risk assessment may identify new ones. 13

11 Identify Resources In most organisations these are people, systems, facilities and supplies. Recovery Resource Analysis CRITICAL ACTIVITIES e.g. loss of site STAFF SUPPLIES EQUIPMENT BUILDINGS UTILITIES TRANSPORT Key Steps to restore activity Once you have completed your risk assessments you should forward them to the Business Continuity Lead for inclusion in the PCT Business Continuity Plan (BCP). 1

12 THIS IS FOR INFORMATION ONLY Business Continuity Plans usually include: Front page document control Distribution list copies Contents details Introduction Aims and objectives Assumptions Plan ownership Event / decision log Supporting information Personnel Staff welfare and counselling Media / PR contacts Emergency service contacts Finance Legal advice Suppliers Recovery Resource Profile Standard workstation Computer equipment Software applications Technology connectivity Telecommunications Back up data Unique vital documents / records Office equipment, stationary and specialist equipment Suggested forms and pads with plan Internal briefing Decision / action logs Task lists Telephone message pads Action lists 15