Archived decisions

HFRA 13 9 06 - Service Continuity Framework

Appendix A

HAMPSHIRE FIRE AND RESCUE SERVICE

SERVICE CONTINUITY FRAMEWORK

VERSION 1.1

INDEX

OVERVIEW

The Civil Contingencies Act 2004 designates Fire Authorities as a Category 1 Responder. The Act places two key responsibilities on Category 1 Responders:

· To ensure that they can continue to exercise their functions in the event of an emergency, as far as reasonably practicable.

· To provide advice and assistance to businesses and other organisations about Business Continuity Management. (This is a responsibility of Local Authorities and not the Fire and Rescue Service).

To ensure we are able to maintain our essential services during a large scale event or incident the Fire Authority is committed to embedding Business Continuity Management within the service.

The Business Continuity Institute(BCI) make the following definitions:

Business Continuity Management (BCM) is a: "holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities."

Business Continuity Planning (BCP) is: "advance planning and preparation which is necessary to identify the impact of potential losses, to formulate and implement viable continuity strategies, and to develop continuity plan(s) which ensure continuity of organisational services in the event of an incident."

Note: HFRS will use the term `Service Continuity' in place of `Business Continuity' where appropriate

HFRS will develop a Service Continuity Framework that will draw together policy, risk assessment and the necessary tools to enable the service to plan for events that will impact on our ability to deliver our key services. The Service Continuity Framework establishes processes by which service continuity plans are produced, implemented and tested. It will identify key roles, responsibilities and accountabilities within the service and provide the framework within which events/incidents impacting on the day to day running of the service will be managed.

The implementation of this Service Continuity Framework demonstrates our compliance with the duties under the Civil Contingencies Act 2004 and will enhance our organisational resilience. Furthermore it will ensure we successfully embed the principles of risk management and service continuity into day-to-day management practices and ensure that in the event of an event/crisis occurring that disrupts one or more business/service delivery processes, the organisation can:

· Minimise the initial impact of the incident.

· Recover its key processes, as much as possible as soon as possible, or compensate for their temporary or permanent loss.

· Return to its normal pre-incident state as soon as possible.

POLICY

Hampshire Fire and Rescue Service recognises its responsibilities for maintaining appropriate arrangements for ensuring that it can continue to function and meet its emergency response and other service delivery obligations in the event of an unforeseen interruption. To achieve this, we will develop and maintain a Service Continuity Framework in accordance with current best practice.

HFRS will:

· Undertake Service Impact Analyses at appropriate intervals

· Review our Service Continuity recovery strategies and plans in the light of any organisational or operational change

· Train and inform all staff and Members of the Authority to assist them in undertaking their respective Service Continuity responsibilities effectively.

· Involve staff at all levels in producing and rehearing our procedures

· Perform annual maintenance and regular audit of our service continuity arrangements

· Undertake periodic rehearsals of our Service Continuity plans

John Bonney

Chief Officer

1 INTRODUCTION

1.1 The purpose of the Service Continuity Framework (the Framework) is to assist Hampshire Fire and Rescue Authority (the Authority) to meet its statutory duties and organisational aims and objectives where the consequences of an emergency situation threaten to disrupt service delivery. The implementation of the Framework and the associated procedures and guidance will ensure resilience against potentially catastrophic events.

1.2 As a Category 1 responder under the Civil Contingencies Act 2004 (CCA) the Authority has a duty to take measures to try and prevent an emergency; reduce, control or mitigate the effects of an emergency. Robust Service Continuity Management (SCM) arrangements are an essential and vital component of maintaining delivery of our core business and therefore meeting the requirements of the CCA.

1.3 The Framework has been established on the basis of the Guidance of the Civil Contingencies Act 2004, its associated regulations and non-statutory arrangements. Furthermore account has been taken of guidance from the Civil Contingencies Secretariat, the CPA self-assessment checklist and guidance from other professional bodies such as the Business Continuity Institute (BCI). The Framework is a dynamic process that will evolve with future guidance and experience.

