Operational Directive Enquiries to: Senior Policy Officer, DPMU OD number: OD 0595/15
Phone number: (08) 9222 2368 Date: 22 April 2015
Supersedes: File No: F-AA-26945
Subject: Business Continuity Management
Purpose
WA Health is required by the Public Sector Commissioner and the Treasurer to practice Business Continuity Management (BCM) and ensure Business Continuity Plans (BCPs) are established, maintained, tested, reviewed and updated on a regular basis.
WA Health provides a range of health services to the public, some of which are considered critical services for the protection of lives. BCM ensures those critical services can continue to operate following a disruptive event or incident that would otherwise impair or stop them. BCM comprises both preparation and crisis management.
Policy Statement
All WA Health entities and shared services are required to practice BCM, and establish a BCP to ensure the continuity of critical business functions in the event of a disruption. BCPs are to integrate with the health service’s emergency procedure and risk management programs and align with the whole-of-health BCM policy outlined and attached to this Operational Directive.
BCM Scope and Principles
A BCM program is to ensure the organisation’s BCP:
reflects the service’s vision, mission and key organisational objectives
is site-specific and interconnects with key interdependencies
integrates with the service’s emergency procedure and risk management programs using an “all hazards” approach
is regularly maintained, tested and approved by an appropriate governance structure.
This document can be made available in alternative formats on request for a person with a disability.
© Department of Health 2015
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.
Compliance Divisions and Health Services are to be compliant with the requirements listed in this Operational Directive. Professor Bryant Stokes A/DIRECTOR GENERAL DEPARTMENT OF HEALTH WA
This information is available in alternative formats for a person with a disability.
health.wa.gov.au
Business Continuity Management Policy
1
Effective: March 2016
Title: Business Continuity Management Policy
1. Background
In accordance with Public Sector Commissioner’s Circular 2015-03 - Risk Management and Business Continuity Planning, all public sector bodies “are required to have continuity plans in place to ensure they can respond to, and recover from, any business disruption”.
2. Scope
This policy applies to all WA Health entities and shared services.
3. Policy statement
All WA Health entities and shared services are required to practice Business Continuity Management (BCM), and establish Business Continuity Plans (BCP) to ensure the continuity of critical business activities in the event of a disruption.
4. Definitions
Business Activity An activity, process, or function that is undertaken by a business area of an organisation that produces or supports the delivery of products or services
Business Continuity Management
A holistic management process that allows organisations to recover and re-establish the delivery of services or products at acceptable predefined levels following a disruptive event
Business Continuity Management Program
The overarching management system that establishes, implements, operates, tests, maintains, improves, and updates business continuity for the health service.
Business Continuity Plan A documented procedure that outlines the strategies and resources required for the recovery & re-establishment of business activities (according to pre-determined priorities) following a disruptive event
Business Impact Analysis A systematic process that analyses activities undertaken by a business area and estimates the effects a disruption may have upon them. It includes assessing dependencies and preparing strategies to respond and recover and to determine the priorities for those processes
Disruption An event that results in an interruption to business activities
2
5. Roles and responsibilities
Director General and State Health Coordinator
The Director General is the Accountable Officer and has overall responsibility for risk management and business continuity in WA Health. The Director General has delegated responsibility of State-level BCM to the Director, Disaster Management, Regulation and Planning Directorate, as the delegated State Health Coordinator. The State Health Coordinator, as the Chair of the WA Health Emergency Management Committee, performs the system manager role for BCM reporting and assurance.
Chief Executives and Area Health Services
Chief Executives and Area Health Services are responsible for providing assurance to the State Health Coordinator, via the Health Emergency Management Committee, that BCM is being practiced at hospitals within the area health service, as per to BCM reporting and assurance requirements attached to this policy.
Executive sponsors
The executive sponsor is ultimately responsible for governance over the BCM program and should be a member of the health service’s executive team. The executive sponsor’s role includes:
overall responsibility for the health service’s BCM program
chairing the committee with responsibility for the health service’s BCM program
approving the health service’s BCP
ensuring the BCM program is adequately resourced.
BCM program managers
The BCM program manager is responsible for the ongoing management of BCM for the health service. The BCM program manager’s role includes:
leading the implementation of BCM program
engaging senior managers to participate in planning process.
facilitating a Business Impact Analysis (BIA) for each business area
aggregating, consolidating and documenting the BCP
ongoing maintenance of the plan, including exercising and updating
facilitating the training of staff in the health service’s BCM arrangements.
Senior managers
Senior managers are to ensure BCM has been embedded and actively managed in their areas of responsibility. This includes:
management of the BCM planning processes for activities under control
ensuring staff have undertaken training in the organisation’s BCM arrangements
documenting and endorsing the BCM strategies for activities under control
leadership when plan is activated.
All Staff
All staff members should undertake appropriate training in the BCM arrangements for the organisation.
3
6. Scope of planning The scope of the BCM program should be based on a localised single function or departmental-wide disruption. This should include identification of critical business activities through a BIA, identification of continuity strategies and resources, development of the BCP, and on-going training, exercising, and maintenance of the BCP, as per the attached BCM principles and requirements.
7. Compliance
Compliance with this policy is mandatory for all health services. Whilst there is no requirement to standardise the format of the BIA and BCP, BCM program managers are strongly encouraged to utilise the tools and templates attached to this policy.
Area Health Services are responsible for reporting and assurance to the State Health Coordinator, as per the attached reporting and assurance requirements.
The BCP should be tested and reviewed annually. The BIA for each business area should be reviewed every three years, or after any substantial organisational change or restructure.
8. References
Public Sector Commissioner’s Circular 2015 – 03 – Risk Management and Business Continuity Planning.
9. Relevant legislation
Financial Management Act 2006
Public Sector Management Act 1994
10. Related documents
Business Continuity Management – requirements and principles for WA Health
Whole of Health Business Impact Analysis Template
Business Impact Analysis Handbook
Business Continuity Plan template
This document can be made available in alternative formats on request for a person with a disability.
© Department of Health 2016
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.
Title: Business Continuity Management Policy
Contact: Senior Policy Officer, Disaster Preparedness and Management Unit – (08) 9222 2368
Directorate: Disaster Management, Regulation and Planning Directorate
Version: 2.0 Date Published: 16/03/2016
Date of Last Review: 19/02/2016 Date Next Review: 16/03/2018
health.wa.gov.au
Business Continuity Management
Requirements and principles for WA Health
1
Introduction
This document outlines the requirements and principles of Business Continuity Management (BCM) within WA Health. It details the step-by-step process for undertaking BCM within a hospital or health service and links the process into the specific tools and templates for undertaking BCM within WA Health.
What is business continuity management? BCM is a holistic management process that allows organisations to continue the delivery of critical services and / or products at acceptable predefined levels following a disruptive event.
The key objectives of BCM are to:
Minimise the impact of a disruption
Resume priority services within pre-defined timeframes
Restore full business capabilities as quickly as possible.
The below diagram highlights the relationship between business continuity, emergency response, and recovery.
The response continuum
2
Why do we practice business continuity management?
WA Health provides many critical services to the public of Western Australia. Hospitals and health services are resource-intensive services susceptible to many natural and man-made risks. When these risks materialise into a disruptive event the effects of the disruption may impede WA Health’s ability to continue providing these critical services leading to unacceptable outcomes.
BCM allows decision-makers to delineate between essential business activities that must be re-established within set pre-defined timeframes, and less critical business activities which may be temporarily suspended and its resources redirected to higher priority areas.
WA Health has an obligation to practice BCM and is regularly audited to ascertain it’s compliance to best-practice standards. This requirement is reinforced by Public Sector Commissioner’s Circular 2015 – 03 – Risk Management and Business Continuity Planning.
Elements of the business continuity management process
There are five main elements of BCM:
1. BCM program management
Executive leadership is required to establish governance over the BCM program and entrench an organisational culture that is proactive to organisational resilience. The key outputs from BCM program management are the establishment of a BCM Committee (however titled), the development of a BCM Policy, and endorsement of a BCM implementation schedule.
A BCM Committee should be established that is charged with responsibility for the ongoing maintenance, governance, education and training for BCM. This committee can be absorbed into pre-existing emergency or risk management committees, or established as a separate BCM-focused committee. The committee should be chaired by the executive sponsor.
Planning scope and assumptions
The scope of the BCM program should determine the extent of planning. For hospitals and health services, the scope is to be based on a localised single function or departmental-wide disruption.
3
Assumptions should also be documented and include considerations, suppositions and inferences on which the BCM planning is based.
The scope and planning assumptions should be approved by the executive sponsor.
Communication and consultation
A stakeholder analysis should be performed prior to the commencement of the BCM planning process. Communication and consultation with internal and external stakeholders is essential in ensuring that staff, relevant stakeholders and interdependencies have input to the BCP and are aware of their role when the BCP is activated. A communication plan should be formulated to ensure all relevant parties are identified and actively involved in the BCP development, implementation and maintenance process.
