nhs business planning guidance

• Search text Search
• Kahootz Knowledgebase
• Getting Started
• Functions of Kahootz
• Personalise your Kahootz
• How-To Guides
• This Workspace
• Contact the Workspace Manager
• What Good Looks Like Hub
• What Good Looks Like useful links library

NHS Operational Planning and Contracting Guidance

The 2022/23 priorities and operational planning guidance sets out our priorities for the year ahead. This guidance reconfirms the ongoing needed to restore services, meet new care demands and reduce the care backlogs that are a direct consequence of the pandemic.

https://www.england.nhs.uk/publication/2022-23-priorities-and-operational-planning-guidance/

Follow us on Social Media

Terms and Conditions | Privacy Policy | Accessibility Statement

You are in Kahootz with the NHS

Select from our range of services

• NHS healthcare

Learn more about how we can help you

Gps, dentists & pharmacists, out of hours, our sectors.

Learn more about our service areas

Our services.

Insights and events

NHS England publishes new priorities and operational planning guidance

On 23 December 2022, NHS England published the  2023/24 priorities and operational planning guidance . In this insight, we summarise the key points and what has changed since the  2022/23  and how it has been received.

The guidance is significantly shorter than previous years (20 pages down from 40+), more focussed (35 objectives down from 130+) and less prescriptive. This reflects the Government’s stated desire to reduce NHS micromanagement.

The guidance sets out three priority areas for 2023/24 (down from nine in 2022/23):

• to recover core productivity
• progress the aspirations in the Long Term Plan
• transform the health and care system for the future.

Workforce Objectives – what are they?

There is one specific workforce objective for 2023/24: -

“Improve retention and staff attendance through a systematic focus on all elements of the NHS People Promise”

This objective is to be achieved by:

• increased investment by NHS England in workforce education and training
• organisations refreshing the whole system workforce plans they developed in 2022/23, which will support: -
• Improved staff experience and retention through systematic focus on all elements of the NHS People Promise and implementation of the Growing Occupational Health Strategy, improving attendance toolkit and Stay and Thrive Programme.
• Increased productivity by fully using existing skills, adapting skills mix and accelerating the introduction of new roles (e.g. anaesthesia associates, AHP support workers, pharmacy technicians and assistants, first contact practitioners, and advanced clinical practitioners).
• Flexible working practices and flexible deployment of staff across organisational boundaries using digital solutions (e-rostering, e-job planning, Digital Staff Passport).
• Regional multi professional education and training investment plans (METIP) and ensure sufficient clinical placement capacity, including educator/trainer capacity, to enable all NHS England- funded trainees and students to maintain education and training pipelines.
• Implementation of the Kark recommendations and Fit and Proper Persons (FPP) test.

There are also a number of workforce recommendations aligned to the objective focused on “Use of Resources” which aims to meet a 2.2% efficiency target. Organisations will be expected to:

• taking advantage of opportunities to deploy staff more flexibly 
• measuring workforce growth by staff group, identifying expected productivity in line with growth
• reduce agency spend across the NHS to 3.7% of the total pay bill in 2023/24
• reduce corporate running costs.

Workforce Objectives - What has changed?

The focus of the workforce objectives this year is very much on improving retention and attendance of staff. Obviously, there are many factors at play here which are outside any individual organisation’s control – not least the pressures on services and staff that remain from the COVID-19 pandemic and the current pay dispute and industrial action.

Although NHS England expects organisations to meet the objectives by building on and refreshing the plans developed in response to the 2022/23 guidance, it is understood that organisations will not be performance measured or managed in relation to any objective, target or ambition that is not specifically set out in this year’s guidance. Significantly, this year’s guidance does not include the 2022/23 ‘ambitions’ of: -

• improving the Black, Asian and minority ethnic disparity ratio, by delivering the six high impact actions to overhaul recruitment and promotion practices
• continuing to support the health and wellbeing of our staff, including through effective health and wellbeing conversations and the mental health hubs.

