Councils provide a wide range of services to the community. Disruption to the continuity of these services can prevent a council from meeting these obligations. Business continuity management aims to minimise the adverse effects of impacts arising from these disruptions.
The audit found that business continuity plans examined at each council are unlikely to prove effective in the event of a significant disruption to council services. While events that can cause a major disruption are rare, should they occur, there is little assurance councils’ responses will be timely and effective.
There was a need to:
- strengthen risk management practices to better assure that all possible disruption risks were identified and that their impacts on important council functions were thoroughly assessed
- improve each council’s business continuity plan to assure greater clarity on the specific response actions, roles and responsibilities, including better integration with other council disaster recovery and emergency plans
- improve the governance framework at each council examined. None had adequate policies for business continuity management or provided sufficient guidance to staff on the procedures needed to soundly develop and test a business continuity plan.
Arrangements at each council for monitoring the performance of their business continuity activities were also inadequate. The lack of testing, limited training opportunities and absence of continuous improvement for business continuity at each council meant there was little assurance plans were up-to-date, that they would be effective if needed, or that staff were adequately prepared to deal with significant disruptions to critical business operations.