Version:3; Last Review: May 2019; Review Date: April 2020; Author: Andy Cheshire, MD
The aim of having a Business Continuity Plan is to ensure that CQM T&C is able to maintain its activities in the face of disruptive challenges. Therefore, key personnel are expected to prepare, exercise, maintain and review this plan based on the principle that the business should be able to maintain critical activities. This policy document defines a broad framework for the implementation of a recovery plan to minimise the impact of business disruption. Full compliance with this policy will ensure procedures exist for recording, assessing and managing business continuity risk; identifying and prioritising essential activities; responding to business disruptions or incidents, regardless of cause; and maintaining essential services (or restoring services to a minimum acceptable level).
A controlled paper copy of this plan is kept at the following locations:
CQM Training and Consultancy Ltd. – in Safe 2 The Orchard House, Hathersage Hall Business Centre, Hathersage, Hope Valley, S32 1BB
Instructus Group Offices Unit 3, Cherry Hall Road, North Kettering Business Park, Kettering, Northants, NN14 1UE
Members of the recovery team
Each member retains a copy at his/her home address, details as per appendix A.
This plan is approved for use by the following:
Name: Andy Cheshire
Date: 28th May 2019
This plan is subject to annual review and re-issued in line with the financial year in order to ensure it encompasses any changes in the business processes and contact details at CQM T&C Ltd.
2. BUSINESS RECOVERY SCENARIOS
This document has been written to cope with recovery from a number of disasters, natural and man-made, internal to the business and caused by third parties. The table below gives an illustration of the types of disaster envisaged:
TYPE OF LOSS INTERNAL EXTERNAL / THIRD PARTY
Fire Fire Arson Flood Burst pipe or tank Burst riverbank Explosion Dust Bomb Gas PetrolSteam (boiler, pipes)
loss Hardware failure, Software failure, Computer Virus,
Personnel Loss of key personnel, Breakdown Major equipment breakdown, Utilities failure, Communications, Gas, Electricity, Water, Communications, Third-party legislative actions, HSE prohibition (safety) Environmental health prohibition (product safety) Environment agency prohibition (pollution) Catastrophic events Aircraft crash Major rail accident Major traffic accident Major storm Earthquake Other ‘Acts of God’ Malicious third-party actions Fraud Theft Vandalism
The management of the recovery process following a disaster is exactly the same, no matter what the size or nature of the disaster, but the detail within that process will change depending on the circumstances. This is explained in more detail within the next section.
3. MANAGEMENT OF THE RECOVERY PROCESS
3.1 Recovery Process
The recovery process should follow four main steps, outlined in the diagram below. The detail behind each of these steps is expanded in the following sections of this document.
3.2 Business Recovery Team
The board of CQM T&C Ltd have delegated responsibility for managing the recovery process to the ‘Business Recovery Team’, which comprised the following five key personnel:
Managing Director MD
Operations Director OD
Centre Coordinator CC
Director of Sales & Marketing DSM
Quality & Compliance Manager QCM
The recovery team has the power during the process to pull in resource from within the business and external to the business to effectively achieve recovery. Wherever key personnel are referred to in this document, a short code is used. The key to this is summarised in Appendix A, along with names and contact information.
4. INITIAL ASSESSMENT AND POST EMERGENCY ACTIONS
Before an initial assessment can be carried out, it is the responsibility of MD to ensure the site is safe for inspection. Members of the recovery team can then inspect the site, under MD guidance, wearing the correct personal protective equipment, to collect evidence (e.g. photographs, documents) so that the initial actions taken are as effective as possible.
The following actions will need to be taken immediately, i.e. before the planning meeting takes place:
KEYWORDS DETAILS RESP* CONTACTS Hazards Carry out initial risk analysis and allocate actions to reduce risk where appropriate MD HSE for advice Fire Protection Restore fire protection systems. CC HHBC – 01433 651098Fire Extinguishers Have portable extinguishers inspected and recharged or replaced (second fires are more likely during abnormal conditions) CC HHBC – 01433 651098 Services Isolate major services where required if not already done. For specialist jobs, use contract help. OD HHBC – 01433 651098 Protection from Elements Cover the equipment, plant, machinery, computer hardware and records with waterproof sheets. OD HHBC – 01433 651098 Plant, Machinery If building is still weather-proof but the equipment is water damaged, immediately call help to dry it out OD Speedy 0114 242 0100 Tool Hire Express 0114 275 5179 Security Arrange roster of guards to prevent unauthorised access until normal physical security is restored OD HHBC – 01433 651098 Insurer Inform insurer via broker as soon as practicable after any disaster to afford them the opportunity to visit. MD QBE Insurance Policy MAC00008758OFF 0161 838 7300
* For abbreviations see Appendix A
Once these actions are complete, the planning meeting can take place, as outlined in Section 5.
