Analysing the entity and its context

Executive Endorsement

Identify interdependent business processes
An interdependency is a reciprocal relationship. It involves a reliance, directly or indirectly, of one process, activity or resource upon another. An entity could be dependent on receiving a process or information from another entity or organisation as an input to one of its critical business processes. Conversely, external entities and organisations may be dependent on the output of the entity to deliver a critical business process.

When attempting to understand their critical business processes, entities need to define external interdependent processes. This means understanding key personnel, key failure points, contractual obligations, service level agreements and memorandums of understanding. Considerations include customers, suppliers, portfolio agencies, contractors and regulators.

Entities may use the determination of interdependencies as an opportunity to gather information such as addresses, contact phone numbers (business and after hours) and email addresses of key personnel in the external agency, to input into the business continuity plan. This contact information will need to be updated on a regular basis.

In larger entities, consideration should also be given to internal interdependent processes between business units.

Figure 5 depicts one way of thinking about and identifying interdependencies in an entity.

Figure 5 - Identifying interdependent business processes

What level of business continuity assurance should an entity seek for an external entity it is reliant on?

Case study – Interdependencies

The NSW Police Force is Australia’s largest policing organisation, with approximately 20 000 employees (including 15 000 sworn officers) and 500 police stations.

Developing a business continuity framework - In 2008 the NSW Police Force won an Australian Business Award for ‘Innovation’ for developing their business continuity framework. The framework adopts an innovative approach to business continuity planning, through a logical step-by-step sequence designed to identify and prioritise the entity’s operating activities, and develop solutions to six generic disruption scenarios. The framework is a consequence based approach, rather than being incident driven. Also, rather than focusing on the length of time for which the entity might operate without critical resources, the framework allows the entity to identify the critical operating activities, and focus their efforts on maintaining these activities, as distinct from routine or discretionary activities. The framework includes a simple 8 Step Guide to Business Continuity Plan Development and Maintenance, which was deployed to local police areas. Step one involved local areas identifying all of their business unit’s activities, and classifying them as ‘Critical’, ‘Routine’ or ‘Discretionary’. This step is similar to a traditional business impact analysis. The second step involved grouping critical, routine and discretionary activities, and identifying the partnership dependencies that exist for the activities.

Identifying interdependencies - Examples of interdependencies that were identified included major custody stations’ reliance on Corrective Services staff to handle prisoners, reliance on laboratories for processing crime scene DNA, and reliance on energy providers to power facilities.

Involving interdependent organisations in business continuity management - Local police commands and specialist business units were encouraged to involve representatives from partnership entities to be involved in the development of workarounds for their business continuity plan. For example, representatives from NSW Maritime Services, three ports corporations, volunteer marine rescue groups, the Australian Maritime Safety Authority and AusSAR were involved in the development of the Marine Area Command’s workarounds for its critical activities of Emergency Response, Port Security, Boat Safety and Search & Rescue, when its own capacity is rendered ineffective due to the unavailability of such essential operational elements as vessels/crew or suitable command facilities. This process included identifying suitably trained staff to supplement police crews, suitable vessels which can be ‘loaned’ or seconded to police duties, establishing appropriate responses by other organisations in lieu of police resources for port security, and establishing secondary Emergency Operations Centres and Search and Rescue Coordination Centres.

_{Source: ANAO analysis.}

>Contents

>Workbook

>Feedback