East of England Ambulance Service Trust Business Continuity Process
East of England Ambulance Service Trust Business Continuity Process
i
East of England Ambulance Service Trust Business Continuity Process
Author
Ian Crowson
Reviewed by
Jon Moore, Gareth Boynton
Authorised by
Robert Morton, Sarah Boulton
Date
10 March 2016
Version
1.0
Document control Version history Version
Status*
Author
Reason for issue
Date
0.1
Draft
Ian Crowson
First Draft
23/11/2015
0.2
Draft
Ian Crowson
This process document was approved by the Trust Executive Group in February 2015 and should be read in conjunction with the Policy document approved at the same time. Version 0.1 indicates that the document has been copied to Continuity 2 document management system which will be utilised to ensure document control in the future.
24/11/2015
0.3
Draft
Ian Crowson
Process Document updated to reflect Trust Vision and Values, updated to include improvements to BCMS including the role of the RCC as C2 becomes more embedded across Trust. The document is now to be managed by the Document Management System within C2
16/12/2015
1.0
Authorised
Ian Crowson
Document signed off.
10/03/2016
* E.g. Draft, Authorised
Distribution list Copy
Name
Position/Organisation
Method of issue
1.
Robert Morton
Chief Executive Officer
Electronic
2.
Sandy Brown
Director
Electronic
3.
Jon Moore
Gold Commander
Electronic
4.
Rob Ashford
Gold Commander
Electronic
5.
Dave Fountain
Gold Commander
Electronic
6.
Matt Broad
Gold Commander
Electronic
ii
East of England Ambulance Service Trust Business Continuity Process 7.
Kevin Smith
Director
Electronic
8.
Ruth McAll
Director
Electronic
9.
Laila Abraham
Trust Secretary
Electronic
10.
Chris Hartley
Communications Director
Electronic
11.
Nicola Ward
12.
Liz McEwan
Silver Commander
Electronic
13.
Jennie Farenden
Plan Writer
Electronic
14.
Paul Henry
Gold Commander
Electronic
15.
Clare Chambers
Department Head
Electronic
16.
Steven Moore
Specialist Operations Manager
Electronic
17.
Gareth Boynton
Resilience Manager
Electronic
18.
Ian Crowson
Auditor / Business Continuity Manager
Electronic
19.
Gary Morgan
Silver Commander
Electronic
20.
Marcus Bailey
Department Head
Electronic
21.
Tracy Nicholls
Gold Support / Department Head
Electronic
22.
Sarah Boulton
Chair Trust Board
Electronic
23.
Heather Madden
Electronic
24.
Karen Barry
Electronic
25.
Shawn Beckerleg
Electronic
26.
Emma Sears
27.
Gail Huggins
28.
Gail Butler
Notes
Electronic
Plan Writer
Electronic Electronic
Plan Writer
Electronic
1.
All personnel listed above receive copies, or are notified, of updated versions of the document. Any other copies provided to third parties are not subject to automatic update.
2.
The method of issue includes provision of paper or electronic copy of authorised document, or notification by email to those with access to the authorised version in the project directory.
3.
Review comments are required during the document’s production process from those personnel on the review list. The author must retain an audit trail of comments returned and how they have been addressed in the authorised document.
4.
Documents are reviewed & signed-off as a minimum every 2 years or due to significant business change
iii
East of England Ambulance Service Trust Business Continuity Process
Table of contents Section 1
Page
Trust Aim .............................................................................................................................. 1 1.1 Trust Vision .....................................................................................................................................1 To be innovative, responsive, excellent, always community focussed and always patient driven. ..........1 1.2 Policy ..............................................................................................................................................1
2
Strategic Objectives ............................................................................................................. 2 2.1 2.2 2.3 2.4
Business Impact Analysis ...............................................................................................................2 Business Continuity Plans ..............................................................................................................2 Exercises ........................................................................................................................................2 Accountable Officer ........................................................................................................................2
3
Introduction .......................................................................................................................... 3
4
Legal and Regulatory Requirements .................................................................................. 4 4.1 4.2 4.3
5
Disruptions ........................................................................................................................... 5 5.1 5.2 5.3 5.4
6
Continuity2 Software ......................................................................................................................7 Planning Module .............................................................................................................................7 Business Impact Analysis ...............................................................................................................8 Critical Activity ................................................................................................................................8 Exercises ........................................................................................................................................8 Exercise Module .............................................................................................................................8 Awareness Module .........................................................................................................................9 Contacts ..........................................................................................................................................9 Incident Management .....................................................................................................................9 Role of Regional Coordination Centre (RCC) ................................................................................9 Associated Documents ...................................................................................................................9 Audit and Document Control ..........................................................................................................9
Operation of the Trust Business Continuity Management System (BCMS) ................... 10 8.1
9
Alignment ........................................................................................................................................6 Plan, Do, Check, Act ......................................................................................................................6 Context of the Organisation (Plan) .................................................................................................6 Leadership (Plan) ...........................................................................................................................6 Planning (Plan) ...............................................................................................................................6 Support (Plan).................................................................................................................................6 Operations (Do) ..............................................................................................................................6 Performance and Evaluation (Check).............................................................................................7 Improvement (Act) ..........................................................................................................................7 Duties of Category 1 Responder ....................................................................................................7
Operation of the Trust Business Continuity Management System (BCMS) ..................... 7 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 7.10 7.11 7.12
8
Major Incident .................................................................................................................................5 Emergency......................................................................................................................................5 Incident ...........................................................................................................................................5 Cause .............................................................................................................................................5
Business Continuity Planning ............................................................................................. 6 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 6.10
7
Civil Contingencies Act 2004 (CCA) ...............................................................................................4 Frameworks and Core Standards...................................................................................................4 Other Requirements .......................................................................................................................4
Risk .............................................................................................................................................. 10
Management Review .......................................................................................................... 10
10 Business Continuity Management and working Groups ................................................. 10 10.1 Business Continuity Management Team ..................................................................................... 10 10.2 EOC Business Continuity Working Group ................................................................................... 10 10.3 General Working Group ............................................................................................................... 11
11 Business Continuity Roles ................................................................................................ 11 iv
East of England Ambulance Service Trust Business Continuity Process 11.1 11.2 11.3 11.4 11.5 11.6 11.7 11.8 11.9 11.10
