Ensuring Business Continuity at YMCA of Greater Toronto:

Transcription

1 YMCA of Greater Toronto Ensuring Business Continuity at YMCA of Greater Toronto: BCP Program for YMCA Senior Managers Original issue date: March 1, 2008 Last revised date: May 1, 2017

2 TABLE OF CONTENTS 1 INTRODUCTION DEFINITIONS BCP PROGRAM CHART CONTINUITY PLANNING ASSUMPTIONS BCP GOVERNANCE, ROLES AND RESPONSIBILITIES BCP RESPONSIBILITIES DOCUMENT REPOSITORY BCP COMPONENTS INCLUDING RESPONSE PHASES BUSINESS IMPACT ANALYSIS AND RISK ASSESSMENT PREVENTION AND MITIGATION EMERGENCY RESPONSE SAFETY AND EMERGENCY PROCEDURES CRISIS ESCALATION AND COMMUNICATIONS BUSINESS RESUMPTION IT DISASTER RECOVERY RECOVERY OPTIONS BUSINESS RESTORATION PLAN TESTING AND MAINTENANCE PANDEMIC PREPAREDNESS SUMMARY APPENDICES AND OTHER RESOURCES A: PROCESS PRIORITIZATION DEFINITIONS B: BUSINESS IMPACT AND RECOVERY STRATEGIES BY YMCA PROGRAM C: YMCA CRISIS ESCALATION MODEL AND ROLES D: CRISIS COMMUNICATIONS CHECKLIST E: RESUMPTION AND RECOVERY CHECKLISTS F: YMCA MANAGER S BCP CHECKLIST G: INFECTIOUS DISEASE OUTBREAK CHECKLIST This document belongs to the YMCA of Greater Toronto and shall not be used by or disclosed to unauthorized persons without written permission. For more information, contact Monica Merrifield at monica.merrifield@ymcagta.org YMCA OF GREATER TORONTO,

3 1. Introduction At the YMCA we have a responsibility to continue to maintain the mission, vision and core values of our charitable organization. We know the many people we serve rely on our ability to deliver uninterrupted programs in safe environments. In order to ensure we are able to do so even when faced with a disruption, the YMCA of Greater Toronto has established this Business Continuity Planning Program or BCP as a resource for senior managers to use when managing a major disruption event. Like all organizations, the YMCA will face unforeseen events that could impact operations. Through our BCP Program, we can ensure responsible action is taken and appropriate procedures are in place and followed before, during and after a disruptive event. Whether responding to a natural disaster, fire, a critical injury, power outage, loss of data or IT system, our BCP program allows us to continue to deliver time-sensitive programs and processes, in keeping with our YMCA Emergency Preparedness Policy and YMCA Asset Protection Policy. 2. Definitions Business Continuity can be defined as the procedures, processes, decisions and activities that ensure that an organization can continue to function through an operational disruption. Business Continuity Planning (BCP) defines reasonable measures including program and service recovery strategies, to assure continuity of key activities, programs and processes to minimize potential personal injury, property damage, loss of revenue, or impacts to mission delivery. Our BCP Program consists of shared strategies and procedures applicable to all YMCA programs and processes, and includes the following key components (see BCP Program illustration chart on the following page): Business Impact Analysis and risk assessment to understand business impacts of a disruption; Prevention and mitigation consisting of ongoing measures to minimize or eliminate the potential for disruption or impact of disruption; Emergency response procedures to protect immediate life safety (people) and physical assets (buildings), as well as our image through effective crisis escalation and communications to accelerate decision-making and ensure appropriate communication during a disruption; Business resumption including IT disaster recovery to resume and recover time sensitive and essential activity and computing and telecommunication process priorities; Business restoration for safe return to normal operations at a permanent program site; Testing and maintenance to ensure plan effectiveness and ongoing relevancy of the BCP; Pandemic planning is an additional component forming part of our BCP, to ensure preparedness in the event of a pandemic or major infectious disease outbreak. 2

4 2.1 The following chart illustrates the BCP Program for the YMCA of Greater Toronto. BCP Program Manager s BCP Checklist Business Impact Analysis & Risk Assessment Process Prioritization Annual Risk Assessment Prevention & Mitigation Emergency Response Safety & Emergency Procedures Crisis Escalation Model and Crisis Communications Business Resumption IT Disaster Recovery Plan Business Restoration Testing & Maintenance Test Exercises Plan Maintenance / Updates Pandemic Preparedness Pandemic Plan Infectious Disease Checklist 3

