APP_17 — Disaster Recovery & Business Continuity Plan¶
Document Information
| Field | Value |
|---|---|
| Document Reference | APP_17 |
| Issue Number | 3 |
| Issue Date | 1 June 2026 |
| Next Review | 1 June 2027 |
| Controlled By | Sean Ashton (HSQE Consultant) |
| Approved By | Aaron Mason, Managing Director |
Download the document
The page below is the canonical record. The Word document is the same content as a downloadable snapshot — use it for offline copies, paper records, or to circulate to senior stakeholders.
Related: APP_16 Emergency Preparedness & Response Matrix · APP_05 Risk & Opportunity Log · APP_07 Hazard Identification
Two-tier emergency model
AMWS uses a two-tier response model across APP_16 Emergency Preparedness and this BCP:
- Tier 1 — Incident Response (APP_16): minutes-to-hours — immediate safety actions. 12-scenario Response Matrix.
- Tier 2 — Business Continuity (this document, APP_17): hours-to-days/weeks — recovery of critical business functions if the incident is prolonged.
Section 5 below shows the explicit Scenario Mapping between APP_16 ER-XX scenarios and this BCP's risk sections, plus the escalation triggers.
1. Purpose¶
This Business Continuity Plan sets out how A M Water Services Ltd would keep operating, or recover, if something disrupts the business for more than a day. It is sized to AMWS — a ~20-person water-services contractor with two Directors, one office, and a small fleet — and deliberately avoids the multi-tier corporate scaffolding that doesn't reflect how AMWS actually works.
This plan complements APP_16 Emergency Preparedness & Response Matrix: APP_16 covers the first minutes-to-hours of any incident; this plan picks up where APP_16 ends if the disruption is going to last.
2. When this plan gets invoked¶
Any disruption that is — or is likely to be — longer than 24 hours, and that affects AMWS's ability to deliver service to a customer, keep staff safe, or run the business. Anything shorter is managed within normal operations or via APP_16.
3. Who decides¶
- Aaron Mason (Managing Director) is the decision-maker for any BCP invocation.
- Leanne Mason (Director) deputises if Aaron is unavailable, with full authority across financial, customer and HSQE matters.
- Sean Ashton (Onyx Operations, HSQE Consultant) is on-call as adviser — does not hold operational authority but is involved in any decision touching HSE, environmental, or regulatory risk.
No further command-authority hierarchy is needed for a business this size — escalation in practice is a phone call between Aaron and Leanne.
4. Scenarios & response¶
The 12 scenarios below are the things genuinely capable of disrupting AMWS for more than 24 hours. Each row gives the trigger, what gets done in the first 24 hours, and how recovery looks beyond that.
People¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 1 | Aaron unavailable for a week or more | Confirmed absence ≥ 5 working days (illness, injury, family event) | Leanne assumes full Director authority across customer, financial and HSE decisions. Anglian / Severn Trent supply-chain contacts notified of the deputising arrangement. Sean (Onyx) covers HSQE queries. | Leanne continues as acting MD until Aaron returns. Major commercial decisions paused or escalated by phone where practical. If absence extends beyond 4 weeks, Directors review whether interim management support is needed. |
| 2 | Leanne unavailable for a week or more | Confirmed absence ≥ 5 working days | Aaron picks up customer comms and Anglian/Severn Trent documentation. Payroll falls to the accountant under the existing arrangement if month-end falls in the absence. Sean covers IMS / compliance queries. | Cover continues until return. Non-time-critical paperwork (insurance renewals, accreditation submissions) paused; bank reconciliation deferred. |
| 3 | Jason unavailable for a week or more | Confirmed absence ≥ 5 working days of the Site Supervisor | Aaron deputises as Site Supervisor — morning briefings, site visits, RAMS approvals. Sean covers TBT delivery if scheduled. Operatives report direct to Aaron. | Aaron continues until Jason returns. If absence runs beyond two weeks, engage a freelance site supervisor via the existing network. |
| 4 | Multiple operatives off at once | ≥ 3 operatives unavailable for ≥ 3 days (flu wave, regional event) | Aaron + Jason re-prioritise the job board: emergency and contract-deadline work first; non-urgent work pushed back with customer notice. Available crews paired to keep buddy-check discipline. | Use overtime or labour-supply agency for critical work. Resume normal sequencing as absentees return. Document customer impact for any service-level conversation. |
