1. Purpose
1.1 The purpose of this policy is to establish and provide an overview of the University’s methodology and approach to business continuity, critical incident, and emergency management and its approach to organisational resilience across all university activities.
1.2 This policy enables the University to anticipate, prepare for, respond to, and recover from disruptive events in a manner that mitigates the loss of university assets and operations, protects the University’s reputation and social licence, reduces any negative impacts on the University community and the environment, and enables an effective restoration of critical functions and a return to business-as-usual operations as soon as practical.
1.3 Council is accountable for ensuring the University’s operations are managed efficiently, effectively and economically, including maintaining appropriate oversight of business continuity, incident and emergency management, in accordance with the University of the Sunshine Coast Act 1998 (Qld).
1.4 This policy must be read in conjunction with the Business Continuity and Resilience - Procedures and Incident and Emergency Management - Procedures, which operationalise the requirements of this policy.
2. Scope and Application
2.1 This policy applies to all staff, students, contractors or consultants, strategic partners, third-party service providers, controlled entities, and members of the University governance, decision-making or advisory bodies.
2.2 It is consistent with the ISO 22301:2020 and Business Continuity Management and demonstrates the commitment to and support for effective and efficient business continuity, incident and emergency management and applies to all activities across the University.
2.3 In support of this policy and the Business Continuity and Resilience Framework, more detailed governance documents are in place to address specific business continuity, incident and emergency risk types and legislative/regulatory obligations relating to their specific topic. They include the following:
- Business Continuity and Resilience - Procedures
- Contract Management - Operational Policy
- Data Governance - Operational Policy
- Health, Safety and Wellbeing - Governing Policy
- Incident and Emergency Management - Procedures
- Information and Cyber Security - Operational Policy
- Project Assessment and Management - Operational Policy
- Procurement - Operational Policy
- Work Integrated Learning – Academic Policy
3. Definitions
3.1 Refer to the University’s Glossary of Terms for definitions as they specifically relate to policy documents.
Alternative Site is an identified location which could feasibly be used as an alternative to an organisational unit’s normal location in the even that an emergency prevents the use of the normal location. Alternative sites need to meet most of the requirements of the normal operating location to assist in the recovery of an organisational unit’s critical functions.
Business Continuity is the capability of the University to continue the delivery of its critical functions at acceptable, predefined levels following a business disruption.
Business Continuity Management (BCM) is the suite of policies, processes and capabilities that enables the University to maintain or recover critical functions and services in the event of a disruption.
Business Continuity Plan (BCP) is a plan which outlines how critical functions and critical assets can be maintained or recovered in a timely fashion after a disruption.
Business Impact Analysis (BIA) is a detailed assessment analysing activities and the effect that a business disruption might have upon them.
Campus refers to (for the purpose of this Policy):
- The physical location where a program or course of study is being delivered
- A location where online course materials and IT assets are maintained
- The location where University research and development is taking place
Comprehensive Approach is a risk based systematic approach outlining the phases of Prevent, Prepare, Respond and Recover (PPRR) that cover all aspects of planning, collaboration and resource allocation for incident and emergency management.
Control is any measure or mechanism that is put in place to reduce the cause, consequence and/or likelihood of identified risks and to manage compliance. The establishment of controls within business processes provides protection, and their effectiveness strengthens the ability to manage and mitigate the associated risks and compliance obligations.
Critical Functions are functions or activities that are critical to the University’s ability to deliver its core services and meet its obligations, and which would result in immediate and unacceptable consequences, including threats to life and safety, breach of legal or regulatory obligations, or severe damage to the University’s ability to operate if not addressed.
Critical Assets are digital or physical assets that support the critical functions of the University.
Critical Incident is an actual or potential issue or incident that has been risk assessed with a consequence of Major or Catastrophic using the UniSC Risk Matrix & Assessment Tables where the scale, complexity or consequences exceed business-as-usual management and require coordinated institutional oversight.
Critical Incident Management Team (CIMT) is a management-level advisory and coordination body supporting the Vice-Chancellor and President that is convened during a declared critical incident to provide integrated situational awareness, cross-portfolio risk and impact assessment, and coordinated strategic advice. Comprising senior leaders with delegated authority over their respective portfolios, the CIMT supports institutional decision-making by recommending priorities, committing portfolio resources, and enabling a coherent whole-of-university response.
