Business Continuity Plan | Plan Invocation and Developing the BCP | Internal and External Communications | Authorised Payment Institution API | Electronic Money Institution E-money EMI | Small Payment Institution SPI

Purpose and Scope

The purpose of this Business Continuity Plan (BCP) document is to ensure Hirett Ltd (“Hirett”) is able to continue operating in the event of a critical issue or disaster that disrupts normal activity.

The scope of this document is to identify the critical situations which would cause Hirett to invoke the BCP as well as the mitigating actions and recovery plans to ensure business continues to perform as near to normal as possible.

The scenarios in scope for this document include but are not limited to:

• Natural disasters (flooding, extreme weather, epidemics)
• Willful damage (terrorism, civil disorder, internal/external strike action or work stoppage, computer crimes and arson)
• Accidental damage (power failure, gas leaks, fire, impact by vehicle/aircraft, heating/ventilation/air conditioning failure)

Responsibilities

The CEO is responsible overall for the BCP and is responsible for ensuring that business continuity is given full consideration for all aspects of the business that could be impacted by the scenarios in scope.

Plan Invocation

Over time the list of team members who are authorised to invoke the plan and documented scenarios wherein the plan should be invoked will be expanded upon and the BCP will be updated.

The initial BCP plan will be invoked by the CEO in agreement with the board in the case of one or more of the scenarios defined as in scope for the BCP occurring and causing:

• The services provided by Hirett to its customers are significantly impacted or unavailable
• Hirett’s premises are significantly impacted due to being wholly or partially unavailable
• Hirett’s staff are significantly impacted by not having access to IT systems and/or telephony
• One or more third-party supplier is impacted and can not provide their service to agreed levels
• Access to Hirett’s premises to be difficult or personally hazardous due to external factors
• A significant issue at a third-party with whom Hirett does not have a direct relationship having an outage which indirectly affects Hirett and/or its customers significantly

Developing the BCP

The BCP is a living document and will be reviewed quarterly throughout the year to ensure it is current.

In addition, the BCP will be assessed for any new service or operation is introduced or an amendment is made to an existing service or operation, as part of the Change Management process.

This includes changes by third party suppliers, to ensure that the BCP is still accurate and applicable.

Communications

The BCP plan is designed to ensure communication is maintained to the highest possible standard throughout any scenario, based on the best channels available.

For each critical third-party supplier:

• A list of key contact phone/email details will be maintained in an appendix of the BCP, including who at Hirett is authorised to contact the third-party in order to notify them of a scenario occurring and the BCP being invoked. This will include mobile numbers for all key contacts to ensure communication is available if either party suffers a loss of landline telephony.
• The same appendix will also contain the current business continuity documentation from the supplier, so Hirett are clear on how to engage with the supplier if it is the third-party that has a major issue which then impacts Hirett. This will then form a subset of Hirett’s own BCP document.
• At the time of writing, the critical supplier identified is FinMatic – a specialist white label systems provider that will provide an end to end solution for almost all of the services that Hirett requires, except for the in-house telephony and networked PCs (deemed critical) for the Hirett call centre and the Hirett company website (deemed not critical).

Internal communications:

Hirett will use a Zoom conference call facility for all stakeholders to be able to provide internal updates on the scenario and confirm the steps taken so far as per the BCP to mitigate the scenario that is happening. If Hirett’s premises are still operational, then the stakeholders based there will meet in person and the remainder will join via Zoom.

These stakeholders are then responsible for cascading the information internally to their own teams via email or in person as appropriate and depending on the scenario

Where landline telephony is not available, mobile phones or web access will be used to join the Zoom call.

If telephony and email is unavailable, then communications to Hirett’s team members will be made via SMS text messages or closed Whatsapp group.

External communications

If telephony is still available, it is assumed that a high volume of inbound calls will be received creating longer than normal call wait times, so whilst trying to answer as many calls as possible, the inbound automated prompts will be updated with a brief recorded message to explain the latest update of what the impact is and what Hirett is doing about it, as well as when the impact is expected to have ceased.

In addition, updates will be added frequently to Hirett’s website, providing the latest guidance to our customers of what services are impacted, expected time to resolution and any other related information.

Where subscribed for electronic communication, customers will receive notifications of the situation through the Hirett mobile app, email, and SMS messages to their phone.

Regular updates will be posted via social media, including Twitter and Facebook, to extend the communication further.

Document Owner, Approver and Change History Record

The BCP is owned by the Chief Executive Officer and approved by the board. Other stakeholders within Hirett will be added over time and they will be able to update the BCP as needed, adding a new version number, author name and a brief note of changes made to the log on the first page. All new versions of the BCP will not be live until approved by the board.

Change management

Hirett change management process is enabled via a Change Board which meets monthly and is chaired by the Chief Executive Officer. Any change, to processes, operations, technology or other aspect of Hirett’s business is raised via the Change Board and assessed by all stakeholders within the business to determine impacts, assess costs and timelines. As part of the Change Board process, any changes raised are also assessed against the BCP, with the following possible outcomes:

• The proposed change has no impact to the BCP, no action needed.
• The proposed change does have an impact to the BCP, in which case the CEO will ensure that a full impact assessment is carried out and additional steps required are documented in the BCP. As per the process, the updated BCP will then go before the board for approval before it is accepted as the active version of the BCP.

Business Continuity Plan Testing

The BCP will be tested at least bi-annually, or more often if there has been a significant change to the operation or new additions/amendments to the BCP. This will be predominantly a rehearsal of the entire process of invoking the BCP for a specific scenario, including working through internal procedures and external third-party procedures with suppliers, as a desktop exercise to ensure all participants are very familiar with all activities required.

Some physical tests will also take place as part of the testing exercise, including ensuring that procedures used when the main Hirett office is not accessible are operating as expected. This includes switching part of the team to the alternate site and ensuring that all functions work correctly in terms of telephony and software systems access and testing of remote access from home for the same, as well.

By going through this exercise, improvements can be identified and added to a supplementary detailed Hirett workbook, which will go down to the level of specific checklists.

Following the completion of the test exercise, a summary report will be recorded to show which test activities were carried out, what the result was and a lessons learned section to ensure further improvements can be made to the BCP.