Business Continuity Policy

Prepared for the Unexpected

All Services 4U is committed to maintaining the continuity of our services to clients and residents, even in the face of disruption. We recognise that our clients depend on us for essential property maintenance and compliance services, and that interruption to these services could have serious consequences for resident safety and regulatory compliance. This Business Continuity Policy sets out our approach to preparing for, responding to, and recovering from disruptive events.

This policy applies to all employees, directors, officers, contractors, and anyone involved in the delivery of our services.

Our Commitment

We are committed to:

  1. Resilience — Building the capability to withstand and adapt to disruption
  2. Preparedness — Planning for potential disruptions before they occur
  3. Response — Responding quickly and effectively when incidents happen
  4. Recovery — Restoring normal operations as rapidly as possible
  5. Communication — Keeping stakeholders informed throughout any disruption
  6. Continuous Improvement — Learning from incidents and testing to improve our capabilities

Scope

This policy covers:

Business Continuity Objectives

Our business continuity objectives are:

Objective Target
Protect life and safety Priority in all situations
Maintain critical services Resume within defined recovery times
Protect company reputation Transparent and professional response
Meet contractual obligations Minimise client impact
Protect information and assets Prevent loss and damage
Comply with regulations Maintain regulatory compliance
Support employees Ensure welfare and communication
Recover fully Return to normal operations

Business Continuity Framework

Our business continuity framework is based on ISO 22301 principles.

Framework Components

Component Description
Policy This document — sets out our approach and commitment
Business Impact Analysis Identifies critical activities and recovery priorities
Risk Assessment Identifies threats and vulnerabilities
Business Continuity Plans Documented response and recovery procedures
Incident Management Processes for managing disruptive incidents
Testing and Exercising Regular testing of plans and capabilities
Training and Awareness Ensuring people know their roles
Review and Improvement Continuous improvement cycle

Critical Business Activities

We have identified our critical business activities and their recovery requirements.

Critical Activities

Activity Description Recovery Priority
Emergency repairs 24/7 emergency response for gas leaks, floods, security Critical — immediate
Gas safety services CP12 certification, gas repairs, CO response Critical — within 24 hours
Fire safety services Fire alarm response, emergency lighting, fire door repairs Critical — within 24 hours
Electrical safety Electrical faults, safety hazards Critical — within 24 hours
Water hygiene Legionella response, water system failures High — within 48 hours
Planned maintenance Scheduled PPM services Medium — within 1 week
Compliance management Certificate tracking, documentation Medium — within 1 week
Finance and payroll Payments to staff and suppliers High — within 48 hours
Client communication Updates, enquiries, reporting High — within 48 hours

Recovery Time Objectives (RTO)

Priority Recovery Time Objective
Critical Within 4 hours
High Within 24-48 hours
Medium Within 1 week
Low Within 2 weeks

Recovery Point Objectives (RPO)

Data Type Recovery Point Objective
Financial data Maximum 24 hours data loss
Compliance certificates Maximum 24 hours data loss
Job management system Maximum 4 hours data loss
Email and communications Maximum 24 hours data loss

Risk Assessment

We assess risks that could disrupt our operations.

Threat Categories

Category Examples
Natural events Severe weather, flooding, pandemic
Technological IT failure, cyber attack, power outage, telecoms failure
Human Staff illness, key person unavailability, industrial action
Physical Fire, building damage, denial of access
Supply chain Supplier failure, material shortages
External Civil unrest, terrorism, regulatory change

Risk Assessment Process

For each threat, we assess:

Key Risks and Mitigations

Risk Likelihood Impact Key Mitigations
IT system failure Medium High Cloud systems, backups, disaster recovery
Cyber attack Medium High Security controls, backups, incident response
Loss of premises Low High Remote working, alternative locations
Key staff unavailability Medium Medium Cross-training, succession planning
Pandemic/widespread illness Medium High Remote working, hygiene measures, PPE
Severe weather Medium Medium Flexible scheduling, route planning
Supplier failure Low Medium Multiple suppliers, stock holding
Vehicle fleet loss Low Medium Insurance, hire arrangements
Power/telecoms failure Low Medium Mobile devices, alternative connectivity

Business Continuity Plans

We maintain documented plans for responding to disruptions.

