Business continuity: strategic guidance for NHS health boards

Section 5: Testing, Exercising and Review

Graphic text below:

Operational planning & control

• Business impact analysis & risk assessment
• Business Continuity Strategy
• Establish & implement BC procedures
• Exercising & Testing

5.1 As part of the Business Continuity cycle, all BCM plans need to be tested and exercised. BCM arrangements cannot be considered reliable until they have been tested, exercised and proven to be workable for all parties. Due to the critical nature of the services provided by Health Boards it may not be possible to test all elements of your BC plans however every endeavour should be made to test the most crucial elements. In developing a test/exercise scenario, you should keep it simple, but realistic in order to fully test each element. The Civil Contingencies Act 2004 requires that BCM strategies and plans for both Category 1, including SAS and Health Boards, are regularly exercised. As set out in the NHS Scotland Organisational Resilience Standards, NHS Health Boards shall:

• carry out an ‘all-risks’ risk assessment at least annually to identify hazards, threats and vulnerabilities which may affect its resilience and ability to deliver its functions (standard 6),
• have up-to-date, effective Business Continuity (BC)/contingency plans for all prioritised services and functions (standard 8),
• have a training and exercising plan in place to test its state of preparedness and to inform its response capability (standard 12).

5.2 Organisations should review their BCM system and process at appropriate intervals to ensure continued suitability, adequacy, and effectiveness. This can be done via either an internal or external audit of BCM competence and capability to identify actual and potential shortcomings. The organisation should establish, implement and maintain procedures for dealing with such reviews.

5.3 A BCM self-assessment process also plays a role in ensuring that an organisation has robust, effective and fit-for-purpose BCM competence and capability. It can provide the qualitative verification of an organisation’s ability to recover from disruption to normal service(s) and/or a major incident. Self-assessment is regarded as good practice and should be conducted against the organisation’s objectives.

Scottish Government Health and Social Care Directorates:

Health Emergency, Preparedness, Resilience and Response Division