Incident Management and Business Continuity Framework

Section A: Contacts in the event of an emergency

1. Who to call in the event to of an Emergency

In the event of an emergency such a fire, gas leak or other dangerous situation staff should call:

• 3333

This number is answered 24 hours a day.

In the event of a call, Security will assess the situation and:

• a) call the emergency services as necessary
• b) Alert the key contact for the Department concerned:
  • i. Director of Property Services in the event of a fire, gas leak or property related emergency or security related incident;
  • ii. Chief Information Officer for IT related incidents;
  • iii. Vice Chancellor’s Office during office hours where there is a major emergency.
  • iv. Out of working hours Security should call the nominated VCE member in the event of a major emergency as required.

2. Location of Incident management plans and Business Continuity Plans:

Copies of the Incident Management response plans are held at SMR Main Reception, The Park Reception SMR, Paragon Reception, Villiers House and Fountain House Reception.

Each Major Incident Management Group Member (see Page 10) has a copy.

Battle bags with emergency equipment are held in all receptions in Villiers House, SMR, Paragon and Fountain House. Battle bags contain:

• 1 x 100m Condon Tapes (Hazard)
• 1 x Illuminated guide system, for marking safe routes and areas of danger
• 1 x Battery powered work/search lights.
• 1 x White Coverall (Large Size)
• 1 x Roll of Yellow/Black Hazard Tape
• 1 x Set of Ear Muffs
• 10 x Disposable Gloves
• 5 x Paper Masks
• 1 x First Aid Kit
• 5 x Shoe Covers
• 1 x High Visibility Jacket (Large Size)
• 1 x Calculator
• 5 x Black Pens
• 3 x Pencils
• 1 x Spare Memory Stick
• 1 x Note Book
• 1 x Clipboard (Red)
• 1 x Spare Plastic Folder
• 1 x Loud Horn
• 1 x Torch with 2 Batteries + 2 extra Batteries
• 1 x Pair of Plastic goggles
• 1 x Yellow Helmet
• 1 x Loud Haler with 4 Batteries and 4 extra Batteries
• 1 x Colour plastic wallet containing hard copies of BCM Data
• 1 x Colour Memory Stick containing BCM Data

3. BCM website

The University has established a BCMS webpage https://www.uwl.ac.uk/about-us/business-and-continuity-management. The information it contains has been grouped into general (accessible to anyone viewing the webpages), specific (access restricted to University students and/or staff), and operational (access restricted to those University employees with BC responsibilities for managing major disruptive incidents and events through to recovery).

Section B: Introduction and background to Incident Management and Business Continuity

4. Introduction

Most emergencies, by their nature, are low probability events which cannot be predicted. The circumstances surrounding and causing a major emergency, the place and time it happens, and a multitude of other factors means that action cannot be predetermined. The key to resolution of any emergency is effective emergency planning and management.

Most incidents fall into three main categories: buildings and infrastructure; equipment and IT systems; and people. Typical causes include flood, power failure, fire, explosion, a threat of terrorist activity, major building or infrastructure failure, malicious activity, spread of infectious disease, death, etc. There may also be incidents which do not disrupt the business but which have major reputational implications that need to be managed through this Incident Management and Business Continuity Framework (IMBCF).

This University’s Incident Management and Business Continuity Framework provides for the planning for and management of an emergency. It provides a framework for dealing with and coordinating responses in the event of a disruption or an emergency. It establishes the roles and responsibilities for central planning for response, recovery and continuity activities, and for ensuring that response, recovery, and resumption plans are in place and tested. In addition to central (University-wide) planning, this framework also requires Schools and Professional Service Departments (PSDs) to have their own business continuity plans.

5. Objectives of the Incident Management and Business Continuity Framework

In the event of a major disruption or emergency, the University’s IMBCF provides the necessary framework, structure and processes for coordinating an early resumption to normality with the minimum of disruption to the University’s core activities.

The objectives of the IMBCF are to:

• identify the corporate business continuity planning structure and process
• embed the business continuity planning culture throughout the University, as part of effective risk management
• identify the critical business processes and assist Schools and Professional services departments in developing their business continuity plans
• develop and implement training and education in business continuity planning, reducing the level of risk from emergencies disrupting the University business operation
• develop the provision of important management information
• produce emergency response, business resumption and disaster recovery plans
• conduct a review and exercise programmes to regularly test the policy
• minimise the impact on the University’s business operations and services.

