Business Continuity Plan

The Business Continuity Plan (BCP) outlines the purpose, scope, and goals for maintaining operations during disruptions.

• Purpose: To ensure the School's academic and operational functions continue seamlessly during emergencies. The BCP aims to minimise disruption, protect critical infrastructure, and support rapid recovery while upholding the institution’s mission and safeguarding the interests of students, staff, and other stakeholders.

• Scope: Covers all departments and operations, including academic, administrative, and support services.

• Goals: Establish clear recovery objectives, safeguard stakeholder interests, and minimise disruption to educational services.

The School adopts a proactive and structured approach to risk management to ensure operational success. The Risk Management Policy provides a framework for identifying, categorising, evaluating, and mitigating risks systematically. Risks are tracked through the School’s automated governance system (AGS) and are managed with the following guidelines:

• Prevention: Document measures to prevent the risk from occurring.
• Alleviation: Outline strategies to reduce adverse effects if the risk materialises, including backup plans.
• Plans: Specify current and future actions to improve risk ratings.
• Target Score: Indicate the desired risk rating (red, amber, green) after implementing mitigation measures.

Departmental Directors use the risk register in daily operations and report on risks and mitigation to the Executive Committee and Quality, Compliance, and Audit Committee. The Quality, Compliance, and Audit Committee meets at least three times annually, aligning with key operational dates as detailed in the Governance Statement.

The AGS will:

1. Maintain an evidence and audit base.
2. Support Directors with regular reporting and analysis.
3. Alert management, the Executive Committee, and Quality, Compliance, and Audit Committee to emerging or escalating risks.
4. Assist the Quality, Compliance, and Audit Committee with evidence and reporting for effective oversight.

The Executive Committee will assess strategic and operational risks, including those related to student protection, and coordinate with the Board of Governors and Quality, Compliance, and Audit Committee. The Board of Governors will review risk management at each meeting, and the Executive Committee and Quality, Compliance, and Audit Committee will report on risk management to the Board.

The School conducts a Business Impact Analysis (BIA) as part of its Board of Governors’ reviews to assess the impact of disruptions on essential functions and services. This analysis, undertaken by the Board of Governors, Academic Board, Executive Committee, and Quality, Compliance, and Audit Committee, identifies critical operations, prioritises recovery strategies, and ensures effective continuity planning. The BIA is regularly updated to adapt to changes and maintain resilience.

The School’s IT Incident Response Plan, part of the IT Infrastructure Management Policy, is designed to minimise disruption to students' learning and ensure continued service delivery. The Director of Technology (DoT) oversees the plan, initiating it by notifying the Board of Governors, Quality, Compliance, and Audit Committee, and Executive Committee of the incident. The President assesses the situation and authorises the DoT to activate the plan and convene a Response Committee if needed.

The Response Committee, chaired by the DoT, meets daily until the incident is resolved and formally closed by the President. The DoT collaborates with IT, Marketing, Wellbeing, and Department of Education (DoE) heads at least twice a year to review and update the plan. The DoT is responsible for reporting on the plan’s effectiveness and ensuring team training. After an incident, the DoT conducts a root cause analysis, evaluates why risk management measures failed, and drafts a report for the Executive Committee, Quality, Compliance, and Audit Committee, and Board of Governors to update the plan.

For minor incidents not requiring full activation, the President may authorise the DoT to take necessary actions, with direct reporting to the President.

In the event of a serious risk affecting continuity, the School is committed to protecting students. The School submits an annual Student Protection Plan to the Office for Students (OfS) to ensure student protection in case of significant disruptions. This plan addresses risks such as operational cessation, campus closure, loss of degree awarding powers, inability to deliver programmes, loss of Tier 4 Sponsorship licence, and loss of key staff.

The plan details mitigation measures, student refunds and compensation, and communication strategies. The Board of Governors oversees the plan, ensuring that risk management is integrated into School operations.

The Student Protection Plan ensures that students can either complete their studies or receive compensation if this is not possible due to course, campus, or institution closure. This plan complements, rather than replaces, the protections guaranteed under consumer law.

It covers:

1. Risk Assessment: Includes risks such as cessation of operations, loss or suspension of degree-awarding powers, and loss of key staff.
2. Mitigation Measures: Strategies to address identified risks.
3. Refunds and Compensation: Details on how students will be reimbursed or compensated.
4. Communication Plan: Procedures for informing students about their options and the status of their studies.

The School will ensure all relevant staff and committees, including the Board of Governors, Academic Board, Executive Committee, and Quality, Compliance, and Audit Committee, receive regular training on the Business Continuity Plan (BCP). This training will cover the plan’s objectives, procedures, and their specific roles during disruptions. Awareness sessions will be conducted annually and updated whenever significant changes occur to the BCP.

The School will regularly test and update its Business Continuity Plan (BCP) to ensure its effectiveness and relevance. Testing will involve simulations and reviews, involving the Board of Governors, Academic Board, Executive Committee, and Quality, Compliance, and Audit Committee. Updates will be made based on test outcomes and changing operational needs.

The School will maintain comprehensive documentation and records for all aspects of the Business Continuity Plan (BCP). This includes detailed logs of testing results, training sessions, and incident responses. The Executive Committee and Quality, Compliance, and Audit Committee are responsible for ensuring that these records are regularly reviewed, updated, and securely stored to support effective plan execution and compliance with regulatory requirements.

The School's Business Continuity Plan (BCP) is reviewed and updated regularly to reflect lessons from drills, incidents, and feedback from the Board of Governors, Academic Board, Executive Committee, and Quality, Compliance, and Audit Committee. This ongoing process ensures the plan adapts to new risks and maintains effective response strategies.