Business and continuity management
What is Business Continuity Management?
Business Continuity Management (BCM) is about ensuring that we can continue to operate in the event of unplanned incidents that would otherwise disrupt learning, teaching, research and work.
BCM involves:
- identifying and managing risks to the normal operation of the University
- the development and testing of plans to enable the University to withstand and respond to disruptive events
- maintaining the delivery of critical services to students, staff and other stakeholders
Events that could necessitate the implementation of the business continuity plans include:
- adverse weather such as extremes of temperature, storms or flooding
- health outbreaks such as pandemic flu
- loss of services such as electricity, heating and IT systems
- fire and explosion
- security incidents such as bomb threats, terrorism and civil unrest.
Business Continuity Management quick guide
-
Business Continuity Management plans
Business Continuity Plans (BCPs) are plans which are designed to facilitate the response to and recovery from disruptions, whatever their source or whatever aspect of the business they affect. They are designed to:
- Secure the critical infrastructure and facilities
- Resume normal business operations
- Protect UWL’s reputation
Each School and Central Support Department (CSD) has their own Business Continuity Plan (BCP) to help restore its key activities in the event of a major disruption or loss of facilities. Each BCP includes the risk analysis, logistical requirements and checklists of actions to maintain or reinstate the School or CSD’s main activities. The BCP is the responsibility of each Head of School or CSD and it clarifies issues of authority, priority, management and communication.
These documents will be available to a number of senior staff in each School and CSD and also the Vice-Chancellor’s Strategic Coordination Group during a disruptive event that necessitates implementation of the BCPs.
-
Who is responsible for Business Continuity Management?
Business Continuity Management is overseen by the University Secretary and Chief Compliance Officer on behalf of the Vice-Chancellor and Board of Governors.
They are responsible for the Incident Management and Business Continuity Framework and works very closely with the Director of Property Services and the Chief Information Officer.
-
What are the objectives of the Incident Management and Business Continuity Framework?
The objectives of the IMBCF are to:
- identify the corporate business continuity planning structure and process
- embed the business continuity planning culture throughout the University, as part of effective risk management
- identify the critical business processes and assist Schools and Central Service Departments in developing their business continuity plans
- develop and implement training and education in business continuity planning, reducing the level of risk from emergencies disrupting the University business operations.
- develop the provision of important management information
- produce emergency response, business resumption and disaster recovery plans
- conduct a review and exercise programmes to regularly test the policy
- minimise the impact on the University’s business operations and services
-
How does Business Continuity Management work?
The University’s Business Continuity strategy involves a hierarchy of Gold, Silver and Bronze Teams as follows:
Gold = Major Incident Management Team
Vice-Chancellor's Executive and key staff to deal with a major incident that affects multiple operations.
Silver = Emergency Response Team
Deans of College and/or Heads of School, Directors and/or Heads of Central Service Departments, Safety Manager responsible for dealing with a cross-University incident which involves one or more departments but which can be dealt with without reference to a Major Incident Team. Silver teams may also be required to deal with a business continuity issue, reporting to the Gold team.
Bronze = Department Operational Teams
Departmental Operational Team(s) dealing with incidents that affect only one department.
-
What do schools and departments have to do?
Each academic school and central support department is required to develop a Business Continuity Plan (BCP). A Business Impact Analysis (BIA) identifies the core functions and activities that are critical to the school or department’s continued operation. From this, the BCP is developed to facilitate the response, resumption and recovery to any situation that could adversely affect the unit.
Information from the BIAs is used to maintain a calendar of business-critical events, activities and operations, and this information ensures that the Senior Management team in the Gold and Silver Groups can respond and allocate resources appropriately in the event of a significant incident.
-
What do I need to do?
Make sure that your line manager and Human Resources have up-to-date contact details for you. In addition to your University email address, you should provide them with any personal e-mail address that you use and any relevant telephone numbers (preferably a mobile and a landline number). This will enable us to contact you should a situation arise that could affect you (for example, rescheduling or relocation of work activities).