Plan Structure

Plan Scope
Incident Management Plan Overall coordination and escalation
IT Disaster Recovery Plan IT systems and data recovery
Premises Continuity Plan Loss of or denial of access to premises
Pandemic Response Plan Widespread illness affecting workforce
Severe Weather Plan Disruption from weather events
Supply Chain Continuity Plan Supplier or material failures
Communication Plan Stakeholder communication during incidents

Plan Contents

Each plan includes:

Plan Ownership

Plan Owner Deputy
Overall business continuity Managing Director Operations Director
IT Disaster Recovery IT Manager [Deputy]
Premises Continuity Facilities Manager [Deputy]
Operations Continuity Operations Director [Deputy]

Incident Management

We have clear procedures for managing disruptive incidents.

Incident Classification

Level Description Examples
Level 1 — Critical Major impact, business-wide disruption Total IT failure, premises destroyed, major cyber attack
Level 2 — Significant Significant impact, multiple functions affected Partial IT failure, key system unavailable, significant staff absence
Level 3 — Minor Limited impact, single function or location Single system failure, localised issue, minor supplier problem

Incident Management Team

For significant incidents, we activate an Incident Management Team (IMT):

Role Responsibilities
Incident Manager Overall coordination, decision-making
Operations Lead Service delivery continuity
IT Lead Technology response and recovery
Communications Lead Stakeholder communication
HR Lead Staff welfare and resources
Finance Lead Financial decisions and payments

Incident Response Process

Phase 1: Alert and Activation

  1. Incident reported and logged
  2. Initial assessment of severity
  3. Incident Manager notified
  4. Decision to activate business continuity plans
  5. Incident Management Team convened if required

Phase 2: Response

  1. Immediate actions to protect life and safety
  2. Containment actions to limit damage
  3. Assessment of impact and recovery needs
  4. Activation of relevant continuity plans
  5. Resource mobilisation
  6. Stakeholder communication initiated

Phase 3: Recovery

  1. Recovery actions implemented
  2. Workarounds and interim solutions
  3. Progressive restoration of services
  4. Ongoing communication with stakeholders
  5. Monitoring of recovery progress

Phase 4: Return to Normal

  1. Full restoration of services
  2. Stand-down of incident management
  3. Post-incident review
  4. Lessons learned documented
  5. Plans updated based on learning

IT Disaster Recovery

Our IT systems are critical to service delivery.

IT Recovery Strategy

Component Strategy
Cloud systems Hosted in resilient data centres with redundancy
Data backup Daily backups with offsite/cloud storage
Email Cloud-hosted (Microsoft 365) with built-in resilience
Job management Cloud-hosted with regular backups
Telephony Cloud-based phone system with mobile failover
Devices Laptops and mobile devices for flexible working

Backup Strategy

Data Frequency Retention Location
Critical business data Daily 30 days Cloud + offsite
Databases Daily 30 days Cloud + offsite
System configurations Weekly 90 days Cloud
Email Continuous 1 year Cloud

IT Recovery Procedures

System RTO RPO Recovery Method
Email 4 hours 0 (continuous) Cloud resilience
Job management 4 hours 4 hours Cloud restore
Finance system 24 hours 24 hours Cloud restore
File storage 24 hours 24 hours Cloud restore
Telephony 4 hours N/A Cloud + mobile failover

Cyber Incident Response

In the event of a cyber attack:

  1. Isolate affected systems
  2. Notify IT and Incident Manager
  3. Assess scope and impact
  4. Activate IT Disaster Recovery Plan
  5. Notify relevant authorities (ICO if data breach)
  6. Communicate with stakeholders
  7. Recover from clean backups
  8. Investigate root cause
  9. Implement additional controls

Premises Continuity

We plan for loss of or denial of access to our premises.

