Meeting documents

To be provided by Andy Fyfe, Resilience Manager.

Andrew Fyfe attended the meeting to present the report.

·         Business Continuity Management (BCM) is a statutory requirement, a requirement of Financial Regulations and is best practice business management process for continuing to delivering critical activities in the event of an internal disruption.

·         The report aimed to highlight those areas of the Audit report that had not been declared as complete.

·         It was confirmed that the Audit report was a snapshot of the status of BCM arrangements across parts of the organisation prior to the end of the financial year. Ongoing monitoring was required.

·         The report on page 220 of the agenda pack, highlighted those areas with outstanding issues, was discussed in detail.

·         Following discussion it was agreed by the Committee that under the new assurance framework BCM had to be a key step to be continuously monitored.

·         The Internal Audit had highlighted Limited Assurance within the organisation in relation to BCM, significant questions remained regarding this.

·         Andrew Fyfe advised that an exercise within the organisation will be carried out on the 5 November, which would confirm where BCM plans were in place and those areas which still required attention.

·         The Committee agreed that BCM was a priority and that regular updates should be provided. 

·         Andrew Fyfe also suggested BCM plans should be monitored via DSP objectives for Service Managers.

·         Richard Ambrose confirmed that the One Council Board were aware of the BCM plans and those areas still to implement and had explored adding into DSP objectives. It was also advised that areas within the organisation are taking BCM seriously, however some areas due to the nature of the work, were harder to implement e.g. Social Care.

Member Questions

Question 1

·         A Member queried whether the unresolved issues were around Contract Management Application (CMA).

·         Richard Ambrose agreed that this had been part of the issue and advised that as progress was made with all new Alternative Delivery Vehicles, the CMA and subsequent BCM plans would become even more complicated. BCM is a key element and would continue to be monitored. Ian Dyson advised that a further report regarding CMA would be presented at the next meeting in November, providing an update on improvements to CMA.

Question 2

·         A Member queried how resources were being monitored, in relation to suppliers and partners. Was it possible resources were being focussed within non-critical areas?

·         Andrew Fyfe advised that within the BCM programme there was a staged process. OCB provided a list of criteria to the Resilience Team in relation to Critical Mission status. Within this list scope was given for all Service Directors to look through, to ensure area’s focus on Mission Critical BCM only. During an incident the process could be flexible and resource would be focused where necessary.

Member Comments

·         Ian Dyson suggested that the role of the Committee regarding BCM should be to support the improvement. A further report should be brought to a future meeting, with enhanced detail exploring those areas yet to implement BCM, and to provide explanation as to why this remained outstanding. In such cases it would be valuable to hear explanation from the Business Unit Director.

·         The Committee supported this suggestion and it was agreed that a further report would be brought to the Committee meeting on 20 January 2015.

ACTION: Andrew Fyfe

·         A Member queried whether the Resilience Team researched other Local Authorities, where internal disruption had occurred, to ensure best practice and highlight any areas for improvement within BCC Business Continuity?

·         Andrew Fyfe confirmed that this had been explored and he would be attending a conference in the near future regarding New International Standards for BCM and things that could be learnt from other Local Authorities e.g. South Oxfordshire District Council fire earlier this year.

RECOMMENDATIONS

The Regulatory and Audit Committee need to have an oversight role included in the BCM policy as part of the general assurance process and to drive BCM from a Member and Assurance perspective.

Business Continuity Management needs to be reported on to the Regulatory and Audit Committee Quarterly.

Service Directors have the requirement for BCM to be included on their DSP’s as a measure for a mandatory Assurance objective. This should cover their own service activities and also any contracted out service for which that Director is responsible. Service Directors would need to add similar measures to their direct reports.

Managing Director of Transport, Economy and Environment to be requested to provide and update regarding the state of BCM arrangements in that Business Unit.

DECISIONS:

A progress report to be presented to the Regulatory and Audit Committee in January with an expectation that actions have all been completed and business continuity risks are mitigated. Where gaps remain or actions are not complete, relevant Managing Directors to attend the meeting to explain the reasons why.  

The annual business continuity report to be presented to the Committee in April 2016. Thereafter the Committee will determine the frequency for any further reports.