Familiarise yourself with any local arrangements in place within your School or Department for responding to incidents. Ask to see the Business Continuity Plan and let your line manager know of any additional activities or actions that may need to be considered to ensure the continuation of a positive student experience.
Make sure that you monitor our website and the staff intranet for our latest information, and updates to any situation developing that may affect you in the event of an incident.
-
How do I report an incident?
In the event of an incident you should call the 24 hour Security Service on 3333 (or dial 020 8231 2572 from outside the University).
The Incident Management and Business Continuity Framework
-
The Incident Management and Business Continuity Framework
To deal with any eventuality the University has developed an Incident Management and Business Continuity Framework which:
- provides for the planning for and management of an emergency
- provides a framework for dealing with and coordinating responses in the event of a disruption or an emergency
- establishes the roles and responsibilities for central planning for response, recovery and continuity activities
In the event of a major disruption or emergency, the University’s Incident Management and Business Continuity Framework (IMBCF) provides the necessary framework, structure and processes for coordinating an early resumption to normality with the minimum of disruption to the University’s core activities.
The objectives of the IMBCF are to:
- identify the corporate business continuity planning structure and process
- embed the business continuity planning culture throughout the University, as part of effective risk management
- identify the critical business processes and assist Schools and Central Support Departments in developing their BCPs
- develop and implement training and education in business continuity planning, reducing the level of risk from emergencies disrupting the University business operation
- develop the provision of important management information
- produce emergency response, business resumption and disaster recovery plans
- conduct a review and exercise programmes to regularly test the BCMS
- minimise the impact on the University’s business operations and services
-
Priorities for Incident management
In the event of an incident, the University’s priorities are to:
- protect life
- secure the critical infrastructure and facilities
- protect the student experience
- resume normal business operations
- protect UWL’s reputation
Emergency teams
-
Major Incident Management group
Major Incident Management group:
- Vice-Chancellor/Deputy Vice-Chancellor (in the chair)
- VCE members
- Heads of any relevant/affected Schools and/or Central Service Departments
- Head of Communication and Marketing
- Head of Legal Services
- Health and Safety Manager
- Chief Exec of SU (as appropriate)
- General Manager, Bouygues (as appropriate)
Responsibilities:
- set up of Incident Control Centre
- establishing priorities
-
Emergency Teams and Action Cards
The responsibilities of each level of command are set out in the table below. Actions to follow in the event of an incident are set out in the action card for each team.
Major Incident Management group:
- Vice-Chancellor/Deputy Vice-Chancellor (in the chair)
- VCE members
- Heads of any relevant/affected Schools and/or Central Service Departments
- Head of Communication and Marketing
- Head of Legal Services
- Health and Safety Manager
- Chief Exec of SU (as appropriate)
- General Manager, Bouygues (as appropriate)
Responsibilities:
- set up of Incident Control Centre
- establishing priorities
-
Action Card (Bronze Action Card)
Bronze Control Procedures:
- Department/School assumes initial incident control, collates and confirms information.
- Assess people, priority and business continuity implications.
- Assess need for lead executive and escalation to the introduction of a cross university business continuity team. If a business continuity team is not required implement university emergency procedures and take appropriate action.
- Alert lead executive of action to date.
- Ensure an event log is maintained.
Escalate incident to Silver command if:
- access to a substantial part of the site is lost for more than a few hours
- more than one department will be required to work together regarding the incident
- credible threat to the health of occupants
- serious injury or death
- media interest is shown
- possibility of damage to University reputation
- police involvement
Checklist:
- Service isolated
- Area evacuated
- Exposure contained
- Access controlled/curtailed
- Messages transmitted
- Event log maintained
- Incident checklist consulted
-
Action Card (Silver Action Card)
Silver Control Procedures
- Bronze commander escalates incident control to Silver commander - BCT.