Accountable Officer ..................................................................................................................... 11 Business Continuity Manager ...................................................................................................... 11 Resilience Manager ..................................................................................................................... 11 Chair Business Continuity Management Team / Recovery Team Leader .................................. 11 Plan Writer ................................................................................................................................... 12 Auditor ......................................................................................................................................... 12 Facility Management Coordinator ................................................................................................ 12 HR and Communications Coordinator ......................................................................................... 12 IT Coordinator .............................................................................................................................. 12 Loggist ......................................................................................................................................... 12
12 Business Continuity Terms and Definitions..................................................................... 12 12.1 12.2 12.3 12.4 12.5 12.6 12.7 12.8 12.9 12.10 12.11 12.12 12.13 12.14 12.15 12.16 12.17 12.18 12.19 12.20 12.21 12.22 12.23 12.24 12.25 12.26 12.27 12.28 12.29 12.30 12.31 12.32 12.33 12.34 12.35 12.36 12.37 12.38 12.39 12.40 12.41 12.42 12.43 12.44 12.45 12.46 12.47 12.48 12.49 12.50 12.51
Activity ......................................................................................................................................... 12 Audit ............................................................................................................................................. 12 Business continuity ...................................................................................................................... 13 Business continuity management ................................................................................................ 13 Business continuity management system ................................................................................... 13 Business continuity plan .............................................................................................................. 13 Business continuity programme .................................................................................................. 13 Business impact analysis ............................................................................................................ 13 Competence ................................................................................................................................ 13 Conformity ................................................................................................................................... 13 Continual improvement ................................................................................................................ 13 Correction .................................................................................................................................... 14 Corrective action .......................................................................................................................... 14 Document .................................................................................................................................... 14 Documented information ............................................................................................................. 14 Effectiveness ............................................................................................................................... 14 Event ............................................................................................................................................ 14 Exercise ....................................................................................................................................... 14 Incident ........................................................................................................................................ 14 Infrastructure................................................................................................................................ 15 Interested party stakeholder ........................................................................................................ 15 Internal audit ................................................................................................................................ 15 Invocation .................................................................................................................................... 15 Management system ................................................................................................................... 15 Maximum acceptable outage ....................................................................................................... 15 Maximum tolerable period of disruption ...................................................................................... 15 Measurement ............................................................................................................................... 15 Minimum business continuity objective ....................................................................................... 16 Monitoring .................................................................................................................................... 16 Mutual aid agreement .................................................................................................................. 16 Nonconformity.............................................................................................................................. 16 Objective ...................................................................................................................................... 16 Organisation ................................................................................................................................ 16 Outsource .................................................................................................................................... 16 Performance ................................................................................................................................ 16 Performance evaluation ............................................................................................................... 17 Personnel ..................................................................................................................................... 17 Policy ........................................................................................................................................... 17 Procedure .................................................................................................................................... 17 Process ........................................................................................................................................ 17 Products and services ................................................................................................................. 17 Prioritised activities ...................................................................................................................... 17 Record ......................................................................................................................................... 17 Recovery point objective ............................................................................................................. 17 Recovery time objective .............................................................................................................. 17 Requirement ................................................................................................................................ 18 Resources .................................................................................................................................... 18 Risk .............................................................................................................................................. 18 Risk appetite ................................................................................................................................ 18 Risk assessment.......................................................................................................................... 18 Risk management ........................................................................................................................ 18 v
East of England Ambulance Service Trust Business Continuity Process 12.52 12.53 12.54 12.55
Testing ......................................................................................................................................... 18 Top management......................................................................................................................... 19 Verification ................................................................................................................................... 19 Work environment........................................................................................................................ 19
vi
East of England Ambulance Service Trust Business Continuity Process
1 Trust Aim “To maintain a robust Business Continuity Management System that supports our mission to provide a safe and effective healthcare service to all our communities in the East of England” 1.1
Trust Vision
To be innovative, responsive, excellent, always community focussed and always patient driven. 1.2
Policy
The East of England Ambulance Service Business Continuity Policy establishes the Business Continuity Management Process for the East of England Ambulance Service and must be read in conjunction with this process document which sets out how the policy will be achieved. The Aim of this document is to inform Business Continuity Practitioners and interested parties of Business Continuity planning applied by the Trust. Details of response to a business interruption, including activation and Command and Control arrangements can be found in the suite of Business Continuity Plans.
