Policies and Resources

BUSINESS Continuity Strategy

This Business Continuity Strategy provides the basis for developing plans that will prevent or mitigate the severity of potential interruptions and enable the Kayndrex Foundation to effectively respond to occurrences. The plan will identify the mitigation measures, specific recovery objectives, the structure for implementation, and the communication process to keep personnel, partners, and the public informed of necessary changes to service delivery.

Strategies

The strategy adopted for development of the business continuity plans can be summarised as follows:

• Major Event Initial Response Plan.
• Buisness Impact Analysis to assist define recovery priorities for the Kayndrex Foundation.,

Aims and objectives

The aim of the strategy is to support the Foundation in anticipating risks for the purpose of mitigating them and having flexible plans in place, which are already tested, to moderate interruption when unplanned events significantly interrupt normal business.

The objectives are:

• To identify preventative measures that can be performed to moderate the likelihood of an event occurring.
• To ensure the Foundation can continue to exercise its functions in the event of an emergency, ensuring that statutory requirements are maintained.
• To identify the essential services, so as to determine overall priorities for recovery of services if interruption takes place.
• To ensure the Foundation’s service units are involved in the preparation of the Plan, so that there is an effective and consistent response to service continuity.
• To provide a basis for cost benefit analysis to determine which contingency plans will be developed.
• To develop a process to review and update the overall Plan and develop service area, functional or specific plans where necessary, so as to protect the activities and reputation of the Foundation.
• To perform training and awareness programmes for personnel, elected members, suppliers, and partners.
• To perform regular tests of the Plan to validate the arrangements.

The Business Continuity Policy

Irrespective of an unusual or interruptive event, occurring internally or externally, the capabilities of the Kayndrex Foundation to provide its statutory and legal duties, services to the community, and income generation should be maintained. This process aims to address the concerns likely to arise, and to identify measures to mitigate them. The Business Continuity process aims to address the concerns likely to arise, and potential solutions, grouped in the following three areas:

• Mitigation – Identify and select proactive measures to moderate likelihood of interruption
• Continuity and Recovery- Maintenance of essential services and set timescales for recovery, returning to normality
• Event Response Structure – Provide a mechanism for responding to an incident

Buisness Continuity is an on-going cyclical process of risk assessment, management, and review with the purpose of ensuring that the business can continue if risks materialise. The effective implementation of business continuity has 6 stages:

• Policy and Programme Management
• Embedding business continuity
• Analysis
• Design
• Implementation
• Validation

It is the policy of the Foundation to:

• maintain a strategy for reacting to, and recovering from, unfavourable situations which is in line with an agreed level of acceptable risk
• ensure that, whenever practical, action is taken to prevent the occurrence or recurrence of an unfavourable situation through adopting appropriate probability managements
• maintain a programme of activity which ensures teh Foundation has the ability to react appropriately to, and recover from, unfavourable situations in line with predefined business continuity objectives
• maintain appropriate response plans supported by a clear escalation process
• rehearse response and recovery plans annually
• maintain a level of operational resilience in line with the risks faced
• maintain personnel awareness of the Foundation’s expectations of them during an emergency or business continuity unfavourable situation
• take account of changing business needs and ensure that the response plans and business continuity strategies are revised where necessary
• remain aligned with good industry practice in business continuity management

Scope of Business Continuity Planning

Business continuity planning at the Foundation concentrates on the following priorities:

• personal safety of all the Foundation’s facilities
• initial/emergency response
• communications
• safeguarding of assets
• recovery/continuity of key organisational activities
• recovery/continuity of revenue streams

Responsibility for Sphere Continuity

To be effective Buisness Continuity should be fully endorsed and actively promoted by senior management and there should be a clearly defined responsibility for coordination of Business Continuity. However, it belongs to everyone, or role, and every unit has a responsibility for ensuring that they are capable of responding to an interruption.

There are three levels of responsibility for managing the business continuity process:

1. Co-ordinator

2. Corporate Response Team

3. Service Teams

There is a core role of co-ordinating the process and ensuring that individual units have access to information and assistance when building their own plans. The co-ordinator also has responsibility for ensuring that key partners are involved in the process.

In the event that there is an interruption there should be a defined corporate response team who will have overall management of the situation. The co-ordinator is responsible for maintaining details of this team ensuring that they are fully briefed on implementing the plan and are informed of any potential concerns that could arise.

There are also individual unit action teams who are responsible for ensuring that their unit has its own response plan and can manage the continuity and recovery for the services within that unit. The team is likely to consist of one person for the process of defining the response plans and day to day co-ordination of Business Continuity but will call upon other senior managers if and when the plan needs to be put into practice.

Training

All members of the Corporate Response Team and the Service Teams need to be trained, and exercised, on an annual basis to ensure that they are fully aware of how to implement the plan. All personnel should be informed of the process and further training should be available if required. Stakeholders should be trained to ensure that they know of the existence of the plan and also how they can assist politically, in the continuity and recovery process.

Review Process

The Plan(s) will be reviewed annually to ensure that it is still relevant to the Foundation’s needs. The high risks and priority services will also be re-assessed annually.