6. Emergency planning

Emergency Planning is about identifying risks and developing procedures that will mitigate the effects of an emergency, save lives and avoid injury. As part of an integrated response this leads to business continuity management which seeks to protect buildings and reputations and support the University in carrying on its business.

The emergency planning cycle involves a continuous process of assessing the risk of and preparing for emergencies supported by procedures to keep staff in readiness and validate plans. Plans should also be reviewed and, if necessary, revised when they have been activated in response to an emergency.
The better prepared the University is for dealing with emergencies, the more effective and efficient a response is likely to be. This is one of the key reasons why it is important for the University to engage in emergency planning activities.

Training and exercising is a key part of the planning process, encouraging effective evaluation, review and updating of plans as part of the cycle of continuous improvement, awareness and readiness to respond. This process can contribute significantly to the overall resilience of the plans and those tasked with responding to and managing the incident.

The cycle of emergency planning

Consult:

1. Gather information
   1. Set direction from risk assessment
   2. Set objectives
2. Construct
   1. Determine actions and responsibilities
   2. Agree and finalise

Embed:

1. Promulgate
   1. Issue and disseminate
   2. Train
2. Consolidate 
   1. Validate
   2. Review and Revise

7. Definitions

Emergency: An event or situation that threatens serious damage to staff and student welfare or to the HEI environment. To constitute an emergency this situation must require the implementation of special arrangements by the HEI.

Incident Management can be described as having an external focus which responds to community based events (in this case, the University is the community). Incident Management will involve a focus on an initial response, liaison with many agencies and responding to the requirements of this affected by the emergency.

Business Continuity is concerned with maintaining internal operations in an organisation even in the middle of an emergency. There will be some crossover, but the two work streams have very different priorities and are designed to deliver results. Examples of business continuity priorities include liaising with insurers and loss adjusters and maintaining/returning IT networks and other core services.

8. Priorities for business and continuity

In the event of a major emergency or incident, the aims of the University’s business continuity plans are to:

• Protect life
• Secure the critical infrastructure and facilities
• Protect the student experience
• Resume normal business operations
• Protect UWL’s reputation

9. Possible Consequences of emergencies

If the University’s response is not forthcoming in an efficient and effective manner the consequences of this could be:

• Failure of service offered to existing students.
• Legal action from students and their sponsors for shortcomings in service
• Damage to reputation and thereby recruitment of students
• Damage to public perception of the University
• Damage to the University’s reputation within the sector; Government and with the Office for Students and other key agencies
• Damage to reputation with partners
• Negative financial impact
• Impact on quality and continuity of provision
• Impact on business continuity and integrity
• Damage to strategic and operational direction at School level
• Damage to links with commercial partners
• Damage to the University Estate.
• Personal injury claims
• Failure of duty of care
• Adjoining property damage
• Service of Improvement and prohibition notices (HSE).

Section C: Command and Control

10. Responsibility in the event of an emergency

The Vice Chancellor has ultimate responsibility in the event of an emergency. In the absence of the Vice-Chancellor and Chief Executive, the Deputy Vice-Chancellor (DVC) will take responsibility.

In the absence of the Vice-Chancellor and Chief Executive and the DVC the following will assume responsibility:

1. Senior Pro Vice-Chancellor (Student Experience)
2. University Secretary
3. Pro Vice-Chancellor (Academic)
4. Associate PVC and Chief Information Officer
5. Chief Financial Officer
6. Director of Property Services

Designated officers will be responsible in the evenings and weekends. The numbers of these members of staff will be located with Security.

