Business Continuity During COVID-19

Did business continuity arrangements enable the continuation of essential public services during the coronavirus (COVID-19) pandemic?

Video presentation

Video transcript

Key facts

Note: The number of prioritised services can vary as departments review their services and undergo structural changes.
Source: VAGO, based on information from departments.

What we found and recommend

We consulted with the audited agencies and considered their views when reaching our conclusions. Their full responses are in Appendix A. 

Preparedness versus response

The ability of government departments to continue providing services during a disruption depends on how well prepared they are and how they respond. Good business continuity management (BCM) is key to this.

We examined whole-of-government business continuity arrangements. We also looked at departments’ preparedness for a major disruption and their response to the coronavirus (COVID-19) pandemic. 

Whole-of-government arrangements

COVID-19 has caused a disruption of a scale that most people have not experienced before. Responding to a pandemic is complex. It involves private industry and the public sector, emergency management, crisis management, and a health response.

However, a pandemic was foreseeable. For many years, statewide risk plans have listed a pandemic as a risk. In 2019, the State Significant Risk Interdepartmental Committee (Risk IDC) rated this risk as ‘likely’ to occur with ‘severe’ consequences.

Prior to COVID-19, the Victorian Public Service (VPS) had mitigation strategies for managing a statewide disruption. However, its focus was on the emergency response (protecting life, assets and the environment), not business continuity. 

Business continuity planning

In October 2018, the Government Sector Resilience Network (GSRN) ran Exercise Petunia to examine what would happen if a significant percentage of the population could not work due to a pandemic. This exercise used a multi agency pandemic scenario.

Whole-of-government oversight

No single agency is responsible for coordinating prioritised services from a whole of government perspective. This means that each department largely acts on its own.

During the initial stages of COVID-19, the Department of Premier and Cabinet (DPC) took on a lead business continuity role for whole-of-government matters.

While this arrangement was beneficial, it was temporary and reactive, which led to some delays in communication and setting up processes. 

The Victorian Government set up the Crisis Council of Cabinet and VPS missions in April 2020. However, these groups have understandably focused on the emergency response. 

Recommendations about whole-of-government arrangements

Preparedness: departments’ individual arrangements

BCM policies and procedures

All departments had BCM policies, procedures and response structures in place prior to COVID-19. While these had some minor gaps, they were mostly aligned with the requirements of the AS ISO 22301:2020 Security and resilience—Business continuity management systems—Requirements standard (ISO standard). 

However, preparedness involves more than just having policies. It requires departments and the sector to understand the services they provide, the impact a disruption would have on these services and how they should respond. 

The first step to do this is through a business impact analysis (BIA).

Business impact analysis

A BIA is one of the most important elements of business continuity planning. However, there are significant gaps in this practice across the departments.

A BIA should help an organisation:

• understand how a disruption might impact its services
• understand what services it should prioritise in a disruption
• identify the processes and resources that support its services.

However, many departments' BIAs did not fully assess the impact that a disruption might have on their services. They also did not all consider minimum resource requirements and the internal and external suppliers that their services need to run. 

These gaps can impact how effectively departments respond and maintain their prioritised services during a disruption.

Despite the importance of BIAs:

• only the Department of Education and Training (DET), the Department of Environment, Land, Water and Planning (DELWP) and the Department of Justice and Community Safety (DJCS) have organisation-wide BIAs
• DPC had not undertaken a BIA since 2016
• the Department of Transport (DoT) and the Department of Jobs, Precincts and Regions (DJPR) did not undertake a BIA in 2019 after significant machinery-of-government changes. DoT stated that this is because it did not finalise its structure until December 2019.
• DET was the only department that had BIAs that included all elements of the ISO standard prior to COVID-19.

Business continuity plans

Organisations should use the information they gather through their BIAs to develop strategies to ensure they can maintain their prioritised services during a disruption. Departments document these strategies in their BCPs. However, we found several issues with departments’ BCPs prior to COVID-19, which Figure A shows.

Figure A: Gaps in BCPs

Note: *Activation criteria are a list of factors that departments use to decide if an event is likely to disrupt services and if they need to use their BCPs. 
Source: VAGO assessment of departments’ BCPs prior to COVID-19.

Practising for a disruption

Departments need to exercise their BCPs to ensure they will be effective in a disruption. They also need to ensure that staff know how to respond. 

Exercising BCPs

Only DET and DJCS had a clear program of exercising and tracking recommendations for their entire BCM program.

Departments often limited their BCM exercises to small-scale or desktop exercises, such as testing SMS functionality or testing the impact of a disruption on one or two business units. 

Limited exercising of complex disruptions means that departments have missed opportunities to train staff and identify and implement lessons learnt, such as workforce planning or large-scale communication issues. 

