| Business continuity a central plank of the Pitt Review
In the foreward to the report Sir Michael summarises the key lessons which have been gleaned from the review process, stating: 1) We believe that there must be a step change in the quality of flood warnings. This can be achieved through closer cooperation between the Environment Agency and Met Office and improved modelling of all forms of flooding. The public and emergency responders must be able to rely on this information with greater certainty than last year. 2) We recommend a wider brief for the Environment Agency and ask councils to strengthen their technical capability in order to take the lead on local flood risk management. More can be done to protect communities through robust building and planning controls. 3) During the emergency itself, there were excellent examples of emergency services and other organisations working well together, saving lives and protecting property. However, this was not always the case; some decision making was hampered by insufficient preparation and a lack of information. Better planning and higher levels of protection for critical infrastructure are needed to avoid the loss of essential services such as water and power. There must be greater involvement of private sector companies in planning to keep people safe in the event of a dam or reservoir failure. Generally, we must be more open about risk. 4) We can learn from good experience abroad. People would benefit from better advice on how to protect their families and homes. We believe that levels of awareness should be raised through education and publicity programmes. We make recommendations on how people can stay healthy and on speeding up the whole process of recovery, giving people the earliest possible chance to get their lives back to normal. Of the 92 recommendations, two directly address business continuity and many others relate to it, particularly in the area of critical infrastructure protection. Recommendation 13 states that: Local authorities, in discharging their responsibilities under the Civil Contingencies Act 2004 to promote business continuity, should encourage the take-up of property flood resistance and resilience by businesses. In his discussion of this recommendation, Sir Michael elaborates as follows: - Businesses need to assess the risk of flooding and the potential impact on their trade. While the Review found that businesses were generally very proactive in recovering from the floods, they were less well prepared in terms of pre-flood resilience. - Take-up of flood-resilient or flood-resistant measures – even in floodhit areas – is low. Resilience measures should be included in all business continuity plans created by organisations in flood-risk areas. - The insurance industry should do more to increase the take-up of flood resilience measures by businesses, for example by reflecting risk mitigation measures in premiums. - Business continuity guidance should reflect the benefits of flood-resilient and flood resistant measures. Recommendation 54 states that: The Government should extend the duty to undertake business continuity planning to infrastructure operating Category 2 responders to a standard equivalent to BS 25999, and that accountability is ensured through an annual benchmarking exercise within each sector. The report provides more detail on the thinking behind this recommendation: - The Civil Contingencies Act 2004 (CCA) places very few direct legal obligations on Category 2 responders relating to business continuity management. Instead, it puts the emphasis on cooperation with Category 1 responders. - The CCA takes a principle-based approach, requiring Category 1 responders to maintain business continuity plans in order to ensure that they can continue to exercise their functions in the event of an emergency so far as is reasonably practicable. This duty relates to all their functions, not just their emergency functions. - The CCA does not mandate a framework: rather, it allows Category 1 responders to choose their own model for meeting the legal requirement. However, the statutory Guidance issued under the CCA does provide a common approach for Category 1 responders to follow. This Guidance is based on PAS 56, the forerunner of BS 25999. This means that, unlike Category 2 responders, Category 1 responders have a more systematic and consistent approach to business continuity management. - The driver for business continuity and wider organisational resilience should be the long-term interests of stakeholders and all those who depend on the organisation in some way. In the case of essential services delivered by critical infrastructure, these interdependencies are even more significant. Given the importance of this relationship, the Review believes the Government should act to increase the overall capacity of critical infrastructure operators to resist failure for as long as possible and recover quickly when faced with unexpected challenges. While we recognise that risk cannot be totally eliminated, the likelihood of an event threatening the business can be anticipated and the potential impact reduced. - The scale and complexity of critical infrastructure, coupled with the uncertain nature of natural hazards, means that effective cross-sector preparedness is a real challenge. Inconsistencies between required levels of preparedness for distinct sectors add to that complexity. Although there is a foundation of business continuity planning on which to build, coverage is patchy and approaches are inconsistent. - The events of summer 2007 serve as a reminder that this is an issue to be tackled. To shy away from it would leave society open to the possibility of a more serious loss of essential services – particularly as vulnerability to risk appears to be growing with time. As a society, we must deal with risks effectively. Ensuring that the essential services delivered by Category 2 responders are resilient to a consistent standard is a key aspect of this. The Review believes that this resilience is vital and that consistency of approach should be promoted by introducing business continuity planning on a statutory basis. - Each organisation needs to assess how to apply BS 25999 or equivalent to their own organisation ‘ensuring that their BCM competence and capability is appropriate to the nature, scale and complexity of their business, and that it reflects their individual culture and operating environment’. - However, we believe that the Government must ensure business continuity provisions are technically robust and deliverable. We would welcome Government utilising a light-touch, benchmarking approach, ensuring accountability for BCM by obliging regulators or sponsor sector departments to conduct sectorwide benchmarking exercises through which companies can assess whether their level of business continuity is average, or significantly above or below average. This approach will have the added benefit of allowing the Government to assess the level of resilience within each sector and would form part of the proposed Sector Resilience Plans. The output of the benchmarking exercise could be made public as part of the annual reporting process. This could act as a powerful incentive for companies, as a good reputation is often important for companies who would rather change their behaviour than lose their good reputation. Read the full report at http://www.cabinetoffice.gov.uk/thepittreview/final_report.aspx Associated news piece:
•Date: 26th June 2008• Region: UK •Type: Article •Topic: Emergency planning
|
