Dublin City Council (DCC)’s context as the largest Local Authority in Ireland providing services to approximately one quarter of the population of Ireland means that developing and maintaining fit for purpose Business Continuity management arrangements (BCM) and Crisis Management capabilities is regarded as a key aspect of managing risk and ensuring the provision of adequate services during times of disruption.
DCC implemented a roll out of BCM in 2010 and significant progress was made in the development of Business Impact Analysis and some aspects of planning and governance. To inform further enhancements of its Business Continuity capability in 2016 DCC selected Risk and Resilience to undertake a review of the existing BCM System and a report, along with roadmap for enhancement, produced. Following this report Risk and Resilience were engaged by DCC on a 24 month programme to implement the desired analysis, planning and capability enhancements and mature the BCM System and Crisis Management Plans.
Risk and Resilience undertook the review as a combination of desk based research and on site at DCC main offices. We met with key staff who had previous involvement with the 2010 roll out of BCM, with staff who were key for any future implementation of BCM and with those who held recent experience of responding to disruptions and Major Emergencies. The review considered strategic direction of BCM, its link to risk management and the basis of continuity planning within DCC; The structures for BCM planning and response and how these relate to crisis, emergency, disaster recovery and other relevant response structures; Existing BCM plans, their integration and resourcing and the maintenance of a BCM capability through a well governed system of audit, continuous improvement, training and exercises. The maturity of arrangements were assessed for gaps (at a high level) and the review made observations as to the opportunities to fill these gaps and align with best practice (ISO 22301) in order to develop a genuine BCM capability linked to strategic goals, risk and ‘the art of the possible’. Risk and Resilience were then requested to support the design and rollout of an enhanced impact analysis process, specific to DCC context, across all five Departments, supporting Departments (Corporate Services, HR, IT, Finance and Law), and the Dublin Fire Brigade, commencing with a pilot project. We also drafted a Policy, that clarified governance structures, conducted familiarisation sessions with key personnel and provided analysis focused training and mentoring to teams as they progressed the analysis and planning process. We drafted Departmental Business Continuity Plans, providing training on their use and exercising teams as they rehearsed their operations in disruption. Finally, we were asked by DCC to act as an advisor to the resulting Crisis Management Working Group, constructing for their approval a new concept of operations for Crisis Management and drafting the resulting Crisis Management Plan.
With our support DCC have established a Business Continuity Policy and governance structures, established clear strategic direction for Business Continuity analysis and planning and built the tools necessary to carry out that analysis and planning. They have trained people and mentored teams as they assess their continuity requirements and build their solutions / plans. They have adopted several Departmental Business Continuity Plans, trained the teams to use those plans and undertaken table top and discussion exercises to embed awareness. Finally, they have developed a fit for purpose Crisis Management Plan, that integrates the various capabilities across Crisis Management, Business Continuity, Major Emergency Management and Crisis Communications.