2. Business impact analysis
A Business Impact Analysis (BIA) should be performed for each business unit within the health service. The BIA is the systematic process of analysing activities and the effect a disruption may have upon them. The BIA assesses two key elements:
1. The impact of a disruption to a business activity; and
2. The resources (people, systems, equipment, premises and services) the business activity depends upon to successfully function.
A BIA template and handbook have been developed to guide BCM program managers through the process. The template and handbook are available in Operational Directive 0595/15.
The key output from the BIA is the determination of the Maximum Tolerable Period of Disruption (MTPD) for each business activity. The MTPD is a prioritisation indicator that determines the length of time a business activity can be disrupted before the consequences of not performing that activity become unacceptable to the organisation. Business activities with a MTPD of two weeks or less are considered time-critical, whereas business activities with a MTPD of greater than two week are considered non-critical for business continuity purposes.
3. Business continuity strategy
Once the MTPDs and dependencies have been determined, the next step is to identify Business Continuity (BC) response strategies to support the business functions. The strategies should take into consideration the resource for people, systems, infrastructure, premises, information and work processes.
BC strategies don’t necessarily imply the resumption of full service activities. A reduced, but tolerable, activity level may be enough to ensure critical elements of the activity are fulfilled. Strategies should include a minimum acceptable level and sustainable level of activity.
Examples of BC response strategy include:
temporarily suspending the business activity
workarounds
transferring the activity to another health facility (eg: going onto bypass/diversion)
transferring staff and resources to an another facility, department, or health service
4
working from home (generally non-clinical activities)
relocating the service and/or resources to a back-up location.
Unless previous agreements or Memorandum of Understandings have been formalised between health services, relocation strategies should be generalised rather than specific to allow for flexible arrangements to be implemented. For example: relocate to alternative tertiary facility.
Once the strategies have been determined, the resources required to implement the strategies need to be mapped. Resources include people, systems, specialist equipment, key consumables, premises and services.
In some clinical settings, the list of key consumables may be extensive. Rather than detail an exhaustive list, the consumables may be referred to as ‘supply’ or ‘pharmaceutical imprest’ lists.
4. Documentation of the plan
The Business Continuity Plan (BCP) is simply the documentation of the outputs from the BIA, and the listing of business continuity strategies, resources and interdependencies. A series of BIAs for different service streams may feed into one BCP for the health service. The plan should detail how it communicates with internal and external stakeholders, and outline the roles and responsibilities of key responders. A sample BCP template is available under Attachments in Operational Directive 0595/15.
The BCP is to be endorsed by the health service executive and dovetail with existing emergency response, contingency, and recovery arrangements and plans. A BCP is an iterative document that should be tested, maintained and updated to reflect changes in the organisation. The plan should be readily available on HealthPoint and in hard copy.
5. Training and exercising
Once the BCP has been endorsed by the organisation’s executive, training should be provided to staff members. This may vary from awareness training for new staff, to response training to those with a pre-identified role when a BC response is required.
BC training should include an annual exercise which tests the arrangements detailed in the health service’s BCP. An exercise may include:
A discussion exercise
A simulation exercise
A walkthrough or familiarisation exercise
A live test.
Regular reviews and maintenance
Health services are to ensure the maintenance over the BCM program. This includes ensuring the BCP remains current and relevant. Maintenance should be undertaken:
When new business activities are undertaken or existing business activities are discontinued
5
Following a restructure or change in governance arrangements
Where there are major changes to the health service’s location and / or technology
Following an exercise or real event
Following an internal or external audit where gaps have been identified
Periodically, in accordance with BCM Policy.
More information
More information on BCM can be found on the Community of Best Practice for BCM HealthPoint page.
Definitions
Business Activity An activity, process, or function that is undertaken by a business area of an organisation that produces or supports the delivery of products or services
Business Continuity Management
A holistic management process that allows organisations to recover and re-establish the delivery of services or products at acceptable predefined levels following a disruptive event
Business Continuity Plan
A documented procedure that outlines the strategies and resources required for the recovery & re-establishment of business activities (according to pre-determined priorities) following a disruptive event
Business Impact Analysis
A systematic analytical process that analyses activities undertaken by a business area and estimates the effects a disruption may have upon them. It includes assessing dependencies and preparing strategies to respond and recover and to determine the priorities for those processes
Dependency A process, service, supplier, or resource which is essential in order for a business activity to successfully function.
Disruption An event that results in an interruption to business activities
Impact The consequences that result from an adverse event or disruption
Maximum Tolerable Data Loss
The maximum period of time that data can be lost before the impact becomes intolerable or unacceptable to the organisation
Maximum Tolerable Period of Disruption
The period of time it would take for adverse impacts, which arise from not providing a service or activity, to become intolerable or unacceptable to the organisation
Strategy (business continuity)
A response option, based on the business impact analysis, for how an organisation will respond to a disruption to a business activity
This document can be made available in alternative formats on request for a person with a disability.
© Department of Health 2016
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.
health.wa.gov.au
Business Impact Analysis handbook
November 2015
2
Contents
What is a Business Impact Analysis 3
Process 3
Templates and tools 5
Carrying out the BIA 6
Step 1 Preparation and set-up 6
Step 2 Dependencies Assessment 7
Consolidated dependencies profile 9
Step 3 Impact assessment 10
Consolidated BIA profile and priorities 12
Step 4 Business continuity strategies and resource requirements 13
Attachment 1 Impact Reference Table 16
Attachment 2 Dependency Rating Table 17
Attachment 3 Consolidated Dependencies Assessment – People and Infrastructure 18
Attachment 4 Consolidated Dependencies Assessment – Systems and Applications 19
Attachment 5 Consolidated BIA Profile 20
BIA Handbook November 2015
3
Purpose
The purpose of this handbook is to provide guidance on how to undertake a
Business Impact Analysis (BIA) using the templates and tools that have been
developed for healthcare facilities in the Department of Health. There is, however, no
requirement to standardise the BIA – health services and divisions are free to use
other BIA methodologies and tools that are deemed appropriate so long as the
objectives of the BIA are met. These objectives are described in the sections below.
What is a Business Impact Analysis The BIA is a structured and formal process for determining the priorities for the
resumption and continuity of services / business activities following a disruption.
Whilst all the daily activities1 carried out in a healthcare facility are important, not all
these activities are “time critical”. In the event of a major disruption, some of these
activities could temporarily be suspended with little or no negative consequences on
patient care or the broader health system. On the other hand, some activities have
very low tolerances for disruption because the consequences of disruption on the
organisation are unacceptable, even for a few minutes or hours. The BIA allows you
to prioritise the activities from a time perspective, separating those that are time
critical from those that are not.
The BIA is an important process as it allows the organisation to determine the scope
that will form the cornerstone for the development of business continuity strategies
and response plans.
Process The BIA is a 4-step process as illustrated in Figure 1 below:
1 The term ‘activities’ is used broadly to include services, functions and processes that are
undertaken in a business area
BIA Handbook November 2015
4
Figure 1 Business Impact Analysis Process
Step 1 Preparation and set-up
Identify the activities that are undertaken by each unit / business
area
Step 2 Dependencies assessment
Identify the resources that are used by each of the activities under
normal operations, and assess the level of dependency that the
activity has on a given resource.
Step 3 Impact assessment
Assess the potential business impact of a disruption to business
activities, determine the maximum amount of time that the activities
may be disrupted for before the business impact becomes
intolerable, and prioritise the activities for recovery
Step 4 Business continuity strategies and resource requirements
Identify the strategies, interdependencies and resource
requirements for the continuity of priority activities
BIA Handbook November 2015
5
Approach
The BIA should be conducted with managers who have overall responsibility for a
department, unit, or business area. They must be able to “stand back” and provide
an organisation-wide perspective when assessing the impacts of disruption, and
have the authority to make an educated determination of the recovery priorities for
activities within their department or unit.
Inputs should be sought from multiple participants so that the analysis is balanced
and not based on the opinions of a single person. For this reason, the BIA is best
conducted in a facilitated workshop setting with department and unit managers.
BIA workshops should be conducted for each directorate. Depending on the size of
the directorate, you may need to have separate workshops for each department /
unit to keep it manageable. The BIA is conducted bottom-up – i.e. information is
collected at the unit / business area level, and then rolled-up and consolidated at the
department / directorate and organisation-wide level.
Templates and tools The templates and tools for conducting the BIA are:
Impact Reference Table2 (see Attachment 1)
Dependency Rating Table (see Attachment 2)
BIA template, consisting of the 7 worksheets
o WS1 Listing of activities
o WS2A Dependencies assessment – people and infrastructure
o WS2B Dependencies assessment – systems and applications
o WS3 Impact assessment
o WS4A Business continuity strategies
o WS4B Resource requirements
o WS4C Interdependencies
2 The Impact Reference Table is a subset of the Consequence Description Table found in
the RiskBase (version 3) DoH Data Definitions document. The table has been simplified by
removing the impact categories that are not relevant for business continuity. Note that
RiskBase will be discontinued from March 2016.
BIA Handbook November 2015
6
Carrying out the BIA The following tables describe the process for carrying out each step of the BIA. This
is to be used with the BIA template.
