Q1. What does "Business Continuity Management" mean in the MOD?
A1. Business Continuity Management (BCM) identifies what needs to be done before an incident occurs to protect people, premises, technology, information, supply chains, stakeholders and reputation. Good BCM enables any organisation to develop strategies and contingency plans to manage the consequences of disruption, mitigate the impact on critical activities or outputs, and recover business back to normal levels of operation as soon as possible afterwards. It is part of a range of good Corporate Governance and Risk Management, and is a necessary and important management process that helps keep an organisation's outputs going even in the most trying of times.
Q2. What is the MOD's approach to Business Continuity?
A2. It is vital for the maintenance of effective national defence forces and structures that critical business functions are identified and measures put in place to recover them within an acceptable timeframe should a disruptive event occur. We therefore take business continuity seriously – it is a core management function and a key strand of Corporate Governance. MOD's Business Continuity Management policy is set out in Joint Services Publication 503 (JSP 503).
Q3. Who is in charge of Business Continuity at the MOD?
A3. Business Continuity Management is part of the Department's wider policy on risk management, therefore ultimate responsibility for the effective application of Business Continuity (BC) principles lies with the Defence Board (DB).
Q4. How many people are involved with Business Continuity in the MOD?
A4. Because of the size of the MOD, it is not possible to say how many people are involved in some way with BC, but everyone in MOD has at least some responsibility for BC and everyone should, at least, have read the BC Plan covering their business unit. The Top Level Budgets and Defence Trading Funds each have a BC Focal Point to help them drive forward, influence and improve their BCM arrangements. At the lower level, business units or areas nominate someone to ensure their unit or area BC plans are up-to-date and exercised. These BC Planners also have a responsibility for ensuring that their BC plans are regularly shared with all the staff they cover to ensure that everyone is aware of their roles and responsibility in the event of a disruptive incident.
Q5. What is a Business Continuity Plan?
A5. A Business Continuity Plan sets out such things as the resources, structures, actions, tasks and data required to manage the business recovery process in the event of a disruptive incident, as well as the recovery priorities and timescales. The plan will also contain the information about who is responsible for invoking it, and the contact details for those who need to be informed or involved.
Q6. Who is responsible for writing/producing a Business Continuity Plan?
A6. Each Business Unit must construct a Business Continuity Plan, and Business Units sharing a site must work together at site level to develop a coherent Site Recovery Plan.
Q7. What happens after a Business Continuity Plan is invoked?
A7. The arrangements will be set out in the Plan, which will normally guide the response. At a suitable point after any invocation, a lessons identification process will normally be started to ensure learning from experience.
Q8. How often are Business Continuity Plans reviewed and updated in the MOD?
A8. Our policy is that Business Continuity plans should be reviewed and if necessary updated at least once a year. In addition to scheduled reviews, BC plans should be revisited whenever the owning organisation undergoes a significant change, such as the installation of a new I.T system, a physical move to a new building or a transfer in or out of one or more business units. BC plans should be exercised at least annually.
Q9. Do Business Continuity Plans get tested?
A9. Yes. Testing can take a number of forms such as Proof Reading or Desktop exercises, where key members of the recovery teams talk through certain scenarios, right through to simulation/live exercises, moving staff to work in a new location for example.
Q10. How much does the MOD spend on Business Continuity?
A10. The Ministry of Defence's budgetary system is divided among a number of cost centres (Top Level Budget Holders) and subordinate levels (Higher Level Budget Holders) and it is not possible to say how much is set aside for Business Continuity purposes.