What to Take Away and Next Steps

Although it is being reported that specific Equity, Diversity and Inclusion and staff wellbeing targets have been ‘dropped’, there are good arguments that this is not, in fact, the case.

Each organisation’s performance in 2023/24 will still be measured against the objective that they have improved “ retention and staff attendance through a systematic focus on all elements of the 2020 NHS People Promise ” , which includes having a compassionate and inclusive culture (“not tolerating any form of discrimination, bullying or violence… making the NHS a place where we all feel we belong”) and being safe and healthy ( “wellbeing is our business and our priority ”).

The number of specific objectives has reduced from 130+ to around 35. However, rather than reducing the ambitions for workforce, this reflects a change in approach to focus on outcomes rather than prescriptively setting out how each of the three priority areas are to be achieved.

Organisations should be mindful of this when implementing the guidance and refreshing their workforce plans for 2023/24 and beyond.

Systems and providers are asked to submit five-year joint forward plans before the end of March 2023. Further guidance on developing the joint forward plan is available and the annex of the planning guidance identifies evidence-based actions to support delivery. NHS England will separately set out the requirements for plan submission.

How Capsticks can help

Capsticks has significant experience in supporting employers in the context of workforce planning and change management processes, mitigating potential redundancy implications of efficiency plans, implementing cross-system working, and maximising workforce flexibilities, taking account of the remaining need to ensure staff wellbeing, and equality, diversity and inclusivity. If you would like access to advice, training or need further guidance on any of these issues (either generally or in relation to a specific case or in relation to the 2023/24 guidance) please contact Sian Bond, Kirsty MacDonald or Chloe Edwards.

Sign-up today

Follow us on social media.

• Working with us
• Legal services frameworks
• Corporate social responsibility
• Emergency services
• Private healthcare
• Primary care
• Professional regulatory
• Press releases
• Trainee solicitors

Sign up for Capsticks Insights & Events

Please check your email..

We have sent you a link to proceed to the subscription process.

Register to attend event

To see our privacy policy  click here .

Thank you for registering to attend our event. To see our privacy policy  click here .

Capsticks’ cookies

Manage capsticks’ cookies.

• About NHS Supply Chain
• Business Plan
• Certifications and Compliance

Our 2024 – 2025 Business Plan

We are creating one connected and efficient supply chain that delivers for the NHS.

The NHS is facing challenges but remains committed to providing outstanding patient care. NHS Supply Chain plays a crucial role in supporting the NHS to evolve, deliver on its priorities and continue to put patients first. Together with our partners, we are not just focused on reducing prices; we are working to bring more value to the entire healthcare system while ensuring supply chain resilience and sustainability.

Looking ahead to 2024 – 2025, we are excited to continue enhancing our capabilities and services. This includes upgrading our technology, improving customer experiences, and expanding our inventory management solutions to offer digital transparency across the NHS.

Our goal remains clear: to leverage our talented team and expertise to prioritise patient care. Collaboration is key and by working together, we are dedicated to delivering even greater value to the NHS and its patients.

Our strategy

We are pleased to share our Business Plan with you. It helps us deliver on our ongoing commitment to supporting the NHS to deliver safe and excellent patient care.

One NHS Supply Chain We are one organisation in the eyes of our teams and stakeholders, operating efficiently as a single organisation within the NHS family.

Strengthen Resilience We ensure availability of critical products, supporting the NHS to deliver excellent patient care.

£1 Billion of Value We will create £1 billion of recurrent value to return to the NHS from 2030.

See our Downloads ▼ section to read our full business plan for this year.

Working together for the NHS

As part of the NHS family, our Strategy and Business Plan are firmly rooted in the principle of working together with our NHS partners to deliver patient-led care. We are firmly committed to the NHS value of working together for patients and we will do this through five focus areas:

Organisational Development Developing our clinical capabilities through clinical practice, evidence-based decision-making and effective collaboration; and strengthening clinical leadership across our organisation.

