Service Continuity

Maintaining Your Agency’s Ability to Respond

What is Service Continuity?

The ability of a service organization to continue to function under adverse conditions

Service Continuity Planning

Set of policies, procedures, and information developed and maintained for use in the event of a service disruption

Purpose The purpose of Service Continuity is

to maintain a minimum level of service while restoring your organization to “business as usual.”

Why is SCP important? An organization which fails to

provide a minimum level of service to its clients following a disaster may not have an agency to recover.

Trust may be breached; Reputation damaged

Funding may disappear Service may be re-evaluated and

deemed unnecessary Clients may seek services elsewhere

Also:

Emergency Response agencies have a moral and professional obligation to be prepared to provide community assistance during an event

Question?

What specific event ignited the topic of business continuity?

Y2K

Y2K represented uncertainty. Questions were:

What value is information if there is no system to put it on?

What good is the system if there is no place to put it or no access to it?

What good is the system if there are no skilled people to perform the work?

Thus, Business Continuity was born…

Service Continuity assists in…disasters Hurricane Katrina

> 1,600 Deaths

$75 Billion in damages

$200 Billion estimated in economic impact

Catastrophic Incidents

September 11, 2001 2,750 persons perished 8,000 Intel-based

servers and 5,000 UNIX servers lost

Estimated that 45,000 – 50,000 securities positions (i.e. trading, sales, research, operations) were lost in WTC and adjacent buildings.

Loma Prieta Earthquake7.1 -- 15 Seconds

3,000 Injured 62 Deaths $7 Billion property

damage $1.5 Billion highway

repair 1,925 Businesses

destroyed/damaged 414 Homes destroyed 18,306 Homes

damaged

1906 San Francisco Earthquake

April 18, 1906 8.3 Magnitude $500 Million

Damage > 3,000 Deaths 375,000

population Fire was the

greatest danger

More common risks that we face:

Communications failure

Computer crash Fire Electrical failure Flood Hazmat incident Inflation Internet failure

Legal action Loss of key

personnel Recession Reputation Severe storm Unscrupulous

vendor Ubiquitous “other”

Where do the Hazards originate?

External Nature Utilities & Suppliers Economic / Political forces Human nature

Internal Facility problems Equipment failures Staff

Development of a Service Continuity Program

ApproachA. Service Impact AnalysisB. Risk AssessmentC. Service Continuity PlansD. Disaster Recovery PlanE. Incident Management Plan

Municipal Recovery Plan

Community Recovery Plan

Preparedness Plan

Mitigation Plan

Risk Assessment

Comprehensive Emergency Management

Response Plan

Community Recovery

Local Authority

Recovery

Response

Preparedness

Mitigation

Risk Assessment

EVENTLevel of

Effort

Business InterruptionBusiness as Usual

Time

Business Continuity Plan

Effective Service Continuity

Effective Service Continuity is built on 7 P’s:1. Program – proactively managing the process2. People – roles & responsibilities, awareness &

education3. Processes – all organisational processes4. Premises – buildings & facilities5. Providers – supply chain, vendors, outsourcing6. Profile – reputation, image7. Performance – benchmarking, evaluation,

auditSource: Business Continuity Institute, 2003

Most important Resource?

Answer: Personnel

Although there are other critical resources, the service or product in almost all organizations depend on actions preformed by, and decisions made by, people.

The difference between Service Continuity and Disaster Recovery

Service Continuity is PROACTIVE. Its focus is to avoid or mitigate the impact of a risk

Disaster Recovery is REACTIVE. Its focus is to pick up the pieces and restore the organization to business as usual after a risk occurs

Three Phases of Continuity Planning

1. Risk Reduction

2. Incident 3. Recovery

Producing a Service Continuity Plan

Activating the Service Continuity Plan

Using and closing down the Service Continuity Plan

A. Service Impact Analysis

Examines the impact of the service interruption.

Impacts might include: Well-being of clients is reduced Public image; loss of reputation

and community goodwill Loss of donor funding

Additional Impacts:

Excessive staffing costs

Legal - failure to meet contractual obligations; fines or penalties

Extra expense to replace supplies or equipment

Customer services – reduction or termination of service, possibly when needed most

B. Risk Assessment

Risk Options

1. Avoid the risk– Leave location – Eliminate the service rendered

2. Transfer the risk– Contract out function or resource– Insurance

3. Mitigate the risk– Reduce the risk or its impact – Control the risk

4. Accept the risk– Should be calculated after full evaluation– Absorb only after weighing cost vs.

benefit

Not all risks present the same danger

Risks can be rated: Probability of occurrence

•frequency Consequence on the organization

•impact

Probability and Consequence

Probability

Consequences

1

Insignificant2

Minor3

Significant4

Major5

Catastrophic

5 Certain L M H E E

4 Likely L M H H E

3 Possible L M M H H

2 Unlikely L L M M M

1 Rare L L L L L

L: Low riskM: Moderate riskH: High risk E: Extreme risk

C. Service Continuity Plan Development

1. Obtain Management Support for SCP

2. Identify Essential Services3. Identify Key Support Functions4. Identify Critical Resources5. Assure Workforce Considerations6. Exercise and distribute the Plan

Clarifications

Services are those activities which are deemed vital to client well-being.