In the absence of all of the above the following will apply:

1. Director of Student Services
2. Nominated Head of School
3. Academic Registrar

The above must:

• Determine the facts (Information) – fact, not rumour / take time to determine the facts
• Assess implications (Implications) – it is essential to determine the full implications of disruption prior to taking any action i.e. what can’t we do now that we could have if the incident hadn’t arisen? It is worthwhile to note down the assets, resources, people and locations now not available
• Determine impacts over time of doing nothing (Impacts over time) and, for each activity affected by the disruption, define a recovery timeline.
• Agree coping strategies (Strategy) – these should already have been considered and documented for each critical activity but it is up to the response teams to ensure that sufficient resources are made available to those tasked with implementing them
• Implement strategies (Track implementation) by providing required resources & support to the response teams

11. Communication Chain

1. Key Contact contacts the various departments within the University as required e.g. security, Property Services, Student Services, IT Services etc.
2. Key Contact will also instruct Security/Reception staff to contact emergency services if or when they are needed.
3. Directors and/or Heads of Professional services departments/Deans of Colleges and/or Heads of School will contact and notify appropriate University Managers/Directors.
4. Where Bouygues (for facilities management) and Elior (for catering) are required, the Director of Property Services or Nominee will contact them according to the requirements and severity of the incident. Property Services will maintain their contact details.

12. Strategic and Operational Control

Emergency Planning and Business Continuity will be defined by Gold; Silver or Bronze teams in accordance with the severity of the incident.

Gold = Major Incident Management Team

• Vice-Chancellor’s Executive and key staff to deal with a major incident that affects multiple operations

Silver = Emergency Response Team

• Deans of College and/or Heads of School, Directors and/or Heads of Professional services departments, Safety Manager responsible for dealing with a cross-University incident which involves one or more departments but which can be dealt with without reference to the Major Incident Team. Silver teams may also be required to deal with a business continuity issue, reporting to the Gold team.

Bronze = Departmental Operational Teams

• Departmental Operational team(s) dealing with incidents that affect only one department.

13. Responsibilities of each level of command

The responsibilities of each level of command are set out in the table below.

Major Incident Management Group:

• Vice Chancellor/Deputy Vice Chancellor (in the Chair)
• VCE members
• Heads of any relevant/affected Schools and/or Professional services departments
• Head of Communication and Marketing
• Head of Legal Services
• Health and Safety Manager
• Chief Exec of SU (as appropriate)
• General Manager, Bouygues (as appropriate)

Responsibilities:

• Set up of Incident Control Centre
• Establishing Priorities
• Allocation of resources
• Management of Emergency Response Teams
• Reputation management and communications plan
• Liaison with appropriate authorities
• Financial control
• Legal issues

Emergency Response Teams:

• Security
• Health and Safety
• Data/Academic Registry
• IT
• Marketing and Communications
• Student Services
• Others teams and staff members as designated by Chair of IMG
• Other staff members as appropriate

Responsibilities:

Incident response:

• Evacuation of Campus/Buildings
• Cordon off unsafe/unsecure areas
• Health and safety of staff, students & responders
• Escalation to IMG
• Deal with serious injuries or death
• Establishing and running helpline
• Contacting next of kin

Resumption:

• Transporting staff to alternative locations
• Determining and obtaining new locations
• Setting up areas with IT and telecommunications systems

Department Business Continuity Teams

Each School/College and Professional Service Department will have its own Business Continuity Plan with a specified Business Continuity Team.

Responsibilities:

• Respond to direction from Major Incident Management Group and Emergency Response Teams
• Manage the prioritised recovery of activities through referral to own Business Continuity Plan
• Manage workarounds and contingencies, taking account of situation and resource available

14. Alternates and Deputies

Heads of Schools/Deans of Colleges and Directors/Heads of PSDs will identify alternates or deputies for all roles and posts in their BCP.

15. Incident Management

University-wide incident management is the sole responsibility of the Major Incident Management Group who will also require Head of Schools/Deans of Colleges and Heads of PSDs to locally manage their areas according to their Business Continuity Plans where appropriate.

The repercussions arising from a major incident may be much longer term than the incident itself; such issues may include the impact upon the University from unhelpful media and press, negative effects upon the student experience arising from site closure(s) and unbudgeted expenditure issues.

In such a case it will be necessary to form specific operational groups to manage the longer- term issues arising from a major incident. The remit of such a working group will be determined and managed by the IMG.

16. Escalation of incidents

When an incident occurs, it may arise at departmental/school level initially. Where a University wide response is required, this will be escalated to silver level to the Cross University Operational Team. This team will escalate to the Gold level and the Incident Management Group (IMG) will be convened according to the diagram below and the actions cards in Appendix 1.