5. PLANNING MEETING FOR TEAM TASK ALLOCATIONS
This meeting will discuss the current situation, after any initial essential actions are completed. Every member of the disaster recovery team, or a deputy, should attend. The meeting may need to take place offsite, depending on the details of the disaster. It is essential that this meeting takes place before any restorative measures are started because:
– Clear allocation and agreement on tasks is required to prevent overlap or areas being missed- The MD must confirm that any actions will be covered financially (this will involve discussion with insurance assessor)- Full discussion needs to take place to involve all angles – operations, administration, safety and personnel in the decision making
The meeting will produce a series of actions to begin debris removal and setting up of temporary systems. The next section acts as a checklist to ensure all areas are covered.
6. DEBRIS REMOVAL AND TEMPORARY SYSTEMS
In Section 5, clear responsibility is assigned for setting up temporary systems and removing debris. The following table is intended as an aide-memoir to ensure clear allocation of responsibility for this next set of actions.
KEYWORDS DETAILS RESP* CONTACTS
Debris Start cleaning up debris and removing it as soon as it is cool enough or otherwise safe to do so. Remove heaps of wet cardboard, paper and the like as soon as possible – it may ignite. OD Mitie 0161 7430 743 Rentokill 0161 876 5411
Pest Control Any food products spilled or damaged can quickly attract pests. Remove it if practicable and call in infestation experts for advice OD Rentokill 0161 876 5411
Water Remove surplus water from the premises. If pumps are needed, contact the fire service or another contractor. OD Pump Hire Speedy 0114 242 0100Tool Hire Express 0114 275 5179 Premises Dry and air the premises. Contact equipment hire companies for the hire of industrial blower heaters, taking particular care that any secondary fire risk has been assessed. OD Speedy 0114 242 0100 Tool Hire Express 0114 275 5179 Photocopier Printer Unplug. Wipe down and dry. Contact the supplier if in doubt. CC Copier Systems 07917846205 Computer Refer to Appendix B, detailed IT recovery plan, for relevant details MD See Appendix BTelephone Restore to premises or employ temporary system if badly damaged. Note that the phone portal allows routing of the phones to any mobile or landline to ensure continuity of service. MD Reliance Networks 01625 665900Portal: https://www.unlimitedhorizon.co.uk/webapp/signinElectricity Restore to premises when safe to do so. OD Powergen 0845 7023031
Water Restore to premises once major leaks isolated CC HHBC – 01433 651098Salvage Separate or tag any goods into ‘undamaged’, ‘badly damaged’ and ‘slightly damaged’. Do not dispose of any goods until seen by insurance assessor. Concentrate on halting deterioration of restorable property. Do not waste time on property obviously beyond economic repair.For large scale clearance, an expert contractor may be needed. OD Rentokill Initial 0161 430 3226 First Aid Set up a first aid post for workers involved in the recovery CC N/AAmenities Have toilet and washing facilities restored as quickly as possible. If they are destroyed, arrange for mobile facilities to be hired. CC HHBC – 01433 651098 Accounting Requirements Refer to Appendix C for the special accounting requirements which will be required both for the company to separate costs out and for later insurance purposes MD (FC) N/AProtective Equipment Assess need for special protective equipment for staff during recovery and clean up (e.g. hard hats, eye protection, footwear, gloves, breathing equipment) OD Arco 0161 869 5800Dilworth 01663 748 601
Employees Contact employees directly to advise them of the disaster and when and where to report – some may be needed for emergency work. OD Current EmployeesNews Media Prepare factual information for the news media. Avoid harmful speculation. Ensure that only authorised board members make statements to news reporters. DSM BBC 08700 100 email@example.com
Customers Arrange for customers to be advised of position. The DSM will prepare a concise and accurate summary of the current status OD NumerousOther Stakeholders Arrange for suppliers to be advised of position. The DSM will prepare a concise and accurate summary of the current status QCM Colleges, Awarding Organisations, Instructus Group, etc.Contractors Advise service contractors of any expected changes in needs. OD NumerousRedundancy Once the extent and probable length of business interruption has been estimated, identify those employees who will be redundant. Decide which are to be retained and which are to be laid off. Make a plan of work for those which are being retained. Morale will be important so keep employees fully informed of prospects. MD SolicitorsIronmonger Curtis 0114 253 6540* For abbreviations see Appendix A
Once these actions have been put in place, medium to long term recovery of the business can begin, as detailed in the next section.
