Purpose:

This Business Continuity Policy forms part of the Risk Management Framework at ICMA.

The main objective in the adoption of Business Continuity Management best practices at ICMA (Australia) is to achieve its business continuity aim of safeguarding its reputation and public image in order to achieve the goals and objectives stated in its Strategic Plan (Sept 2017). This will occur by using best endeavours to meet the needs of staff, members, students, the wider community, and other critical stakeholders, through ensuring that business critical education, training and continuing professional development (CPD) outcomes are not compromised by a major disruptive event.

Definitions:

Business Continuity: Business continuity is “the uninterrupted availability of all key resources supporting essential business functions” (Australian National Audit Office, 2000).

Business Continuity Plans: A collection of procedures and information that is developed, compiled and maintained in readiness for use in the event of an emergency or disaster. (Associated terms: Business Recovery Plan, Disaster Recovery Plan, and Recovery Plan)

Business Continuity Management: Business Continuity Management provides for the availability of processes and resources in order to ensure the continued achievement of critical objectives.

Business Impact Analysis: Detailed risk analysis that examine the nature and extent of disruptions and the likelihood of the resulting consequences. May include consideration of the ICMA’s business functions, people, processes, infrastructure, resources, information, interdependencies and the nature and extent of capability loss over time.

A major disruptive event: May be Natural (e.g. flood, hurricane, earthquake), Accidental (e.g. fire, contamination), Commercial (e.g. loss of supply of critical services) or Wilful (e.g. sabotage, vandalism, arson, terrorism). Associated terms: “major crisis’, ‘disaster’.

Maximum Acceptable Outage (MAO): Maximum period of time that an organisation can tolerate the disruption of a critical business function. Disruption may include both the discontinuance of an activity, or the inability to perform it to an acceptable quality or with sufficient reliability. Associated terms “Maximum tolerable outage” or ‘maximum tolerable period of disruption”

Risk Assessment: The overall process of risk identification, risk analysis and risk evaluation.

Stakeholders: Those people and organisations that may affect, or be affected by, or perceive themselves to be affected by, a decision or activity

Policy:

ICMA (Australia) must;

1. Establish a Business Continuity Plan, or Plans, to ensure business continuity for the ICMA Council, ICMA Secretariat, and each ICMA Regional Office.

• • The Business Continuity Plan (or plans) must address both the general management aspects of the continuity process, member and student services, and those for IT and data/voice communications elements.
  • The Business Continuity Plan must include action plans for the reactivation of all essential ICMA services and must include provision for loss of supply of services by those external agents upon which the ICMA is critically dependa

2. Annually review the Risk Assessment including periodic maintenance of the Business Impact Analysis.
3. Periodically update the Business Continuity plan (or plans) to ensure currency of information, and response strategies. The plan must be reviewed for possible updating within 30 days of any major operational or system changes that will have a material effect on the contingency strategy of ICMA Secretariat and/or any Regional Office or external agent upon which the ICMA is critically dependant.
4. Undertake exercises for training and evaluation purposes of the Business Continuity Plan each year or within 30 days of any major operational or system changes that will have a material effect on the contingency strategy of ICMA Secretariat and/or any Regional Office or external agent upon which the ICMA is critically dependa

MANAGEMENT RESPONSIBILITIES

ICMA Managers must ensure that the key functions, for which they have responsibility, are able to continue following credible major disruptive events and that arrangements are in place to achieve this. This requires the proactive development, maintenance and devolution of business continuity planning within their areas. Managers are expected to encourage the active participation of staff in business continuity issues and must ensure that key personnel are able to perform competently during a major disruptive event.

 

ICMA Managers must;

 

1. Complete a periodic Risk Assessment or more detailed Business Impact Analysis if requeste
2. Manage risks in accordance with this policy
3. Ensure that the Business Continuity Plan in their area of influence and control is exercised on schedul

Audience:

All staff

Relevant Legislation:

None

Legal compliance:

None

Related documents and procedures:

AS/NZS 5050:2010; Business continuity – Managing disruption-related risk Standards Australia/Standards New Zealand

ISO31000; Risk Management Principles and Guidelines

Risk Management Policy

Section	Risk Management
Contact	COO
Last Review	March 2018
Next Review	March 2021
Approval	ICMA Council 07/04/18