1.4 Service continuity is an important constituent of the Authority's overall approach to Risk Management and it should be seen as an integral part of everyday work. Once embedded it will bring benefits at departmental and operational level, in that it:

· Requires focus on critical services

· Is based on risk assessment and service impact analysis

· Generates corporate and departmental action plans which will increase resilience

· Identifies key members and groups of staff

· Highlights vulnerabilities to meeting service delivery targets

· Provides clear plans for managing emergency situations

· Identifies the important detail necessary for effective service continuity

· Provides an opportunity to monitor and improve service delivery

1.5 The Framework is based on the Business Continuity Management Lifecycle developed by the Business Continuity Institute (BCI). The components of the lifecycle are:

· Understanding the organisation

· Determining Business Continuity Management options

· Developing and implementing a Business Continuity Management response

· Exercising, maintenance, auditing and self assessment

· Business Continuity Management - Programme Management

· Embedding Business Continuity in the organisations culture

2 PLANNING

Effective planning of service continuity focuses around accurate identification of the vital activities performed by the service. These are referred to as `Mission Critical Activities'.

The framework provides a structure and process to respond to an incident affecting one or more Mission Critical Activities, so as to minimise the impacts and reinstate the activities of the service. It is not possible, nor prudent, to try and plan for every single incident that may occur. Our planning will focus on 4 key elements that may disrupt and prevent HFRS from delivering it's core services to the public. The 4 key elements are:

Significant failure in any one of these elements will directly impact on our capacity to deliver, and sustain delivery of, our key services to the public and meet our corporate aims. The failure could be due to a range of incidents from industrial action; severe weather; damaged premises from fire, flood, storm; health and safety issues etc.

Using this simple approach enables the service to prepare strategic and department level plans to support the service during an event or emergency. The service will develop strategic and department response plans designed to move the service as quickly as possible back to the usual business model as soon as is practical.

The service will develop bespoke plans, where necessary, to address identified threats to the service continuity of the Authority (i.e. Pandemic flu: Industrial action etc ). These plans will be developed by the Contingency Planning Department.

3 RISK ASSESSMENT

Development of the service continuity plans is based on risk assessment of the activities identified as critical to maintain our service delivery. These will be referred to as the Mission Critical Activities (MCA's).

Effective risk assessment will ensure we develop appropriate arrangements that are sound and proportionate to the risks. Minimal risks may require little or no specific action whereas significant risks will require the production of contingency plans. The plans will set out sufficient detail to identify who has to do what, how and when.

Risk assessment is not purely a quantitative process; it relies on the judgements and informed decisions of the team conducting the assessment. Furthermore it is essential to involve managers and practitioners who know their particular part of the service, as they will be best placed to accurately identify potential threats, opportunities and appropriate countermeasures.

Anticipation of the range of threats and consequences of incidents requires the Authority to demonstrate a proactive approach to risk management. In doing so countermeasures will be identified which may prevent an emergency occurring in the first place.

4 EQUALITY IMPACT ASSESSMENT

Development of service continuity arrangements will require alternative working arrangements, and possibly locations, to be identified for the short, medium and long term. Each plan that is developed will be subject to the Equality Impact Assessment process to identify any differential impacts on our staff and people receiving our services.

5 LOCAL RESILIENCE FORUM

Under the Civil Contingencies Act 2004 (CCA) co-operation between local responder bodies is a legal duty. The principle mechanism for multi-agency co-operation between Category 1 responders is the Local Resilience Forum (LRF). This is based on police areas; however the forum is not a statutory body and has no powers to direct members.

The purpose of the LRF is to ensure strategic co-ordination for the effective delivery of those duties under the act that need to be developed in a multi-agency environment. In particular the LRF process should deliver:

The compilation of agreed risk profiles for the area, through a Community Risk Register, a systematic, planned and co-ordinated approach for each responder body, according to their functions, to address:

_ Risk

_ Planning for emergencies

_ Planning for service continuity management

_ Publishing information about risk assessments and plans

_ Arrangements to warn and inform the public

_ Support for the preparation of multi-agency plans and other documents

The LRF will provide leadership on community and cross agency resilience issues. HFRS will support the work of the LRF and take a lead role in agreed areas of specialism.

6 SERVICE CONTINUITY PLANNING

The HFRS Service Continuity Framework is based on the Business Continuity Management Lifecycle developed by the Business Continuity Institute (BCI). The following actions will be carried out at each stage of the lifecycle:

6.1 Understanding Your Organisation

6.1.1 Service Continuity Impact Assessment

Each department/workgroup will complete a Service Continuity Impact Assessment (SCIA), an example of which is at Appendix A. The SCIA will identify the key activities the department/workgroup perform that contribute to the Corporate Aims. These will be risk assessed to identify the priority for each activity and enable them to be compared with other departments.