Step 1 Preparation and set-up
Template /
tool:
WS1 Listing of Activities
Objectives: To identify the activities that are undertaken by each business
area
Who should
provide inputs:
Unit / business area managers
Key tasks:
1. Identify the directorates and units / Business Areas in the
organisation, and the managers responsible for these areas.
2. Identify the sub-units (if appropriate) under each Unit /
Business Area.
3. Identify the activities that are performed in each Sub-unit (or
Unit / Business Area if Sub-units are not applicable).
Additional
notes
When identify activities that are performed in each Sub-unit,
care should be taken to ensure that they are not listed at too
high or too low a level. The following are some general
guidelines:
Identify what is done or what service is provided, not how it
is carried out
If you start to going into a process or procedural breakdown,
you have gone too far
If a set of tasks must be carried out in sequence in order to
meet an objective, complete a job or deliver a service, you
can probably group these into one activity rather than listing
them as several activities
A sample list of activities is presented in Attachment 5.
BIA Handbook November 2015
7
Step 2 Dependencies Assessment
Template /
tool:
WS2A Dependencies Assessment – People and
Infrastructure
WS2B Dependencies Assessment – Systems and
Applications
Dependencies Rating Table
Objectives: To Identify the resources that are used by each of the activities
(identified in Step 1) under normal operations, and assess the
level of dependency that the activity has on a given resource
Who should
provide inputs:
Senior staff members with good operational knowledge. Results
are to be reviewed by the respective Unit / Business Area
managers
Approach: One-on-one / small group interview with facilitator
Key tasks:
WS2A Dependencies Assessment – People and Infrastructure
1. Identify the dependencies (people, utilities / essential
services, office equipment and telecommunications, medical
equipment, specialised equipment and key consumables)
that are used by each activity
2. For each activity, rate the level of dependency (using the
dropdown menu) that it has on each of the resources listed.
Refer to the Dependency Rating Table for the definitions of
the ratings
WS2B Dependencies Assessment – Systems and Applications
1. Identify the systems / applications that are used by each
activity
2. For each activity, rate the level of dependency (using the
dropdown menu) that it has on each of the system /
application listed. The Dependency Rating Table is to be
used with this worksheet
3. When all the activities have been assessed, return to the list
of systems / applications. For each system / application:
4. Determine the “system off-line duration”– the maximum
duration that a system / application may be unavailable
before the impact becomes unacceptable using the
dropdown menu
5. Determine the “data loss duration” – the maximum data loss
that can be tolerated before it becomes unacceptable using
the dropdown menu.
BIA Handbook November 2015
8
Additional
notes:
Upon completion of the assessment, the ratings will provide
an indication of what the critical dependencies for each Unit /
Business Area are, and a separate exercise may be
undertaken to risk assess these dependencies and to
implement further preventative controls or contingency
measures where necessary
BIA Handbook November 2015
9
Consolidated dependencies profile
Template /
tool:
None
Objectives: To present a consolidated view of the resource dependencies
across the healthcare facility
Who should
provide inputs:
The person who is coordinating business continuity across the
healthcare facility will consolidate the information when all the
units / business areas have completed Step 1.
Key tasks:
WS2A Dependencies Assessment – People and Infrastructure
1. For smaller healthcare facilities, the assessments conducted
for each unit / business unit on WS2A may be simply be
merged into a single worksheet
2. For larger healthcare facilities, the assessments at the
activity level may be rolled up to a unit / business area level
by selecting the highest dependency rating for each
resource as being representative of the overall rating for the
unit / business area
A sample output is presented in Attachment 3
WS2B Dependencies Assessment – Systems and Applications
1. Similar to WS2A, the assessments at the activity level may
be rolled up to a unit / business area level by selecting the
highest dependency rating for each system / application as
being representative of the overall rating for the unit /
business area
A sample output is presented in Attachment 4
BIA Handbook November 2015
10
Step 3 Impact assessment
Template /
tool:
WS3 Impact Assessment
Impact Reference Table
Objectives: To assess the potential business impact of a disruption to
activities, determine the maximum amount of time that the
activities may be disrupted for before the impact becomes
intolerable, and prioritise the activities for recovery
Who should
provide
inputs:
Managers for the respective Units / Business Areas. Results to be
reviewed and endorsed by the Director
Approach: Facilitated workshop
Key tasks:
For each service / activity identified:
1. Discuss how a disruption could impact the organisation, using
the impact categories in the Impact Reference Table as a
guide (not all the impact categories would be relevant for every
activity). Use column C, “Impact of disruption”, to make notes
of key points discussed and note the relevant impact
categories in column D.
2. Score the impact over various timeframes (i.e. minutes, hours,
days, weeks) using the severity level rating 1 to 5 (dropdown
menu) as defined in the Impact Reference Table, taking into
consideration the impact categories discussed earlier. Answer
the question, “What would the severity level rating be if this
activity was disrupted for minutes, hours, days and weeks?”
3. Determine the Maximum Tolerable Period of Disruption
(MTPD)3 in column I by selecting the appropriate timeframe (2
hours, 4 hours, 8 hours, 1 day, 3 days, 1 week, 2 weeks and 1
month+) in the dropdown menu. The MPTD should be guided
by the severity level ratings in the previous task - a score of 4
or 5 indicates an unacceptable level of impact (this is the “cut-
off” score). The MPTD should therefore fall within the
timeframes where the score is a 4 or 5 in the time columns
(see examples and table below).
Example 1 - the cut-off score of 4 appears in the ‘Days’ column,
hence the MTPD fall within 1 to 7 days. The specific MTPD is
arrived at based on discussion and agreement with the workshop
3 MTPD refers to the maximum amount of time that an activity can tolerate a disruption
before the impact on the organisation becomes unacceptable
BIA Handbook November 2015
11
participants
Example 2 – the cut-off score of 4 appears in the ‘Weeks’ column,
hence the MTPD should fall within 1 week to a month. The specific
MTPD is arrived at based on discussion and agreement with the
workshop participants
Example 3 – the cut-off score of 4 does not appear in any of the
time columns. This indicates that this activity could be stopped for
weeks with little impact on the organisation, and the MTPD will be
more than a month. The specific MTPD is arrived at based on
discussion and agreement with the workshop participants
Examples: Impact ratings
Mins Hrs Days Wks MTPD
Example 1 2 3 4 5 3 days
Example 2 1 2 3 4 2
weeks
Example 3 1 1 1 2 3
months
4. Repeat the assessment for each service / activity listed.
5. Upon conclusion of all the assessments, every activity in the
Unit / Business Area should have an associated MTPD. The
MPTDs thus provide the basis for you to prioritise recovery of
these activities following a disruption.
Additional
notes:
The following ground rules should be observed when performing
the assessment:
Assess the impact from an organisation-wide perspective, i.e.
how would a disruption impact the organisation, rather than on
the individual Unit / Business Area
The cause of the disruption is immaterial – it may be a power
outage, roof collapse, fire, etc. – the focus is on the impact of a
disruption, rather than the cause of the disruption
Do not take into consideration any contingency arrangements
that may already be in place or measures that could be
implemented to mitigate the impact – these will be addressed
in the strategy phase of the BCM process
BIA Handbook November 2015
12
Consolidated BIA profile and priorities
Template /
tool:
None
Objectives: To present the consolidated findings of the impact assessment
for Executive management endorsement
Who should
provide inputs:
The Business Continuity Coordinator for the healthcare facility is
responsible for consolidating the information when all the units /
business areas have completed Step 3.
Key tasks:
1. Upon completing the impact assessments for all the
Directorates, the results (from WS3) should be consolidated
and presented to the Executive for endorsement.
2. As a general guideline, all activities with MTPDs of 2 weeks
or less are considered as “priority activities” and must fall
within the scope of the organisation’s business continuity
strategies and response plans
A sample output is presented in Attachment 5.
Additional
notes:
It is important that Executive endorsement is obtained before
proceeding to Step 4.
BIA Handbook November 2015
13
Step 4 Business continuity strategies and resource requirements
Template /
tool:
WS4A Business continuity strategies
WS4B Resource requirements
WS4C Interdependencies
Objectives: To identify the strategies, interdependencies and resource
requirements for the continuity of priority activities
Who should
provide inputs:
Managers for the respective Units / Business Areas. Results to
be reviewed and endorsed by the Director
Approach: Facilitated workshop
Key tasks:
WS4A Business continuity strategies
The purpose of WS4A is to document the high level strategies
for the continuity of priority activities (i.e. those with MTPD of 2
weeks or less as identified in Step 3)
For each priority service / activity:
1. Identify the Immediate Continuity Strategy (column E) for
responding to a disruption and the duration that this strategy
can be maintained for (column F). This is a short term
strategy designed to provide a bare minimum or basic level
of service in order to contain or minimise the impact of the
disruption on stakeholders until a more sustainable level of
service can be provided.
