In the event of a disruption:
Activating and deploying the plan

Large entity: Australian Taxation Office – Burst water pipes in head office

Case study - Implementation of a Business Continuity Plan for a single site

The Australian Taxation Office (Tax Office) is the Government’s principal revenue collection agency, and its role is to manage and shape tax, excise and superannuation systems that fund services for Australians. Audit Report No.16 of 2007-08, Administration of Business Continuity Management in the Tax Office details the business continuity arrangements in the Tax Office.

Frequency of business continuity disruptions - The majority of business continuity events experienced by the Tax Office, as recorded on its Business Continuity Planning database, relate to facilities, specifically buildings. In the past few years, a range of natural disasters as well as power failures and flooding due to burst water pipes have rendered all or part of at least one Tax Office building unusable each year. However with some 70 office locations across Australia, the Tax Office has been able to transfer the operation of critical processes to other buildings or locations. This has created a multi-dimensional capacity to perform critical processes despite the loss of a site.

Flooding in National Office - In March 2008, flooding resulting in a major business disruption occurred at the Tax Office’s National Office, affecting two of the three buildings that had only recently been occupied in the Canberra Central Business District. The flooding was caused by a faulty seal in a fire hydrant and affected several floors, including the computer room.

Emergency response - A number of Tax officers reacted quickly and, in conjunction with emergency services, determined that the building was safe. The National BCM Director, who is based in Brisbane, was present in Canberra and coordinated the Tax Office response.

Crisis management - A number of crisis meetings were called and priority processes were allocated work space within the remaining National Office sites (including the recently redundant former National Office accommodation). Most staff were sent home and advised to call the 1800 emergency help line telephone number to be informed of updates.

Business continuity - It was quickly determined that the major issue was not accommodation as the Tax Office still had access to its old National Office building and other premises. The Tax Office estimated that within 24 hours general IT requirements could be met for most staff. A priority issue related to ICT and the inability of the Tax Office to immediately replicate a development environment for some of its strategic IT programs.

Source: Adapted from a case study in Audit Report No.16 of 2007-08, Administration of Business Continuity Management in the Tax Office.

 

Returning to normal operations

During the earlier stages of their business continuity program, entities need to think through and document reconstitution procedures just as carefully as business continuity procedures. This will help ensure that the continuity approaches selected are supportive of a relatively seamless return to normal. A solution that gives an easy recovery, but makes it difficult to return to normal operations is not an effective continuity approach.

The return to normal services is the point that the business disruption is officially declared ‘over’. At this point, entities will ‘stand down’ or deactivate their business continuity plan, and return to the business as usual management structure. It is important to document this decision.

Following the stand down of the business continuity plan and the return to normal operations, communications may be undertaken to bolster staff and stakeholder confidence.

 

Post incident review

It is important to record and evaluate the business disruption. This facilitates the review of the business continuity response after the entity has returned to normal operations. By analysing successes and failures, lessons to be learned can be drawn out and actions can be taken to prevent future failures and to replicate and repeat successes.

A post incident review can be conducted the same way as a post exercise review. See Post exercise review in the section of the Guide on Maintaining the program and plan: testing, exercising, updating and reviewing, for an example list of questions to be answered in the post incident review. Alternatively, a route cause analysis, or other structured and systematic evaluation methodology may be used to review an incident or exercise.

 

Continuity event reporting

The post incident review can be written up in a lessons learned report, with actions assigned to implement recommendations. This report needs to be provided to relevant parties, such as the business continuity committee.

Finally, do not forget to thank staff for their efforts during the business disruption!

 

The Workbook contains a checklist for suggested post incident review questions. Click Here

 

 >Contents

>Workbook

>Feedback

Back

Next