Introduction and context

Resilience, as described and promoted in Preparing Scotland, has many different but interconnected elements. In an organisational or business context, this manifests as the practical ability to avoid disruptions to normal activity, to keep the things that matter most going and, if disruptions occur, to get back to a desired state of operation quickly – not by good fortune, but by design.

Being resilient in this way is immediately appealing. Resilient Category 1 responders will be more able to fulfil their duties when adverse circumstances mean we need them most. Businesses that are resilient will avoid costly losses, gain commercial advantage and be able to continue to provide the employment, goods, and services we value.

And voluntary organisations will be able to continue their work to support individuals, communities, and other service providers, increasing the quality of many lives.

This guidance uses the term ‘Business Resilience’ to mean ‘the capacity of an organisation to adapt in order to sustain an acceptable level of function, structure and identity.’

For most organisations, resilience of this sort will be a means to an end and not their main objective. When working to develop resilience in an organisation, it is therefore essential to keep its objectives and the interests of the people involved clearly in focus. In this way the preparations will be seen to be relevant and the response to disruptions or emergencies will be more effective. This is consistent with the Preparing Scotland approach to developing resilience based on the doctrine of Integrated Emergency Management (IEM) which includes the principles of integration, responsibility, and continuity. This approach to Business Resilience must therefore consider:

• the priorities, motivations and skills of individuals, teams, and organisations
• relationships with external organisations and their resilience capabilities
• the formal processes and tangible resources that deliver goods or services
• the risks the organisation faces and potential emergencies that might arise

The term ‘business’ should be understood to include the activity of both commercial and non-commercial organisations or groups, whether small or large, and whether they are in the commercial, public, or voluntary sectors.

The Civil Contingencies Act and business resilience

The Civil Contingencies Act and Regulations place several duties on Category 1 responders, including:

• The ability of Category 1 organisations to continue to be able to perform their functions in the event of emergencies
• The provision, by local authorities, of advice and assistance to businesses and other organisations about the continuance of their activities

These are sometimes expressed as ‘having and promoting business continuity.’

The legislation is also concerned with how these duties are carried out, with cooperation between partner agencies (both statutory and non-statutory) and how this relates to its other requirements – including risk assessment, maintaining plans, and emergency response and recovery.

The approach recommended in this guidance is to apply the principles of Integrated Emergency Management in the context of organisations and businesses. Category 1 responders are advised to consider the requirements of the Civil Contingencies Act alongside their other responsibilities and objectives, so that the most effective, integrated ways of working can be found. Similarly, when working to develop resilience in other organisations, this approach will encourage businesses to develop resilience in a way that serves their strategic aims and utilises their existing strengths.

In this guidance the phrase ‘having and promoting Business Resilience’ is used to refer to these duties carried out in this way.

Overview of business resilience guidance

This guidance provides strategic advice to Category 1 responders and information to other readers by considering:

• How Business Resilience relates to other resilience issues such as the resilience of communities and emergency response arrangements
• What should be understood by Business Resilience, business continuity, and related terms
• How these duties might best be fulfilled

What the Civil Contingencies Act and Regulations require of Category 1 responders regarding their ability to continue to perform their functions and provision of advice and assistance to others about this.

The broader context of resilience is set out in the Preparing Scotland ‘core’ guidance and is outlined below. This and particular links between Business Resilience and Community Resilience are discussed further in 'Having buisness resilence'.

Business resilience and other resilience activity

Scotland’s resilience depends not only on the ability of organisations such as the police or ambulance service to deal with emergencies, it also requires other public sector organisations, private businesses, households, and local communities to play their role. Because the different parts of our society are closely interconnected, more or less resilience in one part will affect the whole, and good practice in one area of life may inform behaviour in another. Because our society is diverse, the varied skills of different groups and individuals will all be needed for it to work at its best. While business continuity (or similar duties) are not legal requirements for all organisations, self‑interest and good management make it advisable for all organisations to develop Business Resilience in ways that are appropriate to their circumstances.