2. Identify the Sustainable Continuity Strategy (column G) that
will provide a higher level of service that can be sustained
beyond the Immediate Continuity Strategy, and the duration
that this strategy can be maintained for (column H)
Note:
There may be instances where the Immediate and
Sustainable continuity strategies are the same
Examples of strategies include (not exhaustive)
o Temporary suspension of an activity
o Redirecting the activity to another facility
o Transferring resources to another facility
o Redirecting patients to alternate care options
o Using alternate procedures / workarounds
o Stopping altogether until full recovery can be
achieved, etc.
BIA Handbook November 2015
14
WS4B Resource requirements
The purpose of WS4B is to capture the minimum levels of
resources required by a sub-unit / unit over various timeframes
(8 hours, 1 day, 3 days, 1 week, 2 weeks and 1 month or
greater) to implement the business continuity strategies
identified in WS4A.
The information is collected at an overall sub-unit / unit /
business area level rather than activity level as the same
resources are likely to be shared or deployed across a number
of services / activities. The resource information collected in
Step 2 on WS2A will automatically be transferred to this
worksheet.
You may or may not need to create multiple copies of this
template, depending on the number of sub-units you have and
how resources are deployed. As a general guide:
If the sub-units are fairly autonomous and have their own
pool of personnel, each sub-unit will require its own
worksheet.
If the sub-units are largely dependent on the same pool of
personnel who share duties and responsibilities across sub-
units, you can combine the sub-units and have a single
worksheet for the unit / business area.
In the example within the spreadsheet, Operation Theatre
Services, Central Sterilisation Services and Day Stay Unit are 3
autonomous sub-units. Each of them will require its own
worksheet.
People
1. For each category / position (e.g. Manager, Medical Officer,
Nurse, etc.) that are in the sub-unit / unit / business area,
identify the number of staff that you have under normal, day-
to-day, conditions (column B)
2. For each timeframe (i.e. 8 hours, 1 day, 3 days, etc.) in
column B, identify the minimum number of staff in each of
the categories / positions that will be required to support the
continuity strategies of priority activities identified in WS4
Office equipment and telecommunications, medical equipment,
specialized equipment and key consumables, systems /
applications and utilities / essential services
BIA Handbook November 2015
15
1. For each type of resource listed, identify the normal quantity
that are in use, and the minimum quantities that are required
over time (i.e. 8 hours, 1 day, 3 days, etc.) to support the
continuity strategies of priority activities identified in WS4
2. If a resource that is required is not quantifiable, use ‘Y’ (for
yes) to indicate that it is needed
WS4C Interdependencies
The purpose of WS4C is to capture the internal and external
dependencies of a sub-unit / unit / business area in relation to
the priority activities. Like WS4B, the information is collected at
an overall sub-unit / branch / business are level rather than
activity level as multiple activities are likely to have the same
interdependencies.
The same guidelines from WS4B on the need for multiple
copies apply for this worksheet.
1. Internal Interdependencies - identify the internal parties /
stakeholders (outside the branch / business area) within the
organisation with whom you have interdependencies with.
Upstream – are parties whom you are dependent on to
perform your activities
Downstream – are parties who are dependent on you to
perform their activities
2. External Interdependencies - identify the external parties /
stakeholders (outside the health facility, such as other
agencies, suppliers, service providers, etc.) with whom the
branch / business area have interdependencies with.
Upstream – are parties whom you are dependent on to
perform your activities
Downstream – are parties who are dependent on you to
perform their activities
16
Attachment 1 Impact Reference Table SEVERITY LEVEL 1 2 3 4 5
CONSEQUENCE CATEGORIES Insignificant Minor Moderate Major Catastrophic
FL FINANCIAL LOSS
(Destruction, Theft, or Litigation / penalties)
Less than $5,000. $5,000 to less than $100,000.
$100,000 to less than $3M. $3M to less than $20M. $20M +.
RI REPUTATION AND IMAGE
Non-headline exposure. Not at fault. Settled quickly. No impact.
Non-headline exposure. Clear fault. Settled quickly by Departmental response. Negligible impact.
Repeated non-headline exposure. Slow resolution. Ministerial enquiry / briefing. Qualified Accreditation.
Headline profile. Repeated exposure. At fault or unresolved complexities impacting public or key groups. Ministerial involvement. High priority recommendation to preserve accreditation.
Maximum multiple high-level exposure. Ministerial censure. Direct intervention. Loss of credibility and public / key stakeholder support. Accreditation withdrawn.
NC NON-COMPLIANCE
Innocent procedural breach. Evidence of good faith by degree of care / diligence. One off minor legal matter. Little impact.
Breach, objection/complaint lodged. Minor harm with investigation. Evidence of good faith arguable.
Breach of contractual or statutory obligations, or probity infringements. Lack of good faith evident. Non-compliance results in performance review.
Major breach of contractual or statutory obligations. Non-compliance results in termination of process or imposed penalties, formal investigation or disciplinary action. Ministerial involvement.
Serious breach of contractual or statutory obligations. Non-compliance results in loss of accreditation, litigation or prosecution with significant penalty. Dismissal. Ministerial censure. Public enquiry
HP HEALTH IMPACT ON PATIENT(S) / STAKEHOLDERS
Increased level of care (minimal). No increase in length of stay. Not disabling. Little or no noticeable impact on patient care**.
Increased level of care (minimal). Increased length of stay (up to 72 hours). Recovery without complication or permanent disability. Inconvenience & minor delays to individuals but little or no impact on overall service delivery**
Increased level of care (moderate). Extended length of stay (72 hours to one week). Recovery without significant complication or significant permanent disability. Moderate impacts on a number of individuals, resulting in noticeable impact on overall service delivery**
Increased level of care (significant). Extended length of stay (greater than one week). Significant complication and/or significant permanent disability. ALL SAC 1 EVENTS Serious impacts on significant numbers of individuals, resulting in noticeable impact on overall service delivery**
Death, permanent total disability. ALL SAC 1 EVENTS. Major / debilitating and long term impacts on individuals and overall delivery of services**
OO ORGANISATIONAL OBJECTIVES
Little impact. Inconvenient delays. Material delays. Marginal under achievement of target performance.
Significant delays. Performance significantly under target.
Non-achievement of objective / outcome. Total performance failure.
*Note: Table is a subset of the Consequence description table in the Riskbase DOH Data Definition. Text in italics added to provide clearer contextual reference for the purpose of the BCM Business Impact Analysis
17
Attachment 2 Dependency Rating Table
Level Description
1 Minimal
dependency
There is minimal dependency on this resource. Resource is nice to have; successful delivery of critical services or completion of a task is possible without this resource
2 Low
dependency
There is low dependency on this resource for the successful provision of critical services or completion of a task; an outage will have minimal material impact; the task can still be successfully completed using manual workarounds or alternative resources as a stop gap measure until the resource is available again.
3 Occasional dependency
Successful delivery of critical services or completion of a task is occasionally dependant on this resource; an outage may cause some inconvenient delays in completion of a task but parts of the task can be successfully completed using manual procedures or alternative resources for a period of time.
4 High
dependency
Successful delivery of a critical service is fully dependant on this resource; resource is used regularly for processing; an outage may result in significant knock on effects; there is low tolerance of an outage before the impact becomes unacceptable; limited manual workaround or alternative resource may be used for a short period of time as a stop gap measure.
5 Critical
dependency
Successful delivery of a critical service is fully dependant on this resource; resource is used continuously for processing or to provide real time feedback/information; resource must be operational 24 x 7; an outage may result in serious knock on effects; there is close to zero tolerance of an outage before it becomes unacceptable; there are no or very limited manual workaround or alternative resources.