Emergency Management is the coordinated and risk-informed approach through which the University prepares for, responds to, and supports recovery from emergency events in order to protect life, property, the environment and the continuity of University operations.
Business Resilience and Emergency Planning Committee (BREPC) provides governance and senior leadership oversight of the University’s incident and emergency management planning and preparedness arrangements and oversees the development, implementation and maintenance of business impact analyses, business continuity, emergency, critical incident, cyber and other incident response plans, in alignment with relevant legislation, standards and the University’s Business Continuity and Resilience Framework. The BREPC does not perform operational or decision-making roles during an incident response, which is the responsibility of the CIMT and relevant operational leads. The BREPC must, following a critical incident, significant disruption, activation of the University BCP, or other event referred by the Chair, review response outcomes and oversee improvements to plans and preparedness arrangements.
Incident is an event or occurrence that interrupts normal operations or causes a deviation from expected outcomes and often requires investigation and corrective actions to prevent recurrence.
Incident Response Team (IRT) a team of specialists that is mobilised to assess and respond to an incident that has occurred.
Maximum Acceptable Outage (MAO) is the longest period of time that an activity, service, or process can be disrupted before the resulting impacts become intolerable for the organisation. It represents the upper limit of downtime that must not be exceeded and is used to set recovery time objectives (RTOs) and prioritise continuity strategies.
Notifiable Incident is an incident that meets the reporting criteria prescribed under applicable Commonwealth or State legislation and is required by law to be notified to a regulator or government authority within specified timeframes.
Organisational Resilience is the ability of the University to anticipate, prepare for, respond and recover from incidents in order to meet its strategic objectives and legislative obligations and maintain its social license in a changing environment.
Recovery Time Objective (RTO) is the period of time following an incident within which an activity must be resumed, or resources must be recovered.
Risk Ratings are assessed using the UniSC Risk Matrix & Assessment Tables and provide a consistent scale for measuring incident severity through the following classifications: Extreme, High, Medium or Low.
Third Party is a legally established entity separate from the University with which the University has a formal relationship for the purposes of delivering, supporting or maintaining critical functions or assets. This includes, but is not limited to, the provision of Work Integrated Learning (WIL) activities, program or course delivery, research and/or the provision of support services to students. Refer to Third Party Provider Coursework Program Arrangements - Academic Policy and UniSC Research Centres and Research Institutes - Academic Policy.
University Community relates to UniSC students, staff and other stakeholders engaging with the University, including visitors, contractors, volunteers and controlled entities.
4. Policy statement
4.1 The University is committed to maintaining a resilient, safe and sustainable operating and learning environment that protects the health, safety and wellbeing of our people, provides strong academic leadership, supports the continuity of the University’s critical functions and assets, ensuring that the University is prepared for and capable of responding to and recovering from actual or potential issues or incidents in a manner that upholds our values and strategic goals.
4.2 The University is committed to maintaining its critical functions and assets and seeks to ensure the uninterrupted delivery of learning, teaching, research and assessment activities in support of academic progression.
4.3 The University will proactively identify, assess, and manage teaching and learning continuity risks, including alternate delivery models such as online learning, offshore delivery, third party arrangements, and WIL.
4.4 The University is committed to delivering its critical functions within tolerance levels during severe disruptions and have relevant credible business continuity (BC) and disaster recovery (DR) plans in place which identify the critical systems and processes and their recovery time objectives.
4.5 The University will conduct systematic and periodic testing on the resilience of the critical functions and the key plans supporting the University Business Continuity and Resilience Framework using diverse scenarios to validate effectiveness in responding to real-world critical incidents and ensuring the preparedness of the Critical Incident Management Team (CIMT).
4.6 The University will ensure that the supporting plans are ‘fit for purpose’ through testing and exercising as well as through appropriate internal and external audit reviews. Testing will identify areas for improvement, validate the effectiveness of planning and recovery strategies, and refine procedures to enhance the University’s resilience to a spectrum of potential situations or threats.
4.7 Reporting on the outcome of these tests will be provided to the University Executive and the ARMC on at least an annual basis. Reporting will be supported by verifiable evidence compiled via testing, incident reviews, historical performance, and lessons learned analyses, and incorporate a review of the Critical Functions and Critical Contracts Register providing assurances detailing system recovery times and potential data and financial losses.
