BSO Board Director of Human Resources & Corporate Services Business Continuity Policy. 28 February 2012

Transcription

1 To: From: Subject: Status: Date of Meeting: BSO Board Director of Human Resources & Corporate Services Business Continuity Policy For Approval 28 February 2012 The Board is asked to agree the attached draft Business Continuity Policy which is required under controls assurance standards and reflect the DHSSPS requirements for the BSO. Director of Human Resources and Corporate Services POLICY ON BUSINESS CONTINUITY MANAGEMENT

2 1 Role of the Business Services Organisation The Business Services Organisation has been established to provide a broad range of regional businesses support functions and specialist professional services to the health and social care sector in Northern Ireland. These include Procurement and Logistics Information Technology Pensions Service Service Services Legal Services Family Practitioner Internal Audit Payments and Administration Office of Research Ethics Finance Counter Fraud and Probity (NI) Human Resources Services Leadership Centre Clinical Education Centre Equality and Human Rights Customer Care and Performance Management 2 Purpose 2.1 The aim of this policy is to detail a comprehensive framework for Business Continuity Management so that the Business Services Organisation (BSO) can continue to function through an unplanned operational interruption. Such interruptions could be caused by Loss of utilities Loss of premises Loss or shortage of staff Civil contingencies Public Health Incidents Loss of services 2.2 This document sets out the general principles and processes for the development, maintenance and review of business continuity plans for the BSO. 2.3 This policy is separate from but complements the BSO Risk Management Policy. It is based on the requirements of BS , Business Continuity Management Code of Practice. 2.4 This policy should be read with due reference to the BSO Risk Management Strategy and Policies and action plans; Business Continuity Plans and the PHA/HSCB/BSO Joint Response Plan. 3 Scope ---- What is Business Continuity Management? Page 2 of 8

3 3.1 Business Continuity Management is a business-owned, business driven process that establishes a fit-for-purpose strategic and operational framework that: Proactively improves an organisation s resilience against the disruption of its ability to achieve its key objectives; Provides a rehearsed method of restoring an organisation s ability to supply its key products and services to an agreed level within an agreed time after a disruption; and Delivers a proven capability to manage a business disruption and protect the organisation s reputation and brand. 3.2 Business Continuity Management involves managing the continuation or recovery of business activities in the event of a business disruption, and management of the overall programme through training, exercises and reviews, to ensure that business continuity plans stay current and up-to-date. 4 Relationship with Business Planning and Risk Management 4.1 Business Continuity Management shall be part of the planning cycle undertaken within the BSO Organisation. The cycle applies to all levels of planning in the Organisation. All levels shall have business plans, risk registers, business continuity plans and processes for the maintenance and review of plans. Business Unit level Business Continuity Plans are mandatory An outline of the planning cycle is set out below. Process for the on-going maintenance and review of the business plan, risk register and business continuity plans Establish objectives Maintain & Review Business Plan Document procedures and information in readiness for use in an incident to enable the Directorate to continue to deliver its critical activities at an acceptable pre-defined level Business Continuity Plan Risk Register Identify risks that may cause interruption to business or prevent the achievement of objectives Page 3 of 8

4 4 Civil Contingencies and Business Continuity Management 4.1 Civil contingencies activities are those undertaken by individuals and organisations to prevent emergencies and critical business interruptions, to mitigate and control their effects and to prepare to respond. These activities include risk assessment, Business Continuity Management, Integrated Emergency Management, preparedness, validation, response and promotion of recovery and restoration. 4.2 Business Continuity Management provides an organisation with the resilience to continue to function during an emergency and to return to full functionality effectively and efficiently once the crisis has passed. 5 Policy Statement 5.1 BSO is committed to ensuring the delivery of services on a continuous basis and where possible to restore business within 4 days of any interruption. It is essential that, irrespective of demands and circumstances, the BSO is able to deliver its critical functions and services as set out in the Business Continuity Plan. 5.2 BSO shall develop, exercise, maintain and review the Business Continuity Plan for its critical functions and services in the event of a service disruption or disaster. The Business Continuity Plan will detail the priorities and processes for the management of particular circumstances covered by the Business Continuity Plan with a view to ensuring the rapid, efficient and cost effective continuity of the Organisation s functions and services. 6. Roles and Responsibilities 6.1 Board The Board has overall responsibility to ensure that the organisation has a robust approach to the management of risks to business continuity and how critical events are managed. 6.2 Chief Executive Whilst holding overall accountability the Chief Executive will delegate the operational requirements to each individual director for their own business units who will have the responsibility to ensure each business unit has a business continuity plan which will include a business impact analysis. 6.3 The Director of Human Resources and Corporate Services (DHRCS) The DHRCS will be responsible through the Administrative Services Manager for the coordination of Business Continuity Plan and activities for the organisation 6.4 The Senior Management Team (SMT) The SMT will agree the overall strategy for Business Continuity Management by: Defining the objectives of the strategy Page 4 of 8

