Preparing Scotland: business resilience guidance

1. Introduction and Context

Resilience, as described and promoted in Preparing Scotland ^[1] , has many different but interconnected elements. In an organisational or business context, this manifests as the practical ability to avoid disruptions to normal activity, to keep the things that matter most going and, if disruptions occur, to get back to a desired state of operation quickly - not by good fortune, but by design.

Being resilient in this way is immediately appealing. Resilient Category 1 ^[2] responders will be more able to fulfil their duties when adverse circumstances mean we need them most. Businesses that are resilient will avoid costly losses, gain commercial advantage and be able to continue to provide the employment, goods and services we value. And voluntary organisations will be able to continue their work to support individuals, communities and other service providers, increasing the quality of many lives.

This guidance uses the term 'Business Resilience' to mean 'the capacity of an organisation to adapt in order to sustain an acceptable level of function, structure and identity.'

For most organisations, resilience of this sort will be a means to an end and not their main objective. When working to develop resilience in an organisation, it is therefore essential to keep its objectives and the interests of the people involved clearly in focus. In this way the preparations will be seen to be relevant and the response to disruptions or emergencies will be more effective. This is consistent with the Preparing Scotland approach to developing resilience based on the doctrine of Integrated Emergency Management ^[3] ( IEM) which includes the principles of integration, responsibility and continuity (see section 1.3). This approach to Business Resilience must therefore consider:

• the priorities, motivations and skills of individuals, teams and organisations
• relationships with external organisations and their resilience capabilities
• the formal processes and tangible resources that deliver goods or services
• the risks the organisation faces and potential emergencies that might arise

The term 'business' should be understood to include the activity of both commercial and non-commercial organisations or groups, whether small or large, and whether they are in the commercial, public or voluntary sectors.

1.1 The Civil Contingencies Act and Business Resilience

The Civil Contingencies Act and Regulations ^[4] place several duties on Category 1 responders, including:

• The ability of Category 1 organisations to continue to be able to perform their functions in the event of emergencies
• The provision, by local authorities, of advice and assistance to businesses and other organisations about the continuance of their activities

These are sometimes expressed as 'having and promoting business continuity'.

The legislation is also concerned with how these duties are carried out, with cooperation between partner agencies (both statutory and non-statutory) and how this relates to its other requirements - including risk assessment, maintaining plans, and emergency response and recovery.

The approach recommended in this guidance is to apply the principles of Integrated Emergency Management in the context of organisations and businesses. In this way Category 1 responders are advised to consider the requirements of the Civil Contingencies Act alongside their other responsibilities and objectives, so that the most effective, integrated ways of working can be found. Similarly, when working to develop resilience in other organisations, this approach will encourage businesses to develop resilience in a way that serves their strategic aims and utilises their existing strengths.

In this guidance the phrase 'having and promoting Business Resilience' is used to refer to these duties carried out in this way.

1.2 Overview of Business Resilience Guidance

This guidance provides strategic advice to Category 1 responders and information to other readers by considering:

• How Business Resilience relates to other resilience issues such as the resilience of communities and emergency response arrangements ( section 1.3)
• What should be understood by Business Resilience, business continuity, and related terms ( section 2)
• How these duties might best be fulfilled (sections 3 and 4)
• What the Civil Contingencies Act and Regulations require of Category 1 responders regarding their ability to continue to perform their functions and provision of advice and assistance to others about this ( Annex 1)

The broader context of resilience is set out in the Preparing Scotland 'core' guidance and is outlined below. This and particular links between Business Resilience and Community Resilience ^[5] are discussed further in section 3.

1.3 Business Resilience and other Resilience Activity

Scotland's resilience depends not only on the ability of organisations such as the police or ambulance service to deal with emergencies, it also requires other public sector organisations, private businesses, households and local communities to play their role. Because the different parts of our society are closely interconnected, more or less resilience in one part will affect the whole, and good practice in one area of life may inform behaviour in another. Because our society is diverse, the varied skills of different groups and individuals will all be needed for it to work at its best. While business continuity (or similar duties) are not legal requirements for all organisations, self-interest and good management make it advisable for all organisations to develop Business Resilience in ways that are appropriate to their circumstances.

Although untrained members of the public should not attempt to perform the functions of professional emergency staff, their efforts can complement those of Category 1 responders in many valuable ways. When developing the resilience of businesses or other organisations, often the people employed there will be the only ones with the specialist skills or knowledge needed to address problems. Also, when responding to an emergency, the priorities of the emergency services, such as saving life and helping the most vulnerable, may mean that issues that are important to an individual firm may be deferred. In many cases these issues will be outwith the remit of the emergency services and will be left to the owners and employees to resolve.

Similar relationships between statutory and non-statutory roles apply when considering community resilience, where the contributions of local people are crucial. Category 1 responders may also depend on the resilience of non-statutory and voluntary organisations because of their role in the supply chain or because work has been subcontracted to them.

Preparing Scotland: Scottish Guidance on Resilience recognises these different roles and describes the overarching structures and principles that guide resilience in Scotland. Work to develop and promote Business Resilience should be consistent with this advice and should be coordinated with related areas including ^[6] :

• Emergency Planning
• Surge Capacity Planning
• Planning for the Recovery Phase ^[7]
• Community Resilience ^[8]
• Risk Assessment (including links to community risk registers)
• Training and Exercising

In doing this, the active engagement of partner agencies will be particularly important. This includes work across regional and professional boundaries, work with voluntary and non-statutory agencies, with different parts of the commercial sector and its representative bodies, as well as the core multi-agency work within Resilience Partnerships.

1.4 Process and Cultural Aspects of Business Resilience

Business Resilience demands a sound understanding of the logistics, technologies and resources needed to deliver goods and services (see section 3), but as well as these 'process aspects' there are also essential 'cultural aspects' to both developing and promoting resilience. Recognising this can help organisations make fuller use of the skills and knowledge of their staff and enable them to develop a culture where Business Resilience is seen as a positive contribution to the aims of the organisation and its staff. These 'cultural aspects' include:

• identifying the groups and individuals who have an interest in developing resilience and engaging with them
• understanding their priorities, concerns and the influences upon them
• drawing on their expertise and knowledge, including informal systems and practices
• securing their commitment to, and ownership of, the process for building resilience
• supporting a learning culture in organisations and ensuring trust so that risks and 'near misses' can be discussed and lessons learned

In a similar way to Community Resilience, developing Business Resilience within an organisation or promoting it externally will involve making people aware of the issues, engaging their help, and providing support so they can contribute to plans and implement responses. Once engaged with this process, individuals and groups are likely to:

• be more motivated - to want to help themselves, their colleagues and their organisation
• provide specialist knowledge about their area of work, including information about risks, and suggest solutions based on this
• be more able to contribute their experience, recall previous disruptions and how they were dealt with
• be able to provide constructive criticism of proposals from different perspectives
• provide access to networks of people who can assist in other ways
• be more ready to recognise and report emerging problems, providing early warnings
• have a fuller understanding of their role and be more able to respond flexibly when faced with unexpected disruptions

This in turn may have wider resilience benefits as staff may apply the approach outside work, at home or in their local community, given the benefits it can deliver.