Preparing Scotland: business resilience guidance

Executive Summary

Resilience, as described and promoted in Preparing Scotland ^[1] , has many different but interconnected elements. Although the ability to prepare for, respond to and recover from emergencies and disruptions is relevant to organisations and communities of all sizes and types, how this is realised will vary according to their particular circumstances. The resilience of one organisation or group will, in turn, have consequences for others, creating a complicated network of influence: increasing or decreasing risk, promoting or discouraging resilient behaviour.

This diversity is reflected in Preparing Scotland, which recognises the different roles of a wide range of agencies, organisations and individuals, and also the important contribution of community resilience. Preparing Scotland recommends the benefits of joint working and the value of considering the management of emergencies and disruptions from different perspectives. Within that broader context, this guidance focuses on how organisations can become more resilient. In particular, it provides advice to Category 1 responders and information to other readers about the duties set out in the Civil Contingencies Act (2004) and associated Regulations. This includes recommendations concerning:

• The ability of Category 1 organisations to continue to be able to perform their functions in the event of emergencies; and
• The provision, by local authorities, of advice and assistance to businesses and other organisations about the continuance of their activities.

These duties are often expressed as 'having business continuity arrangements' and 'promoting business continuity'.

The approach recommended in this guidance to fulfilling these duties is to apply the principles of Integrated Emergency Management, described in Preparing Scotland, in the context of organisations and businesses. This approach to building 'Business Resilience' considers both:

• the logistical aspects of how organisations work, what could go wrong and how to deal with this
• the cultural aspects of organisational behaviour, learning and attitudes to risk, within which resilience will be maintained

This does not imply any enlargement of the duties of the Civil Contingencies Act, but recognises that when fulfilling these duties (and others to which they may be subject) organisations will benefit from adopting methods which fully utilise the different sources of knowledge and expertise they already possess. These principles also address the diverse nature of emergencies and disruptions, which require flexible and scalable management, how resilience can be built before and after disruptive events, and the value of an organisational culture that fosters learning.

Much of this guidance will discuss issues that will be familiar to organisations that have business continuity arrangements that are aligned to British Standard BS25999 or ISO 22301. Alignment with these standards, in their most inclusive forms, will ensure substantial compliance with this guidance. Some differences in emphasis and scope will be noted regarding the cultural aspects of resilience, integration with related disciplines and the promotion of resilience.