1
East of England Ambulance Service Trust Business Continuity Process
2 Strategic Objectives 2.1
Business Impact Analysis
All Service Areas will complete Business Impact Analysis for their activities which will be assigned to a manager and signed off by the appropriate senior manager. EOC activities for Category 1 sites will be reviewed every six months, Operational response activities for Category 2 sites will be reviewed annually and Category 3 sites biannually. Support services will review critical activities annually and other activities biannually.
2.2
Business Continuity Plans
The Business Continuity Manager will ensure that the Trust Business Continuity Plan is reviewed annually. Senior Locality managers will ensure that Locality Managers produce and review Category 2 Locality Business Continuity Plans at least annually, and Category 3 locality Plans at least biannually.
2.3
Exercises
A strategic business continuity exercise will be help annually. All plans will be exercised at least biannually. EOC Plans will be exercised annually. Tests will be performed more frequently as appropriate
2.4
Accountable Officer
Direct responsibility for ensuring that Trust Aim, compliance with the policy, and Business Continuity Objectives are achieved rests with the Trusts “Accountable Officer” who will ensure that Departments complete their Business Continuity Planning in alignment with Trust Policy and this document. Resources will be made available as required and approved by a business case as appropriate. Plans using Continuity2 software will be completed, reviewed, and exercised as directed by the Accountable officer and the Business Continuity Management Group with progress reports being submitted by the Business Continuity Manager.
2
East of England Ambulance Service Trust Business Continuity Process
3 Introduction The primary legal and contractual reasons for having a robust Business Continuity Management System are set out below; however a more compelling reason is that having such systems makes good business sense. The Trust’s suites of Business Continuity Management System documents are intended to identify and protect the Trusts prioritised/critical activities, and in the event of a disruption, stabilise, resume and recover these activities to an agreed level within an agreed timeframe. They also aim to effectively manage the impact of the disruption
3
East of England Ambulance Service Trust Business Continuity Process
4
Legal and Regulatory Requirements
4.1
Civil Contingencies Act 2004 (CCA)
The Civil Contingencies Act 2004 and associated statutory Regulations and Guidance (Contingency Planning Regulations 2005) that came into force in November 2005 form the legal background that requires the East of England Ambulance Service (as a Category 1 Responder) to produce and maintain comprehensive Business Continuity Plans that will enable the Trust to continue providing its Critical Functions as far as reasonably practical, to a pre-determined level, during an ‘Emergency’
4.2
Frameworks and Core Standards
NHS National Contracts and Commissioning Board Frameworks 2013 and NHS Core Standards for Emergency Preparedness, Resilience and Response (EPRR) Require that organisations funded by the Department of Health to have arrangements to protect their services that are aligned to ISO 22301:12, guided by ISO 22313:12 and take into account any toolkits issued from time to time by Department of Health
4.3
Other Requirements
. The Business Impact Analysis process takes into account the impact of failure to comply with legal and contractual requirements applicable to activities undertaken by the Trust.
4
East of England Ambulance Service Trust Business Continuity Process
5
Disruptions .
5.1
Major Incident
For the NHS, a major incident is defined as: ‘Any occurrence that presents serious threat to the health of the community, disruption to the service, or causes (or is likely to cause) such numbers or types of casualties as to require special arrangements to be implemented by hospitals, ambulance trusts or primary care organisations’ See Trust Major Incident Plan.
5.2
Emergency
An ‘Emergency’ as defined in Section 1 of the Act (CCA) is “an Event or Situation which threatens serious damage to human welfare in a place in the United Kingdom – an Event or Situation that threatens human welfare only if it involves, causes or may cause – loss of human life, human illness or injury, disruption of money, food, water, energy or fuel, systems of communication, facilities for transport or disruption to services relating to health, and other non-health related matters”.
