Business Continuity Plan Reference Terms:
Header of Template
Once the document has been approved by the Head, select the date approved.
Replace the test (Organisational Unit) with the name of your Organisation Unit, eg Faculty of …, School of…, etc.
Page 1 of Template
Business Process:
List the name of the risk, eg Loss of teaching laboratory, Single person dependency – research, Loss of samples.
Risk Rating: UTAS Risk Matrix http://www.utas.edu.au/__data/assets/pdf_file/0007/217789/UTAS-Risk-Matrix.pdf
Business Process Responsibility:
The person who has overall accountability for the business process. Generally this is the Head of Division, Head of Institute, Head of School, Principal etc.
Minimum # Staff or Infrastructure:
This is used to detail the minimum number of staff or infrastructure that is required to run the Business Process. This is not the number of staff or infrastructure required during a disaster but what is used for normal operations eg payroll normally runs with 15 staff but at a minimum during a pandemic or under industrial action, the business process can still continue with 6 staff. This is only for a short-term situation and not what would be expected for a longer outage.
Software Applications:
Detail any software that is required for this Business Process eg financial processing is reliant on TechnologyOne Financials at the University.
Recovery Location:
If there is one defined recovery location for the Business Process detail here. If the recovery location is dependent on the extent of loss, time of year or availability of resources then the detail of the loss will require far more information and simply type “refer to body of document” in this box and specify the particulars in the body of the document.
Processing Periods – Critical:
Many business processes occur only during set times eg teaching operations may only occur during semester, graduations twice a year in August and December.
Staff Contacts:
For every person listed in the document as either the Business Process Responsibility or Crisis Event Responsibility, contact details (phone and email) and an alternate contact person and details must be detailed.
Supplier Details:
Suppliers should only be listed where they are critical to the business process eg there is no need to list an electrician when various providers could be used, however is there is a single point of failure on a supplier for delivery of a business process, the contact details should be listed.
Page 2 of Template
Risk:
List the name of the business process in terms of the business loss eg Loss of teaching laboratory. This is then transferred to page 1 of the template under the business process heading.
Maximum Allowable Outage:
This is the period of time that an outage in a business process becomes a loss of business rather than a significant event that management effort can endure eg loss of a teaching laboratory may occur for 13 weeks before it constitutes a loss of business by being able to modify course content, relocate some classes, run laboratory classes in the field and block teach.
Category: Teaching/Research/People/Infrastructure/Systems
Remove any of the categories that do not apply. Several categories can be chosen for any business loss.
Short-term Risk/Normal Processing Periods:
This is the strategy that is taken as soon as an outage is identified. The outage will be less than the maximum allowable outage and therefore not constitute a loss of business. Generally the risk rating will be lower as the consequence will be less despite the likelihood being more common. The response strategy is very important to identify what needs to be done should the event continue past the maximum allowable outage.
Long-term Risk/Critical Processing Periods:
This is the strategy that will follow on from the short-term strategy. It may involve more long-term solutions such as rebuilding facilities.
Crisis Event Responsibility:
These are the staff members that deal with the actual crisis and recovery. These can be the people with the technical expertise to recover as well as the management accountability to make decisions and have financial delegations to act accordingly.
Communication Plan:
This is a brief strategy to ensure all interested parties are aware of the business loss and the correct reporting protocol is followed. Generally there will be additional interested parties included in the long-term risk, eg accreditation body, SMT etc.
Supporting Document:
If supporting documentation exists which either supports the recovery strategy (disaster recovery plan) or details the technical requirements of a loss (specifications for a particular piece of equipment) please reference here. This will reduce the need for double-up of information.