The Service Continuity Impact Analysis (SCIA) contains the risk assessment process which enables the service to:

· Identify the mission critical activities which need to continue after disruption occurs

· Establish how soon the critical service must restart

· Identify potential threats from a risk assessment process

The SCIA's will be analysed to identify activities as being either:

Priority 1 - Must be maintained immediately in the event of an emergency

Priority 2 - Essential to support Priority 1

Priority 3 - Maintain as long as possible/provide scaled down response or resources

In the event of an emergency the Crisis Management Group will use the SCIA to prioritise allocation of resources in the initial stages of an emergency.

6.1.2 Service Impact Analysis Questionnaire

Following completion of the Service Continuity Impact Assessment, each department will complete a Service Impact Analysis Questionnaire (See Appendix B). The Service Impact Analysis Questionnaire (SIAQ) will be carried out by Department Heads as they are in a position to make accurate judgements about their departmental functions and how to restart critical services most expediently.

The questionnaire will identify the requirements for the four key elements of People: Premises: Vehicles and Equipment: Information and Communications Technology. It will identify the minimum resources required to restart the critical service and consider the impact on internal and external stakeholders.

This information will be used to populate the Service Continuity Matrix (SCM) which in turn will identify the key areas requiring additional resources, investment and management effort. This information will be reviewed annually by the Contingency Planning Department and updated in conjunction with the relevant Department Head.

Each department will be responsible for updating their Service Impact Analysis Questionnaire where there is significant change in existing practice or new procedures/practices are introduced.

6.2 Service Continuity Management Strategies

6.2.1 Service Continuity Plans

Following the analysis of each department's requirements, each Department Head will develop their Service Continuity Plan. These plans will be based on one or more of the following strategies, depending upon the risk critical nature of the work to support service delivery:

1. The service cannot fail - full availability must be maintained

2. There can be some suspension of service - Identification of the recovery time from the onset of the crisis

3. There can be some loss if work - Identification of the recovery point from the onset of the crisis

4. The service is not required - Do nothing

Each Department Head will be responsible for the development of their individual Department Continuity Plan and it will be developed using the standard pro-forma at Appendix C. Each department will be responsible for updating their Department Continuity Plan where there is significant change in existing practice or new procedures/practices are introduced. Department Heads will be supported by the Contingency Planning Department.

6.3 Developing and Implementing a Service Continuity Response

6.3.1 Managing a Crisis

A crisis is defined as any event that can, or will have a significant impact on the ability of HFRS to maintain normal delivery of our services. This could be industrial action, severe weather, loss of a large building, widespread illness etc, and could occur with very little or no notice.

There are 3 distinct phases to a crisis that need managing. Each phase will be different and the service may move rapidly between phases or there may be a slower progression depending on the event. The 3 phases are:

Crisis Management:	Immediate response and first 4 hour response to the event/crisis
Crisis Recovery:	First day and first week response to the event/crisis
Continuing the service:	Future management of the service prior to full recovery

6.3.2 Crisis Management

To help manage a crisis in the immediate stages the following structure will be considered for implementation. The Chief Officer, or duty Principal Officer may vary this structure according to the size and nature of the crisis. The structure is represented in Diagram 1.

Diagram 1: Managing a Crisis

Response to a crisis may require a phased approach involving a number of teams, possibly in collaboration with other agencies through the Local Resilience Forum. The following teams should be established in the immediate stages of a crisis:

Crisis Management Group (CMG) - Top tier management, responsible for deciding if an emergency exists and for invoking the appropriate service continuity plan/s and liasing with the Local Resilience Forum where appropriate.

Emergency Response Team (ERT) Will attend to the crisis directly to conduct a damage impact analysis and apply measures to mitigate further loss/damage. The ERT will be the eyes and ears of the CMG.

Service Recovery Team (SRT) comprising individuals drawn from key departments (e.g. Premises, Finance, Personnel, IS). The role of these teams is to ensure day-to-day service continues for the duration of the incident and to support the Department Heads in recovery of their departments.

The make-up of these teams will need to be flexible but a suggested membership for each team is provided along with outline responsibilities at Appendix D.

