With the spread of Coronavirus the threat of imminent disruption looms over schools and academies and it is vital to have a business continuity plan in place. As well as my experience in the field of data protection, this is another field I have been involved in for many years, having prepared the example BCP's for Birmingham schools when I worked for the City Council.
What is a business continuity plan?
A BCP outlines the processes and procedures that a school or academy must follow in the event of a disruption. The plan must identify relevant risks that could cause issues, be they epidemics, cyber attacks, internal vulnerabilities, weather events or technological problems.
Each identified risk should be accompanied with a set of temporary measures or quick fixes that ensure the most important business operations remain functional.
Why is a business continuity plan important?
The most obvious reason to implement a BCP is to ensure that your school or academy remains as productive as possible in the event of a disruption. Pupils and parents will stlll need to use your services, employees must be able to continue doing their job and you can’t allow yourself to face a huge backlog of work as delays continue.
Benefits of a business continuity plan
Creating a BCP will make it easier for your school or academy to cope in a crisis and minimise the disruption for you, your staff and your pupils and parents. Additionally, you should also consider the BCP’s ability to protect your school or academy’s reputation by demonstrating a fast and efficient response to disruption.
Who should have a business continuity plan?
All organisations, no matter their size, should create a BCP. Consider it a small investment that will save you a fortune when you suffer a data breach – and it is a matter of when, rather than if. Obviously things like Coronavirus are far less common but they still need to be planned for!
Key features of an effective business continuity plan
1. Purpose and scope - your first task is to define the purpose and scope of the plan.
2. Responsibilities - the next step is to decide which employee(s) will be responsible for enacting the plan. You might opt to put one person in charge of the plan or delegate responsibility to people across your school or academy. Small organisations might be able to get away with a single leader, as there’s a good chance that a senior member of staff will have oversight of every department and its needs. However, if that’s not the case, a group of employees will need to share responsibility.
3. Plan invocation - this step defines when and how the plan will take effect as it’s not always clear that a serious (and possibly planned-for) disruption has occurred. It’s only when someone takes charge that you can determine what caused the problem and how to respond.
4. Developing the BCP - this is the meat of your plan, containing the actions you will take to recover from various incidents. It will be the result of two other processes – the risk assessment and the business impact assessment – in which you identify the threats you face and the way your school or academy will be affected by them. Once you’ve collected this information, you should take each business disruption and outline the steps that must be taken to protect individuals (staff, pupils, parents, etc) during the business disruption and actions that should be taken to contain the disruption and prevent further loss, disturbance or unavailability of prioritised activities.
5. Communications - this stage focuses on internal and external communications. Internal communication refers to the way you will keep employees, pupils and parents informed about the state of play, something that’s particularly important if your usual modes of communication are disabled due to the disruption. External communication refers to the way you will deal with the media regarding the incident. In extreme cases, you might also be obliged to give interviews, in which case you should decide who will represent your organisation and what your strategy will be.
6. Stakeholders - you will be required to contact stakeholders as soon as possible following a disruption, so your BCP should contain their contact details for easy reference.
7. Document owner, approver and change history - the business continuity manager is the owner of the BCP and is responsible for ensuring that the procedure is reviewed and tested regularly.
8. Change management - once the plan is finalised, it should be published in hard copy and as a digital file, and be made accessible to all members of staff. Every time changes are made to the BCP, you must ensure that the digital and hard-copy forms are updated.
The importance of testing your business continuity plan
The only way to be sure that your plan works is by testing (or ‘validating’) it. How often you test the plan is up to you, but at least an annual test is sensible. If you're planning with Coronavirus in mind you may not get chance to test before the plan is activated but at least you will be more prepared than if you had no plan at all!
Who can help?
There are plenty of companies who can assist and a lot of free resources available on the internet but, when it comes to experience of producing school BCP's, I am probably your best bet. I am able to provide a template which can be populated with your own school or academy's data and advise on how to make the plan effective. Feel free to ring or email me for costs.
Steve Cullen
Tel: 07984 838038