APP_17 — Disaster Recovery & Business Continuity Plan¶
Document Information
| Field | Value |
|---|---|
| Document Reference | APP_17 |
| Issue Number | 3 |
| Issue Date | 1 June 2026 |
| Next Review | 1 June 2027 |
| Controlled By | Sean Ashton (HSQE Consultant) |
| Approved By | Aaron Mason, Director |
Master source — this page is canonical
The IMS portal is the master source for APP_17. The Word document below is a downloadable snapshot — narrative BCP covering critical business functions, risk scenarios (technology, personnel, supply chain, premises, cyber [NEW 2026], climate-physical [NEW 2026]), command structure, communication, testing programme and audit trail.
Related: APP_05 Risk & Opportunity Log · APP_16 Emergency Preparedness · APP_07 Hazard Identification
Tip: use the floating button bottom-right to toggle wide-mode (Alt+W).
Pre-audit BCP desktop exercise (P1 gap-closure)
A short BCP desktop exercise is scheduled before 31 May 2026 (Sean + Aaron + Leanne). Scenarios on the table: cyber / ransomware (water-sector breach pattern) and extreme-weather event. Output filed as appendix to this BCP.
1. Purpose and Scope¶
This Business Continuity Plan ensures A M Water Services Limited maintains critical operations during disruption events. It complements APP_20 Emergency Preparedness & Response Matrix by focusing on operational continuity rather than immediate emergency response.
The plan applies to all company operations including water infrastructure services, grab operations, and administrative functions.
2. Critical Business Functions¶
| Priority | Function | Maximum Acceptable Downtime | Impact of Loss |
|---|---|---|---|
| 1 | Emergency water repairs | 2 hours | Public health risk, contractual penalties |
| 2 | Personnel safety and communication | 2 hours | Legal liability, duty of care |
| 3 | Vehicle and plant operations | 4 hours | Service delivery failure |
| 4 | Administrative functions | 8 hours | Financial and compliance impact |
| 5 | Routine maintenance | 24 hours | Customer satisfaction |
3. Risk Assessment and Mitigation¶
3.1 Technology Disruption¶
| Risk | Impact | Mitigation | Response |
|---|---|---|---|
| Internet failure - Office | Loss of system access | 4G backup installed, cloud systems | Activate backup connection, remote working |
| Internet failure - Site | Cannot submit reports | Offline applications, paper forms | Paper-based recording, telephone updates |
| Cyber security incident | Data loss, system lockdown | Managed IT security, daily backups | Isolate systems, restore from backup |
3.2 Personnel Unavailability¶
| Risk | Impact | Mitigation | Response |
|---|---|---|---|
| Director absence | Decision delays | Documented authorities, trained deputies | Deputy assumes defined responsibilities |
| Multiple staff absence | Insufficient resources | Agency agreements, cross-training | Prioritise critical work, engage contractors |
| Key person dependency | Single point of failure | Documented procedures, succession planning | Activate contingency responsibilities |
3.3 Operational Disruption¶
| Risk | Impact | Mitigation | Response |
|---|---|---|---|
| Vehicle failure | Service delivery delays | Preventive maintenance, recovery contract | Immediate hire, resource sharing |
| Equipment failure | Work stoppage | Maintenance programme, hire agreements | Same-day replacement, alternative methods |
| Material shortage | Job completion delays | Multiple suppliers, stock management | Alternative sourcing, client communication |
3.4 External Factors¶
| Risk | Impact | Mitigation | Response |
|---|---|---|---|
| Fuel shortage | Fleet immobilisation | Multiple fuel cards, monitoring | Alternative suppliers, prioritisation |
| Severe weather | Site access, safety risks | Monitoring, flexible scheduling | Suspend non-critical operations |
| Utility failure | Office closure | Remote working capability | Alternative location, home working |
4. Incident Management Structure¶
4.1 Command Authority¶
| Level | Role | Authority |