A Sustainable NHS Delivering our Sustainability Strategy in alignment with the NHS Greener Plan and the Chief Nursing Officer Nursing and Midwifery Strategy.

Quality-Led Resilience Building supply chain resilience to strengthen patient safety, patient experience and clinical effectiveness, to ensure we are procuring using the best available clinical evidence.

Products and Category Management Facilitating patient engagement in what we buy and how we buy it; and embedding clinical leadership at each stage of our category development and contract management processes.

NHS Clinical Engagement Collaborating with national healthcare organisations such as GIRFT along with National Clinical Directors, to deliver once for the NHS; supporting local and regional priorities; communicating effectively with all our clinical stakeholders; and utilising clinical feedback to improve how we work.

Commercial transformation Transforming our commercial capabilities

We are here to provide the NHS with superior procurement services that meet all of the latest regulations. Our goal is to streamline processes and strengthen our ability to handle any supply challenges that may come our way.

Here is what you can expect from us in the coming months:

• Implementing higher standards for clinical quality across all procurement activities.
• Identify opportunities to bring new products to market that will enable trusts to lower the total cost of care delivered (for example through reduced length of stay) – known as value-based procurement.
• Collaborating across different categories to strengthen supplier relationships.
• Introduce an eSourcing solution and Supplier Collaboration platform for smoother transactions.

Resilience and sustainability Embed an optimised, resilient and sustainable supply chain

As we move through 2024, supply chains around the world are expected to face various challenges, from shortages of raw materials to disruptions in manufacturing and transportation.

In response, we are taking steps to make our supply chain more flexible, capable, and resilient while also minimising our environmental footprint.

Here is what we have planned for the year ahead:

• Designing a Logistics and Operational IT Strategy to enhance our operations.
• Finalising the procurement of a logistics provider to ensure smooth delivery.
• Getting ready for UKCA marking compliance.
• Making improvements in packaging and promoting a circular economy.
• Through these initiatives, we’re committed to ensuring that our supply chain remains robust.

Integrated Care Systems Connect across Integrated Care Systems and regions

We are dedicated to improving patient care and clinical outcomes by working closely with partners across the NHS. This means enhancing how we communicate and engage with healthcare providers to better meet their needs.

Here is how we are making strides in this direction:

• Building strategic relationships with Integrated Care Systems to improve coordination.
• Collaborating with healthcare providers to create smoother patient pathways.
• Hosting customer panels and working groups to gather feedback and shape our strategies.
• Piloting a new eCommerce platform for select healthcare providers to streamline transactions.
• Rolling out our new inventory management system to improve efficiency in 20 healthcare providers.

Through these efforts, we’re committed to making it easier for healthcare providers to focus on what they do best: caring for patients.

Improving capabilities Develop, empower and engaging our workforce

In the upcoming year, we are committed to embedding the changes introduced via our Target Operating Model throughout the organisation.

Here’s what is in store for the year ahead:

• Welcoming 28 graduates into our graduate scheme to nurture new talent.
• Establishing a Leadership Academy to develop leadership skills within our team.
• Evolving and implementing our People Strategy to better support our team members.

Efficiency improvements Operate a well-run organisation

Our Business Plan will help us deliver our goals for 2030, which are closely tied to the priorities laid out in the NHS Long Term Plan.

Here is where our focus lies:

• Implementing new ways of working that align with our Target Operating Model.
• Sharing best practices across the organisation through our academies.
• Procuring IT providers to support our operations.

Downloads ▼

Nhs supply chain business plan, quick links.

• My Supply Chain
• Website Feedback Form
• Career Opportunities
• Sustainability

Governance and Legal

• Advisory Board
• Legal Information
• Privacy Notice for Home Delivery Service Patients
• Terms of Use
• Accessibility

Connect With Us

• Twitter / X

© Supply Chain Coordination Limited, a company registered in England and Wales. Registered number: 10881715. Registered office: Wellington House, 133-155 Waterloo Road, London SE1 8UG.

