This template has been created to assist in the creation of a Business Continuity Plan. Any areas
highlighted in yellow may not apply to your business or alternatively may need amending to fit in
with how your business operates.
Business Continuity Plan
Contents
Introduction ........................................................................................................................... 2
Objectives .............................................................................................................................. 2
Definitions ............................................................................................................................. 2
Responsibilities ....................................................................................................................... 3
Senior Managers ................................................................................................................. 3
All Staff .............................................................................................................................. 3
Occurrence Management Teams (OMT) ................................................................................ 3
Communications Strategy ........................................................................................................ 3
RAG Communications Strategy ............................................................................................. 3
Media Communications Strategy ........................................................................................... 3
Types of occurrence ............................................................................................................... 4
Reputational risk and media attention ...................................................................................... 5
RED/AMBER OCCURRENCE - KEY ACTIONS CHECKLIST ............................................................. 6
Managing an occurrence process ............................................................................................. 7
Log of Events ......................................................................................................................... 8
Testing and review ................................................................................................................. 9
1
Introduction
The purpose of this document is to outline plans for responding to disasters or unexpected events
(referred to in this plan as ‘occurrences’) so that we limit potential damage and maintain service
delivery. Planning and making decisions in a crisis situation is difficult; business continuity
measures should be developed prior to an incident occurring and all staff should be aware of
emergency procedures. Approaches to business continuity should not take the place of common
sense and all processes and procedures are secondary to ensuring the safety of staff, clients and
any other person.
Assessing the potential business impact of an occurrence or outage on a business unit/premises is
subjective in nature and some procedures and processes will be site- or contract-specific. The
Business Continuity Plan aims to reduce subjectivity by providing a consistent set of rules and
measurement criteria that is applied across the company. This plan should form the basis of
business continuity procedures, however it is acknowledged that some occurrences will fall outside
the scope of this plan and that responses to emergencies will vary according to the type of
occurrence.
An occurrence could relate to a wide range of events from physical building damage to injury or
death of a client. An occurrence could cause reputational risk and result in media attention; any
occurrence of this nature should be reported directly to Prospects.
Objectives
The objectives of the Business Continuity Plan are to:
 Identify and assess risks to the business
 Assess for and limit reputational risk and negative media attention
 Detail the agreed response
 Identify key contacts
 Ensure the safety of employees and any other persons on site
 Protect infrastructure and assets
 Minimise the impact on partners
 Learn from events.
Definitions
TERM
Occurrence
OMT
Outage
RAG rating
Green occurrence
Amber occurrence
Red occurrence
DESCRIPTION
Refers to any unwanted event which threatens personnel, buildings or the
operational structure of the company, requiring special measures to be
taken to restore normality. In this plan, occurrences are classified in terms
of their degree of severity
Occurrence Management Team – local team for occurrence management
Refers to service interruption
Refers to the Red, Amber, Green classification system for identifying the
severity of an occurrence
This describes a business interruption which affects the normal delivery of
services for an extended period or poses a reputational risk and invites
media attention
This is an event which has a significant impact on operations although
some service can be provided. There is the potential for injury and for
damage to property or assets, reputational risk and media attention
This is an event which causes services to be disabled. There is a high
probability of injury and/or of significant damage to property or loss of
assets. Media attention and reputational risk are likely
2
Responsibilities
Senior Managers
Business continuity management is the overall responsibility of the Senior Management Team.
They are responsible for communicating the plan to staff. It is the responsibility of individual line
managers to ensure an up to date communication matrix exists for staff within their remit.
All Staff
All staff are expected to be vigilant, raise the alarm if appropriate and immediately report any
emergency or significant occurrence to a manager, or deputy in the case of unavailability.
Occurrence Management Teams (OMT)
The Occurrence Management Team is the local team designated to manage an occurrence. The
team is site specific and reporting procedures are dependent on location and the nature of the
occurrence. The OMT will generally comprise senior management staff. Where the occurrence is
rated Amber or Red the most senior member of the management team should assume
responsibility. The most senior manager will assess and RAG rate the occurrence, which will
inform their local communication strategy.
Communications Strategy
RAG Communications Strategy
 Red occurrence (event causes services to be disabled)
Red rated occurrences should be reported to the most senior officer who will instruct and
make tactical and strategic decisions
 Amber occurrence (event could severely affect operations although some services may
be delivered) Amber rated occurrences can be dealt with by a senior manager at a local
level
 Green occurrence (event causes disruption to services for an extended period)
Green rated occurrences can be dealt with at local level.
Media Communications Strategy
Media communications should be dealt with by the most Senior Officer and notified to Prospects
Services or other Prime Contractor. If an occurrence which could be of interest to the media takes
place, the Occurrence Management Team will alert the most senior officer immediately.