18
Attachment 3 Consolidated Dependencies Assessment – People and Infrastructure (Sample)
People Utilities / Essential services Office equipment and telecommunications Medical equipment Specialised equipment Key consumables
Service Area C
linic
al sta
ff
Nurs
ing s
taff
Ord
erlie
s
Adm
inis
tratio
n s
taff
Te
chnic
ians
Pow
er
Wate
r
Natu
ral gas
Liq
uid
petr
ole
um
gas
(LP
G)
Me
dic
al oxygen
Me
dic
al N
itro
us O
xid
e
Me
dic
al carb
on d
ioxid
e
Me
dic
al air
Me
dic
al suctio
n
Ventila
tio
n
Air-c
onditio
nin
g / H
eatin
g
Pers
onal com
pute
r
Lapto
p c
om
pute
r
Ta
ble
t
Prin
ter
(bla
ck a
nd w
hite)
Prin
ter
(colo
ur)
Photo
copie
r
Fa
x m
achin
e
Docum
ent scanner
Desk p
hone
Mo
bile
phone
DE
CT
Phones
Pager
Inte
rnet
access
Operation Theatre services 5 5 4 2 4 5 5 5 5 5 5 5 5 5 4 2 5 5 3
Central Sterilisation Services Dept
5 5 5
Day Stay Unit services 5 4 5
Administration and Medical Records
5 2 5 3 5 4 3 3 3 5 3 3 5
Nursing 5 3
Allied Health 5 5 3 3 5 4
Aged Care Services 5 4 4 4 4 5
Community Mental Health 5 3
Emergency Department 5 5 4 2 3 5 5 5 5 5 5 5 5 5 5 4 3 3 3 5 5 5 5
Inpatient Medical & Nursing Care
5 5 5
Maternity 5 5 3 2 2 5 4 5 5 5 5
Hospital Management 5 3
Home Nursing Discharge Services
5 3
Pharmacy and Supply 5 3 5
Food Services 5 5 5 5
Laundry Services 5 5 5 3
19
Attachment 4 Consolidated Dependencies Assessment – Systems and Applications (Sample)
Applications
# Services using this application
Level of dependency
System offline
duration
Data loss
duration
Business areas
Op
era
tion
The
atr
e s
erv
ices
Cen
tral S
terilis
atio
n S
erv
ice
s
Dep
t
Day S
tay U
nit s
erv
ice
s
Ad
min
istr
ation a
nd
Med
ical
Reco
rds
Nurs
ing
Alli
ed
He
alth
Ag
ed C
are
Se
rvic
es
Com
mu
nity M
en
tal H
ea
lth
Em
erg
en
cy D
ep
art
men
t
Inp
atie
nt M
ed
ical &
Nurs
ing
Ca
re
Ma
tern
ity
Hosp
ita
l M
ana
ge
me
nt
Hom
e N
urs
ing
Dis
ch
arg
e
Se
rvic
es
Ph
arm
acy a
nd
Su
pp
ly
Foo
d S
erv
ice
s
La
un
dry
Se
rvic
es
Health Records Management + Scanning and eForms (eHRM)
9 5 30 mi 0 3 4 4 2 5 5 4 3 1
WebPAS 13 5 30 mi 0 2 2 2 4 5 5 5 3 2 1 1 4 5
Clinical Pathology (Ultra/LIS) 0 5 1 h 0
Theatre Management System (TMS) 14 5 3 h 0 3 3 2 2 4 5 5 5 3 2 1 1 4 5
Internet 15 5 1 h N/A 1 1 2 4 5 5 5 3 2 1 1 4 5 2 4
eReferrals 13 4 6 h 0 2 2 4 5 5 5 3 2 1 1 4 5 5
Cardiobase 0 4 4 h 1 h
Enterprise Bed Management (EBM) 13 4 4 h 1 d 1 3 3 2 2 4 5 5 5 3 2 1 1
Diet Management 10 4 1 d 0 2 4 5 5 5 3 2 1 1 4
HealthPoint (Sharepoint Intranet) 14 3 6 h 1 d 5 5 5 3 2 1 1 5 5 5 3 2 1 1
Haematology & Oncology Protocols & Prescriptions (HOPP)
9 3 1 d 0 2 5 5 5 3 2 1 1
MS Exchange 9 3 1 d 0 5 5 5 3 2 1 1 4 2
WA Nephrology Database (WAND) 0 3 1 d 0
Journeyboard 11 3 3 d N/A 3 2 1 1 4 2 4 2 1 1 5
Allied Health System (AHS) 1 2 3 d 2 d 4
Quality of Care Registry (QoCR) 2 2 5 d 1 d 3 5
Transition Care (TCP) 7 2 5 d 1 d 5 5 5 3 1 1
MS Office 11 2 1 d N/A 5 5 5 3 2 1 1 5 2 1 4
ScriptTracker2 8 2 3 d N/A 5 5 5 3 2 1 1 5
Nursing Hours per Patient Days (NHpPD)
8 2 1 w 1 w 5 5 5 3 2 1 1 5
health.wa.gov.au
Business Continuity Plan
(Insert health service)
BCP template 20151113 V1 approved
Approved: (Insert approval date)
Version: (insert version control)
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 1
This page has been left intentionally blank
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 2
Contents
1. Introduction 6
1.1 Purpose of plan 6
1.2 Objectives 6
1.3 Scope of plan 6
1.4 Assumptions of plan 7
1.5 Ownership 7
1.6 Plan Availability 7
1.7 Associated documents 8
2. Organisation background 9
2.1 Description of health service 9
2.2 Organisational aim 9
2.3 Key organisational objectives 9
2.4 Organisational structure 9
3. BCM Governance and Policy 10
3.1 Policy statement 10
3.2 Roles and responsibilities 10
3.3 Governance 10
4. Plan review and maintenance 10
5. Training and exercising 11
5.1 Training 11
5.2 Exercising 11
6. Business Continuity Priorities and Strategies 13
6.1 Critical business functions 13
6.2 Business continuity strategies 14
7. Plan activation 16
7.1 Activation criteria 16
7.2 Authority to activate 16
7.3 Escalation 16
7.4 Mobilisation of Business Continuity Team 16
7.5 Incident Control Point 16
7.6 Activation process 17
7.7 Standing down 17
8. Response organisation 18
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 3
9. Communication strategy 19
10. Functional Annexes 20
Annex 1 Business Continuity Team 21
Roles and responsibilities 21
Team members 21
Incident Control Point 21
Response Actions 22
Contact List 23
Reference information 24
Consolidated Business Impact Profile and Priorities 24
Consolidated Interdependencies 25
Consolidated Dependencies – Resources 26
Consolidated System / Application Requirements 27
Annex 2 Perioperative Unit 28
Roles and responsibilities 28
Team members 28
Critical Functions 28
Business Continuity Strategies 28
Response Actions 29
Annex 3 ……etc 32
(update field when document finalised)
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 4
Authorisation
This business continuity plan outlines the critical business functions of (insert health service) and the strategies, dependencies and resources required to continue the identified critical business functions following a disruption.
This document is endorsed as the approved plan for (insert health service) to be followed in the event of such a disruption.
Approved
________________________________________
<Title First Name Last Name> INSERT POSITION INSERT HEALTH SERVICE
Date authorised: (DD MONTH YYYY)
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 5
Amendment Certificate
Amendment Details Amended by
No. Date
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 6
1. Introduction
1.1 Purpose of plan
This should section outline the purpose of the BCP.
For example:
This Business Continuity Plan (BCP) sets out the principles to be followed, actions to be taken and resources to be used when responding to a critical incident that results in, or has the potential to result in, disruption to critical business functions at (insert health service)
1.2 Objectives
Describe the objectives of the business continuity plan and processes that are being implemented
For example:
The objectives of the BCP are:
Prevent the loss of life, minimise property damage and lessen any negative consequences on (insert health service) and the Department of Health
To establish and implement a structured process that will enable (insert health service) to effectively manage and respond to any anticipated or unanticipated disruptions in a timely manner
To minimise disruption to critical business functions and the resultant impacts on patients, visitors, employees and other stakeholders
Etc.
1.3 Scope of plan
Describe areas covered by the plan and areas that are excluded from the plan.
For example:
This plan is used in the event of a disruption resulting from a prolonged loss or denial of access to infrastructure and premises at (insert health service). It applies to all the activities and resources necessary to ensure the continuity of (insert health service) critical functions in the event normal operations are disrupted or threatened with disruption.
Critical functions are those with a Maximum Tolerable Period of Disruption (MTPD) of 2 weeks or less as determined in the business impact analysis. Functions with
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 7
MTPD greater than 2 weeks will temporarily be suspended and appropriate arrangements will be made at the time of incident for the recovery of these functions.
This plan cross references (insert health service)’s Emergency Management Plan and the supporting emergency response procedures.
This plan does not address day to day operational problems or procedure for dealing with emergencies (such as bomb threat, fire or building evacuation). These are addressed in the appropriate standing operations procedures and emergency response plans.
Contingency arrangements for internal infrastructure disruptions are detailed in Emergency Procedure Manual, Code Yellow – Infrastructure and other internal emergencies. These arrangements may be activated in parallel with this plan.
1.4 Assumptions of plan
The following assumptions have been made as a part of the planning process:
List in dot point form the considerations, suppositions and inferences on which the BCM planning process is based upon.
Assumptions may relate to accommodation, resource requirements, interdependencies and cost justification or response or recovery strategies.
Assumptions should be communicated and agreed to by all stakeholders. Where assumptions relate to response and recovery strategies, they should be tested as part of the BCP exercise schedule.
For example: The contingency arrangements for emergencies relating to infrastructure failures are detailed in the code yellow section of the emergency procedures.
1.5 Ownership
Describe who is owns and is accountable for this plan
1.6 Plan Availability
Describe who has copies of this plan, how it is stored and accessed
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 8
1.7 Associated documents
Describe how this plan is related to other response plans in the organisation. This may include emergency procedures manuals, surge plans, ICT disaster recovery plan, etc.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 9
2. Organisation background
2.1 Description of health service
Insert description of health service, its history and future plans, and the community it service
2.2 Organisational aim
Insert aim(s) of health service.
This should be a high level statement about the reason the health service exists.
For example:
Provide high quality health care to the local community.
Hint: Organisational aims and objectives may be ascertained from the organisation’s strategic plan.
2.3 Key organisational objectives
Insert the key organisational objectives of the organisation.
This area should provide some more detail about how the health service will meet its aim. If any of these objectives are not met, this will seriously jeopardise the viability of the service.