5 3. Continuity Planning Assumptions The following assumptions apply for the purposes of Business Continuity and Pandemic Planning at the YMCA: Our primary focus is keeping people safe. Many disruption events can strike with little or no warning allowing little time for preparedness management. In some cases, local and/or provincial authorities may be in charge and control response to major disasters, and may require support from organizations including the YMCA. The YMCA relies on the availability of key suppliers to provide certain goods or services which may impact recovery objectives. When the BCP cannot be followed, or in the event that a target recovery cannot be met, a reasonable recovery or plan alternative will be agreed upon between program and Association Services management based on input from internal and/or external experts. All Senior Vice Presidents and Vice Presidents have designated General Managers in each program area who are responsible for executing their responsibilities under this plan. 4. BCP Governance, Roles and Responsibilities 4.1 BCP Governance BCP oversight, roles and responsibilities are as follows: a) YMCA leadership and Program & Strategy Support shall ensure the following: The VP of Risk Intelligence is the BCP custodian and internal expert, and shall ensure ongoing relevancy of the BCP Program through periodic updates to this document and preparedness testing, for any needed enhancements to the overall YMCA BCP Program. The Chief Financial Officer assumes senior executive ownership and leadership as Crisis Commander, declaring full activation of the BCP when appropriate and convening a Crisis Management Team to resolve escalated issues and prioritize resources, working with the Program SVP or VP, the COSO and VP of Marketing & Communications to ensure effective crisis management and response. The SVP of Information Technology owns the IT Disaster Recovery Plan, and shall ensure ongoing effectiveness and relevancy of the YMCA Disaster Recovery Plan. The SVP of Human Resources & Organizational Development owns the Pandemic Plan and shall ensure ongoing effectiveness and relevancy of the YMCA Pandemic Plan. b) Each program/process area General Manager, VP or Senior VP is responsible for ensuring: Recovery strategies are identified for essential programs and time sensitive processes, including establishing alternate sites, back up resources, manual workarounds where appropriate; 4

6 Supervisors know and follow emergency response procedures, crisis escalation, and ongoing prevention and mitigation to minimize risk or impact of disruption in their program area(s); Contact information for senior staff, suppliers, local emergency responders, and alternate site and assembly or safe room information is reviewed and updated at least annually; Fire drills are conducted, and staff and program volunteers receive emergency response training and/or refresher training, at least twice a year. 4.2 Document Repository All Business Continuity Planning documents are kept in a central file directory and repository which is backed up nightly by our IT team. BCP documents may be viewed and are available on the YMCA intranet - Information Y-Way. Speak with your General Manager or Vice President, or contact Risk Management for more information about business continuity and preparedness at our YMCA. 5. BCP Phases The YMCA BCP consists of shared strategies and procedures applicable to all YMCA programs and processes, and cover key components and response phases described below. 5.1 Business Impact Analysis and Risk Assessment This initial phase of the BCP process involves identification of risks and understanding impacts of program or service disruption. Risks including those that have the potential to result in significant disruption or loss are assessed and prioritized at least annually by the YMCA executive team. Contact the VP of Risk Intelligence for more information about our risk assessment process. Understanding the human and financial impacts associated with the length of business interruption can drive the tolerated program or service downtimes. It can also help the YMCA make decisions on expenditures for possible recovery strategies or containment of revenue loss, at the time of any potential loss situation. For this phase of the BCP, programs and services that could be impacted by a disruption are identified, with maximum downtime tolerance considered, and initial program or service recovery strategies identified. Contact the SVP of Information Technology for more information about process prioritization. An outline of disruption impacts, process prioritization and recovery strategies across our YMCA can be found in Appendix A and B of this document. 5.2 Prevention and Mitigation Prevention and mitigation identifies measures and activities that lessen the possibility or the impact of an adverse incident or disruption. The primary objective of the Prevention and Mitigation phase is to protect our assets (people, buildings, finances, reputation). This is an ongoing phase of the BCP which captures the day to day practices implemented by managers in each YMCA program area, to be better prepared for a disruption. Prevention and mitigation practices increase our capacity to respond quickly in the event of a disruption and include: emergency response training for staff and volunteers; establishing alternate sites and backup resources, workarounds and other recovery strategies; following our records retention and management procedures and conducing an annual risk assessment to identify and mitigate major risks. 5

7 These and other mitigation practices are outlined in the Manager s BCP Checklist attached as Appendix F. 5.3 Emergency Response When an emergency or disruption event occurs, the first step in activating a BCP is the Emergency Response Phase. The purpose of this phase is to protect immediate life safety, followed by protection of physical (building) assets. The chart below provides a time sequence for the various BCP response phases following a disruption event, which begins with Emergency Response. Time Sequence for Response Phases DISRUPTION EVENT EMERGENCY RESPONSE CRISIS MANAGEMENT BUSINESS RESUMPTION BUSINESS / SITE RESTORATION Stabilize Manage Issues Recover Restore / Return 0 4 hrs 4 hrs days days mo/s mo/s yr (?) Safety and Emergency Procedures An important risk mitigation step for supervisors is ensuring employees and program volunteers are familiar with the YMCA Safety and Emergency Procedures Manual. YMCA managers are responsible for customizing the Emergency procedures manual for their program or location, reviewing and updating at least annually all site specific information such as important (emergency) telephone numbers, alternate site and assembly or safe area information for their program location. Having properly trained staff greatly reduces risk when an emergency occurs. A copy of our YMCA Safety and Emergency Procedures, and tools for supervisors to train staff/volunteers are available on the YMCA intranet - Information Y-Way. Contact the Director of Risk & Insurance or the Human Resources department for more information about YMCA Safety & Emergency Procedures Crisis Escalation and Communications A crisis escalation protocol accelerates the decision-making process in the event of a disruption. 6

