Business Continuity & Resilience Policy

1. Purpose and intent

Supports preparedness for disruption and the timely recovery of critical activities. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to functions and resources identified as important to the continuity of relevant organisational activities.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Prioritisation: identify critical activities, dependencies and recovery requirements.
• Preparedness: define response roles, escalation routes and communication arrangements.
• Resilience: consider alternate resources, suppliers, locations and work methods where appropriate.
• Recovery: restore services in a controlled order based on impact and priority.
• Learning: test plans and incorporate lessons from exercises and real incidents.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Conduct business impact assessments for critical activities.
• Identify key people, systems, records, facilities, suppliers and dependencies.
• Maintain response and recovery procedures with named role responsibilities.
• Protect and test backups for critical information and systems.
• Establish internal and external communication protocols for material disruptions.
• Conduct exercises and update plans after material changes or incidents.

5. Roles and accountability

Management assigns continuity coordinators and process owners. IT, facilities, HR, procurement and operational teams maintain relevant recovery arrangements. All personnel should understand how to report disruption and follow instructions.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Exercises, recovery tests, incidents, action closure and changes to critical dependencies should be reviewed and recorded.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Risk Management; Information Security; Records Management; Emergency Preparedness; Supplier Management.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Critical activity analysis

Relevant activities should be assessed to identify critical services, dependencies, people, facilities, systems, suppliers, records and maximum tolerable disruption. Recovery priorities and target times should be documented proportionate to business impact.

Continuity strategies

Plans may include alternate work arrangements, backup systems, alternate suppliers, manual workarounds, data restoration, emergency staffing and relocation. Strategies should be realistic, resourced and consistent with legal and contractual obligations.

Incident command and communication

Plans should identify who may activate response arrangements, who coordinates recovery and how decisions are escalated. Internal and external communications should be timely, accurate, approved and sensitive to confidentiality and safety.

Technology recovery

Critical data and systems should have suitable backup, restoration and access arrangements. Backup integrity should be tested; recovery procedures should address dependencies, credentials, infrastructure and the risk of restoring compromised systems.

Exercises and validation

Continuity arrangements should be tested periodically through exercises proportionate to risk. Tests should include relevant participants and dependencies. Findings should be documented, assigned and tracked to closure.

Return to normal operations

Resumption should be controlled, with checks for safety, data integrity, service quality and outstanding risks. Lessons learned should be captured and plans updated after exercises or actual disruptions.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.