For example:
Provision of emergency department services.
2.4 Organisational structure
The (insert health service) incorporates (insert organisational elements).
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 10
3. BCM Governance and Policy
3.1 Policy statement
Describe the health service’s BCM and Department of Health policy related to BCM
3.2 Roles and responsibilities
Insert details of who is accountable for business continuity, the committee responsible for drafting, testing and reviewing the BCP, and executive responsible for approving the BCP.
3.3 Governance
Describe how will governance oversight of business continuity be carried out and how will compliance with the policy and requirements be monitored and reported.
4. Plan review and maintenance
Describe how often and under what circumstances should plan review and maintenance be carried out, and who has responsibility for them. Describe also how will continuous improvements and updates be carried out post testing or after an actual incident
Example:
This BCP will be reviewed annually to ensure call trees, positions and structures remain accurate. Business impact analyses should be reviewed every three years to ensure critical business functions reflect the aims and objectives of the organisation.
This BCP may be audited to ascertain its adherence to Operational Directive 0595/15 – Business Continuity Management.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 11
5. Training and exercising
5.1 Training
Describe the training objectives, how often and the type of training to be conducted, who should be in attendance, and who has overall responsibility to develop and implement the training programme.
For example:
A BCM Awareness Briefing is conducted for all (insert health service) personnel
once a year. For new joiners, this briefing will be conducted as part of their induction
programme.
Training for those in the business continuity teams will be incorporated into the
exercising programme. If necessary, briefing sessions will be conducted prior to
exercises to provide background and contextual information but participation in the
exercise itself has the added benefit of training the staff at the same time.
Personnel with specific responsibilities for developing, implementing, exercising and
maintain the BCP are provided with additional training and other opportunities to
enhance their BCM technical competencies and professional standing. This may be
in the form of a formal professional development programme, professional
certification, membership with professional bodies and participation in industry
forums.
The {identify who} is responsible for identifying the BCM skills and competencies
required, developing an appropriate BCM training programme to meet the needs of
(insert health service) personnel, and coordinating the delivery of the training
programme.
5.2 Exercising
Describe the exercising objectives, how often and the type of exercises to be conducted, who should be in attendance, and who has overall responsibility to develop and implement the exercising programme
Example:
Exercises help to verify the effectiveness of all aspects of (insert health service)’s
business continuity arrangements. The aims are to:
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 12
Ensure that plans are current, proven and maintained by the people needing to
use them when an incident occurs.
Provide an opportunity for (insert health service) personnel to rehearse the plans
in order to build familiarity with the response actions, develop effective team
work, and instil confidence
Assess and validate (insert health service) business continuity capability in
responding to an actual incident
Identify shortcomings in (insert health service) business continuity strategies and
plans so that corrective actions can be taken
At minimum, an exercise is to be conducted annually. This may be carried out
notionally, such as a scenario-based walkthrough of the plans or a tabletop exercise,
or in practice involving the actual mobilisation of resources to carry out business
continuity activities.
The {identify who} is responsible for developing an exercise programme and
coordinating the conduct of exercises.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 13
6. Business Continuity Priorities and Strategies
Provide an overview of the health service’s business continuity priorities and strategies. The information in this section can be extracted from the consolidate business impact profile and strategies identified during the Business Impact Analysis.
Example:
6.1 Critical business functions
A Business Impact Analysis (BIA) was conducted to assess the potential impact on
(insert health service) of a disruption to services and to prioritise the business
activities and services for the recovery. Details of the BIA can be found in the
document “name of BIA report”.
Findings of the BIA were subsequent updated and ratified by the Executive on (date)
with the following list of critical business functions:
Figure 1 Critical Business Functions
Branch / Business
Area
Sub Unit Service / activity2 hrs 4 hrs 8 hrs 1 day 3 days 1 wk 2 wks 1 mth+
Perioperative Unit Operation theatre services Perioperative care x
Central sterilisation services Decontamination of surgical and
medical equipmentx
Sterilisation of surgical and medical
equipmentx
Storage of sterile non-disposable
equipmentx
Day Stay Unit services Elective day surgery procedures x
Emergency bed response x
Day infusion procedures x
General Ward Inpatient medical and
nursing care
Acute surgicalx
Acute medical x
Paediatrics x
Education and training for staff x
Liaising with aged care facilities x
Maternity Acute antenatal care x
Birthing including emergency care x
Post natal care x
Hospice Palliative care - terminal illness x
Palliative care specialists clinics x
Referral to consultancy and allied
servicesx
MTPD
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 14
Maximum Tolerable Period of Disruption (MTPD) refers to the time within which a
business activity or service must be resumed following a disruption. It is measured
from the time a disruption occurs to the time when the activity or service becomes
operational again.
Other activities that are not listed in the above table (i.e. Those with MTPD of more
than 2 weeks) will temporarily be deferred in the event of BCP invocation. Although
these deferred activities may be important for the day to day operations, they are not
deemed to be time critical under business continuity situations. Deferred activities
will be restored during the long term recovery phase – the level of effort, allocation of
resources and actions needed would be dependent on the nature of the incident.
6.2 Business continuity strategies
Describe the broad business continuity strategies of the health service as a whole. It is not necessary to describe each business unit’s strategy here – there are contained in the respective business unit’s business continuity action plans.
Example:
The broad business continuity strategies for responding to a major incident and
disruption to (insert health service) are as follows:
In the event of an ICT or building service (such as power, water, air conditioning,
etc.) outage that does not impact the safe operations of the (insert health service)
facility, the facility will remain opened and affected areas may continue to operate
using alternate / work around procedures until the outage is resolved. The
Emergency Management Plan and facilities related contingency plans may be
activated as required.
In the event that an incident renders the (insert health service) building unsafe or
inaccessible, all services will be suspended and the (insert health service) will be
closed. The BCP will be activated and plans for the continuity of critical business
functions will be enacted within the specified MTPDs.
Depending on the nature and expected duration of the disruption, a separate plan
for the recovery of non-critical activities and services will be developed in parallel
to the BCP activation, if necessary.
(insert health service) will remain closed until such a time when the building is
made safe for occupation and services are returned to normal.
A summary of the broad business continuity strategies of each business area is outlined in Figure 2. Detailed response actions and resource requirements for the recovery of critical business functions are documented in the respective business area’s Business Continuity Action Cards.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 15
Sub-unit Service / activity MTPD Immediate continuity strategy Maintainable
duration Sustainable continuity strategy Maintainable
duration
Operation Theatre (OT) Services
Perioperative care 2 weeks
- Temporarily suspend new admissions and elective surgery - Redirect emergency surgery to next nearest hospital
1 week - Transfer elective lists to other hospitals in the region - Relocate resources to other hospitals to carry out elective surgeries
4 weeks
Central Sterilisation Services Department (CSSD)
Decontamination of surgical and medical equipment
3 days - Transfer decontamination of 3rd party equipment to the CSSD of a regional hospital - Transfer surgical and medical equipment to the CSSD of next nearest hospital
1 shift - Relocate resources to CSSD at other hospitals to carry out function
1 week
Sterilisation of surgical and medical equipment
1 day - Transfer surgical and medical equipment to the CSSD of next nearest hospital
1 shift - Relocate resources to CSSD at other hospitals to carry out function
1 week
Storage of sterile non-disposable equipment
3 days - Transfer surgical and medical equipment to the CSSD of next nearest hospital
1 shift - Relocate resources to CSSD at other hospitals to carry out function
1 week
Day Stay Unit (DSU) Elective day surgery procedures
2 weeks
-Temporarily suspend the activity 2 weeks - Transfer day surgery procedures to other hospitals in the region
Indefinite
Emergency bed response 1 week -Transfer patients to other hospitals
4 weeks -Transfer patients to other hospitals
Indefinite
Day infusion procedures 1 Month
+
-Temporarily suspend the activity - Redirect patients back to GPs or surgeries
2 weeks - Redirect patients to next nearest hospital
Indefinite
Figure 2 Summary of business continuity strategies
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 16
7. Plan activation
7.1 Activation criteria
This plan is activated when a disruption occurs, and where a pre-identified critical business function (CBF) has, or is predicted to, exceed its maximum tolerable period of disruption (MTPD).
Where applicable, delineate between emergency response and business continuity response and the arrangements for transitioning between the two responses.
7.2 Authority to activate
Authority to activate this plan rests with the (insert relevant position).
7.3 Escalation
Upon implementation of a business continuity strategy that is anticipated to affect other health services, system-level coordination may be required. In these cases, the On Call Duty Officer at the Department of Health is to be notified on (08) 9328 0553 (24 hours) at the earliest convenience. NB: WA Country Health Service (WACHS) hospitals should escalate through their respective Regional Directors.
7.4 Mobilisation of Business Continuity Team
On activation of this plan, the Business Continuity Team (BCT) is to mobilise at (insert location). Members of the BCT include:
Insert BCT team members
Stipulate which team member has overall authority / responsibility.
Ideally BCT members should represent a division / service area of the organisation.
Team members should be listed by position.