8 A crisis may be defined as an incident or event that impacts or has the potential to significantly impact the organization and its business processes. Identified by the General Manager or On Site Manager, the initial notification of a crisis is upwards, to ensure resources are accessed and prioritized appropriately to resolve escalated issues. The YMCA s Crisis Escalation Model and escalation roles are outlined in Appendix C. A Crisis Management Team and command centre will be established by the Chief Financial Officer depending on the magnitude of the disruption, which will serve as the communications, facility and operations recovery focal point for coordinating activities between various teams established to manage the crisis. A crisis communications plan will be tailored to the specific disruption event and implemented by the VP Communications working with the Crisis Management Team and/or General Manager(s) in alignment with the Crisis Escalation protocol. To ensure our ability to effectively communicate during a crisis, the communications plan will include key components outlined in Appendix D. 5.4 Business Resumption The Business Resumption phase seeks to respond to the situation AFTER human health and safety has been addressed through Emergency Response. It begins with assessing the damage or impact, and ascertains the nature and level of required containment and control activity. Refer to checklists in Appendix E that outline actions to be taken for a structured and prioritized assessment of the situation, and initiating Resumption activity IT Disaster Recovery The Disaster Recovery phase begins as soon as the primary or alternate facility is available to support disrupted programs and services. While service levels may be reduced as a result of a disruption, good continuity planning ensures sufficient levels of service can be provided and a reasonable perception of business as usual conveyed to the members and communities we serve. Programs and processes have been prioritized (Appendix A and B) to recover the more time sensitive and essential programs and services as quickly as possible, with minimum resources. In this phase of the BCP, workarounds (manual activity performed during a systems failure for example) are implemented while IT process priorities are recovered in sequence within recovery time objectives, as outlined in our Disaster Recovery Plan. For more information about the YMCA Disaster Recovery Plan, contact the SVP of Information Technology Recovery Options For those programs that do not rely on the computing environment but are identified as having low downtime tolerance (Appendix A and B), detailed recovery strategies are established and reviewed annually by the Program General Manager or Vice President, and may involve one or more of the following recovery options: Internal arrangement: Program activity may be transferred to another part of the building which has available facilities. Training or meeting rooms, etc may be equipped to support certain program functions or processes; and/or 7

9 Reciprocal arrangement: Alternate YMCA sites may accommodate those affected. This may involve temporary suspension of non-critical functions at alternate sites not affected by the disruption event; and/or External arrangement: Alternate sites with external organizations which agree to accommodate time sensitive or essential program activity and recovery needs; and/or No arrangement: It may not be cost efficient to plan recovery to a detailed level for programs and processes that are less time sensitive. A clear understanding of disruption risks and impact will help program management determine whether no arrangement is acceptable. 5.5 Business Restoration The Restoration phase seeks to restore, at primary or alternate facilities, the full scope of programs and services including those not addressed in the resumption phase. This phase of the BCP identifies how business operations will be migrated from the recovery site to the primary site, and how operational stability will be established at the end of the disruption. The checklist in Appendix E includes priorities and procedures to switch back and restore to normal operations at a permanent program site. 5.6 Plan Testing and Maintenance A BCP is not valid until it has been tested. The goal of Plan Testing is to demonstrate a recovery capability. Tests are also a good way to increase staff awareness, build confidence in and people s ability to carry out tasks that staff would be expected to perform in a disaster. Performed at least annually by designated senior managers, testing options include: Tabletop review is a paper walk-through of the processes and procedures that would be used in a real disaster. An exercise based on a specific scenario, the key to a successful tabletop review is ensuring that the right people attend those who have key tasks to perform in response to a disruption. Simulation involves interdependency testing and walkthroughs through simulation of a disaster, to determine how well the plan responds to a specific event in the operational environment. IT environment (systems and application walkthrough) testing involves conducting an announced or unannounced disaster simulation and executing documented system recovery procedures. The primary objective is to verify that critical systems and backup data can be recovered within a specific timeline or recovery time objective (RTO), and that application interdependencies are documented. Contact the IT department for more information about IT and disaster recovery testing. Alternate site testing tests recovery components at an alternate site. This should include a test of the organization s ability to relocate staff to the alternate site, as well as a validation that recovery processes and IT assets operate. Call tree testing is a good way to validate contact information (employee call tree, emergency contacts, key suppliers) is accurate and complete. For more information about BCP testing, contact the VP of Risk Intelligence. Plan Maintenance ensures ongoing relevancy of the YMCA s Business Continuity Plan through annual review and periodic updates. All senior managers, including general managers and on-site managers, have an active role in ensuring key components of BCP are in place in their program area as outlined in 8