Strategic, tactical and operational options

Bronze - Initial school/department local response 

• Head of school/department

Silver - Emergency response teams

• Lead Executive/Emergency Response Team responsible for calling on individuals as necessary

Gold - Incident Management

• Incident Management Plan invoked through the Incident Management Group

Bronze command

Relevant Department/School:

1. On receipt of incident information, investigate and assess the implication for the affected people and premises and put local measures into effect
2. Agree best course of action to take, consulting with other members of the team as necessary.
3. Decide whether to apply the escalation process to SILVER
4. Advise whether external media is likely to be involved.

Silver command

Executive Lead and relevant Management Teams and personnel as appropriate = Business Continuity Team:

1. Liaise with team handling the incident at Bronze Level.
2. Call a Cross University Emergency Response Team together.
3. If the incident is expected to result in a partial, temporary or sustained building closure, serious injuries or death, contact the Vice-Chancellor/Executive Team

Gold command

Vice-Chancellor/Executive – Major Incident Management Group:

1. On receipt of emergency briefing from the Business Continuity Team take decision on activation of the University’s Incident Management and Business Continuity Plan.
2. Determine priorities and prioritise demands.
3. Liaise with the Media Communications Manager, approve all press releases and if necessary handle the media.
4. If necessary provide / authorise additional resources
5. Report as appropriate to the Vice Chancellor and Board of Governors
6. Identify and maximise opportunities or advantages arising from the crisis.

17. Contact Lists

Contact lists, including home and mobile telephone numbers and alternate email addresses, are kept on a SharePoint page accessible by only the IMG. This list is to be treated as confidential and must only be used for emergency response procedures. Members of the IMG, and School or PSDs should hold a version of relevant plans and contact lists in their office and securely at home.

It is the responsibility of the recipient to ensure that all plans and contact details are kept confidential and secure. Out of date plans and contact lists should be shredded and disposed of securely.

The contact list should cover alternates to cover leave and sickness. It is each school/PSDs’ responsibility to ensure that these are updated regularly.

18. Categories of incidents

The BCMS process tries to identify potential major disruptive threats to the University’s normal operations. Effective BCMS enables the University to develop the strategic and tactical capability to plan for and respond to interruptions to the normal running of the business.

Major disruptive events can be broken down into five key areas. These are:

• Lack of people
  • Pandemics (eg. Influenza, Covid-19), disease
  • Adverse weather
  • Other local major incident preventing people from reaching UWL
• Buildings and infrastructure
  • No access or impaired to rooms, corridors or buildings
  • Failure of utilities (eg. due to fire, explosion, flood)
  • Prohibition notices
• Processes and technology
  • IT or equipment failure
  • Cyber security events
  • Loss of or inability to access data
  • Loss of communications tools, such as email, telephony and Internet connectivity
  • Equipment and services required to teach
• Financial
  • Financial irregularities, poor third stream income, fines, etc
• Reputational
  • UKVI, PREVENT, serious adverse Press, other major reputational issue

Whatever the major disruptive event, it is likely to be caused or affected by one or more of these five key areas identified above.

Appendix 2 sets out some categories of incidents and how to assess their severity.

19. Action Cards

At the early stages of any major destructive incident, when there is most confusion and time is at a premium, Action Cards present the best method of focussing on priority issues.

Action Cards provide essential information and instructions need to perform a specific role, task or function. They are not intended to be exhaustive, as there may be other duties required which are not listed.

Action cards are set out in Appendix 1.

20. Emergency Related Procedures

Procedures exist to deal with specific types of emergency related incidents. Such procedures assist the IMG in providing effective guidance for responding to a major incident. This enhances the University’s preparedness for dealing with a major incident, improves resilience, and supports an effective recovery from such disruptions.

Specific guidance for the following is outlined in Section D:

• Fire & Evacuation (procedures1,2,3)
• Gas leaks (procedure 4)
• Evacuation (procedure 5)
• Exposure to Harmful Substances (procedure 6)
• Death of student or staff member (procedure 7)
• Infectious Diseases (procedure 8)
• Pandemic Illness (procedure 9)
• Lockdown procedure (procedure 10)
• Further information is available on the University’s BCM webpage under Emergency Procedures.