Staff training and resourcing

DELWP, DET and DJCS were the only departments that had dedicated training for business continuity staff. This means that business continuity personnel may not have the necessary skills and competencies to fulfill their roles during a disruption.

The Department of Health (DH) and DPC also do not have dedicated BCM resources. This further reduces their ability to take preventative action and respond to a disruption. 

Recommendations about departments’ preparedness for a major disruption

Response: individual departments

Departments’ pandemic planning

A pandemic is a unique disruption. Pandemics can affect multiple areas, such as staffing, suppliers, site availability and occupational health and safety, and therefore require specific response strategies. Only DELWP, DET and DPC had a pandemic plan prior to COVID-19. This means that departments spent valuable time developing plans during the pandemic.

During the initial stages of COVID-19, DJPR, DoT and DTF finalised their pandemic plans and DELWP, DET and DPC updated theirs. We found that departments’ pandemic plans contained varying levels of detail. For example, DJPR and DoT did not list all of their prioritised services in their plan. 

We also found that:

• DJCS does not have a pandemic plan. Instead, it incorporates pandemic strategies in its BCPs

  The Victorian action plan for influenza pandemic (2015) sets out Victoria’s strategic approach to reduce the social and economic impacts and consequences of a pandemic. It also recommends that departments develop their own pandemic plans that include plans to resume interrupted services. 

• while the Department of Health and Human Services (DHHS) (now DH) has a pandemic plan for the health sector and coordinated the development of the Victorian action plan for influenza pandemic, DH and the Department of Families, Fairness and Housing (DFFH) do not have pandemic plans for their departments.

As a result, there is a risk that departments have not planned for or mitigated the threats to their business continuity due to a pandemic.

Incident response

Incident management plans and teams form part of broader BCM. They focus on the immediate response. Key features include:

• a response group to manage the crisis
• senior-level involvement and accountability
• internal and external communication plans
• activation protocols.

All departments used BCM incident response teams to respond to COVID-19, except DoT, which developed a specific COVID-19 task force, and DELWP, which used its critical incident management team. These structures were essential because they helped departments:

• quickly make and communicate key decisions
• address gaps in understanding of their prioritised services (particularly at a whole-of-department level)
• transition to remote working.

A department’s decision to activate a BCP is discretionary and based on its assessment of risks and impact.

Only DHHS, DJCS, DPC and DTF activated all of their BCPs. Other departments activated some on a group basis or none at all.

DELWP activated its critical incident management plan to manage the effects of COVID-19 on its department. Both DELWP and DET introduced specific activation criteria during COVID-19 to help staff understand when they should use their BCPs. 

Maintaining services

During a disruption, departments may need to temporarily stop some services to focus on their prioritised services. 

Most departments must deliver their prioritised services to ensure public safety or to meet their legislative obligations. 

Data on prioritised services

Departments told us that they were able to provide their prioritised services during the pandemic. However, only DET, DELWP, DJCS and DTF have a comprehensive list of prioritised services in an organisation-wide BIA or BCP. Further, no department comprehensively tracks disruptions at an organisational level against its listed maximum tolerable periods of disruption (MTPDs).

Departments relied on staff knowledge to identify instances where a disruption to their services was likely. They then used their crisis management processes to track and report on selected services. However, all departments did not do this for all of their prioritised services. 

Following a disruption, departments assess their response through their post-incident review (PIR) process. Although COVID-19 is ongoing, DELWP, DJCS, DPC and DTF have conducted PIRs or wider reviews of their BCM. 

However, the incident reporting processes and PIRs we reviewed did not clearly list departments’ prioritised services, their recovery time objectives (RTOs), MTPDs, and if they met them.

Without detailed data on prioritised services, we looked at departments’ other performance measures. While all departments have key performance metrics for their Budget Paper No. 3: Service Delivery (BP3) measures, they do not have BP3 measures for all of their prioritised services. As a result, we could not determine if departments:

• had service disruptions that exceeded their MTPDs
• had reduced service levels (as indicated in some BP3 measures), or 
• maintained services as normal. 

We also surveyed business continuity staff at each department. The results of our survey indicate that despite departments’ assertions, there were respondents who reported that they were not able to restore all services within their MTPDs. 

Transition to remote working

To reduce the impact of a disruption, BCPs need to cover a range of impacts, including when staff are not available or cannot work from their physical office location. 

Departments did not foresee that a pandemic would result in such a widespread, immediate and long-term need to work remotely. Many departments had to onboard additional staff to support the emergency response or backfill roles. Departments also had to change the way they delivered many services. 

DELWP, DHHS, DJCS, DJPR and DoT could not immediately transition their entire workforce to remote working due to inadequate planning in their BCPs, a lack of equipment (such as laptops or remote access), issues with technology, their size and their complexity. 