4.8 The University will meet its legislative, regulatory, and reporting obligations, including those relating to safety, privacy, integrity, and environmental protection. UniSC will ensure timely reporting of notifiable incidents in line with applicable laws, standards and governance expectations.
5. Principles
5.1 The University has adopted a comprehensive approach to the principles of Prevent, Prepare, Respond and Recover (PPRR) to guide its organisational approach. At a strategic level, the University will maintain capability across theses four interdependent components:
- Prevent relates to activities aimed to prevent incidents or emergencies by taking steps to understand the risk that might cause an incident or emergency and mitigating the risk to the extent practical.
- Prepare relates to how to respond to an incident or emergency effectively if they eventuate with the development of plans, people and resources.
- Respond relates to how the University responds to and manages an incident and includes the enacting of the response mechanisms that were put in place during the preparedness phase, as well as the decision making and collaboration that takes place during the response.
- Recover relates to activities aimed at restoring the University to its normal functions and operations as soon as possible. Recovery activities do not need to wait for the ‘response’ phase to be complete and can run in parallel with incident resolution.
5.2 These principles are implemented under the ‘Three Lines of Defence Model’ to ensure that business continuity management accountabilities and responsibilities are embedded across the University, enabling the making of informed operational decisions in the event of an incident. More specific details of authorities and responsibilities are detailed below in Section 8 of this Policy.
6. University Business Continuity and Resilience Framework
6.1 The University Business Continuity and Resilience Framework is a critical supporting element of the University’s Risk and Compliance Management Framework.
6.2 The University Business Continuity and Resilience Framework (Diagram 1) is based on a comprehensive approach to manage business disruptions, critical and emergency incidents, to mitigate the impact of the event and resume critical functions back to business-as-usual (BAU) as quickly and effectively as possible.
Diagram 1 - University Business Continuity and Resilience Framework
6.3 The Framework is supported by the Prevent, Prepare, Respond and Recover principles, and is enabled by the following management activities:
- Business Continuity Management
- Ensures the identification, prioritisation and protection of critical functions, assets and dependencies essential to UniSC’s strategic goals.
- Provides an enterprise approach to continuity planning, response and recovery that supports resilience and adaptability and sustains delivery of critical functions.
- Critical Incident Management
- Provides a systematic and consistent approach to the management of incidents that have been assessed to be critical.
- Establishes clear leadership, decision making authority and communication pathways for high impact incidents.
- Ensures the University can rapidly assess impacts, prioritise actions and protect the people, property and assets of the UniSC community.
- Emergency Management
- Provides a consistent and compliant framework for emergency readiness and response across all UniSC campuses and facilities in a way that supports a safe, coordinated and timely response that safeguards life, property and the continuity of critical functions.
6.4 The relationship between emergency response, incident management, continuity response and recovery response is shown below. The diagram shows the flow on and overlap through the stages of an incident. It illustrates how an emergency incident will change through the progression of four steps taken to return to BAU.
Diagram 2 – Incident Phases
7. Key components of the University Business Continuity and Resilience Framework
7.1 The Business Continuity and Resilience - Procedures and the Incident and Emergency Management - Procedures provide more specific details of the underlying and supporting process for business continuity, incident and emergency management and lay the foundation for a range of supporting Plans, Guidelines, Sub-Plans and Site Operating Plans, including:
- Business Continuity and Resilience - Procedures
- Departmental Business Impact Analysis (BIA)
- Departmental Business Continuity Plan (BCP)
- Incident and Emergency Management - Procedures
- Critical Incident Management Team Support Manual
- Emergency Management Plan
- Data Breach Control Plan (via DB-IRT)
- Cyber Security Incident Response Plan (via CS-IRT)
8. Authorities and responsibilities
8.1 As the Approval Authority, Council approves this policy in accordance with the University of the Sunshine Coast Act 1998 (Qld) upon endorsement from ARMC.
8.2 As the Responsible Executive Member the Vice-Chancellor and President can approve procedures and guidelines to operationalise this policy. All procedures and guidelines must be compatible with the provisions of this policy.
8.3 As the Designated Officer the Director, Governance and Risk Management can approve associated documents to support the procedures and guidelines to operationalise this policy. All associated documents must be compatible with the provisions of the policy.
8.4 This policy operates from the last amended date, with all previous iterations of policy documents related to university risk and compliance are replaced and no longer operating from this date.
8.5 All records relating to the University Business Continuity and Resilience – Governing Policy must be stored and managed in accordance with the Records Management - Procedures.
