Resilience Planning and Business Continuity Update
North Lanarkshire Council · 9 November 2022
Back to Environment and Climate Change Committee — 9 November 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Environment and Climate Change Committee ☒approval ☐noting Ref AMcP/AM Date 09/11/22 RESILIENCE PLANNING & BUSINESS CONTINUITY UPDATE From Head of Regulatory Services and Waste Solutions E-mail mcphersona@northlan.gov.uk Telephone 07939 280467 Executive Summary The report provides an update on the Council’s arrangements relevant to Resilience Planning and Business Continuity and the proposed changes within the structure of the service. Recommendations It is recommended that CMT: 1. Support the ongoing improvements to the Council’s business continuity and resilience planning arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1 The Civil Contingencies Act 2004 and the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 define local authorities as Category 1 Responders and as such we are required to fulfil the statutory obligations in respect of contingency planning and business continuity. 1.2 Previous reports to CMT have highlighted that standard Business Continuity Guidance is now available on the Council’s intranet (http://connect/index.aspx?articleid=20534 ) and a copy of this has been circulated to all Heads of Service for implementation. The provision of this guidance has: • Allowed a more consistent approach towards business continuity planning (BCP) across all Council Services; • Ensured that all Plans are regularly reviewed, updated and tested; • Ensured that failure of critical IT infrastructure/ systems are part of BCP; and • Ensured that periodic assurance is provided by all Senior Managers that appropriate and robust BCP is in place to cover all service areas. 1.3 The delivery of effective continuity arrangements and the Council’s overall emergency response throughout the recent pandemic have highlighted the effectiveness of the previous arrangements, but the lessons learned from this event and the recommendations from a recent internal audit have allowed improvements within the approach to be identified. 2. Report 2.1 The overall resilience and business continuity arrangements were extensively tested throughout the Council’s response to the ongoing pandemic. 2.2 In summary the maintenance of all critical services throughout the period of the pandemic has demonstrated the robustness and depth of the resilience and business continuity arrangements now in place. 2.3 Although the overall response of the Council during the pandemic allowed the continuation of all critical services, this in no way suggests that the response was perfect, and that all business continuity and emergency resilience procedures were without fault. A fundamental principle of any resilience response is the ‘Review’ phase. The purpose of this is not to assign blame but to highlight weaknesses in the overall response to an incident, identify their cause and introduce changes which will prevent a recurrence in any future response. This review has been undertaken at a local level and a national COVID-19 Inquiry has also been established for which the Council will stand up a short-term working group to address all requests for data etc. 2.4 To compliment the ongoing review process, the Council’s Internal Audit team also undertook a review of the current corporate resilience arrangements and issued a report with their findings on the 20 July. Although the report concluded that there existed a ‘reasonable assurance’ that effective business continuity and resilience planning measures were in place, several improvement actions were also identified and agreed: • Changes were suggested to the framework in place for documenting individual Services’ business continuity and disaster recovery arrangements to enhance the quality and completeness of the corresponding plans. • Corporate and individual services’ business continuity and disaster recovery arrangements would benefit from a robust, formalised review process.
Page 3
• Formal testing of business continuity and/or disaster recovery arrangements needs to be undertaken consistently across the Council in line with corporate expectations. • Management should ensure that the role and responsibilities of Business Continuity Champions are reviewed and documented to provide greater clarity of corporate expectations of what such individuals are expected to do in relation to business continuity. 2.5 An action plan has now been agreed which will deliver on all the recommendations detailed above and includes a review of the existing guidance document to provide further clarity to services which should lead to improvements in the overall quality and robustness of all individual business continuity plans. In addition, random audits of individual services’ continuity plans will also be undertaken by the Resilience Development team. 2.6 In line with the current guidance document, there is a requirement on all Heads of Service to complete an annual assurance return. The purpose of this is to demonstrate that each Service area has reviewed their business continuity plans to take account of any change in circumstance to their business activity and provide examples of which business areas have had their BCP’s subject to testing. These assurance returns were due to be completed by 17 September 2022 and all returns have now been received by the Council’s Resilience Development Team from each Head of Service. 2.7 Also included within the business continuity guidance document is a summary of the Council’s ongoing preparation to develop specific arrangements relevant to Power Resilience and how the Council will respond to a ‘black start’ event – the complete loss of power across the national grid. National guidance relevant to this has only recently been released and the draft Power Resilience Strategy is now at an advanced stage and the intention will be to bring a final draft of this to committee in the new year. 2.8 The recent pandemic has now clearly evidenced the importance of effective business continuity and resilience planning arrangements and has placed an even greater focus on the work of the Resilience Development Team; and whilst implementation of the recommendations from the recent internal audit process will enhance the overall approach to business continuity across the Council, this will place additional asks on this team. The irony of the Resilience Development team is that it is one of the least resilient services operating within the Council with a full-time staffing compliment of 1.5FTE. In recognition of the additional tasks now being expected of this team and the increasing role and profile of the service, the compliment of the service has now been increased to two FTE to provide the capacity which will be necessary to deliver on the ongoing improvements required within this area and provide the necessary support to the individual services. 3. Measures of success 3.1 Effective Resilience and Business Continuity Planning to ensure the delivery of critical services in the event of a major incident.
Page 4
Andrew McPherson Head of Regulatory Services and Waste Solutions
Page 5
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality-and-fairer- scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Financial Solutions? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People and Organisational Development? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☐ No ☒ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic Solutions? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒
Page 6
If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for technology, has an assessment been carried out (or scheduled) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? Having effective resilience and business continuity arrangements in place across the organisation will reduce the risk associated within a number of service areas.