A healthcare facility client determined it required a robust Business Continuity Plan to ensure it could continue critical functions in response to a disruptive event and recover to business-as-usual operations in a timely manner.
They already had a robust emergency response plan designed to keep patients and staff safe during a disruptive event. However, their Business Continuity Plan (BCP) was less mature. They wanted a gap analysis to understand where they needed to improve to achieve recognised good practice standards, in particular ISO 22301: 2012 and the Business Continuity Institute Good Practice Guidelines 2018.
This required a detailed review of current processes and procedures, including operational activities and current Business Impact Assessments (BIAs) to identify any gaps and deficiencies related to both crisis management and business continuity. Consideration was given to strategic planning, organisational capabilities, exercising and testing, training, and maintenance of the plan.
Key to assessment was understanding recovery time objectives (RTOs) for critical activities, as these determine the priorities, processes and resources required to protect, recover, and resume services in a reasonable time period.
The client’s incident and crisis management frameworks were evaluated regarding the range of foreseeable emergencies they may face. Responsibilities and capabilities were reviewed at strategic, operational, and tactical levels to ensure they were fit for purpose.
A detailed report was submitted. Existing plans were found to be well structures and comprehensive, but in need of some enhancement, so several recommendations were made, notably a focused exercise and testing schedule and early involvement of medical professionals in BIA and BCP development to ensure critical clinical requirements are prioritised.