5.3
Incident
An incident in relation to Business Continuity is a situation that could lead to a disruption leading to the output of a critical activity falling below an acceptable level in excess of the pre-determined time for recovery
5.4
Cause
Whilst the sources of such disruptions are limitless, their impacts and effects are much fewer in number. Examples may include:Shortage of staff which may be caused by: A mass casualty incident, either spontaneous (transportation accident, act of terrorism, civil disorder or natural event) A ‘slow burn’/ ‘rising tide’, typically a health emergency, e.g. an influenza pandemic, or an activity is identified that could lead to a surge in emergency calls or in-service sickness / absence A surge in demand for any reason Interruption to the transport system Loss of a strategic building or other significant parts of the Trust’s estate for example a Control and Communications Centre. Information Management and Technology (IMT) failure (including voice, Mobile Data Terminals (MDTs), landline and mobile phones, pagers, radio equipment and radio system aerial sites), and / or control room failure Loss of critical information Logistic failures – fleet, equipment, consumables External contractual failures, including the loss of public utilities or supply chain A critical single point failure (internal or external) that threatens the operational ability of the Service Effects of climate change which is currently causing longer and wetter winters (increased snow) combined with hotter summers (heavy rains with flash flooding). In summary, any denial or loss of services or facilities that affects the Trust’s ability to deliver it’s prioritised critical activities to an acceptable level.
5
East of England Ambulance Service Trust Business Continuity Process
6
Business Continuity Planning
6.1
Alignment
The Trust will align its Business Continuity processes to the societal security – Business continuity management systems – Requirements (ISO 22301:2012) and associated guidance (ISO 22313:2012) taking into account, PAS 2015, BCI Good Practice Guidelines 2013 and Department of Health Guidance.
6.2
Plan, Do, Check, Act ISO 22301:2012 is built around the Plan, Do, Check, Act model. The standard has seven main elements:
6.3
I.
Context of the organisation
II.
Leadership
III.
Planning
IV.
Support
V.
Operations
VI.
Performance and Evaluation
VII.
Improvement.
Context of the Organisation (Plan)
The context of the organisation involves understanding the organisation and the context in which it operates including expectations of interested parties; legal requirements; scope of the Business Continuity Management System; and the Business Continuity Management System itself.
6.4
Leadership (Plan)
Top management shall demonstrate its commitment to Business Continuity, and ensure adequate and suitable policies and processes are used and continual improvement is achieved and it will also define Business Continuity roles, responsibilities and authorities.
6.5
Planning (Plan)
Planning will include actions to address risk and opportunities and the setting and reviewing of appropriate business continuity objectives.
6.6
Support (Plan)
This relates to the resources that will be made available to ensure an effective business continuity management system, the competence of those who have defined roles within the system, awareness of those working for the organisation, communication policies and documented information that will be retained to evidence an effective and improving Business Continuity Management System.
6.7
Operations (Do)
This relates to the day to day operation and development of the Business Continuity Management System, is the primary subject of this document, and will be detailed in the next section.
6
East of England Ambulance Service Trust Business Continuity Process
6.8
Performance and Evaluation (Check)
This involves monitoring, measuring, analysis and evaluation of the Trusts Business Continuity Management System. The Trust will also conduct internal audits and management reviews to ensure that Planners are conforming to the Trusts own processes and also to ISO22301:2012 standard.
6.9
Improvement (Act)
When non conformity is identified, the need for action shall be evaluated, and if required action taken to address the causes of that non conformity and to correct and control it. The aim is to strive for continual improvement of the Business Continuity Management System.
6.10 Duties of Category 1 Responder Whilst planning follows the format of Plan Do Check Act and the Business Continuity Lifecycle there is one important difference between the obligations of the Civil Contingencies Act and the ISO Business Continuity standards. The Civil Contingencies Act imposes a duty on Category 1 Responders to consider those occasions where planning should include an enhanced level of activity required to respond to an Emergency.
7 7.1
Operation of the Trust Business Continuity Management System (BCMS) Continuity2 Software
On 31st March 2014 the Trust purchased a three year licence to use Business Continuity software supplied by Continuity2. This software is greatly assisting the Trust to manage its BCMS. The software was rolled out across the Trust from late 2014, owing to staff turnover and other changes training will always be ongoing. The date of a critical business interruption can never be forecast so plans should be completed and reviewed as soon as possible. It should be understood that Business Continuity is an evolving process and must improve over time as a better understanding of the organisation is developed by staff, as training spreads.
7.2
Planning Module
The Trust organisational structure is set up and maintained by the Business Continuity Manager. With the exceptions of Emergency Operations Centres (EOC), Regional Coordination Centre (RCC), Resilience and Specialist Operations Department, and a top level Trust Plan, planning is based around Trust Localities. East of England localities are designated at three levels: level 1 is a site which if lost has the potential to have a catastrophic impact on the Trust; level 2 is a site which if lost has the potential to have a major impact on the running of the Trust, level 3 describes all other sites, which if lost are likely to have a lesser overall impact. The Trust has an overarching Business Continuity Plan which is owned by the Senior Resilience Manager. Each Locality will have a Business Continuity Plan which is owned by the Senior Locality Manager for that area, normally being developed by a local manager. EOC and Resilience and Specialist Operations and Regional CoordinationCentre will each have their own Plan which will sit outside of the locality plans. As part of updating the plan, the plan writer is required to ensure “contacts” that are required for that locality are created and maintained on the system and that the associated “Battlebox” is updated with process documents and action cards as appropriate. There is no need to duplicate action cards for each locality, for example major incident action cards can be found on the EOC plan.
