View Current

Business Continuity Policy and Procedure

This is the current version of this document. To view historic versions, click the link in the document's navigation bar.

Section 1 - Preamble

(1) This Policy is effective from 24 June 2024.

Top of Page

Section 2 - Purpose

(2) Disruption to business operations can occur at any moment. This Policy sets out guiding principles and requirements to assist the University to respond to and recover from business interruptions and return the University to business as usual operations.

(3) It is the purpose of this Policy to support Deakin staff to embed business continuity and resilience practices into business as usual operations and process.

Top of Page

Section 3 - Scope

(4) This Policy applies to all staff and associates and locations across the University.

(5) This Policy supports the University to plan for and respond to an interruption to business operations and to ensure identified critical services and functions can be maintained at pre-defined minimum levels. It does not apply to:

  1. responding to or managing critical incidents, emergency situations and response which is governed by the Critical Incident Management policy
    1. at the discretion of Critical Incident Management Team (CIMT), the policy may be activated to support the business continuity response to a critical incident
  2. responding to or managing Information and Communications Technology (ICT) disaster recovery incidents, which is the responsibility of Digital Services and/or the CIMT:
    1. at the discretion of the CIMT, the policy may be activated to support the business continuity response to an ICT disaster recovery incident.
Top of Page

Section 4 - Policy

(6) This Policy aligns with the ISO 22301 Business Continuity Management and Good Practice Guidelines (2018 Edition).

(7) This Policy supports business continuity and organisational resilience and assists the University to identify, prepare and implement effective and efficient responses to business interruptions and to continuously develop, test, refine and increase business continuity and resilience preparedness and awareness across the organisation.

(8) Priorities for business continuity and resilience planning and recovery are not the same as business as usual operations where teams act to meet operational and strategic goals. Rather, the goal for business continuity and resilience is to avoid or limit major to extreme impacts that can jeopardise the University’s long-term viability.  

(9) The University is committed to:

  1.  building and improving organisational resilience to business interruption events to ensure it can:
    1. maintain identified critical services at pre-defined minimum levels during business interruptions; and
    2. resume operations efficiently and effectively and limit or reduce adverse impacts of business interruptions
  2. ensuring an effective business continuity program is supported by the University Executive and senior leaders; and
  3. supporting a culture aimed at building and embedding organisational resilience through the continuous improvement of preparedness and response capabilities.

(10) The University will build its resilience to business interruption events by:

  1. establishing and maintaining a Business Continuity Community of Practice (CoP) made up of senior leaders to provide guidance and advice on business continuity and resilience during a business interruption, and a Business Continuity Champion Network (BCCN) to act as subject matter experts within their relevant business units
  2. undertaking regular Business Impact Analysis and recovery activity to:
    1. identify critical services and functions, resources, systems, equipment, and staff
    2. identify and assess potential business interruptions, hazards, vulnerabilities, and impacts
    3. develop Recovery Plans identifying effective structures, protocols, actions, tasks, and activity; and
  3. undertaking a range of support activities including:
    1. regular testing and exercising
    2. ongoing education, training and awareness programs and activity for staff undertaking business continuity activities
    3. post incident review and debrief.
Top of Page

Section 5 - Procedure

Planning for a business interruption event

Business Impact Analysis and Recovery Plans

(11) Business Impact Analysis (BIA) identifies the level of impact of a business interruption, including when it may escalate to unacceptable levels, and informs development of corresponding Recovery Plans.

(12) BIA and Recovery Plans are generally developed to align with the Universities organisational structure but may also be service or function specific.

(13) BIA and Recovery Plans will include the following:

  1. general guidance for staff actioning the Recovery Plan and a description of the activity of the business unit
  2. identification of critical services, functions, and peak times relevant to the business unit
  3. assessment of the impact on the University in the event of a business interruption/loss of business unit
  4. resource requirements for the business unit (staff, devices, vehicles, equipment, software etc)
  5. a range of recovery actions aligned to loss of key assets (staff, infrastructure, facilities, technology, specialist equipment etc) designed to maintain critical functions at pre-defined minimum levels
  6. key contacts: those staff with critical or unique knowledge, skills or delegations required to maintain service delivery at pre-defined reduced levels.

Recovery Plan Owners

(14) Each Recovery Plan has an ‘owner’. Recovery Plan Owners are the senior officers of the relevant business unit (director, manager, or another senior officer), as outlined within the plan.

(15) Recovery Plan Owners are responsible for:

  1. ensuring the BIA process is undertaken or reviewed, and aligned with the Business Continuity Exercise Program
  2. ensuring Recovery Plans are developed, reviewed, and updated regularly, and exercised in line with established testing cycles in the Business Continuity Exercise Program
  3. accepting Business Continuity Champion responsibility as set out at clause 17, or nominating a suitable Champion from within the relevant business unit
  4. approving the final Recovery Plan, or where applicable, escalating to a senior leader
  5. implementing the Recovery Plan, or delegating implementation to a suitable staff member within their relevant business unit; and 
  6. advising the CIMT prior to or upon activation of the Recovery Plan.