10 4.1 under Roles and Responsibilities. Furthermore, periodic updates to this BCP document are provided by Risk Management, with a copy also available on the YMCA intranet - Information Y-Way. 6. Pandemic Preparedness The YMCA of Greater Toronto has established a Pandemic Plan that forms part of its BCP program, and is in keeping with the Canadian Pandemic Influenza Plan and City of Toronto Public Health recommendations. Developed to ensure preparedness in the event of a pandemic or major infectious disease outbreak, the YMCA Pandemic Plan outlines required actions in alignment with the WHO (World Health Organization) Pandemic Phases. The Human Resources Department monitors the WHO Phase levels and will communicate to management any change in level of risk. To ensure preparedness, each General Manager shall review the Infectious Disease Checklist attached as Appendix G and follow additional requirements that may be communicated by the Human Resources Department in keeping with our Pandemic Plan. For more information about the YMCA Pandemic Plan, contact our VP of Human Resources. 7. Summary The extent to which we are effective in planning and being prepared for a disruption has a tremendous impact on how well we respond to an event, and may even prevent a disruption from becoming a crisis. Pre-planning through good Business Continuity practices helps us decrease the number of decisions that will need to be made when a disruption or crisis hits, allowing YMCA senior managers to focus on the event-specific decisions that remain. Establishing response and recovery strategies in advance enables our YMCA to accelerate decisionmaking in the event of a major disruption, ensuring the necessary resources are assembled quickly, increasing the quality and speed of YMCA response, recovery and return to normal operations. 9

11 8. Appendices A: Process Prioritization Definitions B: Impact and Recovery Strategies by YMCA Program C: YMCA Crisis Escalation Model and Roles D: Crisis Communications Checklist E: Resumption and Recovery Checklists F: YMCA Manager s BCP Checklist G: Infectious Disease Outbreak Checklist Other Resources: Outlined below are supporting procedures and other resources available on the YMCA intranet - Information Y-Way: YMCA Safety & Emergency Procedures YMCA Disaster Recovery Plan includes BCP Process Prioritization contact IT department for more information YMCA Pandemic Plan YMCA Key Supplier List includes secondary sources and supplier BCP checks contact Procurement Department for more information Facilities Damage Assessment Report template YMCA Operating Policies includes YMCA Emergency Readiness and YMCA Asset Protection Policies YMCA Annual Risk Assessment Process YMCA Records Retention Guidelines 10

12 Appendix A: Process Prioritization Definitions Priority Definitions Priority classifications are used for services and programs required to support resumption or seamless continuation of critical activities during an emergency or crisis, in addition to support of existing resources that are impacted by the crisis. A. Absolutely essential services and programs which must be performed or they could cause complete or severe failure of the organization. Alternate skilled personnel must be preidentified to ensure continuity should surge capacity be experienced or regular capacity be impacted by absenteeism. B. Important services and programs which will continue to be performed if sufficient resources are available. C. Services and programs which can be continued if human resources are available, but which may be temporarily suspended if the existing facilities and human resources are not available or redeployed to support more critical programs. These services and programs are listed for reference purposes. Criteria Location Visibility Customer Impact Business Delivery Consider Priority Level A if The program/process is only performed in one location. If the location or building is not available the program/process cannot be performed. If the program or service fails, it will be highly visible outside the YMCA possibly causing serious damage to stated goals and objectives or reputation. Many employees, members, volunteers and other customers are immediately impacted in a very negative way if the program or service fails. The YMCA would not be able to continue to function and would have very large impacts on loss of new business, loss of human life or loss of future revenue. Consider Priority Level B if The program/process is performed in another location that can take over management of the program or service with some difficulty until some form of recovery takes place. There is some visibility of the process failure outside the YMCA but the visibility is unlikely to seriously impact stated goals and objectives or reputation. Some members, volunteers and other customers are immediately impacted in a very negative way if this program or service fails. The YMCA would need to use other resources located in other geographical locations to deliver the programs or services as promised. Consider Priority Level C if The program or service is performed in many locations or can be easily shifted to another location. There is little to no visibility of the process failure outside the YMCA. Few members, volunteers and other customers are immediately impacted in a very negative way if the process/program fails. There is no impact to the ability of the YMCA to deliver legally or otherwise. 11

13 Criteria Program/Service Delivery Legislative & Legal Impacts Penalties Specialization Communications Consider Priority Level A if The YMCA would not be able to deliver promised programs or services resulting in serious damage to reputation, employee retention or revenue streams If the process fails, immediate legal obligations cannot be met and there are serious repercussions. High penalties or fines result from process interruption. This process has highly specialized requirements (special equipment, complex IT environment, special physical location set ups). If this process is interrupted, employees, members, volunteers and other customers will not receive immediately required information resulting in serious repercussions of some kind. Consider Priority Level B if The YMCA would be able to recover using alternate methods and be able to either partially deliver, or deliver within customer acceptable timelines promised programs and services If the process fails, immediate legal obligations cannot be met, but options are available to delay meeting the obligations. Penalties or fines result in not being able to continue the process, but the fines paid are less than the impact to revenue streams if other processes are recovered on a higher priority basis (requires business case) This process can be partially recovered in less than 72 hours, utilizing standard recovery approaches, such as teleworking, or alternate nearby equipped facilities If this process is interrupted, employees, members, volunteers and other customers will not receive required information as quickly as they normally expect to receive it. On-going delays may result in minor impacts. Consider Priority Level C if The ability of the YMCA to deliver promised new programs and services is not impacted. If the process fails, immediate legal obligations cannot be met but delays in meeting obligations can be easily obligated. No fines result from process interruption, or fines or penalties would result after a period of 3 months. The process can be performed manually or in some other way or suspended for an indefinite period of time. If this process is interrupted employees, members, volunteers and other customers are able to access required information in other ways. 12