6.3.4 Recording Decisions

In order to assist in effective management of an incident and also to promote good communications, a contemporaneous log (Decision Log) will be kept by the CMG. The log will form part of the suite of documents available to the CMG to assist them in the management of a dynamic situation. An example of the incident continuity log is attached at Appendix E.

6.3.5 Crisis Recovery

Once CMG have determined the need for Service Continuity plans to be invoked, and carried out initial actions to control a crisis, the recovery phase commences. CMG will identify the areas of the service impacted by the crisis and consider the appropriate continuity plans to be invoked.

This phase is concerned with the restoration of the mission critical business activities. Function/Department Heads will be responsible for implementing their respective Department Continuity Plans and directing the recovery of their department services. The Service Recovery Team will provide support to Department Heads and provide a point of liaison to CMG.

Services will be reinstated in line with the Service Impact Assessment and priorities identified within the service continuity plans of the affected department/s.

6.3.6 Continuing the Service

It should be recognised that the activities to fully restore the service to normal working may extend over a long period of time. Once the situation is stabilised the emphasis should be making the transition to normal working as smooth as possible. Depending on the nature and extent of the crisis, this phase could last for a day, a week or months if a major building is lost.

ERT conduct an assessment of situation & report back to CMG

6.4 Exercising, Maintenance, Auditing and Self Assessment

6.4.1 Service Continuity - Education and Awareness Training Programme

A Service Continuity Education and Awareness Programme will be implemented to enable staff and managers implement the Service Continuity Framework. A strategy for this programme for all HFRS staff and HFRA Members is outlined at Appendix F.

6.4.2 Embedding Service Continuity into day-to-day management of the service

Service Continuity is not a one-off process that can be completed and then put aside. It must form part of day-to-day management thinking and be considered as the service evolves and develops to meet future challenges.

FRS Service Management Team decide on the future direction of the service and will maintain a responsibility to consider the impacts of future strategies on existing service continuity arrangements. Department Heads will be required to update plans as the priorities change within their department as well as test existing plans on a periodic basis.

6.4.3 Exercising and Plan Maintenance

The prime purpose of audit, monitoring and review is to promote and achieve continuous improvement in the Authority's Service Continuity arrangements. Additionally the audit, monitoring and review processes will produce evidence for internal and external scrutiny. HFRS will audit the Service Continuity arrangements against the Business Continuity Institute (BCI) draft standard BS 25999-1.

Periodic testing, along with monitoring and review against the activities of the service /department will ensure plans are reviewed and up dated regularly and that lessons are learnt from incidents, exercises and research.

The following arrangements will be implemented to test, audit, review and update the existing Service Continuity/Department Continuity plans:

Plan/Document	Action	When	Who
HFRS Service Continuity Framework	Review and update Framework and associated appendices	Annual	Contingency Planning
Department Service Continuity Plans	Test and update	Annual	Department Heads
Department Service Continuity Plans	Audit of Department plans	Biennial	Contingency Planning Dept.
Risk Specific Service Continuity Plans	Review existing plan based on threat of occurrence	As required	Contingency Planning Dept.

6.5 BCM Programme Management

This Framework provides the structure by which HFRS will develop and maintain service continuity arrangements. It identifies the roles and responsibilities of groups in the development and implementation of service continuity arrangements. It provides the necessary tools/checklists and guidance to give staff at all levels a clear understanding of their respective roles in service continuity and the expectations of the service.

The Service Continuity Education and Awareness Programme will help support the staff to implement the requirements of the framework. Further to this a communications structure will be implemented to provide ongoing support and information to all SMT, Department Heads and all staff on service continuity arrangements.

6.5.1 Communications

Communication with staff, suppliers and other stakeholders is a key factor during a crisis. Additionally as the service prepares service continuity plans there will be communication with stakeholders, suppliers and other key groups to ensure plans are developed and fit for purpose.

A Communications Matrix is provided at Appendix G. This matrix identifies the key areas of communication before, during and after a crisis and provides a guide for the Crisis Management Group, Department Heads and the Marketing and Communications Department to work to.

Each individual Department Service Continuity Plan will include a Communications and Media Plan to support Department Heads in preparation for a crisis.