- Assess people, priority and business continuity implications.
- Assess need for lead executive and escalation. Ensure Silver level team and where relevant Bronze team remain on site to maintain the security and direct emergency services.
- Alert Vice-Chancellor/Executive of incident.
- Nominate a member of the BCT to keep an event log.
- Consider reputation, costs, interruption time, recovery, compliance and insurance implications.
- Make contact with external bodies such as HSE, environment agency and local authority if appropriate.
- Escalate incident to Gold command as required.
- Continually assess and report possible implications of the incident.
Escalate incident to Gold command if:
- access to a substantial part of the site is lost for more than a few hours
- multiple serious injuries or deaths
- media interest is involved
- possibility of damage to university reputation
- police involvement
- additional resources need approval/are required
Checklist:
- Service isolated
- Area evacuated
- Exposure contained
- Access controlled/curtailed
- Messages transmitted
- Event log maintained
- Relevant third parties notified
- Incident checklist consulted
-
Action Card (Gold Action Card)
Gold Control Procedures
- Silver commander escalates incident control to Gold commander - VC/DVC.
- Assess capability of local team to handle incident.
- Activate teams as needed and convene the required members at a central/external location if necessary.
- Ensure Silver level staff remain on site to maintain site security and direct emergency services.
- Alert Board of Governors as required.
- Consider reputation, costs, interruption time, recovery, compliance and insurance implications.
- Identify/maximise opportunities or advantages from the incident.
- Make contact with external bodies such as HSE, environment agency and local authority if appropriate.
- Draft communications as required and liaise with the Media Communications Manager to approve all press releases as required.
- Implement major incident and business continuity plan.
- Invoke recovery plans as required.
- Provide/approve additional resources as required.
- Continually assess possible implications of the incident.
Checklist:
- Service isolated
- Area evacuated
- Exposure contained
- Access controlled/curtailed
- Messages transmitted
- Event log maintained
- Relevant third parties notified
- Recovery planned
Reporting an incident
-
BCM Battle Bags
The Business Continuity Management (BCM) Battle Bag is stored on each site and has been delegated to a key member of staff for secure storage, and for use when required.
The BCM Battle Bag is intended to provide safety related items which may be necessary during an emergency situation. Contents include items of personal protective equipment, first aid provision and copies of key documentation.
Battle bags are held at both Park and Front reception at SMR and at Paragon and Villiers receptions. They include:
- 1 100m cordon tapes (Hazard)
- 1 illuminated guide system, for marking safe routes and area of danger
- 1 battery powered work/search lights
- 1 white coverall (size large)
- 1 roll of yellow/black hazard tape
- 1 set of ear muffs
- 10 disposable gloves
- 5 paper masks
- 1 first aid kit
- 5 shoe covers
- 1 high visibility jacket (size large)
- 1 calculator
- 5 black pens
- 3 pencils
- 1 spare memory stick
- 1 notebook
- 1 clipboard (red)
- 1 spare plastic folder
- 1 loud horn
- 1 torch with 2 batteries and 2 extra batteries
- 1 pair of plastic goggles
- 1 yellow helmet
- 1 loud haler with 4 batteries and 4 extra batteries
- 1 colour plastic wallet containing hard copies of BCM data
- 1 colour memory stick containing BCM data
Section D - Emergency procedure documents
These procedures are not specific to any particular team and can be viewed by all staff.
However, there are further procedures that are specific to gold, silver and bronze teams and can be accessed through the Emergency Teams section.
- Procedures 1, 2 and 3 - Emergency procedures in case of fire
- Procedure 4 - Gas leaks: actions for staff
- Procedure 5 - Security evacuation (including bomb alerts)
- Procedure 6 - Exposure to harmful substances
- Procedure 7 - Responding to a death
- Procedure 8 - Infectious diseases
- Procedure 9 - Pandemic illness incident response plan
- Procedure 10 - Building Lockdown procedures
