BUSINESS CONTINUITY STRATEGY January 2009
CONTENTS Page BACKGROUND 1 OVERVIEW 1 AIM AND OBJECTIVES 1 CORE BUSINESS OF THE COUNCIL 2 ORGANISATION STRUCTURE 2 RISK IDENTIFICATION AND MITIGATION STRATEGIES 3 PREVENTATIVE MEASURES 3 SERVICE RECOVERY PLANS 4 FINANCIAL CONSIDERATION 5 REVIEW PROCESS/TRAINING 6 APPENDICES: Appendix 1 - Training
BACKGROUND The Civil Contingencies Act 2004 places a duty on the Local Authority to ensure that it is prepared, as far as reasonably practical, to continue to provide critical functions in the event of a disruption. This duty will be fulfilled by the formulation of a Business Continuity Plan (BCP) implemented by the Council in order to mobilise its response and undertake work to prevent or mitigate the severity of potential disruptions. The BCP identifies the structure for implementation, mitigation measures and the communication process to keep the workforce, partners and the public informed of necessary changes to service delivery and the recovery objectives. OVERVIEW The approach adopted for the development of the BCP can be summarised as follows: The BCP is an operational document designed for development and review with close links to the relevant risk management programmes. The BCP ensures an appropriate response to any disruption. The BCP is generic and addresses the Council s functions and service areas and currently focuses on those services the Corporate Management Team deem the most critical for public protection and safety. AIM AND OBJECTIVES The aim is: To support the Council in anticipating risks for the purpose of reducing them and having flexible plans in place already tested to minimise disruption when unplanned events significantly interrupt normal business. The objectives are: To ensure the Council can continue to exercise its functions in the event of an emergency. To identify the potential areas of vulnerability in Council services on a service by service basis, in order to determine overall priorities for recovery of functions if disruption takes place. 1
To build on good work already in place for risk management ensuring all existing plans are integrated into the overall framework for example the Civil Emergency Plan and individual service areas 'flu pandemic plans. To ensure all service areas are involved in the maintenance of the BCP so that there is an effective and consistent response to service continuity. To develop and update the overall BCP and develop service recovery plans where necessary in order to protect the services and reputation of the Council. To undertake training and awareness programmes for all employees. To carry out regular tests of the BCP to validate the arrangements. CORE BUSINESS OF THE COUNCIL The Corporate Plan sets out the Council's vision to make the most of resources. The Council has adopted a 'One Council' approach to its way of working. This is aimed at removing duplication and ensuring that individual services can work in synergy with each other without the constraint of traditional 'departmental' boundaries. It also identifies goals, priorities and targets for each priority area. This forms the background to the assessment of priority for business continuity. The BCP will be maintained in order to ensure it is robust and 'fit for purpose' to satisfy the Council's current corporate objectives. ORGANISATION STRUCTURE Worcester City Council is organised into six service areas: Chief Executive/Head of Paid Service (strategic and organisational management) Cleaner and Greener City Financial Services Governance and Corporate Support Performance, Innovation and Efficiency (including Customer Service Centre) Safer and Stronger Communities Urban Environment (including Strategic Housing) 2
RISK IDENTIFICATION AND MITIGATION STRATEGIES The services provided by Worcester City Council could be disrupted by a range of incidents. It is important to ensure that the risks that can adversely affect the organisation and its facilities are identified, evaluated and that appropriate control measures are in place to mitigate the risks. Full details of risk mitigation strategies in place/being worked on are listed in the BCP. The risks are managed through use of the Council s service level and corporate risk registers, which are all regularly reviewed and updated through the Corporate Management Team/Corporate Risk Group. As part of the overall Civil Emergency Plan, the Council in partnership with partner agencies has carried out an assessment of the risks and threats in the City. PREVENTATIVE MEASURES There are a number of important preventative measures which can be taken to minimise the likelihood of any incident and also to reduce its possible impact should it still occur. These would also considerably assist the reactive measures identified in the BCP. Preventative measures to be undertaken corporately to assist in avoiding or to give early indication of possible incidents include: regular maintenance of services, e.g. boilers, emergency generators maintenance of smoke alarms training and familiarisation of the workforce in respect of fire drills, bomb and similar security procedures maintenance of plans of the building(s) electrical testing of fixed wiring and portable equipment regular adherence to and review of security arrangements Services can also take proactive steps to assist recovery following an incident through the following measures: direction from IT on correct back up and storage of information identification and safe storage of vital documents to be retrieved following a disaster procedure notes to ensure work can be undertaken by others if employees are unavailable in a recovery period identification of sources of information/working papers following an incident prioritisation of services for recovery following an incident (should multiple services be affected this decision will need to be made corporately) relocation areas or premises identification of those employees who will continue service provision and those who will be involved in recovery. 3