7
East of England Ambulance Service Trust Business Continuity Process Each plan will also have a default “Recovery Team” this will usually consist of the plan leader and a deputy from each of the “service areas” contained within that plan. Plans will also have an associated Business Impact Analysis, which is the core of the system. Plans contain the processes for responding to a business interruption including the recovery processes. Detail for recovery will be within action cards contained in the “Associated Documents/Battlebox”. When stations are grouped it is permissible to use one Battlebox as long as other battle boxes signpost location of documentation. For example plans for Downham Market, Swaffham, Wisbech, and Fakenham could all be contained within the Kings Lynn Battlebox. Trust Action cards will be maintained in the EOC Battlebox.
7.3
Business Impact Analysis
A Business Impact Analysis has been created for each Business Continuity Plan. The Business Impact Analysis (BIA), along with risk assessment, is the starting point of Business Continuity Planning. Each BIA will have one or more service areas each of which will have one or more associated activities. An activity will be assigned to a suitable named person for analysis, with a maximum return date within two weeks of assignment. The assignment process itself contains full instructions relating to conducting an impact analysis. Each BIA will have an owner, and an owner will also be nominated for each service area, and each activity. Each Plan, BIA, and BIA Service area, will have a distribution list, a reviewer and an authorising person. A review period will also need to be set. With the exception of the Emergency Operations Centre a default review period of 12 months for level 2 plans is adequate but can be shortened or extended following consultation with the Accountable Officer on the advice of the Business Continuity Manager. In the event that there is organisational change the BIA must be reviewed. Owing to the criticality of the Department the BIA for EOC will be given a six month review period. The overall BIA of a plan will have a review officer apart from the plan writer. A full briefing and support will be given to each plan writer by the Business Continuity Manager. Senior Managers will ensure that Plan Writers have adequate time both for training and plan writing. Plan Writers will ensure that staff are familiar with the plans and will seek views of staff whenever possible. The system automatically generates BIA reports which in themselves are useful during a Business interruption. The reports can be generated for each activity, each service area and for the entire locality. In the event that a business interruption affects a locality it will be possible to gain a full understanding of each activity undertaken at that locality.
7.4
Critical Activity
The Impact Analysis (IA) for each activity determines if the activity is a critical activity or not and the recovery time and service levels associated with the activity. This is determined using a risk matrix similar to the Trust Risk module, it should be noted that whilst the Trust risk matrix scores impact multiplied by likelihood, to achieve a risk score, business continuity concentrates on impact over time. It should be noted that just because an activity is not classed as “critical” it does not mean that the activity is not important. As often as not, the determining factor is the amount of time which passes between the activities being interrupted before an unacceptable consequence occurs. It should be noted that in relation to ISO22301:2012 the terms “Critical Activity” and “Prioritised Activity” are interchangeable.
7.5
Exercises
Once written every plan should be exercised within 3 months of approval. It is the responsibility of the plan writer to arrange this initial exercise which can be as simple as a walkthrough of the plan with another manager. A level 1 plan should be exercised every six months, level 2 plans annually, Level 3 plans every two years. The Trust top management should participate in an exercise annually. The Business Continuity Manager will maintain an exercise programme.
7.6
Exercise Module
Continuity 2 contains an exercise module. The advantage of using the exercise module to either run or monitor exercises is that issues identified by the exercise and any subsequent actions can be tracked via the system. Advice can be sought from the Business Continuity Manager. 8
East of England Ambulance Service Trust Business Continuity Process
7.7
Awareness Module
The system contains an awareness module which associates competencies and training for business continuity roles. This part of the system will be managed by the Business Continuity Manager. A number of awareness packages have been developed and are allocated as appropriate.
7.8
Contacts
Continuity2 operates by using “Contacts””. If appropriate, contacts can be allocated roles, roles will only be allocated by the Business Continuity Manager. A number of roles have been created. The contacts module also contains a training history. Completion of an awareness module automatically updates the training history for that contact. External training records can also be added to contacts. Contacts can update their own training records which may contain details of courses, exercises attended and experience gained. Maintaining this record helps to demonstrate competence of those with roles within the Trusts BCMS.
7.9
Incident Management
Continuity2 contains an incident management module which enables business interruptions to be effectively managed. The module contains a “push” conference call facility for initial notification, two way texting, a secure bulletin board, and check list facility. Plan writers and nominated “Incident Managers” are able to operate this system. It is the responsibility of the “plan writer” to nominate a suitable number of “incident officers” in consultation with head of Department. Incident Managers should participate in an exercise within a reasonable period following training to ensure competency in this role.
7.10 Role of Regional Coordination Centre (RCC) Staff working within the RCC are trained to use Continuity2 and if requested to do so by a manager will active Recovery Teams and “lookup” information contained within the system. The may also set up bulletin boards and have access to Trust wide call lists.
7.11 Associated Documents There is an associated document file with each plan. This contains three “tabs”: System generated files including the plan, current call tree, and current external contacts call tree (word/pdf documents); Battlebox files (any file type). Version controlled files (word documents). The Battlebox should be used for action plans and other business continuity files.