|---|---|---|
| Strategic | Directors | All business decisions |
| Tactical | Supervisor | Operational decisions within policy |
| Operational | Team Leaders | Immediate safety decisions |
4.2 Financial Authority¶
| Level | Normal Operations | Crisis Response |
|---|---|---|
| Supervisor | £500 | £1,000 |
| Single Director | £5,000 | £10,000 |
| Both Directors | Unlimited | Unlimited |
5. Communication Protocols¶
5.1 Internal Communication¶
Primary method: WhatsApp Works Group
Secondary method: Individual mobile contact
Tertiary method: Email (when available)
Minimum check-in requirements:
- Normal operations: Morning and evening
- Disruption event: Hourly during business hours
- Critical incident: Continuous monitoring
5.2 External Communication¶
| Stakeholder | Method | Authority |
|---|---|---|
| Clients | Direct contact | Directors only |
| Suppliers | Phone/email | Supervisor and above |
| Regulatory bodies | Formal written | Directors only |
| Insurance | Phone then written | Directors only |
6. Recovery Procedures¶
6.1 Recovery Phases¶
Assessment Phase
- Confirm threat resolution
- Evaluate operational capability
- Determine resource availability
- Assess work backlog
Restoration Phase
- Prioritise by critical function order
- Communicate recovery timescales
- Implement temporary measures
- Monitor stability
Review Phase
- Document incident details
- Calculate impact costs
- Identify improvement opportunities
- Update procedures
6.2 Documentation Requirements¶
All incidents requiring plan activation must be documented including:
- Activation time and trigger
- Actions taken and decisions made
- Resources utilised
- Costs incurred
- Lessons identified
7. Testing and Maintenance¶
7.1 Test Schedule¶
| Quarter | Test Type | Scenario | Duration |
|---|---|---|---|
| Q1 | Desktop exercise | Vehicle breakdown | 2 hours |
| Q2 | Functional test | System failure | Half day |
| Q3 | Desktop exercise | Key person absence | Half day |
| Q4 | Full review | Plan effectiveness | Half day |
7.2 Test Records¶
| Date | Scenario | Outcome | Actions | Status |
|---|---|---|---|---|
| 14/07/2024 | Fuel contamination (actual) | Same-day resolution | Fuel receipt checking | Complete |
| 08/09/2024 | Internet failure (actual) | 4G backup effective | Monthly backup testing | Complete |
| 23/10/2024 | Director absence (actual) | Operations maintained | Document backup procedures | Complete |
| 15/11/2024 | Vehicle breakdown (actual) | Managed within 2 hours | Additional tools needed | Complete |
| 18/03/2025 | Q1 Desktop — Vehicle breakdown | Hire-route validated; same-day grab replacement confirmed via Speedy Hire | Update hire contact list | Complete |
| 12/06/2025 | Q2 Functional — System failure | 4G backup activated successfully; cloud systems accessible from site | None required | Complete |
| 10/09/2025 | Q3 Desktop — Key person absence (5 working days, MD) | Decision matrix tested; Leanne (Director) deputised within delegated authority; Site Supervisor handled day-to-day operations within £500 limit | Deputising list refreshed and saved to portal | Complete |
| 15/12/2025 | Q4 Full review of plan effectiveness | All 4 quarterly tests + 4 actuals reviewed; plan structure sound; contact directory required refresh; deputy financial-authority limits confirmed adequate | Contact directory updated; reviewed at Management Review 18/12/2025 | Complete |
| 17/03/2026 | Q1 Desktop — Vehicle breakdown (winter scenario: 7.5t grab lorry, hydraulic failure mid-job) | Hire route via Speedy framework validated; same-day grab replacement confirmed achievable within 2-hr SLA; client communication script confirmed | Add GAP Group as second-tier backup hire; refresh hire contact card in van pack | Complete |
| 28/05/2026 (planned) | Q2 Desktop — Cyber / ransomware + extreme-weather (combined) | To be completed by Sean + Aaron + Leanne before the 3-4 June 2026 Achilles UVDB B2 audit. Scenarios: (1) ransomware lockout of office systems on a critical-repair day; (2) extreme-weather (storm flooding) impacting yard access during emergency call-out | — | Scheduled — pre-audit P1 |
