Business continuity and recovery
Business continuity planning
Business continuity can be viewed as ‘keeping the business running’.
Business continuity starts as soon as a disruptive event occurs. Whilst the emergency and crisis management teams are responding and managing the incident, the local impacted area must immediately respond:
- What immediately needs to be done – e.g. do staff and students need to go home, go somewhere else? Are there any injuries or wellbeing needs to be attended, or support to be provided.
- What do we do tomorrow – e.g. what arrangements and communications are needed to tell staff and students to come in / stay home / go elsewhere – and for how long.
- How do we keep a basic / minimum level of service going / can we?
This is where developing and maintaining a business continuity plan (BCP) is essential as this will provide guidance on keeping the business running, determined and implemented well in advance of any disruptive event occurring.
How do we develop a business continuity plan?
Internal Audit & Risk Management can support operational areas in planning and developing a business continuity plan for their area. Templates are available to guide the process.
A business continuity plan is developed in two stages:
- Conducting a business impact analysis (BIA) which will identify critical functions within a business unit (giving a priority for prevention, continuity and recovery), the minimum resources needed to continue the business at a reduced level (if possible), the realistic maximum time the business unit can be inoperable without significant impact, and what is needed to recover the business back to normal. This is usually done with key local stakeholders in a workshop.
- Developing a business continuity plan (BCP) using the information gathered in the BIA to document strategies and key roles / responsibilities to enable business continuity and recovery.
While an emergency or crisis may end, RMIT may be left with a recovery problem.
Post event recovery involves dealing with longer-term effects or impacts and how to return to ‘business as usual’. If major change has occurred as a result of the event, back to normal may not be possible; in which case adaptation is required for recovery to a new ‘normal’.
Crises in particular serve as a major learning point for increasing organisational resilience and recovery includes the evaluation and revision of operational practice by identifying the lessons to be learnt.
Determining when an emergency or crisis is over
The relevant response effort ends when the Emergency or Crisis management team leader is satisfied that a coordinated response is no longer required. For physical accidents or emergencies, the response phase is typically over once emergency services declare the emergency over and leave the scene.
The Head of the impacted area should have been involved in the crisis management team during management of the crisis – as impacted area liaison and recovery coordinator. It is their responsibility to ensure that a team is active within their local area to enable continuity and recovery of their normal operations.
To effectively recover from an adverse event, a suitable recovery plan will be developed as part of the local business continuity plan.