5 Developing the risk assessment process which will identify critical activities and critical dependencies, which need to be addressed to ensure continuation of a pre-determined level of clinical service. Implement a training programme in Business Continuity Management for appropriate staff. Ensuring that the Directorates undertake their risk assessments and produce Business Continuity plans to overcome the critical risks identified in the shortest possible time where appropriate. Ensure that the Directorates have considered the cost benefits between reducing the risk and the benefit achieved. At least annually reviewing the Business Continuity Plans Conducting exercise events to at least annually test the effectiveness of the Business Continuity Plan and ensure any action points arising from such tests are implemented. 7 Framework and Approach 7.1 The BSO shall establish a framework of plans which shall be underpinned by a corporate Business Continuity Plan. The corporate Business Continuity Plan shall take account of the key functions and services in the organisation and plan for their on-going delivery in the event of an interruption to normal business. Further plans shall be developed at Business Unit level to support the corporate plan and ensure resilience of key products and services. Directorate level Business Continuity Plans are not required but may be developed if required. 7.2 The BSO shall adopt the code of practice as set out in BS and establish a Business Continuity Management Programme against the standard. 7.3 BSO will strive to conform to BS Communications and Training 8.1 Relevant staff will be trained in the application of the management arrangements surrounding business continuity and all staff will be advised of the existence of the policy. 8.2 When Business Continuity plans are operational special emphasis will be based on the need to communicate and effectively update all staff during an emergency 8.0 Monitoring 8.1 Review of all Directorate Business Continuity Plans and the overarching Corporate Business Continuity Plan will be undertaken at least annually. The testing of the plans will be undertaken regularly in accordance with relevant controls assurance standards. 9.0 Evidence Base/References 9.1 This policy has been developed in accordance with the following list of legislative, guidance and standards; Page 5 of 8

6 NI Civil Contingencies Framework 2004 British Standard for Business Continuity BS25999 Controls Assurance Standards Joint Emergency Response Plan Equality Considerations. In developing and implementing business continuity plans the BSO will be particular alert to the needs of the following section 75 categories particularly when a change in location is required. Those with a disability Those with caring responsibilities Equality Statement This policy has been drawn up and reviewed in the light of Section 75 of the Northern Ireland Act (1998) which requires the BSO to have due regard to the need to promote Equality of Opportunity. In line with the duty of equality this policy has been screened against particular criteria and as a result no major issues requiring further impact assessment have been identified. This policy has also been considered and prepared with regard to the Board s obligation under the Human Rights Act The Board is satisfied that the policy complies with its obligations under the Act. If at any stage of the life of the policy there are any issues within the policy which are perceived by any party as conflicting with his/her rights, that party should bring these to the attention of the Head of Corporate Services. Page 6 of 8

7 . Glossary of Terms Business Continuity Management (BCM) Business Continuity Management Programme Business Continuity Plan (BCP) Civil Contingencies Disruption Emergency Emergency planning Incident Risk Risk management Holistic management process that identifies potential threats to an organisation and the impacts to business operations that those threats, if realised, might cause. It provides a framework for building organisational resilience with the capability for an effective response that safeguards the interests of key stakeholders, reputation, brand and value-creating activities Ongoing management and governance process supported by top management and appropriately resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products and services through training, exercising, maintenance and review. Documented collection of procedures and information that is developed, compiled and maintained in readiness for use in an incident to enable an organisation to continue to deliver its critical activities at an acceptable pre-defined level. Civil contingencies are the events and situations impacting on the community which may or may not occur, but would lead to an emergency if they did. Civil contingencies covers all the hazards and threats which could impact upon human welfare, the environment, national security or the continuity of essentials of life services. Event, whether anticipated (e.g. a labour strike or hurricane) or unanticipated (e.g. a blackout or earthquake), which causes an unplanned, negative deviation from the expected delivery of products or services according to the organisation s objectives. An event or situation that threatens serious damage to human welfare, the environment or the security of the UK. Development and maintenance of agreed procedures to prevent, reduce, control, mitigate and take other actions in the event of a civil emergency. Situation that might be, or could lead to, a business disruption, loss, emergency or crisis. Something that might happen and its effect(s) on the achievement of objectives. Structured development and application of management culture, Page 7 of 8

8 policy, procedures and practices to the tasks of identifying, analysing, evaluating, and controlling responding to risk. Page 8 of 8