Functions are those measures within the

organization to support the critical services, i.e. management, administration, IT, logistics, etc.

Resources are the materials, hardware/ software, and vendors that are necessary to achieve either the functions or service mandate.

2. Identify Essential Services Identify all services that my agency

delivers Identify essential services Useful Tool: “Maximum Acceptable

Downtime” Window of time after which there is a

serious impact on my agency’s service delivery

3. Identify Key Support Functions

List the functions within the agency that are necessary to support Essential Services Senior management IT Logistics Administration Human Resources Etc.

Rank Function Activity

Vital IT / Communications Restore communications

  Administration / BSU Restore building, utilities, etc.

  Transportation Restore transport links

Important Operations Supervise / redirect staff

  Logistics Control / redirect relief supplies

  Human Resources Support staff in relief activities

Non-critical Organizational Dev’t (and Program staff)

Staff redirected to relief efforts

     

     

4. Identify Critical Resources List the resources that are necessary

for Support Functions Utilities IT/Internet Communications Vehicles / Fuel Food / Water Etc.

Critical Resource Considerations

Relationship with vendors Multiple vendors and suppliers Systems redundancies Stockpiling supplies and

materials

5. Assure Workforce Measures

Manage Personnel during and after Event Protect Staff (e.g. H1N1)

Decision-making authority Lines of authority Chain of command

Staffing Plan Cross-training Call-out procedure

6. Service Continuity Plan Testing

Exercise the Plan Exercise schedule endorsed by senior

management Tabletop exercises with each service

area in the agency Tabletop exercises with select

functional teams (e.g. IT, logistics…) Coordinate with partner agencies Distribute the Plan Update and revise Plan

Training To assure personnel will be able to

effectively and efficiently respond after a disaster event

To develop self-confidence in the ability to perform assigned functions

SCP Plan Maintenance

A plan that lacks maintenance quickly becomes a “Non-plan”

The Disaster Recovery Plan for provides the “game plan” for the recovery of services.

Service Continuity Program

D. Disaster Recovery Plan

The Incident Management Plan provides the EOC’s senior management and staff with a specific plan to “orchestrate” the recovery of business.

Service Continuity Program E. Incident Management Plan

Summary:

Business Continuity is concerned with:

People Assets Process

Remember…

“Always plan ahead. It wasn't raining when Noah built the ark.”

Richard C. Cushing

Questions?

Business Continuity Plan Scenario…

H1N1 Influenza…a challenging risk

No infra-structural damage, but…

Long term staffing considerations

Quickly changing event (decisions with partial information)

Serious economic interruption

Public ‘unknowns’ have huge impact

Overwhelmed facilities

Limited outside resources

Let’s review with a Flu Scenario…

It has been reported on television that the pandemic flu has reached Canada.

The Times Colonist is reporting flu sickness on the mainland and Vancouver Island.

Week 1: Today

You have noticed that staff absenteeism has been higher than normal yesterday and today.

Week 1

A few staff are coughing and wheezing and complaining of feeling ill…

Initial Reactions…

What staff issues are there? What are the implications? Can any of the staff work from

home? What is required to make this happen?

Who will you communicate with? Other issues?

Week 2

Staff absence is now 25% higher than is normal for this time of the year.

A key supplier calls to tell you that they will not be operating for the foreseeable future because of staff absenteeism.

Actions?

What are the priorities? Who do you communicate with? Is your contact list up-to-date? Do you have a phone tree? What will be the implication of losing a

key supplier for the service? Do any members of the team have

unique skills or knowledge? What are the risks of this? How to reduce this risk?

Week 2

The District has decided to close all schools in the area due to teacher shortages and also to limit spread of the flu.

Half of your staff have phoned in to say that they will not be attending work this week. They are staying at home to look after their children.

A few more questions…

What issues does school closing raise?

How will you deal with staff who don’t attend work to look after their children/dependants?

How will you deal with the work load?

Week 3

Following further staff absences, the number of staff in work has dropped by 75%.

You have just been informed that one of your staff has died in hospital.

A Times Colonist reporter has asked for your response on this and the effects of the outbreak.

Actions of on-site team?

Who do you communicate with? How will you manage your resources,

and your workload, with only 20% of staff attending work?

What are the implications for the team of a death of a colleague?

How will the media enquiry be dealt with?

Anything else?

Week 5

You have located additional staff through an temp agency. Which areas of work would you prioritise for these extra staff?

Do you work with any vulnerable groups? If yes, what are the implications of this group?

How can you minimise the impact on this group?

Week 8

The event has eased. Are there issues that need to be addressed?

Are there any questions this scenario has raised that you will now look into?

Are there any plans you’d now put in place in case a 2nd wave hits?

What lessons have been learned? How can this knowledge be used to improve your Service Continuity Plans?

Remember…

“Always plan ahead. It wasn't raining when Noah built the ark.”

Richard C. Cushing

Additional Sources

Business Continuity Institute http://www.thebci.org/

Business Continuity Plan glossary http://www.drj.com/glossary/glossleft.htm

Business Continuity Planners Association http://www.bcpa.org/

Natural Disasters preparedness http://www.colorado.edu/hazards/informer/informerupdate.pdf

Disaster recovery planning exchange http://www.drie.org/

Thank you!