14 Criteria Results Consider Priority Level A if If "yes" to anything in this column, use a Priority A classification Consider Priority Level B if If you have a "yes" answer to questions on Location, Customer Impact, or Penalties in this column, use a Priority B classification. If you have more "yes" answers in this column than column 3, and all "no's" in column 1, use a Priority B classification. Consider Priority Level C if If all your "yes" answers are in this column, use a Priority C classification. If the total number of "yes" answers in this column exceeds the total in column 2, and you do not have column 2 "yes" answers to Location, Customer Impact or Penalties, use a Priority C classification. An Association-wide BCP Process Prioritization schedule based on the above criteria is maintained and updated annually by the IT Department in consultation with Risk Management. 13

15 Appendix B: Impact and Recovery Strategies by YMCA Program This document serves as a cost benefit summary and reference for decision making in the event of an Association-wide disruption requiring execution of the response phases of the BCP. A business impact analysis (BIA) of YMCA processes, support functions and programs has been completed across the Association. Impacts of downtime have been considered and what follows are the most time-sensitive or priority programs and processes and recovery strategies by program type, approved by YMCA management. These programs and processes will be recovered first in the event of an Association-wide disruption. Sample Disruption Impacts Summary Impacts or costs that are considered include: Financial; impact on cash flow Essential life/family services Health and safety, regulatory requirements Reputation impairment; impact on ability to raise funds/donations Last reviewed/revised: (insert date) YMCA Programs Disruption Impacts (net or other) [refer to Financial impacts in BIA schedule] e.g. $ / mo - full capacity child care e.g. $ / mo - midsize H&F facility YMCA Processes BCP / Crisis Management Support Payroll Contact Centre (inbound calls) Member system Network (WAN) Website YMCA Recovery Strategies for Priority Programs and Processes: Program or Process Impact / Key considerations Strategies to keep minimum process running 14

16 Appendix C: Crisis Escalation Model and Roles The Crisis Escalation Model for the YMCA of Greater Toronto accelerates the decision-making process in the event of a major business disruption including a pandemic. An incident determined to be significant to business processes will be treated as a Crisis. This decision is made by the General Manager or On Site Manager. Although communication continues to flow both ways, initial notification and escalation is upwards and depends on crisis impacts and need for more senior level decision making, notification, and management support. YMCA Crisis Escalation Model Crisis Management Team Subject Matter Experts (SMEs) may include: Risk Intelligence (BCP internal expert) Core program experts (SVPs, COSO, VPs) Communications, Contact Centre HR, Property/Facility Management, IT CEO Chief Financial Officer is BCP Crisis Commander (COSO is back-up commander) BOARD IT Disaster Recovery Team SVP/VPs notify and consult with COSO SVP Health, Fitness & Recreation SVP Child & Family Development SVP Employment & Community VP Camping & Outdoor Ed GMs liaise with emergency Authorities, notify Funder if applicable GMs Health & Fitness GMs Child & Family Dev t GMs Employment & Community, Provincial/National GMs Camping & Education / Head of School GMs Program & Strategy Support notify their VP or SVP *Communications, Decisions On-going with local authorities On Site Manager Employees, Volunteers, Local Authorities (CAS, police, fire, public health, Ministry, etc )* 2 Crisis Escalation Roles are defined as follows: BCP Crisis Escalation Roles YMCA employees, volunteers, Local & Provincial Authorities (fire, police, health agencies, etc.) Respond to or identify crisis Escalation and Communication Points Escalates crisis or identified dangers to health and safety to the Program Manager or available YMCA supervisor Activates emergency response procedures if appropriate Responds to provide first aid to suddenly ill or injured people Escalates to Local / Provincial Authority as directed / trained Notifies or liaises with governing provincial Ministries (i.e. Children and Youth Services) 15