Skip to main content

The professional association for healthcare finance

Bitesize course / Business planning

This course is FREE to NHS staff. In partnership with NHS England, the HFMA are providing this course free of charge to all NHS staff. To see the options to access this course for free, please click here . If you are not a member of NHS staff and wish to purchase this course, please click the 'purchase' button in this banner.

This course evaluates the approach to business planning in the NHS and how each NHS organisation has a role to play in ensuring that its plans are developed in a joined-up manner and that delivery is managed to the benefit of patients, users and carers and other stakeholders. Once completed, you will be able to understand approaches to investment and the governance arrangements surrounding them, as well as learning the differences between strategic and operational plans and how these interact to improve services to patients.  

This course is suited to those who are managing a budget, clinical staff, operational staff, finance staff and primary care staff.

• Planning frameworks to support decision-making
• NHS business planning

What's included?

Up to date, easy to understand content, written by nhs expert, access to your course online for 12 months, 10 hours of accredited cpd, certificate of completion, explore a subscription for your organisation.

ind out more about an HFMA bitesize subscription for your organisation’s staff. Get access to our full range of courses for your staff and save.

Related content

The Institute’s annual costing conference provides the NHS with the latest developments and guidance in NHS costing.

This webinar series offers colleagues of ICS organisations the opportunity to discuss common priorities, challenges, and successes within their field.

NHS Resolution publishes business plan for 2023/24

Date published: 22nd June 2023

We’re pleased to announce the publication of our 2023/24 business plan . In it, we set out our focus for the next twelve months, as we enter the middle year of our three-year corporate strategy: Advise, Resolve and Learn: Our Strategy to 2025.

We will continue to focus on progressing our four strategic priorities:

Strategic priority 1: Delivering fair resolution All of our services will focus on achieving fair and timely resolution, keeping patients and healthcare staff out of formal processes wherever possible to minimise distress and cost.

Strategic priority 2: Sharing data and insights as a catalyst for improvement We will ensure that our unique datasets help derive usable insights that benefit patients and the healthcare and justice systems.

Strategic priority 3: Collaborating to improve maternity outcomes We will build on our role as a system integrator in maternity, bringing together key parties to determine what further improvements can be made within our areas of expertise to support the system’s plans in the area of maternity safety.

Strategic priority 4: Investing in our people and systems to transform our business We will develop our services to support the changing needs of the NHS by investing in our people, systems and services to continue delivering best value for public funds. This includes continuing to progress our two change programmes, the Claims Evolution Programme and the Core Systems Programme while continuing to support staff in building their expertise and skills.

In the context of an NHS experiencing acknowledged pressure and structural change, we’re focused on making our interactions with the NHS as easy as possible to aid NHS staff who are facing extreme pressures.

We also continue to remain committed to promoting compassion and fairness when addressing shortcomings within the NHS, whilst remaining dedicated to delivering savings and efficiencies to the overall system.

We thank our partners and colleagues across the NHS and health and care system and will continue to work with them to deliver solutions rapidly across the system as needed. As well as this, we will continue to build our external relationships and partnerships to drive our strategic priorities forward. Now, more than ever, our plans remain flexible so that we can respond quickly to any unforeseen requirements of our organisation. Helen Vernon, Chief Executive, NHS Resolution

• Awards and accreditation badges

Search our site

• Privacy and cookies
• Terms and conditions
• Accessibility

Cookies on the NHS England website

We’ve put some small files called cookies on your device to make our site work.

We’d also like to use analytics cookies. These send information about how our site is used to a service called Google Analytics. We use this information to improve our site.

Let us know if this is OK. We’ll use a cookie to save your choice. You can  read more about our cookies before you choose.

Change my preferences I'm OK with analytics cookies

NHS England business continuity management toolkit

Introduction.

This guidance updates and supersedes the NHS England and Business Continuity Management Toolkit published in 2016.