8.6 This policy must be maintained in accordance with the University Policy Documents – Procedures and reviewed on an annual policy review cycle.
8.7 Any exception to this policy to enable a more appropriate result must be approved in accordance with the University Policy Documents – Procedures prior to deviation from the policy.
8.8 Refer to the Delegations Manual in relation to the approved delegations detailed within this policy.
Authorities | Responsibilities |
Council | Ultimate accountability for the effective and efficient governance of the University under the University of the Sunshine Coast Act 1998 (Qld). |
Audit and Risk Management Committee (ARMC) | Oversight of the University’s overall governance, business continuity, critical incident and emergency management activities. Monitoring of critical functions, assets and systems across the University, where appropriate, reporting to Council to provide assurances concerning the management of business continuity, critical incident and emergency management within the University. |
Academic Board | Oversight of contingency and business continuity arrangements for learning, teaching and research, including self-assurance that credible, adequately resourced plans and student safeguards are in place to mitigate disadvantage arising from unplanned disruptions to the delivery of programs, including disruptions associated with third-party arrangements, loss of professional accreditation, or the University’s inability to continue offering a program. |
Business Resilience and Emergency Planning Committee (BREPC) | Responsible for providing governance oversight and assurance of the University's business continuity, critical incident and emergency management preparedness arrangements, including monitoring the adequacy and currency of BIAs and BCPs, overseeing training and exercising activities, reviewing outcomes from incidents and exercises, and monitoring improvement actions, capability gaps and emerging risks. |
Vice-Chancellor and President | Accountable to Council to ensure that business continuity, critical incident and emergency management activities are carried out effectively within the University, including promoting a culture that encourages strong business continuity planning and organisational resilience. Responsible for the activation of the University BCP. |
University Executive | Responsible for managing the University's activities:
|
Chief Operating Officer | Responsible Executive Member for the Incident and Emergency Management – Procedures and the effective operationalisation of the supporting documents. Chair of the Critical Incident Management Team (CIMT) and the Emergency Planning Committee (BREPC). Responsible for activating the Critical Incident Management Team in the event of an incident. |
Director, Governance and Risk Management | Responsible for reviewing, maintaining and overseeing implementation of the University Business Continuity and Resilience Management Framework, including supporting and working with Senior Staff and Cost Centre Managers by facilitating the annual review and testing of their BIAs and BCPs, providing advice regarding the preparation of their BCPs, and generally providing information, education, and training to staff on business continuity, critical functions and emergency management processes. Responsible for maintaining the University BCP in consultation with the BREPC and informed by lessons identified through CIMT activities and incident reviews. |
Senior Internal Audit Manager | Responsible for, wherever relevant, incorporating assurance over Business Continuity and Resilience processes and testing into the scope of the individual audits included in the annual operational internal audit plan. The resulting audit reports will identify areas for improvement and validate the effectiveness of planning and recovery strategies, including the review of the Critical Functions and Critical Contracts registers and providing assurances detailing system recovery times and potential data and financial losses. |
Director, Campus Development and Services | Designated Officer for the underlying Incident and Emergency Management – Procedures and the effective operationalisation of the supporting Plans. When required is the alternate to the Chief Operating Officer when CIMT is enacted. |
Senior Staff Cost Centre Managers | Responsible for incorporating business continuity, critical incident and emergency management practices into day-to-day activities in their portfolios and costs centres by:
|
Agreement Owners Agreement Managers | Responsible for the governance, oversight and lifecycle management of contract and supplier agreements, ensuring these agreements support the University's core services and functions and are managed, reviewed and updated in line with the Contract Management - Operational Policy. In relation to business continuity, critical incident and emergency management Agreement Managers are accountable for:
|
Project Managers | Responsible for planning, delivering and governing projects in accordance with the Project Management Framework (Project Management Manual and Framework) which includes the identification of risks, dependencies and business continuity impacts on the University's core services and functions. In relation to business continuity, critical incident and emergency management Project Managers are accountable for:
|
All Staff | Identify, assess business continuity risks and implement mitigating actions to reduce the business continuity risk in their BIA, and, where required, bringing business continuity, critical incident and emergency management issues to the attention of their supervisors and Governance and Risk Management. The business continuity, critical incident and emergency management responsibilities of all staff also include managing:
|
9. Appendices and Supporting Documents
Nil
END