17 BCP Crisis Escalation Roles On-Site Manager Responds to crisis reported to them by employees or volunteers within their programs General Manager is the Site or Program Crisis Commander INITIAL RESPONSE: Leads and coordinates Crisis management in YMCA owned buildings, working with facilities team Leads and coordinates Crisis management, working with building management in leased buildings VP or Senior VP of Program or Process Area Responds to Crisis reported by General Managers or alternates SVP Information Technology and IT Team Responds to disruption involving IT issues Escalates to Crisis Commander (CFO) and Crisis Team (if or when convened) Crisis Management Team Helps determine whether or not BCP needs to be activated Escalation and Communication Points Provides advice to Volunteers and YMCA members on appropriate measures and protective equipment to protect health and safety during various types of crisis (infectious disease, chemical spill, or any crisis which may cause a health threat) Evaluates severity of incident and takes appropriate action Escalates incident to General Manager If an incident is considered significant, it will be treated as a Crisis. GM of the facility or program area is the Site or Program Crisis Commander Escalates decision-making, notifies Program SVP / VP of crisis Assists in emergency response procedures if decisions at GM level are required; coordinates emergency response Ensures assignment of duties and delegation as appropriate Handles communications with Local Authorities (i.e. Fire, Police) depending on level of emergency Establishes communication channel with emergency response authorities (ie. fire chief, police captain) Identifies type of communications that may be required and escalates to VP Communications or Program SVP / VP Notifies Funding Agency, External Relations if applicable Notifies and escalates crisis issues appropriate for review with Chief Operating and Services Officer (COSO) Escalates crisis to COSO and BCP Executive Owner (CFO) and Crisis Management Team (if or when convened) Works with Chief Financial Officer and COSO and other SVPs / VP of crisis decisions as needed Coordinates Crisis response with General Manager (Site or Program Crisis Commander) Coordinates ongoing communication needs with trained media spokesperson when necessary Works with General Managers or SVPs/VPs to assess IT impact to programs and services Reviews IT support requests with Crisis Commander, sets action plan, and escalates support requests within IT accordingly; directs IT outsourced provider if applicable Escalates any IT issues to Crisis Management Team, determines and communicates application outage estimates to Crisis Commander and Team for advice/decision making Provides senior level guidance for teams activating and managing their business continuity 16

18 BCP Crisis Escalation Roles Crisis Management Team cont d Assesses damage to business operations and impact to human resources based on input from Program GM and VP or SVP Team comprised of various Subject Matter Experts depending on nature of the Crisis Management staff most familiar with the program impact and support needs Provides cross-functional coordination, expertise, advice and support to teams executing the BCP response phases (emergency, initial resumption and restoration activity) Chief Operating and Services Officer (COSO) is the back-up commander when CFO is not available Provides cross-program expertise, and support to SVP or VP executing BCP Chief Financial Officer is the BCP Senior Executive owner and overall Crisis Commander Provides cross-functional crisis command, expertise, and support to teams executing BCP Triggers BCP Conference Line to facilitate communication among Crisis Management Team members: CEO Board Conference Dial-in details: Toll free: Participant ID: # Escalation and Communication Points Works with GM and SVP / VP to assure human safety, and minimize loss to physical assets or reputation Escalates issues appropriate for resolution by SVP and/or COSO Guides Communication Plan from VP Communications to include internal/external audiences, management/board/staff briefings, contact centre/member services and website updates as appropriate Provides subject matter advice for crisis management including media, impact/damage assessment, EAP, insurer notice, legal consult or Ministry reporting if applicable, etc. Provide BCP support (damage assessment, facilities planning, staff (re)deployment and other HR issues, revenue and process impacts, initiating downtime steps, regulatory reporting, insurance, access to key suppliers, expenditure guidance, etc. Provide Program advice/support on priorities and strategies Provides input to program SVP or VP Considers cross-program impacts and provides expertise to CFO, and supports CFO in executing BCP Escalates issues appropriate for review with Crisis Commander Provides back-up as commander when CFO is not available Declares full YMCA BCP activation and assumes executive leadership as overall Crisis Commander Leads crisis management based on input from COSO, from Program SVP or VP and appropriate Subject Matter Experts including VP Risk Intelligence as internal BCP process expert Convenes Crisis Mgmt. Team in consultation with COSO and Program SVP to resolve escalated issues and prioritize resources Considers with COSO impact(s) on other programs, for example, a major disruption at an H&F facility may impact Child Care or Camping services Escalates issues appropriate for review and approval in consultation with CEO Consults with and supports Chief Financial Officer in decisionmaking and issue resolution; reviews/approves crisis management response as required Determines need for direct CEO engagement and visibility under certain circumstances, such as crisis involving fatality, in consultation with Chief Financial Officer Informs and updates Board as appropriate Receives updates from CEO, and provides any requested input or guidance 17

19 Appendix D: Crisis Communications Checklist Action Status Notes Upon Crisis Recognition by the General Manager (See also Crisis Escalation Model and Roles in Appendix C) 1. GM alerts Vice President, Communications or designate to existence of crisis situation; establish reliable, open line of communication between crisis manager (GM) and VP Marketing & Communications, or bring VP on site at crisis command site. 2. GM briefs VP Marketing & Communications or designate on full details of crisis. 3. GM and Communications alert staff (specifically staff at communication touch points contact centre; service / reception desks, etc.) as follows: all news media or other external stakeholder requests for information are to be directed to Communication department (or named designate); staff should be specifically directed to not speak to anyone about the issue except to redirect to Communications or named designate. 4. VP Marketing & Communications or designate to: Identify spokesperson(s); Develop or designate to develop comprehensive response messages; Brief Crisis Commander (CFO), BCP custodian (VP Risk), and COSO, and brief designated crisis spokesperson on response messages; Coordinate requests for information; Coordinate proactive response/information release to targeted key audiences. 5. VP Marketing & Communications or designate begins monitoring and tracking of crisisrelated media coverage, media requests and other information requests. 6. VP Marketing & Communications or designate develops communication for internal audience. 7. VP Marketing & Communications or designate opens communications channels with government or others affected, key external stakeholders; brief / liaison with External Relations to coordinate this stage. 18