This guidance was developed by a Task and Finish Group convened by NHS England, comprising of representatives from a variety of healthcare service providers and commissioners across the country.

Under the Civil Contingencies Act 2004 and the Health and Care Act 2022, all NHS organisations have a duty to put in place continuity arrangements. The NHS Core Standards for Emergency Preparedness, Resilience and Response (EPRR), last revised 2022 set out these requirements for all NHS organisations and providers of NHS funded care. This means that services should be maintained to set standards during any disruption or recovered to these standards as soon as possible.

This work is referred to in the health service as ‘emergency preparedness, resilience and response’. A Business Continuity Management (BCM) system provides a holistic management process that identifies potential threats to NHS organisations and the impact to business operations those threats, if realised, might cause.

The holistic process of business continuity management is an essential tool in establishing an organisation’s resilience, this toolkit contains a portfolio of supporting materials, which aim to assist NHS organisations and providers of NHS funded care in meeting their business continuity management obligations.

1.1 Purpose

The ISO 22301 standard is designed to help NHS organisations, and providers of NHS funded care, to prepare for, respond and recover from unexpected and disruptive incidents. It also provides a structure for NHS organisations to align and as a result, highlight key areas that must be adopted as part of the Plan, Do, Check, Act (PDCA) cycle.

NHS England recognises that many organisations have well-structured and credible business continuity plans. There is no national mandate for these organisations to utilise this toolkit to deliver a resilient and robust business continuity programme. Although, to maintain consistency across the NHS, organisations should work to the ISO 22301 principles and adopt the PDCA methodology, as this facilitates incorporation of best practice. The toolkit is an off-the-shelf portfolio of supporting materials to be used at the discretion of each NHS organisation.

Through the use of this toolkit, NHS organisations are able to provide factual evidence of robust planning and preparation. This could be either be as part of a NHS organisation’s internal audit assurance function or where evidence of robust BCM processes is required as part of EPRR assurance, or other commissioning activities at NHS England regional or local level (ICBs).

Having robust business continuity plans provides NHS England confidence at all structural levels, that the NHS in England along with NHS provided services (including Community Interest Companies, private providers, primary care providers etc) is resilient. The establishment and maintenance of systems that aid the eventualities of incidents, such as denial of access, lack of people, lack of infrastructure, loss of electricity, fuel disruption and other incidents, ensure that high quality care is being provided by NHS organisations or a provider of NHS funded care.

1.2 NHS business continuity requirements

Some NHS organisations are identified under the Civil Contingencies Act (CCA) 2004 as ‘category one’ or ‘category two’ responders. Category 1 responders are those organisations at the core of an emergency response and are subject to the full set of civil protection duties. Therefore, these organisations have a legal duty to develop robust business continuity management arrangements, which will help them to maintain their services, if there is a major emergency or disruption. This could include, for example, an infectious disease outbreak, severe weather, fuel shortages, industrial action, loss of accommodation, loss of critical information, loss of communication technology (ICT) or supply chain failure.

Not all providers of NHS funded care are covered by the requirements of the CCA. However, the EPRR Framework and NHS EPRR Core Standards both last revised 2022, requires all NHS providers and commissioners to have suitable business continuity arrangements in place. This responsibility extends to services provided through partnerships or other forms of contractual arrangement.

The Accountable Emergency Officer (AEO) in each NHS organisation is responsible for making sure these standards are met.

NHS organisations and providers of NHS funded care must ensure that business continuity planning is a whole-system approach to the patient care pathway. Each organisation will play a part, but realistic resilience and continuity arrangements will only be achieved, if we consider and understand the patient’s whole journey, and plan to maintain an appropriate service level across the pathway.

NHS organisations and providers of NHS funded care will, therefore, need to recognise how their services depend on each other, and to align their plans with all partner organisations.

As with all plans, business continuity arrangements need to be reviewed and updated regularly, annually as a minimum, and immediately post incident. Learning from exercises and incidents should be incorporated into plans.

