Government Business

Local authorities and other public sector organisations throughout the UK have been devoting significant time and resource to the development of Business Continuity Management (BCM) programmes in recent years, spurred on by the requirements of the Civil Contingencies Act and further encouraged by the findings of the Pitt Review.
 
Even without these stimuli, continuity of service is important in the public sector for two essential reasons. Firstly, people, including many vulnerable people, rely on the services provided; and secondly, public sector organisations can be major businesses and sources of employment within a local economy.  
 
Furthermore, modern public sector organisations are heavily reliant on partnerships with private organisations to deliver services. Deteriorating economic conditions mean that the public sector needs to understand its dependencies on service delivery. The impact of a service-partner unexpectedly failing would be far harder to manage and recover from than a supplier of products.

Responsibility
In the local government environment, responsibility for BCM is often placed with emergency planning officers. The statutory responsibility under the Civil Contingencies Act 2004 tends to be defined in the narrower sense of supporting the public in emergencies, and in the capability of Category 1 responders to recover from and continue providing their primary services post-disaster. 
 
The BCI argues that BCM shares many common attributes of emergency planning but fundamentally BCM is a key management process that crosses a number of functions. There are many important activities within public sector organisations that need to be safeguarded in the event of a major disruption.
 
So how should policy development reflect the broader BCM perspective, beyond emergency planning?
 
There are significant resources available on the subject of BCM. The BCI, for example, provides its Good Practice Guidelines as a free, downloadable resource from its website. However, there are some key aspects of BCM that are worth exploring in greater depth as getting these right and relevant can make a major difference to the level of organisational resiliency.

Scenarios
You can spend a long time thinking about scenarios – what you will see is that many scenarios have the same impact, e.g. a shortage of people, a loss of access to the primary workplace, loss of access to key IT systems, the need to deal with the media quickly and effectively, customers wanting to know what is going on.
 
Not all impacts affect key services to customers and therefore impacts can be dealt with based on their importance. In BCM language these are called “critical activities” – it may be decided that services that deal directly with vulnerable people will take priority over other services, which are less time-sensitive. Clearly any change of service provision, even on a temporary basis needs to be communicated to all key stakeholders, to allay concerns. 
 
Part of the process in understanding impacts is looking at recovery times – you should set recovery times according to the importance of the activity or process.
 
When the terrorists attacked Glasgow Airport, there were three distinct phases of the response: managing the emergency itself, getting the airport operational again (achieved with 24 hours) and then recovery to normal operations. You can see that this would not happen without an applied process well in advance. And again, part of the process is to look at what actions to take to improve further for the next incident.
 
People factors must be fully considered in business continuity planning. Staff wellbeing issues and the organisation’s duty of care obligations need to be considered within BCM planning. 
 
At a practical level, the plan may assume that staff will move location or work different hours or have to assume more responsibility. Research conducted by YouGov on behalf of the BCI in 2008 indicated that employees generally were not aware of their employers’ plans.

Vital communication
Communication processes are vital and cannot be made up on the day. A delay in getting approval to send out a media release can have detrimental impact on reputation and increase stress levels. It is advised to plan in advance with communication mapping strategies to allow swift response.  
 
Public scrutiny comes with the job in the public sector and therefore communication with stakeholders is even more vital than in the private sector. zPoliticians are likely to be in the front-line from local people and media in terms of “what’s going on” and they need to be briefed in advance about BCM and given information in a timely manner.  
 
Embedding BCM in an organisation’s culture is one of the more difficult challenges. There is a cost in running and maintaining a BCM programme. However, plans do need to be tested to assess their effectiveness and for staff to exercise their role in the plan. Behaviour in an exercise is a good benchmark for behaviour in the real crisis. Finally, it is important that plans are reviewed, updated and improved on a regular basis as dependencies change.
 
Where organisations want to demonstrate a robust and independently audited BCM programme to stakeholders, then it is worth seeking certification against the British Standard for BCM - BS25999.  

Closing thoughts
If properly applied, a BCM programme can help an organisation identify threats and the impacts to operations that those threats, if realised, might cause. It provides a framework for building organisational resilience that safeguards the interest of key stakeholders, reputation, brand and value-creating activities.
 
The Business Continuity Institute (BCI) was established in 1994 to “promote the art and science of business continuity management” to assist organisations in preparing for and surviving minor and large-scale man-made and natural disasters. The Institute enables members to obtain guidance and support from their fellow practitioners, as well as offering professional training and certification programmes to disseminate and validate the highest standards of competence and ethics. The BCI has more than 4,500 professional members worldwide and some 70 corporate members including the Civil Contingencies Secretariat and Milton Keynes Council. 

For more information
Web: www.thebci.org