Self-assurance supporting outcome 12.4

A Business Continuity Plan is in place and has been tested within the last year.

Things to Think About

1. Has your organisation identified the key processes/business activities that it must be able to reinstate at short notice should some or all aspects of your business or its infrastructure not be available e.g. computer system failure?
2. Is there a business continuity plan, proportionate to the needs of your organisation, in place which the board has reviewed and approved? (For smaller / developing organisations this may be relatively simple but still covering the key processes/activities you must be able to recover quickly in order to continue to operate).
3. Has your organisation considered how it would operate its key processes/business activities if any of the following became unavailable as a result of unforeseen circumstances:
   • Premises (eg as a result of a flood, fire etc)
   • Communications (including communicating with key staff, members and other stakeholders)
   • IT systems (this would include disaster recovery planning and testing which sets out how you back-up and access electronic data and records, how quickly this is restored etc)
   • Data lists (including membership data)
   • Access to financial systems and information
   • Website
4. Has your organisation thought through how quickly (i.e. number of days) its key processes would need to be recovered?
5. Does your business continuity plan set out the key people responsible for communicating in an emergency situation?
6. Can all staff be readily contacted in the event of an emergency or disaster?

Useful links

• Five-step guide to business continuity
• ISO 3100 - risk management