The business continuity management system must be regularly reviewed by the senior management of the organisation, for its effectiveness and action taken, to address any short comings or changes in requirements.

1.3 Complex business continuity incidents

Complex business continuity incidents are those, where multiple risks are realised at once such as during a pandemic, or a large provider failure. Several of these disruptions occurring simultaneously, will adversely impact upon the measures that the organisation may have considered robust enough to manage a disruption in one of these areas.

Plans therefore must be written to take into account compound failures. In a pandemic for example; loss of staff (staff having ill health or staff having dependents with ill health), loss of location access (travel disruption or the closing of an office due to the spread of disease) and loss of supplier may all occur together and multiple times.

1.4 Primary care

NHS England recommends that all Primary Care Services have plans in place for continued operation of their services during a disruption e.g. Trust plans should feed into Primary Care, to take account of failures within path labs or network failures, to establish joint agreements of returning patient results.

It is recommended that any template used is agreed with the commissioning body, to ensure it meets the relevant needs of local commissioners. Practice managers are encouraged to work collaboratively in the development of arrangements, as any disruption, is likely to have knock on impacts to other Primary and Secondary Care services locally.

1.5 Summary of changes

• Business Continuity Management Framework (Service Resilience) stood down as this is no longer in existence.
• Best practice has been taken from the BC Good Practice Guidelines 2018, replacing the previous guidance.

Business continuity management toolkit updates

• Transferred the Business Continuity Management Toolkit and supporting documentation to the new NHS England document templates.
• Elaborates on the Plan, Do, Check, Act (PDCA) cycle, with a new schematic called PDCA for ISO 22301.
• Further bolstered paragraphs for each heading under the PDCA cycle e.g. Business Continuity Policy, Business Impact Analysis, BC Programme etc.Added new paragraphs into the PDCA cycle to provide additional guidance for each element of the cycle.
• Added a Supplier Service Questionnaire Template provided by North East Ambulance Service (NEAS).
• Provided five new business continuity case studies that have been added to the existing case studies (Part 5).
• ISO 22301:2019 – Business Continuity Management System – Requirements
• ISO 22313:2020 Societal Security – Business Continuity Management Systems – Guidance.
• The Publicly Available Specifications (PAS) 2015
• BCI Good Practice Guidelines (2018)
• Civil Contingencies Act 2004
• Health and Social Care Act 2022
• The NHS Act 2006
• Liaised with the Equalities and Health Inequalities team within NHS England to ensure protected characteristics were considered when updating documentation.

Part 1 Documentation

• Transferred all documentation on to NHS England
• Elaborated on points mentioned within the Business Continuity Management
• Additional Busines Impact Analysis Template (Excel version) added to cater to the wider NHS.
• Updated historic guidance with up to date best practice and in line with ISO
• Added a communications section within the Business Continuity Plan

Part 2 Documentation

• Transferred all documentation onto NHS England templates.
• Updated schematics to reflect the current NHS landscape e.g. replace Clinical Commissioning Group with Integrated Care Boards as well as the abolishing of PHE and replacing with UKHSA.
• Also updated the gradual and sudden mitigated business continuity incident schematics to ensure they are in line with ISO 22301.More recent business continuity incidents were added to the slide pack as they had not been updated for a period of time.
• Notes/comments were added to both the workshop delegate handbook as well as the facilitator notes.

Part 3 Documentation

• Amended grammatical errors across the exercising slide decks.
• Updated the Internal Audit Checklist to bring in line with the Business Continuity Good Practice Guidelines 2018.

Part 4 Documentation

• Transferred all documentation onto NHS England templates
• After Action Review Template (completed version) added to the suite of documentation.
• Background information in relation to Business Continuity Management Reviews, why they are required and what they compromise of have been added.

Part 5 Documentation

• Five new business continuity case studies have been added. The incidents are reflective of recent business continuity events.
• Previous case studies have also been kept in as the learning from each one is still relevant.