3
Types of occurrence
The types of occurrence that could occur are wide-ranging and no two occurrences are likely to be
the same. Some of these occurrences could also lead to media attention and reputational damage
(also see reputational risk and media attention table on page 10). The table below outlines a nonexhaustive list.
SEVERITY OF OCCURRENCE
TYPE OF
OCCURRENCE
Green
Amber
Red
Natural
emergency
causing building
damage or
collapse
Severe weather
conditions
Minor structural damage
No evacuation or
relocation necessary
Minor structural
damage
Evacuation and some
relocation necessary
Major structural
damage
Evacuation or
relocation required
No building damage
Minor disruption to
business activities
Some staff absence
Fire
Minor damage
No loss of equipment
and information
Can continue to operate
Major structural
damage to building
Serious disruption to
business activities
Extensive staff absence
(over 50%)
Major damage
Critical loss of
equipment and
information
Relocation necessary
Flooding
Internal flooding or minor
difficulty getting to
buildings
Minor structural
damage to building
Some disruption to
business activities
Serious staff absence
(over 25%)
Some damage
Some loss of
equipment and
information
Can continue to
operate limited service
Difficulty in getting to
buildings
Power failure
Explosions
No power for short
period
UPS and/or generator
functioning
Small localised blast
Small fire
No damage or injuries
No power for limited
period
UPS and generator
provides limited power
Medium blast
Minor damage and/or
fire
Minor injuries
Some disruption to
activities. Some staff
absence (over 25%)
Medical epidemic
Limited staff absence
leading to minimal
deterioration of services
Terrorist attack
Minor damage to
facilities
Damage to facilities
Loss of
management
function
One key person
unavailable
Some key people
unavailable
Unable to get to
buildings
Potential damage to
equipment
No power
UPS exhausted and
generator down.
Systems down
Major explosion
Causes damage,
injuries and disruption
Serious outbreak of
disease or infection.
Extensive staff absence
(over 50%)
Major damage to
facilities
Key people unavailable
4
Reputational risk and media attention
The table below outlines a non-exhaustive list of incidents which may pose a reputational risk and invite media attention.
SEVERITY OF OCCURRENCE
TYPE OF
OCCURRENCE
Fraud
GREEN
RED
Injury or death of a
member of staff
Injury of a member of staff due to
Prospects’ negligence requiring first
aid treatment
Severe internal fraud- Evidence gathered
and decision on internal or external
investigation
Serious injury of a member of staff due to
Prospects’ negligence requiring medical
treatment
Injury or death of a
customer/client
A customer/client/visitor is injured,
requiring first aid treatment, whilst in
the care of Prospects or whilst visiting
Prospects properties or events
A customer/client/visitor is seriously
injured, requiring medical treatment,
whilst in the care of Prospects or whilst
visiting Prospects properties or events
A customer/client dies whilst in the care of
any Prospects contract or whilst visiting
any Prospects properties or events
Exploitation of minors
N/A An occurrence of this nature will
automatically be classified as a Red
occurrence
Grade 3 Ofsted inspection
N/A An occurrence of this nature will
automatically be classified as a Red
occurrence
Financial audit reveals systemic issue
Mental, sexual or physical abuse of a
vulnerable person in the care of Prospects
or any other customer/client or employee
Malpractice/misconduct/serious contract
non-compliance with media interest
Concerns raised during financial audit
by funder
Substantive underachievement, not
meeting minimum performance levels
outlined in contract
Contract performance
Data loss (paper,
electronic or verbal)
Supply chain
Minor internal fraud-Internal
investigation
AMBER
Contractual underachievement
Loss of commercial advantage putting
partnerships at risk through leaking of
commercially sensitive information
Contractual/SLA underachievement
Cyber-attack or security breach through
negligence or deliberate fault
Major internal fraud- Evidence gathered
and Police investigation
Death of a member of staff due to
Prospects’ negligence
Grade 4 Ofsted inspection
Loss of major contract
High profile data loss
Substantive contractual/SLA
underachievement
Malpractice/misconduct/serious
contract/SLA non-compliance
Severe financial difficulties
Major financial concerns e.g. Bankruptcy
or Fraud
RED/AMBER OCCURRENCE - KEY ACTIONS CHECKLIST (to be completed)
Timing
Action
Example
Immediate Ensure the safety of all personnel
(roll-call and move staff and visitors to a
safe place)
Date: ________________
Unit
Primary persons responsible
responsible
&/or deputy
Local
Senior
Manager
Pre populate as part of the BCP
Allocated
person to
action
Date/time
Local Senior Manager
Populate during an
occurrence
Managing an occurrence process
Log of Events
Time
DATE: _____________________________
Site: _________________________________
Action taken
By whom
The completed Log must be sent to <add appropriate person >.; a copy should be retained locally by the Contract Manager
Testing and review
The Business Continuity Plan is reviewed and tested annually.