21. Helplines

University helplines will be established where there is a need to:

• Receive information relating to the University’s services
• Convey information to students, parents, staff, public, etc.
• Provide support to students, parents and staff and, where necessary, advice on counselling services.

The need for a helpline must be assessed on each occasion by the IMG and any Emergency Service that is directly involved in a major disruptive event.

Having established the need, sufficient time must be allocated to organise, to brief operators, and to arrange administrative and backup procedures before the helpline goes live and is advertised.

If any of the Emergency Services are in attendance, they will take responsibility for all briefings during the response stage. They will update the information and administrative procedures; beyond this, logging basic details will be the University’s responsibility.

Helplines do not remove the obligation for prompt and proactive outward communication using all appropriate media.

There are two options for running helplines: either run internally, or outsourced.
Helplines will not:

• Be set up as a routine response to any emergency
• Take over the role of Police contact lines or Casualty Bureau
• Be advertised on a blanket coverage basis, but will be made available through local media to those most closely affected.

Once active, the decision to close the helpline will depend on the number of incoming calls and the nature of the incident/outbreak. A formal debriefing session for all personnel involved will take place. A helpline report should be prepared for incorporation in any investigation report.

22. Critical Services Calendar

During a 12 month period the University will experience times when the inability to carry out certain activities could have a significant impact upon the short, medium or long term viability of the business. Alternatively, there may be periods throughout the annual calendar when the same circumstances would have less of an impact. The Key activities, together with the priorities for recovery, are set out in Appendix 3.

In the event of an incident each School and PSD must consult their own Business Continuity Plan regarding critical timescales.

23. School/College and Professional Service Department Business Continuity Plans

The process of recovering from an emergency usually starts during the emergency itself. The roles of those tasked with recovery will vary depending on the nature of the emergency but could include identifying new or temporary accommodation, initiating staff working from home, amending the teaching or exam timetables, recruiting additional staff, and instigating School/PSD Business Continuity plans. The interrelationship between the recovery phases is set out in Appendix 4.

All Heads of School/Deans of Colleges and Heads of PSDs must have their own local Business Continuity Plan. These will assist the IMG with the Response, Resumption and Recovery arrangements. These plans are to be held on the BCM website. Each School/PSD Business Continuity Plan will list the requirements and the business critical activities, including those activities dependent on other service areas (such as IT Services or facilities). In determining these each School / PSD must have completed a Business Impact Analysis of their area, as there is no simple ‘one size fits all’ plan or solution. However, templates can be used for drafting School and PSD BCPs, and an example can be found on the BCMS website.

24. Professional Service Department Responsibilities

24.1 Communications and Media

Large scale events are also likely to attract attention from the Media, the scale and extent of interest dependent on a number of factors. Media coordination is the responsibility of the Deputy Vice-Chancellor and the Head of Marketing and Communications and must be covered in the department’s Incident Communications Response Plan. Additionally, the Deputy Vice-Chancellor will, if required, identify a suitable UWL spokesperson.

The Deputy Vice-Chancellor is responsible for maintaining the Incident Communications Response Plan which will include how UWL will maintain effective communications with staff, students and other stakeholders during an emergency.

This will include updating the UWL website, sending group email messages and maintaining social media updates as necessary. Robust methods of communication are vital to ensure that everyone is properly informed and will help to avoid confusion and duplication of effort. During the response to an emergency all communications from UWL, or from Schools and PSDs, are to be approved by the IMG before dissemination.

Staff must not speak to the press about any incident unless authorised to do so by IMG.
Schools and PSDs should have their own arrangements for communicating to staff and students aside from the University-wide communication plan.

In the event of extended closure, the Chair of IMG should assess the position and ensure that appropriate communications are issued by Marketing and Communications and the Schools/PSDs concerned.

24.2 IT Services

IT Services is responsible for the provision and maintenance of data, telecommunication systems and networks, and for ensuring a robust and suitable response to data or telecoms failures. They are required to have in place a full IT recovery plan.

