Housing & Care Provider

The Challenge

Teed first worked with the client many years ago to establish a business continuity management system (BCMS). In addition, there is a lot of good practice operationally with site response plans covering site, IT, communications and people issues.

When a real incident occurred, there was some confusion regarding communications, management responsibilities and escalation; when does an incident become business continuity threatening?

There was concern that the procedures did not link together in an effective manner and, recognising they needed help to improve the current situation, the client returned to Teed who were asked to undertake a business continuity (BC) refresh project. Alongside, our consultant would review the existing response and recovery documents to understand where there were gaps in the process and mitigate risks.

The Solution

Teed conducted a review and facilitated a series of analysis, strategy and planning workshops for business representatives. Talking through scenarios and establishing feasible contingencies enabled an understanding of the client’s current position. An overarching BC plan was developed with an enhanced scope and following the document review of operational emergency procedures, IT DR and BC plans, our consultant suggested areas where improvements could be made to increase overall preparedness and resilience.

The BC plan was introduced at an awareness workshop for the representatives prior to a tabletop exercise. In considering the plan first, people were able to see how the response and recovery would work in a practical manner, with a logical process to be followed.

Attendees were then asked to consider a cyber-related scenario both together and as groups with different focus areas: business and operational, using the BC plan to manage the recovery.

The exercise threw up some inconsistencies, for example, there were certain instances where recovery of IT services would not be satisfied within required timescales which had not been fully understood. It was found that the unavailability of individuals with key skills would be challenging, so an action was raised to document processes for essential activities to maintain continuity. A further action was identified to implement a process and capability to ensure urgent notification and management of a severe cyber security incident that occurs out of hours.

The Result

The client now has a clear and effective response and recovery mechanism in place, comprising an overarching business continuity plan and associated documentation, bringing together the client’s processes and procedures in an efficient manner.

However long BC has been in place, it pays to review and refresh regularly to remain aligned with good practice. Organisations change, technology moves at a fast pace, people can become complacent. When response planning is out of date, risk exposure increases. Ongoing improvement activity with regular exercising is needed to keep BC alive and maintain validity.

In this instance, it is not just about the financial impact of a disruption, it is about protecting people who depend, not only on an emergency alarm system, but also on a prompt response to an incident at their care facility.