BUSINESS CONTINUITY MANAGEMENT GUIDELINES

1 WESTERN AUSTRALIAN GOVERNMENT BUSINESS CONTINUITY MANAGEMENT GUIDELINES Second Edition i Acknowledgement RiskCover has produced the BUSINESS CONTINUITY MANAGEMENT GUIDELINES to assist the Western Australian State Government Agencies to develop and implement their BUSINESS CONTINUITY Plans. First edition August 2006 Second edition July 2009 Please direct all enquiries or comments on the contents of this document to: Risk MANAGEMENT Services RiskCover (08) 9264 3806 _____ BUSINESS CONTINUITY MANAGEMENT GUIDELINES ii Copyright of Insurance Commission of WA RiskCover Division Table of Contents Table of Contents ..ii Public Sector Commissioner s Circular ..iv In Notes On Second Edition ..2 Part One: Introduction ..3 Part Two: The BUSINESS CONTINUITY MANAGEMENT Process ..6 1. Overview of the BUSINESS CONTINUITY MANAGEMENT Process ..6 Step 1 Programme MANAGEMENT .. 6 Step 2 Risk and BUSINESS Impact Analysis .. 6 Step 3 Identify Response Options.

2 7 Step 4 Develop Response Plan .. 7 Step 5 Train, Exercise and Maintain .. 7 2. Step One: Programme 8 Roles and Responsibilities .. 8 BCM Policy .. 9 Develop BCM Programme Schedule and 10 3. Step Two: Risk and BUSINESS Impact 11 Approach to BUSINESS Impact Analysis .. 12 4. Step Three: Identify Response Options ..15 15 Identify response options .. 15 Evaluate response options .. 18 5. Step Four: Develop Response 19 Establishing the Crisis MANAGEMENT and BUSINESS CONTINUITY Teams .. 19 Develop and Document 21 6. Step Five: Train, Exercise and 25 25 Exercising .. 26 Maintenance .. 28 _____ BUSINESS CONTINUITY MANAGEMENT GUIDELINES iii Copyright of Insurance Commission of WA RiskCover Division LIST OF APPENDICES ..29 APPENDIX 1 Glossary of BCM APPENDIX 2 Key components of BUSINESS CONTINUITY APPENDIX 3 Sample Terms of APPENDIX 4 Sample Table of Contents for a BCM Policy ..36 APPENDIX 5 Sample BCM Programme Schedule.

3 38 APPENDIX 6A Sample Risk / BUSINESS Impact Reference Table ..40 APPENDIX 6B Sample BUSINESS Impact Analysis Template ..41 APPENDIX 6C Sample List of BUSINESS Activities ..42 APPENDIX 6D Sample BUSINESS Impact Analysis (1) ..43 APPENDIX 6E Sample BUSINESS Impact Analysis (2)..44 APPENDIX 6F Sample Consolidated BUSINESS Impact Profile ..45 APPENDIX 6G Sample BUSINESS CONTINUITY Requirements ..46 APPENDIX 7A Sample Terms of Reference: Crisis MANAGEMENT Team ..48 APPENDIX 7B Sample Terms of Reference: BUSINESS CONTINUITY APPENDIX 8A Sample Table of Contents: BCM Plan Overview ..51 APPENDIX 8B Sample Table of Contents: Emergency Response Plan ..52 APPENDIX 8C Sample Table of Contents: Crisis MANAGEMENT Plan ..53 APPENDIX 8D Sample CONTINUITY and Recovery Response Team Action Plan ..54 APPENDIX 9 Sample BCM Programme Review Checklist ..66 _____ BUSINESS CONTINUITY MANAGEMENT GUIDELINES iv Copyright of Insurance Commission of WA RiskCover Division PUBLIC SECTOR COMMISSIONER S CIRCULAR _____ BUSINESS CONTINUITY MANAGEMENT GUIDELINES v Copyright of Insurance Commission of WA RiskCover Division BUSINESS CONTINUITY MANAGEMENT GUIDELINES 1 Copyright of Insurance Commission of WA RiskCover Division IN BRIEF These GUIDELINES are intended to be used by any Western Australian Government Agency that is in the process of or intending to develop effective BUSINESS CONTINUITY MANAGEMENT processes.

4 These GUIDELINES are presented in two parts: Part One: An introduction to BUSINESS CONTINUITY MANAGEMENT Part Two: The BUSINESS CONTINUITY MANAGEMENT Process Step 1 Programme MANAGEMENT Step 2 Risk and BUSINESS Impact Analysis Step 3 Identification of Response Plan Options Step 4 Development of Response Plans Step 5 Train, Exercise and Maintain These GUIDELINES are consistent with AS/NZS 4360 and HB 221:2003 with some modifications for Western Australian Agencies. These GUIDELINES should be used in conjunction with the WA Government Risk MANAGEMENT GUIDELINES . BUSINESS CONTINUITY MANAGEMENT GUIDELINES 2 Copyright of Insurance Commission of WA RiskCover Division NOTES ON SECOND EDITION Since the First Edition was published in August 2006, feedback and suggestions have been received from Agencies and other parties on the GUIDELINES .

