Contact your Parish Council

 

MAIDSTONE BOROUGH COUNCIL

 

LEADER OF THE COUNCIL

 

 

REPORT OF ASSISTANT DIRECTOR OF

CUSTOMER SERVICES AND PARTNERSHIPS

 

Report prepared by:

 Dave Lindsay, IT Manager

Date Issued: 4 February 2010 

 

1.              ANNUAL REVIEW OF BUSINESS CONTINUITY ARRANGEMENTS 2009/10

 

1.1        Issue for Decision

 

1.1.1   To review the council’s corporate Business Continuity arrangements.

 

1.2        Recommendation of the Assistant Director of Customer Services

 

1.2.1      That the Leader of the Council notes the progress set out in this report and endorse the revised corporate Business Continuity documents  attached.

 

1.3        Reasons for Recommendation

1.3.1   Introduction

1.3.2      Business Continuity Management (BCM) is a process that helps manage risks to the smooth running of an organisation or delivery of a service, ensuring continuity of critical functions in the event of a disruption, and effective recovery afterwards.

 

1.3.3      Background

1.3.3.1              Good BCM helps organisations identify their key products and services and the threats to these.  Planning and exercising minimises the impact of potential disruption.  It also aids in the prompt resumption of service helping to protect service delivery and organisational reputation.

1.3.3.2              The Civil Contingencies Act requires category 1 responders to:

·           maintain plans to ensure that they can continue to exercise their functions in the event of an emergency so far as is reasonably practicable;

·           Put in place arrangements to warn and inform the public in the event of an emergency; and

·           To put in place a training programme for those directly involved in the execution of the BCP should it be invoked.

1.3.3.3              Category 1 responders include:

·         Local authorities;

·         Emergency services;

·         Government agencies; and

·         NHS bodies.

1.3.3.4              The Act also requires local authorities to provide advice and assistance to businesses and voluntary organisations in relation to business continuity management. This duty is an integral part of the Act's wider contribution to building the UK's resilience to disruptive challenges. It should not be seen as a stand-alone duty, but rather in many ways is a logical extension of the work already undertaken to fulfill other duties under the Act (e.g. working with commercial and voluntary organisations in the development and exercising of emergency plans).

1.3.3.5              In order to be successful, BCM must be regarded as an integral part of an organisation's normal ongoing management processes. To achieve this, leadership is vital as it demonstrates the importance of BCM throughout the organisation.  Engaging senior staff is crucial to the success of any major programme because of the responsibility they have for resource allocation and the culture of an organisation.

1.3.3.6              This report sets out the council’s current Business Continuity arrangements including the revised corporate Business Continuity Plan (BCP).

1.3.4      Developing plans

1.3.4.1              Good BCM requires business continuity plans. The council currently has a corporate BCP (attached as Appendix 1), a BCP Strategy (attached as Appendix 2), individual incident (or scenario plans), a BCP template for service managers (attached as Appendix 3), and separate BCPs for the key services identified below:

1.    IT

2.    Environmental Health

3.    Finance (including Revenues)

4.    Homelessness

5.    Contact Centre

6.    Emergency Planning

7.    Building Control

8.    Bereavement Services

9.    Street Cleaning

10. PR/Communications

11. Waste Collection

12. Housing Benefits

 

1.3.4.2              The Business Continuity Plan is an action plan which allows the organisation to maintain or recover the delivery of the key services, and provides all the information officers need to respond to an incident.

1.3.4.3              The Business Continuity Strategy details the Council’s strategic response to BCP, and refers to best practice from central government.

1.3.4.4              The key services (above) were identified by a Business Impact Analysis (BIA) exercise.

1.3.4.5               A BIA allows the identifications of key services, and the main threats to those services, which can then be addressed through the continuity planning process.

 

1.3.4.6              This year the corporate BCP has been updated to take on board the implications of BS25999 (see below). The corporate BCP is attached for Audit Committee’s consideration and endorsement.

 

1.3.4.7              Since the office move other plans have also been updated.  Service managers have been specifically asked to reflect the change of accommodation and its impact in their BCPs.  They have also been asked to check their key suppliers’ BCPs and to make sure any implications for partnership working are addressed in these plans.

 

1.3.5      Exercising plans

1.3.5.1              Plans cannot be considered reliable until they are exercised and have proved to be workable.  Exercising should involve: validating plans, rehearsing key staff; and testing systems which are relied upon to deliver resilience (e.g. uninterrupted power supply).

