Archived decisions

    HAMPSHIRE COUNTY COUNCIL

    Report

    Committee:

    Policy and Resources Select Committee

    Date of meeting:

    21st January 2010

    Report Title:

    Processes in place to ensure business continuity in the event of an emergency

    Report From:

    County Emergency Planning Officer

    Contact name:

    Mark Donlon

    Tel:

    8 - 200 - 5253

    Email:

    [email protected]

    1.0 PURPOSE OF REPORT

    The aim of this report is to update Members on the County Council's Business Continuity Management programme This report:

    · Outlines the requirement to implement a Business Continuity Management System (BCMS)

    · Provides an update to members on both the practical approach and progress that the County Council has made in implementing and maintaining the BCMS

    · Demonstrates how the wider Business Continuity programme informs planning undertaken by IT

    2.0 CONTEXTUAL INFORMATION

    2.1 Requirement

    2.1.1 The County Council is developing a Business Continuity Management System (BCMS) in line with the statutory requirements of the Civil Contingencies Act 2004 (CCA 2004) and is aligning its BCMS with the principles of the British Standard for Business Continuity Management - 25999.

    2.1.2 Aside from good business practice - the Civil Contingencies Act 2004 requires Hampshire County Council to ensure that it has prepared so far as is reasonably practicable, to continue to provide critical activities and an emergency response during any emergency or disruptive event. To that end, the County Council is undertaking a continuous programme of work to prepare Business Continuity Plans.

    3.0 PROGRESS TO DATE

    3.1 General approach

    The general approach for delivery of business continuity management across the departments is based on a principle of central support for a local delivery. Because of the scale of the continuing BCMS programme, each department is responsible for producing and maintaining its own plans, with the Business Continuity Officer providing support, guidance, training and advice across all departments as required and appropriate. Some elements of our approach are:

    3.1.1 BCM Policy

    The Business Continuity Management Policy attached to this report at appendix A provides the framework for Business Continuity Plans to be developed, implemented, tested and reviewed

    3.1.2 BCM Strategy

    The Business Continuity Management Strategy attached to this report at appendix B outlines the approach that the County Council has adopted in producing its business continuity plans.

    3.1.3 Service Prioritisation

    Council services have been prioritised as follows:

    Priority 1 services - Disruption to these activities would have an impact on our ability to deliver where appropriate an emergency response on behalf of the County Council or may result in serious damage to human welfare

    Priority 2 services - Disruption of these activities would have an impact resulting in:

    · Impact or breakdown of local community services

    · Damage to the environment

    · Council loses income

    · Council suffers a loss of reputation

    Priority 3 services

    · Activities that do not fall into either of the first two categories but contribute to the overall objectives of the council

    Each department has recovery plans in place for Priority 1 and Priority 2 services:

    3.1.4 Coordination

    BCM is coordinated through the Business Continuity Group, the core group comprising of department coordinators, reporting to the Corporate Risk and Safety Executive Group (RSEG) who escalate as required to the Risk Management Board

    3.1.5 Internal Audit

    Internal Audit reported in 2008/2009 that an appropriate framework of control exists corporately to ensure that business continuity and disaster recovery plans are in place to minimise disruption in the event of an emergency. Audit testing confirmed that controls were operating with exceptions. Both corporately and within departments those identified exceptions have been addressed.

    3.1.6 Implementation of plans

    Effective implementation of the Business Continuity Tactical Management Group was seen during the recent swine flu event. In addition, department business continuity plans have also been implemented successfully during recent weather related incidents and telephone technical failures. Plans will be continuously developed as a result of any learning points.

    3.1.7 Partnership working

    3.1.7.1 Local Resilience Forum

    The Hampshire & IOW Local Resilience Forum (HIOW LRF) Business Continuity Sub Group has a requirement to encourage improvements in resilience in all LRF member organisations, A biennial survey of member organisations was inaugurated in Summer 2008 to determine as an LRF, the status of business continuity planning across member organisations. Information gathering was organised and collated by the HCC Business Continuity team based on the audit commission self assessment tool. The aim was to give a broad overall picture of how Hampshire and IOW authorities view their own business continuity preparedness. Overall HCC compared favourably with its partners and has made further progress since in the areas of planning and training - appendix C.

    3.2 Key milestones

    Some key milestones and achievements to date in the development of the council business continuity management system have been:

    · To undertake and complete a critical activities survey to identify services as priority 1 or priority 2 (Definition at 3.1.3) based on criteria outlined in the CCA 2004

    · The identification through business impact analysis of the impact of loss or disruption to each service and the potential exposures which may be present in the event of a business disruption. Appropriate recovery times and workarounds have been identified as required

    · The development, completion and ongoing maintenance of a suite of business recovery plans for all service, business areas and locations as appropriate (Approximately 150 corporate, department and service plans are currently in place)

    · The regular review by departments of continuity requirements and plans to ensure that they reflect the changing needs of the council

    · The implementation and maintenance of training records related to awareness and practitioner training where required

    · The implementation of a continuous, rolling plan validation programme to review, test and improve our business continuity plan(s), in situ, at regular intervals

    · Collaborative working with IT and departments to formalise existing processes by which the requirement and dependency on IT applications by services is identified and communicated to IT

    · The preparation of supplementary pandemic preparedness and response arrangements which supported the invocation of a measured response to the outbreak through the BCM Tactical Management Group

    · To begin the process of embedding a BCM culture through the organisation through staff e-learning, articles in staff publications, development of an intranet website and the promotion of BCM at new management workshops

    3.3 Looking forward

    · To further develop the BCMS in line with the requirements of BS25999 ensuring that plans remain fit for purpose and the BCM ethos is embedded in the culture of all departments

    · To assess the most appropriate method of maintaining existing and future BCMS documentation

    · To work with facilities management in developing Building Emergency Response Teams for the principal work locations

    · To reinforce to departments the necessity of ensuring that business continuity plans take into account the non availability of IT

    4.0 CONCLUSIONS

    In putting the framework BCMS in place, Business Continuity has had both senior management support and all departments have made appropriate resources available. Our existing plans have informed Hampshire County Councils response to a number of incidents ensuring that key services were delivered during adverse situations

    Whilst having achieved a great deal and having in place BC plans for priority one and priority two services, Members are asked to recognise that Business Continuity Management is an ongoing, continuous process that requires continuing commitment in order to review, maintain and further develop Hampshire County Councils Business Continuity Management System.

    IMPACT ASSESSMENTS:

1. Equalities Impact Assessment:

    There is no evidence to suggest that the BCM programme is contributing to any form of exclusion

2. Impact on Crime and Disorder:

    None

3. Climate Change:

    How does what is being proposed impact on our carbon footprint / energy consumption?

    No immediate impact

    How does what is being proposed consider the need to adapt to climate change, and be resilient to its longer term impacts?

    Business Continuity will need to take into account the negative impacts associated with climate change when undertaking their business impact analysis and preparing service recovery plans