20 Appendix E: Resumption and Recovery Checklists The purpose of these checklists is to provide a structured series of steps for managers to follow AFTER human health and safety has been addressed through Emergency Response - See YMCA Safety & Emergency Procedures Manual. The Resumption Phase begins by assessing damage or impact following a disruption event. Site Incident Command Centre Item and Task Done Notes 1. The General Manager (GM) in consultation with the Program VP or SVP and the Chief Financial Officer has established an Incident Command Centre which serves as the communications and facilities recovery focal point for coordinating activities between various teams. Incident Command Centre provides a central location for teams to assemble and receive information, make team decisions, direct information, coordinate resumption and recovery actions. 2. The GM has arranged a situation report meeting in order to manage the situation, preparing an agenda that includes the following: Attendance roster: GM, senior team members, SVP if appropriate, subject matter experts (IT, Asset Dev t, etc.) if appropriate Situation overview Employee, member, volunteer, child safety / well-being status Facilities and Program / Service impacts Absenteeism status (for example if an infectious disease outbreak) Actions for GM / Site Crisis Commander to support requirements (i.e. contact alternate site, staff up/redeploy, etc) and communication to senior management Communications plan (internal and external) working with VP Communications Contingency plan Other Next meeting Impact Assessment Done Notes 3. GM has arranged a facility assessment (by a facility manager or other expert) to assess and document physical property damage. During this step, the facility manager or alternative has made a determination in consultation with the GM as to the level of escalation required. The following is considered in this initial assessment: Identify which areas of the location are safe to continue programs and other uses, if any have been identified Identify length of time or resources required to make assessment of full damages Identify short-term recovery estimate if possible Identify personnel (supplier/contractor) skill requirements to meet recovery objectives Identify any salvage items, and personnel to remain available / on stand-by to secure or prevent further damage to the facility Submit Report to GM and forward to Risk Dept for insurance implications 19

21 Item and Task Done Notes Situation Analysis The GM has ensured the following is addressed in their Situation Analysis: 4. A person has been assigned to document decisions made and actions taken during incident management, including persons accountable for following this checklist. 5. Key programs and events scheduled to occur have been discussed with: GM, program SVP, program manager(s), program delivery partners if applicable (local/ministry/federal government, community partners) 6. Impact to programs, services and timelines required to prioritize support have been assessed: Lists of programs/events and timelines (i.e. scheduled activities or classes due to start) that may be impacted has been prepared. Ability to continue programs/services at normal capacity has been assessed identifying those that may need to be modified, or interrupted temporarily If applicable, notice requirements to a funding agency have been reviewed / discussed with External Relations as appropriate Required equipment and key supplies (Procurement) and other resources to resume program / service delivery has been reviewed Plan(s) to address immediately required changes in programs have been prepared. Refer to program, class instructor and/or other relevant schedules. Expected recovery timeline(s) for critical IT services has been discussed with SVP IT and are known Strategy for recovery of immediately required programs needed to support business resumption has been validated by program SVP Program VP or SVP has been engaged in evaluation of the recovery plan and timelines Insurers are notified (Risk Management); tracking of costs (repairs, replacement, revenue loss) initiated by Finance for cost recovery 7. A communications plan has been established in consultation with the VP Marketing & Communications, to keep all impacted parties informed of BCP response and recovery activities and status: A documented and approved communications plan has been prepared for the incident working with the Communications VP. Various audiences requiring information about the disruption have been identified (members, staff, volunteers, Board, parents, Government, news media, funding agencies, etc). What each audience needs to know is defined Which communications vehicles will be used is defined (phone, , voic , web site, press release, call or contact centre) How to communicate with relocated staff/program volunteers is defined (call rerouting, cell phone, etc.) Regular meetings and updates have been scheduled Standby statements and other crisis communications items are implemented as approved by VP Communications (Appendix D) 20