2. Using this toolkit

This toolkit has been designed to support the development of business continuity arrangements. In addition, this toolkit is designed to support implementation of a business continuity management system, exercising of plans, auditing, as well as spearheading improvements to the BCMS of NHS organisations and NHS funded care.

This BCM toolkit is derived from The Plan, Do, Check, Act (PDCA) cycle. It is advised that all NHS organisations including providers of NHS funded care, should refer to this cycle, to drive improvements in planning and raising the standard of business continuity preparedness. In order to maximise the benefits of a successful BCMS, NHS organisations should continually refer to the PDCA cycle.

Organisations should select the appropriate section of the toolkit; this will be dependent upon where each organisation is, in terms of their business continuity arrangements.

Within each area there is guidance and supporting material to help in the development of plans and processes, through to exercising, without predetermining a course of action for your organisation.

• Establish the business continuity programme/strategy/system
• Develop a business continuity policy
• Create a business impact assessment
• Develop policy and procedures
• Establish a documentation system
• Undertake Business Impact Analysis (BIA)
• Implementation of plans
• Develop a communications plan
• Create an exercise programme
• Schedule management reviews
• Undertake internal audits
• Implement corrective actions
• Continuous improvement measures

3. Standards and reference materials

The main guidance for business continuity management, which also applies to this toolkit, is contained in:

• ISO22301: 2019 – Business Continuity Management Systems – Requirements
• ISO 22313:2020 Societal Security – Business Continuity Management Systems – Guidance

Additionally, ISO 22313 provides good practice, guidelines and recommendations based on the requirements of ISO 22301.

The Publicly Available Specification (PAS) 2015 provides a resilience framework for NHS organisations and all providers of NHS funded care. PAS 2015 brings together the different strands of resilience planning within the NHS to create a framework that supports organisations efforts to become more resilient, it does this through:

• Helping to drive compliance with the relevant legislation, particularly the Civil Contingencies Act 2004.
• Adopting a unified and cohesive approach to resilience and business continuity which builds on BS 25999, the British Standard for business continuity.
• Developing resilient relationships with commissioners and providers of health services, which can be benchmarked against other similar sized organisations.
• Outlining the criticality of patient pathways and critical interdependencies by providing robust health services in all circumstances.
• Developing a sound understanding of partnership working within the resilience agenda.
• Helping to protect the reputation of the NHS and related services, and to maintain public confidence.

Other useful guidance or standards includes:

• ISO 27000 (27001, 27002, 27003, 27004, 27005, 27006) series – Standards relating to security management systems.
• ISO 31000:2018 series – Standards guidelines on managing risk faced by organisations. The standards provide a common approach to managing any type of risk and is not industry or sector specific.
• ISO 22301:2019 – This standard specifies the requirements to implement, maintain and improve a management system to protect against, reduce the likelihood of the occurrence of, prepare for, respond, and recover from disruptions when they arise.
• PD 25888:2011 – Guidance on how best to develop and implement an organisations recovery in response to a disruptive incident.
• PD 25111:2010 – Guidelines on the planning and development of human resource strategies and policies after an incident to ensure business continuity.
• PAS 2015:2010 – Provides techniques for improving and maintaining resilience in NHS funded organisations.
• NHS England Emergency Preparedness, Resilience and Response Framework – This is a strategic national framework containing principles for health emergency preparedness, resilience, and response for the NHS in England at all levels including NHS provider organisations, providers of NHS- funded care, Integrated Care Boards (ICBs), GPs and other primary and community care organisations.
• BCI Good Practice Guidelines 2018 – The global guide to good practice in business continuity.
• BS 65000: 2014 – This standard describes the nature of resilience and ways to build and enhance organisational resilience.
• Data Security and Protection Toolkit – NHS Digital.

4.1 Part one – plan

Business Continuity is defined as the capability of an organisation to continue delivery of products or services, at acceptable predefined levels, following a disruptive incident (ISO).