Add detail about how team is mobilised. For example: through 55 call, paging group or contact list in the appendices.
7.5 Incident Control Point
An Incident Control Point (ICP) is a pre-designated location from which the response
teams would coordinate on-site activities when the BCP is activated. Depending on
the nature of the incident, the ICP will established at one of three locations, if
possible:
Primary location –
1st alternate location -
2nd alternate location -
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 17
If any of the above location is not available or suitable, the person in charge will have
the discretion to decide on the best alternative place to meet, taking into considering
safety issues and proximity to the impacted site.
7.6 Activation process
The following algorithm (sample) outlines the response continuum from the occurrence of a disruption, right through to the stand down.
(adjust this to suit the health service’s processes).
Update
Disruption occurs
Emergency?
Stand down
Emergency response
arrangements activated
Incident Management
Team mobilised
A Critical Business Function
(CBF) has, or is forecast to exceed, the Maximum
Tolerable Period of Disruption
(MTPD)?
N O
Executive authorises activation of Business
Continuity Plan
Mobilisation of Business Continuity
Team (BCT)
YES
Ongoing monitoring &
review of situation
YES
N O
BCT coordinates Business
Continuity Response
Incident resolves +/-recovery complete
Return to business-as-usual
Recovery efforts undertaken
On Call Duty Officer, Department of Health (WA)
(08) 9328 0553
WACHS sites to notify Regional Director
Notify
Review, update & continually
improve
Situation escalates
SAMPLE
7.7 Standing down
This plan can be stood down by the (insert position) when the following criteria are met:
Business-as-usual procedures have been resumed for CBFs; and
Recovery efforts have been completed; or
The disruption has been resolved.
Once normal business processes have resumed, the (insert health service) should notify all relevant stakeholders, as per the communication strategy in section 9.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 18
8. Response organisation Describe the organisation that will be established when the BCP is activated, and the roles and responsibilities of the various teams. This will need to dovetail with the existing emergency management team structure. Provide org chart.
Example:
The Business Continuity Team (BCT) is responsible for coordinating on-site tactical and operational response when the BCP is activated in response to a disruption. The key responsibilities of the team are:
Gather details and assess the impact of the incident Oversee the resumption of critical business functions Liaise with local emergency services, other healthcare facilities and support
agencies Coordinate deployment of internal and external resources required to support
service resumption and recovery Keep the Executive appraised of the incident and status of recovery Carry out post-incident review and long term recovery (return to normal)
Role Responsibilities Reports to
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 19
9. Communication strategy In the event of a disruption, it is critical that stakeholders are effectively engaged and made aware of the disruption and the relevant business continuity strategies in place.
The (insert role) is responsible for implementing the communication strategy.
A stakeholder analysis should be conducted to identify relevant parties, the preferred method of communication and frequency of communication.
Communication templates can be added into the appendices.
Stakeholder Method of communication
Frequency Notes
Internal staff members
Internal emails
Staff forums
Twice daily
Daily
After one week, consider daily internal emails and twice daily staff forums
Suppliers Phone Call Email
Initial Daily
Notify supplier of initial disruption by phone call.
Subsequent updates can be sent by email
Media Press conference Initial, final and as required
The nominate speaker should be the executive sponsor.
On resolution of the disruption, the (insert position) is responsible for notifying the above stakeholders of the resumption of normal business processes.
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 20
10. Functional Annexes Functional annexes contain the specific actions cards and references that are
required for responding to a disruption and continuing critical business functions.
Example:
The functional annexes describe the specific roles and responsibilities, actions to be
taken, business continuity strategies and resources requirements by each of the
business units when the BCP is activated. While the main body of the BCP provides
overarching information relevant to the continuity of (insert health service) as a
whole, these annexes focus on specific responsibilities, tasks and operational
actions that pertain to the elements of a viable business continuity plan for each
team.
Annex 1 Business Continuity Team
Annex 2 Perioperative Unit
Annex 3 General Wards
Annex 4 …
Annex 5 …
Annex 6 …
Annex 7 …
Annex 8 …
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 21
Annex 1 Business Continuity Team
BUSINESS CONTINUITY TEAM
Roles and responsibilities
Gather details and assess the impact of the incident Oversee the resumption of critical business functions Liaise with local emergency services, other healthcare facilities and support
agencies Coordinate deployment of internal and external resources required to support
service resumption and recovery Keep the Executive appraised of the incident and status of recovery Carry out post-incident review and long term recovery (return to normal)
Team members
Role Primary Alternate
Team Leader
Logistics and Admin
Buildings and Facilities
Human Resources
Incident Control Point
Primary location
1st alternate location
2nd alternate location
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 22
Response Actions
Immediate
Action
Who Reference
Initiate Incident Log Obtain general situation report from the
notifier
Notify other members of the team as required
Determine the nature of the incident What has happened? Is anyone hurt? What services / areas are affected? What is the impact on critical
business activities / services? What has been done? How long is the disruption likely to
last?
On-going
Action
Who Reference
Post-incident
Action
Who Reference
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 23
Contact List
Internal contacts
Role Name Work Tel # After hours # Email
External Contacts
Organisation Contact 1 Contact 2
Name
Position
Office hours #
After hours #
Name
Position
Office hours #
After hours #
Name
Position
Office hours #
After hours #
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 24
Reference information
Consolidated Business Impact Profile and Priorities
Branch / Business
Area
Sub Unit Service / activity2 hrs 4 hrs 8 hrs 1 day 3 days 1 wk 2 wks 1 mth+
Perioperative Unit Operation theatre services Perioperative care x
Central sterilisation services Decontamination of surgical and
medical equipmentx
Sterilisation of surgical and medical
equipmentx
Storage of sterile non-disposable
equipmentx
Day Stay Unit services Elective day surgery procedures x
Emergency bed response x
Day infusion procedures x
General Ward Inpatient medical and
nursing care
Acute surgicalx
Acute medical x
Paediatrics x
Education and training for staff x
Liaising with aged care facilities x
Maternity Acute antenatal care x
Birthing including emergency care x
Post natal care x
Hospice Palliative care - terminal illness x
Palliative care specialists clinics x
Referral to consultancy and allied
servicesx
Emergency
Department
Emergency Department Triage and registrationx
Resuscitation including trauma x
Acute care x
Fast track x
Short stay observation x
Pharmacy Pharmacy Clinical pharmacy services x
Pharmacy technical services x
Outpatients Outpatients Community child health x
School health x
Continence x
Enuresis x
Immunisation x
Dietetics (In patient) x
Occupational therapy (In patient) x
Physiotherapy (In patient) x
Speech pathology (In patient) x
Podiatry x
Social work x
Community Mental Health x
Administration Administration Initiating patient flows (way
finding)x
Telephone
switchboard/communicationsx x
Receive incoming deliveries x
Medical record data entry and other
medical records functions
x
Account payments x
MTPD
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 25
Consolidated Interdependencies
Internal Interdependencies
External Interdependencies
Ad
min
istr
atio
n a
nd
M
edic
al R
eco
rds
Nu
rsin
g
Alli
ed H
ealt
h
Age
d C
are
Serv
ices
Co
mm
un
ity
Men
tal
Hea
lth
Emer
gen
cy D
epar
tmen
t
Inp
atie
nt
Med
ical
&
Nu
rsin
g C
are
Mat
ern
ity
Ho
spit
al M
anag
emen
t
Ho
me
Nu
rsin
g D
isch
arge
Se
rvic
es
Ph
arm
acy
and
Su
pp
ly
Op
erat
ion
Th
eatr
e se
rvic
es
Cen
tral
Ste
rilis
atio
n
Serv
ices
Dep
t
Day
Sta
y U
nit
ser
vice
s
Foo
d S
ervi
ces
Lau
nd
ry S
ervi
ces
SJO
G R
enal
Pat
hw
est
Glo
bal
Dia
gno
stic
s
Dis
tric
t Si
tes
Tert
iary
Sit
es
BO
C M
edic
al G
ases
Alin
ta N
atu