22 Item and Task Done Notes 8. An internal communiqué has been prepared for impacted parties so they know their next steps and actions: Senior management and program teams have been notified that the BCP has been activated and what phase is in progress. Employees know where to report for work Volunteers, members, clients, know where to go for programs Manager contact information and timelines for check points / updates have been established with employees All impacted audiences know how and when they should expect to receive further news and instructions 9. Cash flows and other (i.e. financial reporting, filing) impacts associated with events due to occur, have been identified and communicated to the CFO or designate who will ensure the following: Our bank has been notified; emergency payments with instructions from CFO or designate using pre-established controls have been arranged Potential delay in statutory payment deadlines or financial reporting requirements have been identified and prioritized Discussions have occurred with HR and payroll service provider ADP to ensure payroll continuity and any needed adjustments 10. Site accessibility and availability has been assessed and established by the GM in consultation with a facility manager if applicable: A Facilities Damage Assessment Report has been completed (report template to follow). Site access restrictions are known including a timeline and a process for updates if site access is likely to change during the first two weeks following the disruption event Ability to recover any equipment, supplies, critical hard and soft copy files from the site is known Key data, private information, or sensitive documentation that need to be secured has been identified and action taken Needs for required alternate space to continue programs and services have been discussed with the facility manager and/or appropriate VP Action plan and timelines for moving programs, services and other activities to alternate space have been set Any employees that need to travel to an alternate location to support program delivery have been identified and are able to relocate 11. Impact to human resources has been fully assessed by the GM in consultation with the program SVP/VP and SVP/GM Human Resources: If required, key staff are available to work from alternate location(s) Additional resources (staff/volunteers) required for program or service delivery, have been identified. Human Resources has been advised of the need for any additional specialized resources, or other temporary workers. Necessary equipment to deliver the program is available If applicable, succession plan is in place / has been activated for key staff resources 21

23 12. Alternative locations and teams have been put on notice: Item and Task Done Notes Alternate locations and teams able to support BCP needs have been notified are available Timelines set to transfer programs, resume services at those sites Arrangements have been made for any required additional resources, security, administrative needs, legislated requirements at alternative location(s) Resumption This section defines which steps are to be resumed to provide (modified) programs and services, and in what priority. 13. Minimum resources considered for Resumption include: facility requirements to house temporary offices space required to deliver program (i.e. fitness & recreation, child care, outreach, job placement, etc) any unique space requirements (access to shower facilities, change rooms, food preparation, pool, etc) available human resources key business equipment, hardware / software access to public transit, parking hard and soft copy records 14. Special interim procedures that may need to be used to accommodate program workarounds are identified using the following questions: Access to buildings and parking area has been addressed for re-routing? Possible solutions include use of ramps, temporary nearby parking identified, use of alternate entrances and access routes, etc. Impacts of rerouting to other program areas (i.e. showers, change rooms, child care, pool access) have been identified? Office space, or place to access YMCA network identified? Possible solutions include use space at alternate YMCA facility or connect to YMCA network through alternate location with internet access Process for monitoring movement of members, and any rerouting issues that arise has been identified? Possible solutions include collect headcount data from instructors, arrange frequent facility walk-through by staff, monitor any increase in member complaints Key suppliers or alternates have been identified and arrangements made such as quick ship for continued supply of goods or services. Communication to members has been prepared to notify of special procedures to continue accessing YMCA? For example, use signage or postings on doors, local news media in consultation with Communications VP, direct members to website for information. Financial management changes required? For example, deposit end of day receipts, and approvals for special expenditures to support temporary arrangements in consultation with the CFO or controller (i.e. limits assessed, special accounts and controls, extraordinary expense accounting, cash transfer, etc.) Notes 22

24 Item and Task Done Notes Human Resources management changes required? For example, redeployment of staff to alternate site, temporary staff, adjustments to hourly pay, revised shift schedules etc in consultation with HR. Legal issues or advice needed? Crisis Team / management has identified any legal issues and arranged consult with our lawyer. Are special instructions to funding or regulatory agencies needed? Have new security and safety issues at alternate location been assessed and is plan ready? For example, members show membership cards to access a program or class, Ministry approves alternate site for childcare, fire plan and emergency procedures provided, security system assessed and in place. Have arrangements been made for relocation of resources, equipment to alternate site? For example, movers are booked, packing materials are ready, supplies packed. Are (workaround) procedures to maintain hard copy files and records understood by staff and volunteers? For example, store sensitive records in a secured (locked) drawer or cabinet, ensure staff and volunteers have reviewed Y privacy policy. Are procedures in place to re-route calls, contact the relocated team? For example, use of cell phones, use of voic and frequency to pick up messages has been established. Have necessary changes to building services been assessed and implemented? For example, mail delivery, cleaning, garbage removal, shipping / receiving, food services or snack bar. Other Resumption Activities 15. Minimal workstation requirements are identified including minimum number of equipment (PCs or thin clients with standard desktop programs), duration of support required (i.e. 2 weeks), number of staff to share each workstation, etc. Notes 16. Regarding facilities, and as soon as the decision has been made to bring the operation back to a level allowing a portion of the facility (or alternate site) to be functional, program teams or a portion may require relocation to alternate sites until restoration of the primary site is complete. The following activities should be carried out by the GM in consultation with a facility manager where applicable: Implement damage containment and salvage objectives, under the advisement of our insurer where applicable Identify immediate critical needs and escalate to the SVP Ongoing assessment of event impact on program delivery Coordination of various program BCP activity if a multi-purpose site Status reporting frequency, monitor and support evolving situation Establish facility task priorities and required coordination with senior program staff Analyze and determine if recovery timelines in consultation with Association Services is achievable at the site Establish administrative controls Establish personnel, and any contractor tasks, work schedules 23