Business Continuity Management Policy

Transcription

1 Governance: Business Committee Policy Owner: Chief Superintendent, Corporate Services Department: Corporate Services Policy Number: 002 Version: 3.0 Policy Writer: Business Continuity Co-ordinator Effective Date: 12 th March 2015 Review Date: 12 th March Policy Aim The Civil Contingencies Act 2004, places a statutory duty on the police to have Business Continuity Management (BCM) in place to ensure continued service delivery of essential services. BCM is also a regulatory requirement for compliance with the ACPO Community Security Policy and an integral part of the Force s risk management framework. The purpose of this policy and its associated documents is to establish the processes and structures that will enable North Wales Police to survive disruptions to everyday business practice whilst continuing to deliver, as a minimum, its most critical functions. North Wales Police has set out a Business Continuity Management System (BCMS) aligned to the International Standard for Business Continuity, ISO The operation of this BCMS has many benefits for the business, including: Ensures that North Wales Police can continue to deliver critical services to the public in the event of a disruption Proactively improves organisational resilience by developing strategies to minimise any disruption from identified threats and risks Minimises the impact on the organisation and the public in the event of any emergency or disruption Ensures resources are used more effectively Protects against reputational damage and increases public confidence In line with all Force Policies, the overarching purpose of this document is to directly support the North Wales Police (NWP) Police and Crime Objectives. Overall the intention of this policy is to provide a Safer North Wales. Page 1 of 5

2 In the writing of this policy cognisance has been taken of the College of Policing Code of Ethics (2014). NWP policies will be written in accordance with the approved corporate format and published on the Force Intranet, allowing access to staff and, where appropriate, on the pages of the public facing Internet site under the Freedom of Information Act Policy Statement 2.1 Introduction It is important to understand which areas of the business are currently within the umbrella of the BCMS and which are excluded. The boundaries of the BCMS as implemented within North Wales Police are defined within the document entitled Business Continuity Context, Requirements and Scope (Appendix 1). This document should be reviewed in conjunction with this policy. The purpose of this document is to define an overall policy with regard to business continuity that is appropriate to the purpose of North Wales Police and addresses three key areas:- Business continuity objectives Commitment to delivery of business continuity Identification and management of business continuity risk This BCMS Policy is available in both paper and electronic form and will be communicated within the organisation and to all relevant stakeholders and interested third parties. 2.2 Business Continuity Objectives. The high-level objectives for business continuity within North Wales Police are defined within the document Business Continuity Context, Requirements and Scope (Appendix 1). These are fundamental to the organisation and should not be subject to frequent change. These overall objectives will used as guidance in the setting of lower level, more short-term objectives for business continuity planning within an annual cycle. A plan for low level objectives will be maintained by the Business Continuity Co-ordinator. The plan will be monitored by the Policy and Business Continuity Task and Finish Group and will be reviewed on a quarterly basis, at which time the objectives will also be reviewed to ensure that they remain valid. 2.3 Commitment to Delivery of Business Continuity Commitment to the delivery of business continuity extends to senior levels of the organisation and will be demonstrated through this Business Continuity Page 2 of 5

3 Policy and the provision of appropriate resources to establish and develop the Business Continuity Management System. Service Leads and Department Heads should seek to develop a BCM culture in their area or department by: Giving proactive support to the BCM process. Encouraging awareness of BCM. Ensuring ownership of BCM. Demonstrating a commitment to the annual programme of audit, maintenance and review of BC Plans. Communicating the importance of BCM to all staff and clarifying their roles and responsibilities Within the field of Business Continuity Management, there are a number of key roles that need to be undertaken to ensure the success of the BCMS and protect the organisation from risk. Full details of the responsibilities associated with each of the required roles and how they are allocated within North Wales Police are given in Appendix 2 Business Continuity Management Roles, Responsibilities and Authorities. The Business Continuity Co-ordinator has overall responsibility for the implementation and management of the Business Continuity Management System. Individuals who have responsibility for BCM will receive awareness training and support from the force Business Continuity Co-ordinator. This will ensure that individuals have the knowledge to develop, implement and test an effective Business Continuity Plan (BCP). They will receive support and guidance throughout the year, particularly when a Plan is to be reviewed annually. Externally, BCM applies to the management of out-sourced contracts. It requires those responsible for negotiating and managing them to ensure appropriate business continuity standards are included in contracts. This will seek to ensure that the service provider is able to deliver acceptable standards of service following a disruption to North Wales Police, or to the external supplier themselves. Please see Appendix 3 entitled Supplier Business Continuity Evaluation Process 2.4 Approach to Managing Risk The process of assessing business continuity needs will include the consideration of a range of risks to all assets that form part of critical service delivery. Risk will be assessed and scored in line with existing force risk management procedures. Page 3 of 5

4 The Business Continuity Co-ordinator and Force Risk Manager will liaise regularly to ensure that business continuity risks are managed in an appropriate and consistent manner and escalated as necessary. 2.5 Review Once in place, it is important that regular reviews take place of how well business continuity management processes and procedures are being adhered to. This will happen at two levels: 1. Regular self-assessment and quality assurance. 2. Internal audit review by Denbighshire County Council. 3. Control of Documents and Records All business continuity management policies and plans that form part of the BCMS will be documented and managed in accordance with Force Policy and the Management of Police information Code of Practice. The Business Continuity Co-ordinator is responsible for the maintenance of all relevant documentation. 4. Scope All police officers and police staff, including the extended police family and those working voluntarily or under contract to North Wales Police must be aware of, and are required to comply with, all relevant policy and associated procedures. The policy applies to all parts of the force with implementation being the responsibility of Service Leads and Department Heads. 5. Monitoring This policy is governed by the Business Committee and will be monitored and owned by the Chief Superintendent, Corporate Services. 6. Legal Requirements In writing this policy the following have been taken into account The Civil Contingencies Act 2004 ISO 22301:2012 Societal Security Business Management Systems Business Continuity Institute Good Practice Guidelines 2013 National Decision Making Model This policy has been written giving due regard to the above legislation and has considered the risk of unfair and/or disproportionate impacts on Page 4 of 5

5 individuals or groups (actual or perceived) and has done so via an Equality Impact Assessment (EIA). 7. Associated Documents Please find attached (list all supporting guidance documents) Business Continuity Management Guidance Appendix 1 Business Continuity Context and Scope Appendix 2 Roles, Responsibilities and Authorities Appendix 3 Supplier Business Continuity Evaluation Process Appendix 4 Withdrawn Appendix 5 Business Continuity Plan Invocation and Recovery Team Procedure Appendix 6 Business Impact Analysis Process Appendix 7 Business Continuity Plan Appendix 8 Governance Report Page 5 of 5