Appendix 3: Incident Management

Incident management defines how strategic issues will be managed and addressed by senior management during an emergency and/or business disruption event.

Once the initial emergency response has been performed, focus shifts to the management of the strategic impacts. This is called incident management.

For some events that are not physical, the first response may be incident management (for example IT failure, regulator notice, or fraud). Alternatively, it may be that the event being managed falls outside of the scope of business continuity and is not directly related to a business disruption (for example negative media exposure that has no business continuity implications). Because of this, the incident management team may be activated without any need for the emergency management plan or business continuity plan to be activated. However, emergency management and business continuity management require incident management.

By their nature, crises and incidents will vary and the incident management plan will include components and resources that are valuable in assisting the strategic decision making of management. To facilitate incident management, a plan identifies the resources necessary to undertake the strategic management of the incident that has occurred.

To facilitate the strategic decision making, incident management teams usually establish a command centre from which to direct operations. Typically, multiple command centres will be identified within a plan to address the situation where a primary site is unavailable.

It is likely that an incident management team will incorporate individuals that are skilled in:

• strategic thinking;
• internal and external communication;
• the operations of the entity;
• finance; and
• human resources.

Strategic decision making during an incident is key to a successful outcome and will include the decision to escalate from a strategic response into a full business continuity response.

Communications internally and externally and media responses are a key component of managing a strategic response, and need to be addressed by the incident management plan.

Other components of the plan may be developed to address such things as, liaison with the emergency response management team to understand the implications of the interruption and the progress in resolving the incident. In addition, liaison with business continuity teams to approve the activation of the business continuity plans, approving emergency expenditure, monitoring progress, addressing personnel issues, understanding and addressing the strategic implications of the incident on the entity are all likely to be required.

Further references

• British Standard, Business Continuity Management – Part 1: Code of practice, BS25999-1:2006, 2006, British Standards Institution. (see Section 8).
  
• Business Continuity Management (authorised deposit-taking institution), Prudential Standard APS 232, 2005, Australian Prudential Regulation Authority (see paragraph 30).
• Connecting Government: Whole of government responses to Australia’s priority challenges, 2004, Management Advisory Committee (see Ch 7 Managing crises and their consequences).
• NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs 2007 Edition, 2007, National Fire Protection Authority (see Section 5.9).
• The Business Continuity Institute Good Practice Guidelines, 2008, Business Continuity Institute (see Stage 3.1).