7.12 Audit and Document Control The Business Continuity Manager has responsibility in consultation with the Trust Accountable Officer for managing audits of all Business Continuity Plans held within the Trust.
9
East of England Ambulance Service Trust Business Continuity Process
8
Operation of the Trust Business Continuity Management System (BCMS)
8.1
Risk
The Trust has a formulised process for assessing the various risks that are recorded on the 4Risk system. These are taken into account by the Business Continuity Management Team and Business Continuity Manager, which combined with information from Local and National Risk Registers and Business Impact Analysis data inform the setting of Business Continuity Objectives at Trust level by the Business Continuity Management Team. A similar process takes place at Service Area level at each locality.
9
Management Review
A management review of the Trust BCMS will be undertaken at least annually by the Senior Resilience Manager and Business Continuity Manager. The findings will be reported to the Business Continuity Management Team.
10
Business Continuity Management and working Groups
10.1 Business Continuity Management Team The Business Continuity Management Team (BCMT) has been established by the Executive Management Team (EMT) to ensure that the Trust maintains a business continuity management system (BCMS) enabling business continuity management and trust resilience to be continually improved. The team should meet biannually or as determined necessary. Core membership of the group consists of: Director of Finance Assistant Chief Ambulance Officer for Resilience and Specialist Operations Communications Director Head of Operations Support Locality Directors General Manager Primary Care Head of Non-Emergency Services Head of T & T Director of Nursing and Clinical Quality Head of Business Development Consultant Paramedic Safety and Risk Lead Director of HR Senior resilience manager Business Continuity Manager Other members may be co-opted as the need arises. Job roles above are for guidance purposes and are subject to change.
10.2 EOC Business Continuity Working Group The EOC Business Continuity Working Group was established to ensure that Business Continuity for EOC is maintained and consistent across the three rooms. The group should meet at least biannually or as required. Core membership of the group shall be: Regional Head of Emergency Operations Centre 10
East of England Ambulance Service Trust Business Continuity Process EOC Support Manager RCC Manager Senior EOC Manager for Norwich, Chelmsford, and Bedford Training and Audit Manager Head of Front Line Technology Representative from IM & T (CAD) Representative from IM & T (Telephony) One HEOC Duty Manager per room One Clinical Coordinator per room One Dispatch Team Leader per room One Call Handler Team Leader per room Primary Care Representative Non-Emergency services (representing all Trust contracts) Commercial Services representative Operations representative (GM level) Business Continuity Manager Resilience Manager Administrative support
10.3 General Working Group It may be necessary to set up ad hoc working groups as task and finish groups in relation to specific Business Continuity Objectives and also to coordinate planning for those Trust localities that have multiple service areas. These groups will be initiated and chaired by the Business Continuity Manager in consultation with the plan leader for the locality or the objective owner.
11
Business Continuity Roles
11.1 Accountable Officer The role of “Accountable Emergency Officer”, for Emergency Preparedness, Resilience and Response (EPRR) is documented in full in a paper dated December 2012 prepared by NHS Commissioning Board. http://www.england.nhs.uk/wp-content/uploads/2012/12/eprr-officer-role.pdf. The role is currently undertaken by the Trust Chief Executive Officer.
11.2 Business Continuity Manager This is the person with responsibility for ensuring that the Trusts Business Continuity System aligns to the current required standard.
11.3 Resilience Manager Have system user access and knowledge of Continuity2 Business Continuity software and are available via an on call rota to give 24/7 advice in relation to Resilience, Business Continuity, and Crisis Management. Resilience Managers are able to give access to the system including resetting passwords as required.
11.4 Chair Business Continuity Management Team / Recovery Team Leader Person responsible for leading the Business Continuity Management Team (Trust Level) or Recovery Team (Locality) following the activation of a Business Continuity Plan.
11
East of England Ambulance Service Trust Business Continuity Process
11.5 Plan Writer This is the person responsible for each Business Continuity Plan including managing the Departmental Business Impact Analysis, and exercise programme; this responsibility may extend to more than one plan. The role of Plan Writer has also been given to individuals who require this level of system authority to perform their role.
11.6 Auditor Internal audits of the Trusts BCMS may be undertaken by any person who has successfully completed an Auditors Course designed for ISO 22301:2012 by British Standards Institute, provided that person can demonstrate impartiality in relation to the Department being audited.
11.7 Facility Management Coordinator This is the person who has responsibility for liaison between a Department and the Estates Department in relation to facilities required.
11.8 HR and Communications Coordinator Responsibility for liaison with Human Resources Department and Trust Communications Department
11.9 IT Coordinator Has responsibility for ensuring that Departments Information Technology requirements are met in liaison with appropriate person from Information, Management &Technology Department.
11.10 Loggist Trained Loggist are provided by the Trust to ensure that decisions are recorded and available for subsequent scrutiny.