Vehicles & plant¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 5 | Loss of a primary work vehicle | Grab lorry / vacuum excavator / mini-excavator out of service mid-week (fire, theft, major failure) | Aaron contacts insurance broker within 4 hours. Leanne triggers rental from existing approved supplier (same-day or next-day hire). Affected jobs re-allocated across remaining crews. | Repair or replacement managed through insurance and supplier. Specify the replacement to match the original where possible to avoid retraining. |
Office & premises¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 6 | Northampton office unusable | Fire, flood, or extended utility outage rendering the office uninhabitable for > 24 h | Directors and Sean move to home-based working that same day. Microsoft 365 and Sage are cloud-hosted, so no data loss. Insurance / loss adjuster contacted within 24 hours. Site teams continue normally. | Temporary serviced-office or co-work space found within a week if the outage extends. Permanent decision made at Director level after damage assessment. |
IT & data¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 7 | Cloud / email lockout | Account compromise, ransomware indicator, or M365 / cloud-storage outage exceeding 4 hours | Leanne contacts Microsoft 365 admin support and the IT-support partner. Suspected breach: change all Director passwords, enable any dormant MFA, isolate any locally-synced device. ICO notified within 72 hours if personal data may be affected (per POL_HSQE_30 IT Security). | Restore access via recovery / cloud-backup routes. Post-incident root-cause review at the next weekly compliance call; toolbox talk if the vector was user error. |
Customer & contract¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 8 | Loss of or pause on a major customer contract | Stop-notice, dispute, non-renewal, or 30-day notice from Anglian, Severn Trent or other Tier-1 customer | Aaron meets the customer within 5 working days. Leanne pulls the financial impact (revenue at risk, fixed-cost cover). Sean assesses any HSQE / compliance trigger (e.g. KPI underperformance). Directors decide whether to redeploy crews or accept short-term standdown. | Sales-pipeline acceleration on remaining customer relationships. If the revenue gap is material, Directors consider scaling back hired plant, overtime, and non-essential spend. |
| 9 | HSE / EA / regulatory work stoppage | Prohibition notice, EA enforcement action, or a major incident triggering a formal investigation | Aaron and Sean meet the inspector the same day where possible. Site secured per the notice. Customers notified of impact. Legal advice engaged if formal proceedings appear likely. | Comply with the notice fully before resuming work. Root-cause investigation logged in APP_21 NC & Improvement Register. Lessons fed into RAMS, TBTs and APP_05 Risk & Opportunity Log. |
External / world¶
| # | Scenario | Trigger | First 24 hours | Recovery path |
|---|---|---|---|---|
| 10 | Severe weather | Met Office amber / red warning, or weather-driven site shutdown for ≥ 48 hours | Crews stood down where conditions are unsafe. Office staff work from home if the commute is affected. Customer comms about delays. Welfare check on operatives in vulnerable areas. | Resume when conditions allow; re-sequence delayed work. Customer impact and any rescheduling agreements documented for service-level conversations. |
| 11 | Fuel or material supply shock | Diesel shortage, PE-pipe lead-time slipping beyond two weeks, or chlorine-tablet stock-out | Leanne triggers secondary supplier(s) from the approved-supplier list (APP_19). Aaron contacts customers about possible delay; agrees workaround sequencing. Yard stock prioritised for emergency / repair work. | Resume normal sequencing when supply returns. Approved-supplier list reviewed if the shock revealed a single-source dependency. |
| 12 | Public-health event | Government or NHS restriction on close-working, travel, or workforce attendance | Operatives switched to single-occupant van where possible. Close-quarters work re-risk-assessed; RAMS updated. Office staff to home-working. Customer comms about reduced capacity. | Phased return to normal working as restrictions lift. Lessons-learnt fed back into this row for the next refresh. |
5. Integration with APP_16 — two-tier scenario mapping¶
This BCP is Tier 2 in AMWS's two-tier emergency model. APP_16 is Tier 1 (immediate safety, minutes-to-hours). Where an incident touches both tiers, APP_16 takes precedence for the immediate safety actions; this plan picks up for continuity.