Premises Recovery Strategy

Scenario Response
Temporary denial of access Remote working, use of alternative locations
Partial damage Isolate affected areas, continue in unaffected areas
Total loss Remote working, temporary premises

Alternative Working Arrangements

Function Alternative Arrangement
Office staff Work from home (laptops, cloud systems, VPN)
Call handling Mobile phones, cloud telephony, outsourced overflow
Engineers Continue from home/vehicles, direct to sites
Management Work from home, alternative meeting locations
Stores/materials Alternative suppliers, direct delivery to sites

Alternative Premises

Type Arrangement
Emergency office space Serviced office provider on standby
Meeting facilities Hotels, serviced offices, client premises
Storage Alternative depot, supplier storage

Remote Working Capability

All office staff are equipped to work remotely:

Workforce Continuity

We plan for significant staff unavailability.

Workforce Risks

Risk Mitigation
Key person unavailability Cross-training, documented procedures, succession planning
Widespread illness Remote working, staggered shifts, hygiene measures
Industrial action Staff engagement, contingency resources
Skills shortage Agency arrangements, subcontractor relationships

Key Roles and Deputies

Key Role Deputy
Managing Director Operations Director
Operations Director Senior Operations Manager
Finance Director Finance Manager
IT Manager External IT support provider
Compliance Manager Senior Administrator

Cross-Training

External Resources

Resource Purpose
Agency engineers Supplement workforce if needed
Subcontractors Additional capacity for specific trades
Temporary staff Office and administrative support
External IT support Technical support and recovery

Supply Chain Continuity

We manage supply chain risks.

Critical Suppliers

We have identified suppliers critical to our operations:

Category Examples Criticality
Materials Plumbing, electrical, building materials High
Vehicle fleet Lease company, fuel High
IT services Hosting, software, support High
Subcontractors Specialist trades Medium
Utilities Electricity, gas, water, telecoms Medium
Professional services Accountants, legal Low

Supply Chain Mitigations

Risk Mitigation
Single supplier dependency Multiple approved suppliers for critical items
Supplier failure Financial checks, alternative suppliers identified
Material shortages Stock holding of critical items, early warning monitoring
Price volatility Framework agreements, price monitoring
Delivery delays Safety stock, alternative suppliers, direct delivery

Supplier Relationships

Communication

Effective communication is essential during disruptions.

Communication Principles

Stakeholder Communication

Stakeholder Communication Method Responsibility
Employees Email, phone, text, team briefings HR Lead
Clients Phone, email, account managers Operations Lead / Account Managers
Residents Via clients, direct contact where appropriate Operations Lead
Suppliers Phone, email Procurement / Operations
Regulators Phone, email, formal notification Compliance Manager
Media Press statements (if required) Managing Director
Insurers Phone, written notification Finance Lead

Communication Templates

We maintain templates for:

Contact Information

We maintain up-to-date contact lists:

Out-of-Hours Communication

Pandemic Response

We have specific arrangements for pandemic situations.

Pandemic Response Measures

Phase Actions
Monitoring Monitor public health guidance, assess risk
Preparation PPE stock, remote working preparation, communication plans
Response Implement controls, remote working where possible, prioritise critical services
Recovery Phased return to normal, lessons learned

Control Measures

Measure Implementation
Remote working Office staff work from home
Social distancing Reduced office capacity, spacing
Hygiene Hand sanitiser, enhanced cleaning
PPE Masks, gloves as required
Health monitoring Self-assessment, isolation if symptomatic
Vaccination Encourage and support vaccination
Testing Access to testing where available

Service Prioritisation

During severe workforce shortage:

  1. Priority 1: Emergency repairs, gas safety, fire safety
  2. Priority 2: Other safety-critical services
  3. Priority 3: Urgent repairs
  4. Priority 4: Planned maintenance

Severe Weather Response

We plan for disruption from severe weather.