7. FULL RESTORATION
Section 6 dealt with setting up temporary systems and debris removal. The next stage is the actual recovery of the business, taking whichever route is appropriate. Initial assessment will be driven by which departments or parts of departments have been taken out of action.
The business systems are based ‘in the cloud’ and thus the opportunity for rapid recovery are good. Once the boundaries of the overall restoration task are defined, full recovery can be planned. The following table shows the process for this final step with relevant checks with both the insurer and the Company Board for major decisions. The MD may call an extraordinary board meeting if the seriousness of the situation dictates.
ACTION DETAILS RESP* RESOURCES1. Feasibility report for restoration Will include estimated costs and schedule, may consider more than one option MD See Appendix E for detailed procedure.2. Meeting to decide route for business Recovery team will meet to agree preferred way forward, this may include insurance assessor directly or via MD MD Review feasibility reports (1)3. Approval of board for action Present proposed plan for recovery to business and refine as necessary MD Other team members as required.4. Meeting to decide how agreed plan will be implemented Appoint project management structure with clear roles, MD to clarify financial structure All May include main contractor for managing large projects or re-allocation of responsibilities within business to achieve aims5. Begin full restoration All relevant personnel to be briefed. All As required from within business6. Monitor and review Recovery team becomes STEERING GROUP for recovery. Project manager(s) report to steering group and major issues of finance, schedule and resourcing are resolved on an ongoing basis. MD to keep board and insurers informed as required. All (QCM to arrange meetings) As required from within business* For abbreviations see Appendix A
Note that good quality decision through this final stage will depend on good quality information on engineering recovery and/or product outsourcing in actions 1a and 1b and will probably minimise costs and impact as the business is restored. APPENDIX A – CONTACT DETAILS OF KEY PERSONNEL
Note that completely up to date contact information is kept on the telephone database, which should always be used as a first port of call. However, in the event of a major disaster, the following numbers can be used, which are updated with the document yearly. The short code on the left-hand side of the table is used as a reference throughout the document.
Code Full Title Name Home Contact MobileMD Managing Director (Chairperson for this Process) Andy Cheshire 0161 439 6084 07825 108702DSM Director of Sales & Marketing Jenny Humphreys 01433 621205 07970 478627CC Centre Coordinator Sylvia Jenkinson 01246 419311 07879 611612OD Operations Director Keith Bailey 01772 701378 07809 629883QCM Quality & Compliance Manager Dawn Hughes 01159 307761 07779626588
APPENDIX B – IT (COMPUTER) RECOVERY PLAN
There are no servers in the office, all core business data is stored and backed up on MS365 and Sharepoint servers. In the event of office PC’s being destroyed, any desktop PC can be configured to very quickly restore all data.
The Accounting PC has Sage accounting software running on it. Sage is backed up to Sharepoint weekly, so at worst, less than one week’s data would be lost. In the event of the Accounting PC failing, any desktop PC can be installed with Sage software either by:
SAN-IT on 0161 359 3689Or by Paul Horton on 07712751214
All employees have a Microsoft MS365 account and if any computer fails, MS365 can be accessed remotely.
Username is the cqm email of the format firstname.lastname@example.orgPassword is each users unique password for Microsoft
All files are securely stored and backed up on Sharepoint servers and can be accessed remotely.
Other business systems, such as CRM, time tracking, E-portfolio are all outsourced and managed via the cloud and can continue to be accessed in the event of a disaster.
In terms of reconfiguring office IT systems, SAN-IT are our preferred provider and can be called during office hours on 0161 359 3689. In a genuine emergency, out of hours they can be contacted on the duty mobile of 07968 59 59 78.