This table is mirrored into APP_16 §3.
| APP_16 scenario | APP_17 scenario | Escalation trigger |
|---|---|---|
| ER-06 Vehicle breakdown | #5 Loss of primary work vehicle | Out of service > 24 h with no same-day hire |
| ER-08 Fire (site / office) | #6 Northampton office unusable | Office unusable for > 24 h |
| ER-10 Major water-main burst | #8 Loss of / pause on major customer contract (if SLA breach material) | Multi-day SLA breach |
| ER-11 Cyber | #7 Cloud / email lockout | Systems unrecoverable in 4 h or personal-data breach (ICO 72-hr) |
| ER-12 Extreme weather | #10 Severe weather | Yard inaccessible > 24 h or multi-day power loss |
| (Multiple) Key-person absence | #1 / #2 / #3 | > 5 working days for a Director or sole supervisor |
6. Testing¶
6.1 Cadence¶
| Type | Cadence | Lead | Scope |
|---|---|---|---|
| Annual desktop exercise | Once per year (Q2, before annual Management Review) | Sean + Aaron + Leanne | 2-hour walk-through of one scenario from §4 — typically a joint Tier 1 + Tier 2 exercise covering both APP_16 initial response and APP_17 continuity |
| Real-incident review | Whenever a real BCP-relevant incident occurs | Sean | Captured as a test record in §6.2 — actual events are the most realistic test |
| Plan currency check | Continuous, at the standing weekly Director / HSQE call | Sean + Leanne | Contact lists, deputising arrangements, hire-contract status |
This is the cadence AMWS actually operates — annual desktop exercise + ad-hoc real-incident reviews + continuous currency via the standing weekly call. The previous quarterly four-test cycle was retired May 2026 as it over-promised against what AMWS actually does.
6.2 Test records¶
Test records run from October 2025, when the scenario framework now in §4 was first piloted. The Scenario # column references the row in §4 that each test exercised.
| Date | Scenario # (§4) | Test description | Outcome | Actions | Status |
|---|---|---|---|---|---|
| 10/09/2025 | #1 / #2 / #3 | Desktop exercise — key-person absence framework walk-through (Director and Site Supervisor scenarios) | Deputising chain confirmed across all three named-person scenarios; Leanne / Aaron / Sean cover arrangements walked through | Deputising list refreshed and saved to portal | Complete |
| 15/12/2025 | Annual review | Plan-effectiveness review — 2025 desktop and real-incident records reviewed | Plan structure confirmed sound; contact directory required refresh | Contact directory updated; reviewed at Management Review 18/12/2025 | Complete |
| 17/03/2026 | #1 | Desktop exercise — Managing Director (Aaron Mason) unavailable for 5+ working days | Deputising chain confirmed effective: Leanne assumed full Director authority across customer, financial and HSQE decisions; Sean (Onyx Operations) confirmed cover for HSQE queries; customer-notification approach for Anglian / Severn Trent reviewed | Customer-notification template drafted and saved to portal; deputising arrangement re-confirmed at next weekly call | Complete |
| 26/05/2026 | #3 | Desktop exercise — Site Supervisor (Jason May) unavailable for 5+ working days | Held remotely by Leanne Mason with Sean Ashton's support. Aaron deputised as Site Supervisor for morning briefings, site visits and RAMS approvals; operatives confirmed manageable reporting line direct to Aaron; Sean (Onyx) confirmed cover for scheduled TBT delivery. Recorded in APP_16 §4 testing log. Closes CAR-2026-005. | Freelance Site-Supervisor contact list refreshed; RAMS approval routing documented for Jason-absent scenario | Complete |
| Q4 2026 (planned) | #6 | Desktop exercise — Northampton office unusable for 5+ working days (fire / flood scenario) | — | — | Scheduled |
7. Review¶
This plan is reviewed annually, after any plan activation for a real incident, after the annual desktop exercise, and whenever the risk profile changes (new contract, new operation, change of personnel in a key role). Substantive changes are signed off by Aaron Mason as the controlled-document approver.
Audit trail¶
| Issue | Date | Approved By | Summary |
|---|---|---|---|
| 1 | 01/06/2024 | Aaron Mason, Director | Initial issue. |
| 2 | 30/09/2025 | Aaron Mason, Director | Reviewed following IA202512 Emergency Preparedness (0 NC, 0 OBS). Scenario framework introduced; test log restructured. |
| 3 | 01/06/2026 | Aaron Mason, Director | Reviewed in line with the 2026 internal audit cycle — IA202612 Emergency Preparedness (19/05/2026, 0 NC, 0 OBS) — building on IA202512 Emergency Preparedness (30/09/2025, 0 NC, 0 OBS). Restructured to a 12-scenario SME-proportionate format; invocation threshold set at disruption exceeding 24 hours; two-tier emergency model formalised with APP_16 with bidirectional scenario-mapping table at §5. CAR-2026-005 closed via the Q2 2026 desktop exercise (Scenario #3 — Site Supervisor absence, 26/05/2026). |
This document forms part of A M Water Services Limited's Integrated Management System. Paper copies are uncontrolled when printed.