5 In the same period, RiskCover also has had the opportunity to work with many Agencies in the development of their BUSINESS CONTINUITY programmes using these GUIDELINES . The feedback and field experience provided a valuable insight into what needed be done to improve the GUIDELINES . The following updates have been made in this Second Edition: The core elements of the BUSINESS CONTINUITY MANAGEMENT Process remain unchanged but various sections have been re-written for better clarity; Terminologies and their definitions have been updated and the use of these have been made consistent throughout the GUIDELINES ; The entire Appendix has been revised to provide a more comprehensive set of references, samples and tools that are closely aligned with the main body of the GUIDELINES . As with all GUIDELINES , this document is intended to provide a general framework and some sample tools to assist Agencies in the development and implementation of their BUSINESS CONTINUITY MANAGEMENT programmes.

6 It is not intended to be a definitive manual with step-by-step instructions. Agencies would need to exercise their own discretion in customising and adapting the framework and tools to fit their own circumstances. BUSINESS CONTINUITY MANAGEMENT GUIDELINES BUSINESS CONTINUITY MANAGEMENT GUIDELINES 3 Copyright of Insurance Commission of WA RiskCover Division PART ONE: INTRODUCTION The objective of BUSINESS CONTINUITY MANAGEMENT (BCM) is to ensure the timely resumption and delivery of essential BUSINESS activities in the event of a major disruption by maintaining the key BUSINESS resources required to support delivery of those activities. The primary output of the BCM Process is a BUSINESS CONTINUITY Plan (BCP), which is a plan for mitigating some of the Agency s risks. The BCP is initiated when a risk event occurs that has a BUSINESS interruption consequence.

7 The BUSINESS interruptions that are of concern from a CONTINUITY viewpoint are referred to as outages . These events will cause a significant disruption to, or loss of key BUSINESS activities over a prolonged period of time. It follows that such events will have a high impact on and severe consequence for the Agency. Outages need to be distinguished from other day to day operational problems such as system glitches, brief loss of communications link and processing errors that arise from time to time in the normal course of doing BUSINESS . These events should be handled as part of the businesses standard operating procedures and typically do not come under the purview of the BCP. The concept of an outage has a time dimension as well as a BUSINESS impact dimension. The BCM Process includes establishing the maximum periods for which each BUSINESS activity can be disrupted or lost altogether, before the potential BUSINESS impacts (such as damage to reputation, financial loss, effects on stakeholders and breach of regulations) become unacceptable to the Agency.

8 BCM focuses on consequences of an outage and the steps necessary to contain or minimise the negative consequences when an outage actually occurs. It is not concerned with the likelihood of occurrence, as matters of likelihood should already have been addressed as part of the Risk MANAGEMENT process. Preventative controls should already have been established to reduce the likelihood and consequences of the risk event to levels that are acceptable to MANAGEMENT . Effective BCM goes beyond the construction of a BCP. It requires a fundamental cultural change within the Agency, including an acceptance of uncertainty. People at all levels of the Agency need to appreciate that risk is inherent in all decisions and activities and that a proportion of these risks have the potential to create interruption to services, and that they therefore need to consider how they will respond to and manage such interruptions.

9 BUSINESS CONTINUITY MANAGEMENT GUIDELINES BUSINESS CONTINUITY MANAGEMENT GUIDELINES 4 Copyright of Insurance Commission of WA RiskCover Division Agencies may have different approaches to responding to and managing crises. Regardless of the approach, the key elements that can usually be distinguished and collectively make up a BCM response plans are: Emergency Response: The initial response to a disruption, which involves the protection of people and property from immediate harm. An initial reaction by the Crisis MANAGEMENT team will form part of the Agency s first response. CONTINUITY Response: Processes, controls and resources are made available immediately following an interruption to ensure that the Agency continues to deliver its critical BUSINESS services. Recovery Response: Processes, resources and capabilities of the Agency are re-established to return the Agency to normal operations.

10 This will often include the introduction of significant organisational improvements, even to the extent of re-focusing strategic or BUSINESS objectives. BUSINESS CONTINUITY MANAGEMENT is in essence a MANAGEMENT process focussed on what to do following an unexpected event or incident, which is best developed prior to an incident occurring, in the relative calm of daily MANAGEMENT of the Agency. Planning and making decisions on the run in the heat of a crisis situation is both difficult and dangerous. Relationship between BUSINESS CONTINUITY and Risk MANAGEMENT BUSINESS CONTINUITY is an element within the wider context of Risk MANAGEMENT (RM). RM is the practice of systematically identifying, understanding and managing the risks encountered by an organisation. The RM Process is illustrated in Figure 1. A structured, systematic approach to RM will enable Agencies to develop a thorough understanding of the risk issues that may prevent the achievement of goals or objectives.