Schools/Colleges and PSDs need to plan for the loss of IT systems, data and telecommunications within their own Business Continuity Plans.

24.3 Property Services

The Property Services Department is responsible for the acquisition, management and disposal of all property, major and minor capital projects, security matters, health and safety; environmental and sustainability and to ensure the estate is fit for purpose and legally compliant at all times.

Appendix 5 sets out the severity ratings for Property Services related incidents.

The Property Services department is responsible for arranging and maintaining the provision and supply of water, gas, electricity, oil or other utilities for all University owned buildings. They are responsible for making emergency arrangements with alternative suppliers if necessary. A full list of suppliers and contact details are held by the Property Services Department.

24.4 Space Planning and Accommodation

The Director of Property Services is responsible for identifying and sourcing off site alternative accommodation for teaching and office space, if required following an emergency. Strategies such as remote working, online teaching, office relocation, sharing of offices and/or hot-desking will be considered. Any office or desk that is not being used at the time of an incident may be utilised.

Allocation of space under these circumstances will be based on the need to maintain critical services and arranged in conjunction with the APVC & Director of Strategic Planning and the Timetabling Manager.

In the event of more significant long-term losses, alternative accommodation may need to be acquired on a semi-permanent/permanent basis where online teaching and remote working are not feasible. To enable this, a number of corporate decisions will need to be made by the IMG and include:

• potential location
• type of accommodation required and the facilities on offer in the market at the time
• lease terms on offer (including rent)
• possibility for fast track fit out
• sharing of offices and other facilities.

24.5 Student Services

The Director of Student Services is responsible for arranging the provision of critical student services during and following an emergency. A skeleton service will be provided in the affected location with enhanced telephone services as appropriate to supplement online provision

24.6 Student records and assessment

In the event of no access to the Student Records system, Data Operations have a copy of the data off-site to be able to provide student data.

The timetabling team will work with property services to identify teaching space. Where necessary, timetabled space will be rationed to ensure that all students can remain in contact with their studies, supplemented by online provision.

Contingency plans are in place for key events such as graduation, examinations and award boards.
Business Continuity tasks in relation to examinations may involve shifting the time, or location, of particular examinations and communications with students will be required or the provision of alternative assessments. Where the latter is involved, confirmation will be required from the External Examiner and this process will be managed by the Academic Registrar.

During teaching time, priority will be given to maintaining the presence of the Timetabling Team on campus to ensure good liaison with staff and the ability to react to situations.

Where necessary, the Emergency Regulations will be invoked.

24.7 Human Resources

Staff data will be provided by HR where required. In the event that HR are affected by the incident, a skeleton service will be provided at an appropriate location or staff will work remotely as appropriate.

24.8 Finance

During an emergency, there may be a requirement to organise equipment and resources which have not been budgeted for. Where a purchase relating to emergency management exceeds £5000, approval must be sought from the appropriate VCE member. All financial expenditure must be recorded under a separate budget code (to be arranged by the Chief Financial Officer) and in accordance with the University Financial Regulations. All expenditure relating to the emergency should be reported to the University’s insurers.

The Chief Financial Officer is responsible for managing emergency expenditure, liaison with the University insurers, and ensuring continuation of critical financial services following an emergency.

25. Recovery of teaching and assessments

25.1 Recovery of teaching

Following an incident where teaching is disrupted, a key priority is to ensure that teaching is recovered as soon as possible. Action to be taken by the departments and schools/colleges involved will be decided by the Major Incident Management Group and the parameters are as follows:

• on the first day, students will be advised to go home if they are have classes in the affected building(s) and asked to look at the website for further information at the end of the day;
• teaching in unaffected sites/buildings should continue. Where IT is not available, staff should undertake other activities with students;
• where restricted access to building(s) is likely to continue, property services and timetabling will identify rooms that will be allocated on a priority basis. At the beginning of the semester, Level 3 and level 4 students will be given priority. Nearer to assessment, Level 6 should be given priority;
• if the situation is likely to be prolonged, consideration should be given to doubling up classes, providing fewer hours per week and supplementing with online provision for the duration of the recovery period;
• where teaching is likely to be disrupted for more than one week, heads of schools/colleges should invoke business recovery plans to obtain access to specialist space and facilities elsewhere.