12
Business Continuity Terms and Definitions
12.1 Activity Process or set of processes undertaken by an organisation (or on its behalf) that produces or supports one or more products and services EXAMPLE: Such processes include accounts, call centre, IT, manufacture, distribution.
12.2 Audit systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled NOTE 1 An audit can be an internal audit (first party) or an external audit (second party or third party), and it can be a combined audit (combining two or more disciplines). NOTE 2 “Audit evidence” and “audit criteria” are defined in ISO 19011.
12
East of England Ambulance Service Trust Business Continuity Process
12.3 Business continuity capability of the organisation to continue delivery of products or services at acceptable predefined levels following disruptive incident
12.4 Business continuity management holistic management process that identifies potential threats to an organisation and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities
12.5 Business continuity management system BCMS part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity NOTE The management system includes organisational structure, policies, planning activities, responsibilities, procedures, processes and resources.
12.6 Business continuity plan documented procedures that guide organisations to respond, recover, resume, and restore to a pre-defined level of operation following disruption NOTE Typically this covers resources, services and activities required to ensure the continuity of critical business functions.
12.7 Business continuity programme ongoing management and governance process supported by top management and appropriately resourced to implement and maintain business continuity management
12.8 Business impact analysis process of analysing activities and the effect that a business disruption might have upon them
12.9 Competence ability to apply knowledge and skills to achieve intended results
12.10 Conformity fulfilment of a requirement
12.11 Continual improvement recurring activity to enhance performance
13
East of England Ambulance Service Trust Business Continuity Process
12.12 Correction action to eliminate a detected nonconformity
12.13 Corrective action action to eliminate the cause of a nonconformity and to prevent recurrence NOTE In the case of other undesirable outcomes, action is necessary to minimise or eliminate causes and to reduce impact or prevent recurrence. Such actions fall outside the concept of “corrective action” in the sense of this definition.
12.14 Document information and its supporting medium NOTE 1 The medium can be paper, magnetic, electronic or optical computer disc, photograph or master sample, or a combination thereof. NOTE 2 A set of documents, for example specifications and records, is frequently called “documentation” .
12.15 Documented information information required to be controlled and maintained by an organisation and the medium on which it is contained NOTE 1 Documented information can be in any format and on any media from any source. NOTE 2 Documented information can refer to the management system, including related processes; information created in order for the organisation to operate (documentation); evidence of results achieved (records).
12.16 Effectiveness extent to which planned activities are realised and planned results achieved
12.17 Event occurrence or change of a particular set of circumstances NOTE 1 An event can be one or more occurrences, and can have several causes. NOTE 2 An event can consist of something not happening. NOTE 3 An event can sometimes be referred to as an “incident” or “accident”. NOTE 4 An event without consequences may also be referred to as a “near miss”, “incident”, “near hit”, “close call”.
12.18 Exercise process to train for, assess, practice, and improve performance in an organisation NOTE 1 Exercises can be used for: validating policies, plans, procedures, training, equipment, and inter-organisational agreements; clarifying and training personnel in roles and responsibilities; improving inter-organisational coordination and communications; identifying gaps in resources; improving individual performance; and identifying opportunities for improvement, and controlled opportunity to practice improvisation. NOTE 2 A test is a unique and particular type of exercise, which incorporates an expectation of a pass or fail element within the goal or objectives of the exercise being planned.
12.19 Incident situation that might be, or could lead to, a disruption, loss, emergency or crisis
14
East of England Ambulance Service Trust Business Continuity Process
12.20 Infrastructure system of facilities, equipment and services needed for the operation of an organisation
12.21 Interested party stakeholder person or organisation that can affect, be affected by, or perceive themselves to be affected by a decision or activity NOTE This can be an individual or group that has an interest in any decision or activity of an organisation.
12.22 Internal audit audit conducted by, or on behalf of, the organisation itself for management review and other internal purposes, and which might form the basis for an organisation’s self-declaration of conformity NOTE In many cases, particularly in smaller organisations, independence can be demonstrated by the freedom from responsibility for the activity being audited.
12.23 Invocation act of declaring that an organisation’s business continuity arrangements need to be put into effect in order to continue delivery of key products or services
12.24 Management system set of interrelated or interacting elements of an organisation to establish policies and objectives, and processes to achieve those objectives NOTE 1 A management system can address a single discipline or several disciplines. NOTE 2 The system elements include the organisation’s structure, roles and responsibilities, planning, operation, etc. NOTE 3 The scope of a management system can include the whole of the organisation, specific and identified functions of the organisation, specific and identified sections of the organisation, or one or more functions across a group of organisations.
12.25 Maximum acceptable outage MAO time it would take for adverse impacts, which might arise as a result of not providing a product/service or performing an activity, to become unacceptable NOTE See also maximum tolerable period of disruption .
12.26 Maximum tolerable period of disruption MTPD time it would take for adverse impacts, which might arise as a result of not providing a product/service or performing an activity, to become unacceptable NOTE See also maximum acceptable outage.