4.2 Business continuity policy

The policy ‘provides the intentions and direction of an organisation, as formally expressed by its top management’ (ISO 22301). The business continuity policy sets the boundaries and requirements for the business continuity programme, it also states the reasons why it is being implemented. The policy also defines the guiding principles, which the organisation follows and measures its performance against.

Establishing the business continuity policy is critical when developing a business continuity system. The policy should:

• Provide direction and intention by senior management.
• Provide strategic direction from which the business continuity programme is delivered.
• Define the way in which business continuity will be approached by NHS organisations.Identify any standards or guidelines, used as a benchmark for the business continuity programme (see section 3)
• Include Purpose, Scope and Governance.Be used to communicate your key objectives and key deliverables.
• Be communicated and made available to all parties.
• Define the way in which business continuity will be approached by NHS organisations.
• Identify any standards or guidelines, used as a benchmark for the business continuity programme (see section 3)Include Purpose, Scope and Governance.Be used to communicate your key objectives and key deliverables.

4.3 Business continuity programme/system

The first step in the process of developing a business continuity system is getting your system or programme designed and established, ensuring it has the key elements, to allow the gathering of information needed, to make choices on how to protect services.

The business continuity programme is an ongoing process, which adapts in response to the changing nature, of an organisations internal and external operating environment. The business continuity system is put into place, to implement the business continuity policy when the scope, governance, roles, and responsibilities have been agreed. A vital part of the programme is the ability to manage documentation to aid the implementation, where appropriate.

It is important to understand the context of business continuity within the organisation when designing your system, and work alongside Health and Safety, Risk Management, and Information Governance, amongst others, to ensure that your business continuity processes align and prevent complications, as you implement and embed your business continuity system.

A BCMS should include the key performance indicators (KPIs) to be used to measure the success of the system. This could include the percentage of plans in place and exercised or staff that are aware of their own role with regards to business continuity. These KPIs can be used within the review of the system and management report.

The documentation within the business continuity process has three purposes:

• Manage the BC programme effectively
• Define the effective management of the
• Enable a prompt response to an incident

4.4 Risk assessment

The type and nature of the service provided is widely variable within NHS organisations, so any risk assessment of possible events is organisationally subjective. However, there are critical dependencies between NHS organisations and these need to be identified and considered as part of the overall business continuity lifecycle, throughout every health economy for patient pathways.

A business continuity event can be anything that has the potential to disrupt normal service delivery but essentially, all such events will cause either a loss of a resource (e.g. buildings, people, equipment, etc.), an increase in demand (e.g. road traffic collision, health scare) or possibly both simultaneously (e.g. pandemics). The cause of the problem is usually immaterial. It doesn’t matter whether a building is inaccessible because it has burned down or is completely flooded; it doesn’t matter whether a staff shortage is due to snow or industrial action – in either case the organisation has to respond to a loss of resource.

For some services, completion of the template will produce a functional business continuity plan. For other services, completion of the template will provide a “gap analysis” of issues that need to be further addressed. Organisationally as a whole or at Division/Directorate level as appropriate, remedial actions can be prioritised.

Risks should be linked to those being highlighted on the organisational risk register; however, they may be recorded on this as a single risk or multiple individual risks in order to develop strategies to manage these. This may include links to the corporate business objectives and other specific strategic aims of the organisation.

It is imperative to understand the functions and service interdependencies of the organisation, both internal and external when designing your business continuity system. Therefore, working with key teams such as EPRR, Human Resources, ICT, Health & Safety, Risk Management, and Information Governance, amongst others, is critical to ensure your systems align and prevent complications as they are implemented and embedded. It is also crucial to identify and clarify the scope of the BCMS, as this allows the organisation to identify what the BCMS will factor in and what it will not.

Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) is used to identify gaps between the service delivered and what is required, therefore informing an organisations risk register of further risk. NHS organisations should plan to address risk, but also inform the risk register of residual risk via the RTO/RPO process.

The following page contains an example of one organisations approach to identifying the different risks its services face.

Publication approval reference: PR1254