Building entity resilience

This section provides guidance for entities on how to implement preparatory and reactive procedures to minimise business disruptions and support recovery. This involves:

• implementing preparatory controls; and
• preparing the business continuity plan(s).

Implementing preparatory controls

Preparing for recovery involves putting in place controls that will mitigate the consequences of a business disruption to a level acceptable to the entity if it occurs. Preparatory controls may also be put in place to prepare the entity to take advantage of a business disruption event.

Some important preparatory controls include back-up processes, records management (see Undertake a Business Impact Analysis for discussion on vital records), formal contingency arrangements with external parties, and pre-establishing a specialised team to be used during a business disruption event.

Back-up processes
Activating a business continuity plan requires access to information and resources supporting critical business processes. In the event of a business disruption it may still be possible to obtain these from the entity’s premises, but this will not always be the case.

Reliable off-site storage and backup procedures will ensure information essential to continue critical business processes is available as, and when, needed.

Resources required for recovery such as documentation, forms, supplies, data and programs should be obtained and kept at a secure off-site facility. Copies of the business continuity plan and relevant documents can also be provided on secure portable storage (for example a secure USB key) which is able to be kept with individuals.

It is important that off-site storage facilities have suitable environmental and security controls and the resources and information are protected from unauthorised access, modification, disruption or use during storage.

Off-site storage procedures may be modified to align routine operational requirements with those identified in recovery strategies so that resources stored off-site, are available for routine and recovery situations.

Arrangements with external parties
It is necessary to formalise appropriate arrangements with vendor(s) selected as alternative suppliers. Entities need to:

• ensure for each treatment selected, the likely costs are the most commercially viable;
• identify other requirements or changes to be made in order for the treatments to be effective;
• change off-site storage procedures as identified;
• review contracts to ensure they demonstrate better practice for contract management as well as comply with the Commonwealth Procurement Guidelines; and
• finalise contracts.

Establishing business continuity (recovery) teams for a business disruption
Following a disruptive event, a specialised entity structure, which varies from the entity’s structure during periods of normal operations, is established. This structure is invoked upon declaration of a business disruption event that is expected to exceed the maximum tolerable period of disruption.

Depending on the size, complexity, and criticality of the entity, this structure may include one or more of the following:

• emergency response management team;
• incident management team; and
• business continuity (recovery) team.
  

A key consideration in the development of the specialised structure is the role of the entity’s executive during a business disruption. It is often the case that the executive wishes to take the ministerial and media communication/liaison role.

An example of the relationship between the teams during a business disruption event is provided in Figure 6.

Figure 6 - Example of the relationship between teams during a business disruption

In a large entity, each team might constitute a number of sub-teams, which focus on a specific area. In a small entity, there might be a single person performing the role for each area. The business continuity sub-teams may be geographically or individual building site based, or include a team for each of the areas addressed when designing the entity’s continuity approach. An example of business continuity (recovery) teams during a business disruption event is provided in Figure 7.

Figure 7 - Example of teams during a business disruption

For each team and subteam, a team leader is identified as being responsible for that area. Alternative people to fill each role should also be identified.

Entities use a variety of terms to name the business continuity teams and roles, including ‘Recovery Team’ or ‘Business Continuity Team’ and ‘Recovery Coordinator’ or ‘Business Continuity Coordinator’ or ‘Business Continuity Manager’. Regardless of the terminology, it is important to ensure reporting lines and responsibilities are clear when the specialised structure is activated. The entity should clearly understand and document the roles and responsibilities of the different teams and team members.

_{The Workbook contains a checklist for ensuring strategies are implemented.Click Here}

_{The Workbook contains examples of pre-prepared media communications.Click Here}