7.3 Maintenance Requirements¶
Monthly: Verify contact details, check backup systems, review supplies
Quarterly: Test one scenario, update procedures, verify agreements
Annually: Full plan review, risk reassessment, training delivery
8. Resource Requirements¶
8.1 Documentation¶
Office location: Insurance policies, contracts, emergency contacts, financial information
Vehicle carry: Risk assessments, job sheets, incident forms, contact cards
Cloud storage: All procedures, records, project data (daily backup)
8.2 Emergency Resources¶
Communication: Spare mobile device, backup internet connection, contact databases
Operational: First aid supplies, spill kits, basic tools, PPE stocks
Financial: Emergency credit facilities, fuel cards, approved supplier accounts
9. Training Requirements¶
| Role | Training Required | Frequency |
|---|---|---|
| All personnel | Plan awareness, communication protocols | Annual |
| Management | Incident command, decision authority | Annual |
| Supervisors | Resource coordination, escalation procedures | Annual |
| Administrators | Backup procedures, system recovery | Six-monthly |
10. Integration with Emergency Response¶
This plan operates in conjunction with APP_16 Emergency Preparedness & Response Matrix:
- APP_16 Emergency Preparedness & Response Matrix addresses immediate safety and emergency response
- APP_17 Disaster Recovery & Business Continuity Plan (this document) ensures business continuity during and after incidents
- Both documents must be reviewed together annually
- Lessons from either may require updates to both
Where an incident requires both emergency response and business continuity measures, APP_16 Emergency Preparedness & Response Matrix takes precedence for immediate safety actions, followed by APP_17 Disaster Recovery & Business Continuity Plan for operational recovery.
11. Performance Indicators¶
| Indicator | Target | Measurement |
|---|---|---|
| Plan activation response | <1 hour | Time to initial response |
| Critical function recovery | Per Section 2 | Actual vs maximum downtime |
| Communication cascade | 100% contact | Staff acknowledgment rate |
| Test completion | 4 per year | Actual vs scheduled |
| Document currency | 100% current | Monthly verification |
12. Review and Approval¶
This plan shall be reviewed annually or following:
- Plan activation for actual incident
- Significant operational changes
- Test failure or partial failure
- Changes to risk profile
- Regulatory requirement changes
This document forms part of A M Water Services Limited's Integrated Management System and should be read in conjunction with the IMS Manual (MAN_01) and relevant Standard Operating Procedures.
Audit trail¶
| Date | Action | By | Details |
|---|---|---|---|
| Prior | See Document Control table above | — | Historical revisions recorded separately |
| 24/04/2026 | Rev 3 drafted | Sean Ashton, HSQE Consultant | 2026 annual refresh. Standardised doc-control header. Added downloadable companion file. Cross-referenced APP_05 (Risk Register), APP_09 (COSHH), APP_10 (Legal Register) where relevant. Audit trail regularised. |
How this document is approved
This document is maintained under AMWS's continuous-compliance model. Substantive revisions are reviewed and signed off by the Directors at the standing weekly Director / HSQE compliance call (Sean Ashton, Onyx + Leanne Mason). Currency, cross-references and minor edits are checked at the monthly Onyx site visit. The annual Management Review (September) provides the strategic-level confirmation. Compliance is therefore continuous, not gated on a single annual meeting.
This document forms part of A M Water Services Limited's Integrated Management System. Paper copies are uncontrolled when printed.
Local controlled copy
Word version of this controlled document (for offline / paper records):
The page above is the master source — the Word doc is a snapshot for offline use.