Where there is a major incident or national emergency such as a pandemic lockdown, the University Gold Command Group may consider that it is necessary to cancel teaching for a period to allow staff to prepare. This would entail actions including stopping teaching for up to a week and possibly closing the University according to the situation.

To ensure that teaching recovery, the Senior Pro-Vice Chancellor (Student Experience) will convene a silver command group comprising all Heads of Schools/College or their nominee with other staff appropriate to the situation.

Once building access and teaching has been fully restored, consideration should be given to putting on additional sessions for students where time was lost to ensure that learning outcomes can be met.
Plans should be communicated to students and information provided as soon as it is available to ensure that they are aware of the efforts being made to provide their course.

25.2 Assessment considerations

Where an incident has disrupted assessments, consideration should be given to ensuring that students are not disadvantaged.

Where the incident occurs immediately prior to a major assignment deadline, the deadline should be extended for an appropriate period. Students who submitted early should also be allowed to re-submit to ensure no students are advantaged over others.

Where examinations are disrupted, consideration should be given to providing the examination paper or parts thereof as an in class test where rooms are available or for students to complete in their own time. An alternative assessment could also be set. PSRB requirements will need to be taken into account in any action.

In all actions on assessment, Level 6 students should be prioritised to ensure that their graduation is not delayed. For example if only some examinations are to be cancelled, those for Level 6 should be given priority.

Students should not be required to request extensions or mitigation in these circumstances. Any actions should be approved in accordance with the Academic Regulations. Where necessary the Emergency Regulations should be invoked.

26. Space for Incident Management Group and Business recovery teams

In the event of a major incident which affects SMR, the Incident Management Group will convene in Paragon 11th Floor Suite or remotely whichever is the more appropriate.

Space will be made available for academic business continuity teams to operate if their part of the building is affected if required. For example, if Paragon were to be off limits, space would be made available in SMR for the Business School, CNMH and SHSS. This space would be to enable teams of academic staff to plan for teaching recovery and other business continuity tasks.

For all professional services, space will be made available for skeletal business recovery teams (as defined in business continuity plans) in an appropriate building or to operate remotely as considered appropriate by the Incident Management Group. All other staff may be asked to work remotely until instructed otherwise, at least in the first instance.

27. Training

In addition to scenario testing, training is provided for members of staff who have nominated roles on IMG. This, together with specific information and instruction, supports these group members in managing a major event.

Staff awareness training on the BCF will be provided and regularly refreshed. Specific role training such as emergency controller/incident controller, chairs and deputies of IMG, will cover issues such as managing the incident, security, health and safety, communications and handling the media.

Quick reference/instruction guidance for those responding to incidents will be provided in the form of Action Cards.

The table below sets out the training requirements:

Incident management group/Heads of Schools and Services:

• Training Required - Incident management training
• Frequency - Biennial

Incident management group/Heads of Schools and Services:

• Training Required - Health and safety training
• Frequency - Every 3 years

VCE members:

• Training Required - Communications and Media training
• Frequency - As required

Heads of Schools and Services

• Training Required - Business Continuity training
• Frequency - Biennial

Members of Communications Team, Property Services, IT services, Registry

• Training Required - Business Continuity Briefings
• Frequency - Biennial

28. Review

28.1 Post-incident Reviews

The University Secretary shall ensure that a formal post-incident review is undertaken within one month of invocation of any part of the Business Continuity Plan. The review should include as a minimum:

• Lessons learned in responding to the incident
• Effectiveness of business continuity strategies and plans and how they could be improved
• Agreed timeline for implementation of any improvements and changes.

28.2 Maintenance & Test Schedule

At least one business continuity exercise should be carried out each year with the scope and objectives agreed in advance. To minimise business disruption, this is likely to be a straightforward tabletop exercise with the Incident Management Team and relevant business area representatives asked to respond to an initial and unfolding scenario. Ideally such an exercise should also include the deputies to cover post-incident response roles and responsibilities as a means of increasing their awareness.

The outcome of the exercises and any actions arising, learning points etc. should be documented and someone assigned to ensuring that agreed actions are subsequently taken. The exercise documentation should be retained for audit purposes.