 

1.3.5.2              Last year a number of desk top tests were arranged, as a result of which the Corporate Plan and a number of service BCPs were updated.  In the coming year the council intends to test the individual plans of the key services as well as to undertake a test of how the corporate BCP would interact with the Emergency Plan and the Council’s IT Disaster Recovery Plan.

1.3.6      Training and awareness

1.3.6.1              There is a need to train those responsible for implementing BCM, those responsible for acting in the event of disruption and those who will be impacted by the plans.

1.3.6.2              Training has recently been arranged to assist service managers in preparing their BCPs.

1.3.7      Flu Pandemic Preparedness

1.3.7.1              Over the past 12 months, the Council has reviewed its preparedness for a Pandemic following the worldwide outbreak of Swine Flu. This is as a result of the Council’s direct responsibilities under the Civil Contingencies Act, and a requirement to ensure that the Council is capable of maintaining critical services during a Pandemic.

 

1.3.7.2              During this period the Business Continuity Plans of all priority services have been reviewed and updated.

 

1.3.7.3              A specific Flu pandemic Forum was formed and has met periodically to manage the Council’s response in liaison with key partners.

 

1.3.7.4              A Pandemic Plan has been formulated and actioned, including distribution of alcoholic gel dispensers, public display of ‘Catch it, kill it, bin it’ posters, and periodic reports to management Team and Unit Managers.

1.3.8      The Business Continuity Management Standard (BS25999)

1.3.8.1              BS25999 is a code of practice that takes the form of guidance and recommendations.  It establishes the process, principles and terminology of business continuity management (BCM), providing a basis for understanding, developing and implementing business continuity within an organisation and to provide confidence in business-to-business and business-to-customer dealings.

1.3.8.2              The British Standard on Business Continuity Management (BCM), BS25999, defines BCM as 'a holistic management process that identifies potential threats to an organisation and the impact to operations that those threats, if realised, might cause, and which provides a framework for building organisational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.'  It provides a comprehensive set of controls based on BCM best practice and covers the whole BCM lifecycle, which is illustrated below.  The revised corporate BCP follows the guidance of BS25999.

1.4        Disaster Recovery

 

1.4.1      The Council has an IT Disaster Recovery Plan, the invocation of which would result in the Councils Business Continuity plans to be actioned.

 

1.4.2      The Council’s IT DRP was audited during 2009 and the audit report stated that “the Council’s DRP is comprehensive in content and that appropriate back-up regimes are in place. However limited control assurance is provided, this is based upon the fact that the existing disaster recovery arrangements have not been formally tested”.

 

1.4.3      The current version of the IT DRP was tested during December 2009, and will be subjected to further extensive tests early in 2010.

 

1.5        Alternative Action and why not Recommended

 

1.5.1      The council has a legal duty under the Civil Contingency Act to ensure continuity of its services. The other duties set out by the act are:

·         To perform risk assessments;

·         To conduct emergency planning;

·         To inform, warn, and advise the public;

·         To co-operate in recovery activities; and

·         To Share information.

 

1.6        Impact on Corporate Objectives

 

1.6.1      Embedded BCM arrangements ensure that the council is able to continue to discharge its duties in the event of a significant disruption to service.

 

1.7        Risk Management

 

1.7.1                   BCM is a means of mitigating risk.  Preparation of the corporate BCP involves a Business Impact Assessment to identify key services and risks.

 

1.8                         

1.      Financial
2.           Staffing
3.           Legal
4.           Equality Impact Needs Assessment
5.           Environmental/Sustainable Development
6.           Community Safety
7.           Human Rights Act
8.           Procurement
9.           Asset Management (should there not be implications as “checked” above)

 

 

NO REPORT WILL BE ACCEPTED WITHOUT THIS BOX BEING COMPLETED   x       Is this a Key Decision?        Yes                        No        If yes, when did it appear in the Forward Plan? January 2010     x   Is this an Urgent Key Decision?     Yes                  No   Reason for Urgency N/a

How to Comment   Should you have any comments on the issue that is being considered please contact either the relevant Officer or the Member of the Executive who will be taking the decision.   Cllr Garland                                                                          Leader of the Council                                                                                     Telephone: 01622 602683                                                      E-mail:  christophergarland@maidstone.gov.uk   Paul Taylor                         Assistant Director of Customer Services & Partnerships                                                                                     Telephone: 01622 602168                                                                      E-mail:  paltaylor@maidstone.gov.uk   Dave Lindsay                                                                                       IT Manager                                                                                     Telephone: 01622 602156                                                                E-mail:  davelindsay@maidstone.gov.uk