BRADFORD AND AIREDALETEACHING PRIMARY CARE TRUST

BUSINESS CONTINUITY PLANNING

KEITH LISTERMAJOR INCIDENT PLANNING AND BUSINESS CONTINUITY LEAD

March 2007

CONTENTS

Page

1. INTRODUCTION 2

2. CURRENT POSITION 2

3. WHAT THE ORGANISATION NEEDS TO DO 3

4. ACTION REQUIRED BY DIRECTORS 3

APPENDIX 1Business Impact Analysis Template 4-15

APPENDIX 2Completed Business Impact Assessments 16-19

1

1. INTRODUCTION

Business Continuity Management is defined as the holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation and value creating activities.

Its primary objective is to allow the Executive of an organisation to continue to manage their business under adverse conditions by the introduction of appropriate resilience strategies, recovery objectives, business continuity and crisis management plans in collaboration with, or as a key component of, an integrated risk management initiative.

Formal Business Continuity Planning is now a legal requirement for PCTs, as Category 1 responders under the Civil Contingencies Act 2004 and Regulations 2005.

The Act requires Category 1 responders to put in place formal arrangements to ensure that they continue to exercise their functions in the event of an emergency (as defined in the Act) so far as it reasonably practicable.

This document has been written to assist staff at all levels in the Bradford and Airedale Teaching PCT to understand their role in incorporating business continuity management into their workplace.

The Major Incident Planning and Business Continuity Lead has been assisting primary care contractors with their Business Continuity Planning processes. This document is primarily about Business Continuity Plans for the tPCT, but in the new roles of the tPCT will be a requirement to assure itself that those organisations from which the tPCT commissions services have appropriate Business Continuity Plans.

2. CURRENT POSITION

Managing risks to Business Continuity due to the formation of new organisational structures:

We have entered a period where the complexity of change as we develop the structures of the tPCT may increase the risk of being diverted from delivery of our key corporate objectives. To help us manage the organisational change, Directors need to ensure that all service and locality managers have, or are able to conduct, a business impact assessment and delivery plan, as soon as possible (templates and examples are available from the Major Incident and Business Continuity Lead and a blank template is attached as Appendix 1).

Finance and Information Technology are clearly high risk areas for Business Continuity Planning and need secure Business Continuity Plans as a matter of urgency. They also need to identify organisations outside the tPCT [and/or the Bradford health economy?] with compatible systems who may agree to enter into mutual aid agreements in the event of sudden failure.

A lot of work was undertaken in the four previous PCTs towards compliance with the Act. The original implementation timetable of previous plans needs revising due to staff changes. (Similar problems have been encountered in the majority of health organisations with newly forming structures).

Implementation of this relatively new legislation during the structure forming period, has identified levels of risk (see Assurance Framework) which the tPCT needs to address. This will ensure that Business Continuity is carried forward and fully embedded in Bradford and Airedale tPCT.

2

The Strategic Health Authority expects to see full compliance at the earliest opportunity. Further, Business Continuity Planning is a continuous process and needs to be reviewed on a regular basis.

The tPCT needs to establish policies and procedures to co-ordinate continuity and restoration activities with external agencies.

3. WHAT THE ORGANISATION NEEDS TO DO

It is proposed that the Major Incident Planning and Business Continuity Lead sets up a Business Continuity and Resilience Group with a representative from each directorate as soon as possible. Directors will be asked to nominate a member of staff from their service area to represent them on the group.

A list of completed Business Impact Assessments is given as Appendix 2 to this document. These have been roughly grouped under the current directorate structure, but Directors need to consider, in discussion with the Major Incident Planning and Business Continuity Lead, whether these are the correct groupings, and whether there are any further areas where Business Impact Assessments are required, using the blank template (Appendix 1) as a guide.

Following this, any identified service, area, or locality manager across the tPCT who has not yet completed a Business Impact Assessment should be asked to do so.

The key risks identified in the Business Impact Assessments need to be reflected in the Assurance Framework.

On completion of the Business Impact Assessment, risk reduction options must be considered and all high and medium risks must have a delivery and recovery plan in the event of business continuity management failure. This process needs to be harmonised with, and reflected in, the work on the Assurance Framework. The Major Incident and Business Continuity Lead will produce a Corporate Business Continuity and Crisis Management Plan, with identified recovery times and recovery point objectives. The Strategic Health Authority will verify that the plan is to a suitable standard.

The previous PCTs held a half day business continuity awareness session on a Bradford-wide basis. The tPCT currently has a modular training programme for Senior Managers and Directors covering on-call and out-of-hours emergencies. This needs to be extended to include awareness of the Business Continuity Management process.

The Major Incident and Business Continuity Lead will: chair the Business Continuity and Resilience Group; assist with advice (where necessary); provide example business impact assessments; be responsible for collating information for the corporate Business Continuity Plan; be responsible for validating and testing organisational plans; be responsible for extending the on-call and out-of-hours emergencies training to cover

Business Continuity Planning.

4. DIRECTORS ARE REQUESTED TO

note the requirements for Business Continuity Planning under the Civil Contingencies Act as they apply to the tPCT;

agree to the establishment of a Business Continuity and Resilience Group, as outlined above;

review those areas/services where Business Impact Assessments have already been completed and identify key areas which still need to be addressed/completed;

request Business Impact Assessments for those areas identified in 3 above; request the Major Incident and Business Continuity Lead to discuss with the

Associate Director Corporate Affairs how the Business Continuity Planning process is to be linked to the Assurance Framework.

3

4