Business Continuity Champion Network and Business Continuity Community of Practice

Business Continuity Champion Network

(16) Each business unit and corresponding Recovery Plan will have a Business Continuity Champion. The Business Continuity Champion will be the leader of the business unit or their nominee.

(17) The Business Continuity Champion will take on a subject matter expert role within the relevant business unit and is responsible for:

  1. acting as the first point of contact for business continuity queries within the business unit
  2. day-to-day and administrative updating of the Recovery Plan as required
  3. scheduling and undertaking:
    1. regular BIA and formal Recovery Plan review with relevant stakeholders
    2. testing and exercise programs
    3. awareness programs
  4. taking part in regular training, network meetings, and other activity as required
  5. supporting and advising their business unit’s senior leaders during live activations.

Business Continuity Community of Practice

(18) The Business Continuity Community of Practice (CoP) will provide support and advice to the CIMT and to the broader University during business interruption events. Some members may have additional responsibilities under the Critical Incident Management Policy.

(19) The CoP is responsible for:

  1. supporting CIMT activity and response as it relates to business continuity
  2. where required by the CIMT, acting as a conduit between impacted business units and the CIMT
  3. promoting and supporting business continuity initiatives across the University
  4. supporting administration of the business continuity and resilience response by:
    1. managing BIA assessments including dispute resolution
    2. considering unexpected consequences of adverse events
    3. considering opportunities for continuous improvement; and
  5. taking part in regular training, meetings and other activity as required.

Activating a Business Continuity Response

(20) The CIMT is the primary responsible authority to activate a business continuity and resilience response and is responsible for notifying impacted business units, the CoP, and other relevant stakeholders of critical incidents.

(21) Once aware of a critical incident, or the potential for a critical incident to develop, the CIMT will convene to manage and direct the organisational response, which may include activation of the business continuity and resilience response.

(22) In some circumstances, individual staff members or business units may be the first to become aware of a potential business interruption. In these instances:

  1. all concerns must be escalated to their leader and the CIMT as soon as possible. The CIMT will consider any broader ramifications with potential to impact the organisation
  2. every effort must be made to notify the CIMT prior to activation of individual Recovery Plans 
  3. where there are challenges in contacting the CIMT, Recovery Plan Owners have authority to activate their Recovery Plans however the CIMT must be advised as soon as possible after activation.

Joint activations 

(23) Some circumstances may require both a critical incident and business continuity response. During joint activations, the CIMT will maintain primary responsibility for ongoing monitoring and decision-making of the incident and is responsible for advising and updating stakeholders of critical incident response activity.

(24) As the University moves towards ‘normal’, ‘near normal’ or ‘a new normal’ level of operations, minor recovery processes may continue for a period of time and will be incorporated into individual business units’ business as usual operations.

Post-incident review

(25) A post-incident review will be conducted after live activations to identify challenges, opportunities and improvements, and will be arranged by Recovery Plan Owners and/or Business Continuity Champions.

Responsibilities

(26) In addition to the responsibilities outlined above:

  1. the University Executive will demonstrate a high level of commitment to business continuity and resilience by championing relevant activity and programs.
  2. senior leaders and Recovery Plan Owners have primary responsibility for ensuring their business units have implemented the requirements of this Policy
  3. while any staff member may be called upon during a business interruption, key stakeholders are those who have critical expertise or authority to effectively manage a business interruption and primarily refers to the CoP, CIMT, BCCN, Recovery Plan Owners and senior leaders.
  4. Internal Audit, Risk and Business Continuity is responsible for:
    1. establishing and implementing a business continuity framework including the Business Continuity Policy, associated supporting documents, training and awareness programs, and the Business Continuity Exercise Program
    2. establishing and supporting the BCCN and CoP
    3. providing advice and guidance to the University related to business continuity and resilience trends, activity, and initiatives.
Top of Page

Section 6 - Definitions

(27) For the purpose of this Policy:

  1. Associates: contractors, consultants, volunteers, visiting appointees and visitors to the University
  2. Business Continuity Champion Network (BCCN): identified staff within a business unit, taking on a subject matter expertise role and first point of contact for business continuity. 
  3. Business Continuity Community of Practice (CoP): a group of senior leaders (executive directors and directors) that will provide support and advice to the Critical Incident Management Team and the broader University during business interruption events.
  4. Business Continuity Exercise Program: an approved exercise and training program to assess currency and appropriateness of existing Recovery Plans.
  5. Business Continuity Management (BCM): capability of an organisation to continue delivery of critical services or functions at acceptable pre-defined levels following a business interruption.
  6. Business interruption: The inability of an organisation to maintain business as usual operations for a given period that threatens the ongoing wellbeing and viability of the organisation.
  7. Business Impact Analysis (BIA): A method of analysis to assess the quantitative (measured) qualitative (conceptual) loss that may accrue should the organisation experience a business interruption.
  8. Critical Activity/Services: Aligned to Deakin’s Risk Management Framework, critical services are those identified as having major or extreme impact across Deakin or areas of Deakin in the event that they are unable to be undertaken.
  9. Recovery Plan: Business unit specific documents that outline the key information required for managing a business interruption.
  10. Recover Plan Owners: are the senior officers of the relevant business unit (director, manager, or another senior officer) or as nominated by the leader of the relevant business unit.