12.27 Measurement process to determine a value
15
East of England Ambulance Service Trust Business Continuity Process
12.28 Minimum business continuity objective MBCO minimum level of services and/or products that is acceptable to the organisation to achieve its business objectives during a disruption
12.29 Monitoring determining the status of a system, a process or an activity NOTE To determine the status there may be a need to check, supervise or critically observe.
12.30 Mutual aid agreement pre-arranged understanding between two or more entities to render assistance to each other
12.31 Nonconformity non-fulfilment of a requirement
12.32 Objective result to be achieved NOTE 1 An objective can be strategic, tactical or operational. NOTE 2 Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels [such as strategic, organisation-wide, project, product and process). NOTE 3 An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as a societal security objective or by the use of other words with similar meaning (e.g. aim, goal, or target). NOTE 4 In the context of societal security management systems standards, societal security objectives are set by the organisation, consistent with the societal security policy, to achieve specific results.
12.33 Organisation person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives NOTE 1 The concept of organisation includes, but is not limited to, sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private. NOTE 2 For organisations with more than one operating unit, a single operating unit can be defined as an organisation.
12.34 Outsource make an arrangement where an external organisation performs part of an organisation’s function or process NOTE An external organisation is outside the scope of the management system, although the outsourced function or process is within the scope.
12.35 Performance measurable result NOTE 1 Performance can relate either to quantitative or qualitative findings. NOTE 2 Performance can relate to the management of activities, processes, products (including services), systems or organisations. 16
East of England Ambulance Service Trust Business Continuity Process
12.36 Performance evaluation process of determining measurable results
12.37 Personnel people working for and under the control of the organisation NOTE The concept of personnel includes, but is not limited to employees, part-time staff, and agency staff.
12.38 Policy intentions and direction of an organisation as formally expressed by its top management
12.39 Procedure specified way to carry out an activity or a process
12.40 Process set of interrelated or interacting activities which transforms inputs into outputs
12.41 Products and services beneficial outcomes provided by an organisation to its customers, recipients and interested parties, e.g. manufactured items, car insurance and community nursing
12.42 Prioritised activities activities to which priority must be given following an incident in order to mitigate impacts NOTE Terms in common use to describe activities within this group include: critical, essential, vital, urgent and key.
12.43 Record statement of results achieved or evidence of activities performed
12.44 Recovery point objective point to which information used by an activity must be restored to enable the activity to operate on resumption NOTE Can also be referred to as “maximum data loss”.
12.45 Recovery time objective RTO period of time following an incident within which product or service must be resumed, or 17
East of England Ambulance Service Trust Business Continuity Process
activity must be resumed, or resources must be recovered
NOTE For products, services and activities, the recovery time objective must be less than the time it would take for the adverse impacts that would arise as a result of not providing a product/service or performing an activity to become unacceptable.
12.46 Requirement need or expectation that is stated, generally implied or obligatory NOTE 1 “Generally implied” means that it is a customary or common practice for the organisation and interested parties that the need or expectation under consideration is implied. NOTE 2 A specified requirement is one that is stated, for example in documented information.
12.47 Resources all assets, people, skills, information, technology (including plant and equipment), premises, and supplies and information (whether electronic or not) that an organisation has to have available to use, when needed, in order to operate and meet its objective
12.48 Risk effect of uncertainty on objectives NOTE 1 An effect is a deviation from the expected — positive or negative. NOTE 2 Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organisation-wide, project, product and process). An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as a business continuity objective or by the use of other words with similar meaning (e.g. aim, goal, or target). NOTE 3 Risk is often characterized by reference to potential events (Guide 73, 3.5.1.3) and consequences (Guide 73, 3.6.1.3), or a combination of these. NOTE 4 Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood (Guide 73, 3.6.1.1) of occurrence. NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood. NOTE 6 In the context of business continuity management system standards, business continuity objectives are set by the organisation, consistent with the business continuity policy, to achieve specific results. When applying the term risk and components of risk management, this should be related to the objectives of the organisation that include, but are not limited to the business continuity objectives as specified in 6.2.
12.49 Risk appetite amount and type of risk that an organisation is willing to pursue or retain
12.50 Risk assessment overall process of risk identification, risk analysis and risk evaluation
12.51 Risk management coordinated activities to direct and control an organisation with regard to risk
12.52 Testing procedure for evaluation; a means of determining the presence, quality, or veracity of something NOTE 1 Testing may be referred to a “trial”. NOTE 2 Testing is often applied to supporting plans.
18
East of England Ambulance Service Trust Business Continuity Process
12.53 Top management person or group of people who directs and controls an organisation at the highest level NOTE 1 Top management has the power to delegate authority and provide resources within the organisation. NOTE 2 If the scope of the management system covers only part of an organisation then top management refers to those who direct and control that part of the organisation.
12.54 Verification confirmation, through the provision of evidence, that specified requirements have been fulfilled
12.55 Work environment set of conditions under which work is performed NOTE Conditions include physical, social, psychological and environmental factors (such as temperature, recognition schemes, ergonomics and atmospheric composition.
19