ral G
as
Wat
er C
orp
Service Area
Administration and Medical Records
U B U B B U B B U U
D U U B B U U U
Nursing B B D B U
U U D D U U U
Allied Health B B D B U U U D D U U U
Aged Care Services B D
U B U
Community Mental Health D D D D D D D D D D D D D D D
D D D D
Emergency Department B B B B U B U D U D U U
D U U B B U U
Inpatient Medical & Nursing Care U B U B B U B B U U
D U U B B U U U
Maternity U B U B B B U U B U U U U B U U U
Hospital Management U U U U D B U U U U
U U D D U U U
Home Nursing Discharge Services B
B U U U
Pharmacy and Supply U B D
U B U
Operation Theatre services U D D D D D
U
Central Sterilisation Services Dept B D D D D D D U D D D D
D U
Day Stay Unit services B B D B U U B
U U D U U U
Food Services B B D B U B
U U D U U U
Laundry Services B B D B U U
U U D U U U
D Downstream dependency
U Upstream dependency
B Up and downstream dependency
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 26
Consolidated Dependencies – Resources
People Utilities / Essential services Office equipment and telecommunications Medical equipment Specialised equipment Key consumables
Service Area
Clin
ical sta
ff
Nurs
ing s
taff
Ord
erlie
s
Adm
inis
tratio
n s
taff
Tech
nic
ian
s
Pow
er
Wate
r
Natu
ral gas
Liq
uid
petr
ole
um
gas
(LP
G)
Me
dic
al oxygen
Me
dic
al N
itro
us O
xid
e
Me
dic
al carb
on d
ioxid
e
Me
dic
al air
Me
dic
al suctio
n
Ventila
tio
n
Air-c
onditio
nin
g / H
eatin
g
Pers
onal com
pute
r
Lapto
p c
om
pute
r
Ta
ble
t
Prin
ter
(bla
ck a
nd w
hite)
Prin
ter
(colo
ur)
Photo
copie
r
Fa
x m
achin
e
Docum
ent scanner
Desk p
hone
Mo
bile
phone
DE
CT
Phones
Pager
Inte
rnet
access
Operation Theatre services
5 5 4 2
4
5 5 5 5 5 5 5 5 5 4 2 5 5 3
Central Sterilisation Services Dept 5 5 5
Day Stay Unit services 5 4 5
Administration and Medical Records 5 2 5 3 5 4 3 3 3 5 3 3 5
Nursing 5 3
Allied Health 5 5 3 3 5 4
Aged Care Services 5 4 4 4 4 5
Community Mental Health 5 3
Emergency Department 5 5 4 2 3 5 5 5 5 5 5 5 5 5 5 4 3 3 3 5 5 5 5
Inpatient Medical & Nursing Care 5 5 5
Maternity 5 5 3 2 2 5 4 5 5 5 5
Hospital Management 5 3
Home Nursing Discharge Services 5 3
Pharmacy and Supply 5 3 5
Food Services 5 5 5 5
Laundry Services 5 5 5 3
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 27
Consolidated System / Application Requirements
Applications
# Services using this
application
Level of dependency
System offline
duration
Data loss duration
Business areas
Op
erat
ion
Th
eatr
e se
rvic
es
Cen
tral
Ste
rilis
atio
n S
ervi
ces
Dep
t
Day
Sta
y U
nit
ser
vice
s
Ad
min
istr
atio
n a
nd
Med
ical
Re
cord
s
Nu
rsin
g
Alli
ed H
ealt
h
Age
d C
are
Serv
ices
Co
mm
un
ity
Men
tal H
ealt
h
Emer
gen
cy D
epar
tmen
t
Inp
atie
nt
Med
ical
& N
urs
ing
Car
e
Mat
ern
ity
Ho
spit
al M
anag
emen
t
Ho
me
Nu
rsin
g D
isch
arge
Ser
vice
s
Ph
arm
acy
and
Su
pp
ly
Foo
d S
ervi
ces
Lau
nd
ry S
ervi
ces
Health Records Management + Scanning and eForms (eHRM)
9 5 30 mi 0 3 4 4 2 5 5 4 3 1
WebPas 13 5 30 mi 0 2 2 2 4 5 5 5 3 2 1 1 4 5
Clinical Pathology (Ultra/LIS) 0 5 1 h 0
Theatre Management System (TMS) 14 5 3 h 0 3 3 2 2 4 5 5 5 3 2 1 1 4 5
Internet 15 5 1 h
N/A 1 1 2 4 5 5 5 3 2 1 1 4 5 2 4
eReferrals 13 4 6 h 0 2 2 4 5 5 5 3 2 1 1 4 5 5
Cardiobase 0 4 4 h 1 h
Enterprise Bed Management (EBM) 13 4 4 h 1 d 1 3 3 2 2 4 5 5 5 3 2 1 1
Diet Management 10 4 1 d 0 2 4 5 5 5 3 2 1 1 4
HealthPoint (Sharepoint Intranet) 14 3 6 h 1 d 5 5 5 3 2 1 1 5 5 5 3 2 1 1
Haematology & Oncology Protocols & Prescriptions (HOPP)
9 3 1 d 0 2 5 5 5 3 2 1 1
MS Exchange 9 3 1 d 0 5 5 5 3 2 1 1 4 2
WA Nephrology Database (WAND) 0 3 1 d 0
Journeyboard 11 3 3 d N/A 3 2 1 1 4 2 4 2 1 1 5
Allied Health System (AHS) 1 2 3 d 2 d 4
Quality of Care Registry (QoCR) 2 2 5 d 1 d 3 5
Transition Care (TCP) 7 2 5 d 1 d 5 5 5 3 1 1
MS Office 11 2 1 d N/A 5 5 5 3 2 1 1 5 2 1 4
ScriptTracker2 8 2 3 d N/A 5 5 5 3 2 1 1 5
Nursing Hours per Patient Days (NHpPD) 8 2 1 w 1 w 5 5 5 3 2 1 1 5
Capacity Planning System (CapPlan) 0 2 1 w N/A
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 28
Annex 2 Perioperative Unit
PERIOPERATIVE UNIT
Roles and responsibilities
Team members
Roles Primary Alternate
Team Leader
Critical Functions
Business unit Activity / function Maximum Tolerable Period of Disruption (MTPD)
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Business Continuity Strategies
Activity / function Immediate
continuity strategy Maintainable
duration Sustainable
continuity strategy Maintainable
duration
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 29
Response Actions
Immediate
Action
Who Reference
Initiate Incident Log Obtain general situation report from the
notifier
Notify other members of the team as required
Determine the nature of the incident What has happened? Is anyone hurt? What services / areas are affected? What is the impact on critical
business activities / services? What has been done? How long is the disruption likely to
last?
Formulate plan for carrying out immediate continuity strategy for critical business functions
Decide if staff should remain where they are, go home or relocate to the alternate site
On-going
Action
Who Reference
Coordinate on-going communications with stakeholders
Ensure safety and wellbeing of all personnel Set up roster for rotation of team members
if incident is prolonged
Liaise with EMT for deployment of additional resources to support recovery
Provide regular updates to the EMT Formulate plan for implementing
sustainable continuity strategy for critical business functions, if necessary
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 30
Post-incident
Action
Who Reference
Prepare plan for standing down the team Liaise with EMT on standing down the team Collect Incident Logs and submit to EMT Conduct de-brief with team Assign staff to participate in Long Team
Recovery Team, if necessary
Formulate plan for resuming non-critical business functions
Resource Requirements People
Position Current
Cumulative quantity required
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Total
Office equipment and telecommunications
Type Current
Cumulative quantity required
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Medical equipment
Type Current
Cumulative quantity required
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 31
Specialised equipment
Type Current
Cumulative quantity required
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Key consumables
Type Current
Cumulative quantity required
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Systems / applications
Name of system / application System / application required by ….
8 hrs 1 day 3 days 1 wk 2 wks >=1 mth
Interdependencies
Upstream interdependencies
Internal Nature of interaction
External Nature of interaction
Downstream interdependencies
Internal Nature of interaction
External Nature of interaction
DoH BC Plan Template 20151113 V1 approved.docx3 V1 Approved 32
Annex 3 ……etc
This document can be made available in alternative formats on request for a person with a disability.
© Department of Health 2015
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.
BIA Handbook November 2015
20
Attachment 5 Consolidated BIA Profile (Sample)
Branch / Business
Area
Sub Unit Service / activity2 hrs 4 hrs 8 hrs 1 day 3 days 1 wk 2 wks 1 mth+
Perioperative Unit Operation theatre services Perioperative care x
Central sterilisation services Decontamination of surgical and
medical equipmentx
Sterilisation of surgical and medical
equipmentx
Storage of sterile non-disposable
equipmentx
Day Stay Unit services Elective day surgery procedures x
Emergency bed response x
Day infusion procedures x
General Ward Inpatient medical and
nursing care
Acute surgicalx
Acute medical x
Paediatrics x
Education and training for staff x
Liaising with aged care facilities x
Maternity Acute antenatal care x
Birthing including emergency care x
Post natal care x
Hospice Palliative care - terminal illness x
Palliative care specialists clinics x
Referral to consultancy and allied
servicesx
Emergency
Department
Emergency Department Triage and registrationx
Resuscitation including trauma x
Acute care x
Fast track x
Short stay observation x
Pharmacy Pharmacy Clinical pharmacy services x
Pharmacy technical services x
Outpatients Outpatients Community child health x
School health x
Continence x
Enuresis x
Immunisation x
Dietetics (In patient) x
Occupational therapy (In patient) x
Physiotherapy (In patient) x
Speech pathology (In patient) x
Podiatry x
Social work x
Community Mental Health x
Administration Administration Initiating patient flows (way x
Telephone
switchboard/communicationsx x
Receive incoming deliveries x
Medical record data entry and other
medical records functions
x
Account payments x
MTPD
This document can be made available in alternative formats on request for a person with a disability. © Department of Health 2015
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart from any fair dealing for the purposes of private study, research, criticism or review, as permitted under the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes whatsoever without written permission of the State of Western Australia.