6.6 Embedding Service Continuity in the Organisations Culture

For the service to be suitably prepared to respond to a crisis it must embed `Service Continuity' into it's culture. This may be a lengthy process and will require commitment from throughout the service to achieve. To support the process of embedding a continuity culture the service will invest the time and resources into it's middle and senior managers to develop service/department continuity plans and develop their understanding of the service continuity.

6.6.1 Statement of Commitment/Policy

This Service Continuity Framework document provides a formal corporate statement of commitment to service continuity and details the policy of the service.

6.6.2 Key roles that will maintain responsibility for Service Continuity arrangements

The following roles will maintain responsibility for service continuity arrangements:

Hampshire Fire and Rescue Authority	Allocation of resources to support service continuity arrangements. Support during a crisis/emergency to provide political support to the service
Chief Officer/Principal Officers	Determination of service delivery priorities Allocation of internal resources to develop the HFRS Service Continuity Framework and associated continuity plans
Principal Officers	Lead the Crisis Management Group during a crisis/emergency
Deputy Chief Officer (Community Safety/Operations)	Implementation and maintenance of the HFRS Service Continuity Framework. Co-ordination of the development of specific service continuity plans to address identified crises.
Function Heads	Co-ordination of the development and maintenance of Department Service Continuity Plans Implementation of continuity plan testing and co-ordination of updating plans Role on Crisis Management Group, as required, during a crisis/emergency
Contingency Planning Department	Development of specific continuity plans as required Support to Department Heads to develop department level service continuity plans Liaison with the Local Resilience Forum and support to the Crisis Management Group during a crisis/emergency
Department Heads	Development and maintenance of Service Continuity Plans to maintain service delivery during a crisis Testing and updating continuity plans Invocation of department continuity plans during a crisis/emergency
All staff	Maintaining awareness of service continuity arrangements and individual responsibilities during a crisis/emergency

CRISIS MANAGEMENT - ROLES AND RESPONSIBILITIES

Appendix D

The following sets out the roles and responsibilities for the teams referred to in this plan. These are designed to be indicative of the level of activity envisaged and may change as the situation develops.

CRISIS MANAGEMENT GROUP (CMG)

The Crisis Management Group will be formed from SMT members and identified department managers or specialist advisors. This team must determine whether or not a `crisis situation' exists and whether the Service Continuity Plan/s (SCP) should be invoked. The CMG will direct the work of the Emergency Response and Service Recovery Teams and co-ordinate information and action to ensure the service is operating to its best capability. s they implement their part of the plan. CMG will monitor the effectiveness of the plan and make adjustments as necessary.

Crisis Management Group Composition

EMERGENCY RESPONSE TEAM (ERT)

The Emergency Response Team will deal directly with the emergency and report back to the CMG to assist them decide if an `emergency situation' exists which requires the SCP to be invoked. The ERT will carry out an assessment of the situation and seek to stabilise the situation and initiate any immediate salvage operations to mitigate against further loss. This team will be made up of staff with specialist skills or knowledge about the premises or service affected.

Emergency Response Team Composition

SERVICE RECOVERY TEAM (SRT)

Once a decision has been made to invoke the Service Continuity Plan (SCP) the Service Recovery Team (SRT) will be responsible for implementation of the Plan (or parts of it as appropriate).

The role of the SRT is not to deal with the emergency response itself, but to focus on the business of service recovery. This may include notifying staff, relocating to alternative premises, setting up work stations and communications links. The size and composition of this team will depend on the nature and scale of the emergency; furthermore it is likely that this team will be in place for a number of days after the initial incident, therefore relief's and a hand-over will be required.

The SRT will be located away from the scene of the emergency/crisis and will report to the Crisis Management Team. The SRT will support Function Heads/Department Managers to help resume delivery of their services in line with the priorities identified within this framework.

Service Recovery Team Composition

SPECIALIST FUNCTIONAL TEAMS

Specialist Functional Teams already exist in the broadest sense for each of the key organisational functions e.g. Premises, Finance, Personnel, IS. When an emergency situation occurs it may be necessary to bring together a group or several groups of such specialists to assist with the recovery of the services affected whist ensuring that other critical services continue to function. Their role would be to support the above teams with resources and specialist advice as dictated by the crisis.

Secretarial/WP/W/Corporate/Events/HFRA HFRA 13 9 06 Service Continuity Appx A 1/9/06