Weather Risks

Event Impact Response
Snow/ice Travel disruption, site access Rescheduling, remote working, gritting
Flooding Site access, property damage Alternative routes, emergency response
High winds Dangerous working conditions Postpone external work, safety first
Heatwave Health risks, working conditions Early starts, welfare measures
Cold snap Frozen pipes, heating failures Increased demand, prioritisation

Weather Monitoring

Winter Preparedness

Testing and Exercising

We regularly test our business continuity arrangements.

Testing Programme

Test Type Frequency Scope
Plan review Annual All plans reviewed and updated
Walkthrough Annual Talk through plans with key personnel
Tabletop exercise Annual Scenario-based discussion exercise
Functional test Annual Test specific capabilities (e.g., IT recovery)
Full exercise Every 2 years Simulated incident with plan activation

Test Objectives

Test Records

Training and Awareness

We ensure people understand their business continuity roles.

Training Programme

Training Audience Frequency
Business continuity awareness All employees Induction + annual
Incident management Incident Management Team Annual
Plan-specific training Plan owners and deputies Annual
Crisis communication Communications team Annual
IT disaster recovery IT team Annual

Awareness Activities

Roles and Responsibilities

Managing Director

Operations Director

Plan Owners

All Managers

All Employees

Insurance

We maintain insurance to support recovery.

Insurance Coverage

Insurance Purpose
Business interruption Loss of income during disruption
Property Building and contents damage
Computer/cyber IT losses, cyber incident costs
Employers’ liability Employee injury claims
Public liability Third-party claims
Professional indemnity Professional negligence claims
Motor fleet Vehicle damage and replacement

Insurance Claims

Continuous Improvement

We continuously improve our business continuity capabilities.

Improvement Sources

Post-Incident Review

After any significant incident:

Performance Indicators

Indicator Target
Business continuity plan coverage 100% of critical activities
Plan review completion Annual, 100% compliance
Test/exercise completion As per schedule
Training completion 100% of relevant staff
Incident response time Within defined escalation times
Recovery within RTO 100% of incidents

Compliance and Audit

Regulatory Requirements

We meet business continuity requirements in:

Audit

Audit Frequency
Internal business continuity review Annual
Client audits (as required) Per contract
External assessment Every 2-3 years

Policy Review

This policy is reviewed annually and updated to reflect:

Related Policies

This policy should be read in conjunction with:

Approval

This Business Continuity Policy has been approved by the Managing Director.

Signed:

[Name] Managing Director All Services 4U

Date: [Date]

Review Date: [Date + 1 year]

Contact

Business Continuity Lead Email: continuity@allservices4u.co.uk Phone: [Phone number]

Incident Reporting (24-hour) Phone: [Emergency number]

Quick Reference

Incident Reporting

Report any disruption or potential disruption immediately:

Phone: [Emergency number] Email: incidents@allservices4u.co.uk

Critical Services

Service Recovery Target
Emergency repairs Immediate
Gas safety Within 24 hours
Fire safety Within 24 hours
Electrical safety Within 24 hours

Key Contacts

Role Name Phone
Incident Manager [Name] [Number]
Operations Lead [Name] [Number]
IT Lead [Name] [Number]

Your Role

✓ Know your responsibilities during disruptions
✓ Report incidents and potential issues immediately
✓ Follow instructions from the Incident Management Team
✓ Keep your contact details up to date
✓ Participate in training and exercises
✓ Be flexible and adaptable

All Services 4U is committed to maintaining services to our clients even in challenging circumstances. Our business continuity arrangements ensure we are prepared, can respond effectively, and recover quickly from disruptions.

All Service 4U Limited | Company Number: 07565878

All Service 4U Limited | Company Number: 07565878

Copyright © 2024 All Service 4U Limited. All Rights Reserved.