SERVICE RECOVERY PLANS Each service has been required to produce a service recovery plan and it is the responsibility of individual Heads of Service to maintain their service recovery plan to the position where each plan could be implemented with immediate effect. The list below is not exhaustive but service recovery plans should include: which aspects of the service are affected; identification of key employees and their responsibilities in respect of business recovery; employee contact names and telephone numbers; number of workstations are affected and the number of workstations required to maintain critical functions; number of displaced employees are displaced; can operations be continued from the same workstations and offices; alternative accommodation needs; what are the effects on service delivery; what equipment is lost or damaged; essential IT requirements; key external contacts. Service recovery plans are held by each Head of Service/relevant member of the BRG, and as confidential information is contained in each plan they are also located in a confidential area on Sharepoint. 4
REVIEW PROCESS The BCP will be reviewed on an annual cycle and in light of any changes that might affect the Plan itself. Heads of Service are responsible for notifying the Emergency Planning Co-ordinator of any significant changes that occur in between these updates. The outcome of training and exercises of the BCP will be incorporated into the annual review process, as will any lessons learned from experience of emergencies. The BCP will also be reviewed against the Community Risk Register to ensure business continuity reflects the current assessment of adverse events. In line with current legislation the BCP will need to be comprehensively reviewed annually in parallel with the Community Risk Register. Heads of Service are also responsible for reviewing and updating their individual service recovery plans as changes and developments take place in their service area. TRAINING The City Council is committed to providing all employees with training in respect of its business continuity arrangements. Refer to Appendix 1. Training will be developed for all employees but the first tranche of training will be for those officers deemed as mission critical by Heads of Service. All new employees will be made aware of the Council's Business Continuity Plan through the induction process. Existing employees will also be provided with information in the form of a leaflet explaining business continuity and the Council's responsibilities. Testing of the Business Continuity Plan should be undertaken on an annual basis. 5
FINANCIAL CONSIDERATION The overall requirements of the BCP generally represent a better way of coordinating existing resources and should not demand significant investment. This is managed within existing budgets and resources in conjunction with notifying the Head of Financial Services of necessary anticipated costs. The arrangements outlined in this document are strategic in nature and it is not possible to predict the Council s financial standing at the time of an, as yet, unforeseen crisis. The position would depend on a range of factors, such as sources of external funding in such an emergency, and the reserves available to the Council at that time. There are a number of organisations and funding schemes, (either operated by or accessible through the UK government) that may help local responders meet the extraordinary financial costs incurred during the response to, and recovery from, an emergency. The Bellwin scheme (administered by Department for Communities and Local Government) provides financial assistance to local authorities to help meet the costs of dealing with an emergency. It is a discretionary scheme for any incident that is deemed exceptional by local standards, and where the damage to life and/or property in the local authority area causes an undue financial burden on the Authority. During the operation of the BCP in an emergency it will be necessary for proper financial control and procedures to be adopted. The Council's Head of Financial Services (S151 Officer) and the Finance Services Manager are principally responsible for the financial arrangements of the Council. During the operation of the BCP circumstances may dictate that formal processes and procedures cannot take place. In this event Heads of Service and Managers should continue to exercise their full responsibility for prudent stewardship of their resources, and make sure that all emergency transactions are fully recorded, with supporting documentations. These should be provided to the Head of Financial Services at the earliest opportunity. 6
Appendix 1 TRAINING Training is fundamental in ensuring that the Business Continuity Plan succeeds when testing it. All employees should be trained to a standard that will ensure normality is returned as soon as possible following an emergency/major disruption. During the induction process new employees will be informed of their responsibilities and the importance placed upon them and their colleagues to maintain critical services in the event of an emergency. Following training, all employees should have an understanding of responsibilities with regard to: what if they are unable to enter their usual place of work; what are the alternative working practices if there is a sustained power failure; what can they do in the event that IT systems crash; what might be expected of them if the weather is so severe that it is impossible to reach Council offices; are they expected to undertake other duties if a high proportion of the workforce is suddenly taken ill; their specific role and responsibility in a crisis TRAINING EXERCISES Heads of Service will be responsible for testing their own Service Recovery Plan to ensure their internal arrangements are effective. An annual training exercise will be held to test the Council s overall response to a significant disruption. All exercises should be debriefed and lessons learnt incorporated as necessary into the Business Continuity Plan. TRAINING RECORDS Induction will be recorded on training records. Attendance at exercises will also be recorded and Heads of Service will be advised when refresher training of members of their teams is required (every two years). New job descriptions will include reference to business continuity/civil emergency responsibilities and mandatory training. 1