Appian provides a low-code development platform that accelerates the creation of high-impact enterprise software applications – from idea to app in 8 weeks with a guarantee.
In case of emergency
This year has thrown some major challenges to both private and public sector organisations throughout the UK. Floods, loss of water supplies, the driest spring and the wettest summer, terrorism, strikes, foot and mouth, and avian flu are just some of the major incidents that have occurred in this year, and we are only in September.
Managing a crisis
Many of the public sector organisations have been hit by these incidents and the importance of the Civil Contingencies Act in changing the approach to managing major incidents has been demonstrated. The management of the floods across the UK and the speedy handling of the foot and mouth outbreak have indicated that the co-ordination between emergency services, local/regional/central government departments and agencies can, and does work.
There have been many good examples of organisations hit by the recent incidents who have been able to maintain their critical services to the community whilst dealing with the wider disruption. This was demonstrated across Gloucestershire during the major flooding that swept across the county in July. Not only were the floods the worst for 60 years but the area also lost water supplies to 140,000 homes and businesses for two weeks and there were interruptions to power supplies.
So what kept these organisations going in the face of such adversary? I believe it was the excellent work that has been done over the years in introducing Business Continuity Management (BCM). Gloucestershire County Council has been at the forefront of BCM development for several years, they were acknowledged this year by being awarded Beacon status.
On Sunday 22 July, Gloucestershire’s Shire Hall lost power, parts of the building were flooded and water supplies were failing. The BCM plans were activated and the call centre traffic was moved to Chippenham. Calls had to be diverted out of the County as all their office buildings would be without water and could not be occupied under Health & Safety rules. The County Council was able to maintain its critical services for the community and maintain its emergency management capability.
So how did BCM help? One of the earliest activities the County Council undertook when it started on the route to establishing BCM was to define the critical services they supplied including services for the vulnerable in the community. Of the approx 175 services supplied by the authority 37 were considered critical and it was for these that continuity plans had been developed.
Before the plans were developed, however, the Council had undertaken an analysis of how they delivered these critical services, who and what was needed to run the services and what were the minimum levels they would need to operate at if subject to a major disruption. In undertaking this activity, process mapping was used to understand how the services operated and to identify any dependencies, both internal and external.
When developing BC plans it is essential to use high-level scenarios rather than look at individual risks. The recommended scenarios are denial of access to the building; failure of systems; lack of staff; failure of suppliers/partners.
Gloucestershire County Council had to contend with all four. They were unable to occupy their building even when the floods went down because of the lack of water, even though the building was not damaged. Parts of their IT system failed when the UPS failed and major suppliers were impacted by the floods and loss of mains water.
Many staff were unable to report for duty being cut off by the floods. The demands of distributing water to over 300,000 people, assisting with rescue, opening rest centres and clearing roads meant that the Council had to redeploy staff from less critical activities.
By having BC plans that were focused on their critical activities and based on high level scenarios they were able to cope. But having plans is not the end of the matter. These plans have to be rehearsed and maintained.
Good practice and training
There are several sources that seek to provide examples of good practice and training. The government runs a series of BCM training courses at the Emergency Planning College in Easingwold. These are based on current good practice and emerging standards. The courses use visiting speakers from the public and private sector to help delegates develop their own expertise.
The Civil Contingencies Secretariat, part of The Cabinet Office, is developing models of good BCM practice that cover methodology, training and exercising. These models have been selected by practitioner working parties from a wide range of materials submitted by the public sector. These will be placed on the UK resilience website in the latter part of this year (http://www.ukresilience.gov.uk/ ).
For those of us who have been working on BCM for a number of years there has been one over riding aim: to establish a uniform approach to BCM across the UK. As public, private and voluntary sectors are increasingly working together to deliver services to the UK public under normal circumstances, and at times of an emergency, it was essential that a common methodology should be created.
Guides to help
Building on the work done for Y2K two key documents were developed. The BCM Good Practice Guide was published by the Business Continuity Institute in 2002 and PAS 56, a British Standards Guide to BCM in 2003. In 2005 the guidance supporting the CCA was published, building on the two previous publications whilst recognising the needs of the public sector.
Following massive worldwide interest in PAS 56, British Standards published a Code of Practice for BCM (BS25999-1) in 2006. This will be followed by a Specification for BCM (BS25999-2) in 2007 against which organisations can seek certification. Both documents are built on the previous publications.
By encouraging suppliers and partners to comply with or be certified to BS25999-2, public bodies will have a greater assurance that their services will be less likely to be disrupted, or can quickly be resumed, if their supplier or partner is impacted by an incident or emergency. The standard has been created so that any organisation, regardless of size or sector, would be able to meet the requirements set out in BS25999-2.
In order to understand how best to use the new standard as a benchmark for BCM down the public sector supply chain there is a requirement for those in purchasing to understand the basics of the BCM process.