All departments, except for DET, rely on Cenitex to access ICT services. Transitioning public servants to a largely work-from-home model put significant strain on Cenitex and the network. Cenitex service requests increased from 22 104 in February 2020 to 33 389 in March 2020. Departments also reported significant connectivity issues. 

Cenitex's capacity to deliver at this scale was not tested prior to COVID-19.

Surge workforce issues

Key areas, such as health and law enforcement, needed additional staff to respond to the pandemic. This had a flow-on effect in other departments as staff were seconded to assist with the emergency response. 

Only DELWP, DJCS and DHHS considered surge workforce issues in some of their BCPs. This meant that most departments had not adequately considered surge workforce issues for their business-as-usual services. 

Further, there is no whole-of-government surge workforce policy that addresses workforce movements to fill internal vacancies during an extended disruption.

Recommendations about responding to a disruption

Back to top

The Victorian Government delivers a wide range of services that are important to Victorians’ economic, financial and social wellbeing—from managing state finances to child protection, transport and criminal justice. 

Disruptions to these services can have a significant negative impact on communities, businesses and industries. Effective business continuity strategies ensure that departments can respond quickly to disruptions and continue to deliver prioritised services to the community.

1.1 What is BCM?

All businesses, whether government or non-government, need to ensure that they can anticipate, prepare for, respond and adapt to change and sudden disruptions to continue their operations. This is known as organisational resilience. Business continuity is a key element of organisational resilience. 

BCM is a management process that includes frameworks, planning and actions to ensure that departments can deliver prioritised services following a disruption. It is a continuous process that requires commitment from senior management and ongoing monitoring and reviews. Figure 1A outlines the BCM process.

BCM standards

The ISO standard outlines what organisations should include in their BCM processes. While Standards Australia adopted the ISO standard in 2020, it is identical to the recognised international standard for BCM: ISO 22301:2019 Security and resilience—Business continuity management systems—Requirements (ISO 22301:2019). 

Prior to COVID-19, the Standing Directions 2018 Under the Financial Management Act 1994 (Standing Directions) required agencies to align with the Australian standard on business continuity (AS/NZS 5050:2010 Business continuity—Managing disruption related risk) or an internationally recognised standard. The international standard for BCM prior to COVID-19 was ISO 22301:2019. All departments used this standard or its earlier 2012 version. 

The response continuum

Business continuity, crisis management, emergency management and disaster recovery are interrelated and exist along a continuum to return an agency to a normal (or ‘new normal’) operating level after a disruption. Figure 1B shows this response continuum. 

The incident determines what plans are activated, as Figure 1C shows.

This audit looked at business continuity, or departments’ internal responses and ability to continue delivering their prioritised services. We did not assess their emergency response to the pandemic.

1.2 Victorian Government response to the COVID 19 pandemic

The World Health Organization (WHO) officially declared COVID-19 a pandemic on 11 March 2020. COVID-19 has caused a disruption of duration, complexity and impact that most people have not seen in their lives. 

Influenza pandemics have historically occurred every 10 to 50 years, caused high rates of illness and death and resulted in severe social and economic disruption. 

Various government bodies, such as Emergency Management Victoria, DJCS, DJPR and DHHS, have been (and still are) responsible for managing various aspects of the state’s emergency response to the pandemic, including quarantine, business grants and the health response. 

Departments continue to respond to the challenges of COVID-19, which has been the first novel coronavirus pandemic in Australia. This has meant that departments have needed to adapt depending on health advice, changing virus transmission and government policy decisions.

The pandemic has reshaped how many organisations, including the VPS, work. Tens of thousands of VPS employees transitioned to remote working in March 2020. 

Figure 1D presents a timeline of relevant events relating to the COVID-19 pandemic in Victoria.

1.3 Roles and responsibilities

Government departments

Legislation requires departments to plan for disruptions. The Standing Directions requires each department to:

• have business continuity planning processes that are consistent with the latest Australian standard on business continuity (this is the ISO standard)
• ensure that it reviews and tests its business continuity processes on a regular basis (at least every two years)
• annually assess its compliance with the business continuity requirements in the Instructions supporting the Standing Directions 2018 under the Financial Management Act 1994 (Standing Directions Instructions) and report any compliance deficiencies to DTF.

The business continuity requirements in the Standing Directions Instructions are issued under the Financial Management Act 1994. As a result, DTF’s focus is primarily on business continuity matters in the context of financial risk management.

All departments had incident or crisis management processes and BCPs in place both prior to and during COVID-19. 

Machinery of government changes

In February 2021, DHHS became two new departments—DH and DFFH. We use ‘DHHS’ in this report except for in the recommendations and when we refer to actions that the new departments have taken since February 2021.

DoT and DJPR also had machinery of government changes that affected their business continuity processes. On 1 January 2019, the Victorian Government split the Department of Economic Development, Jobs, Transport and Resources (DEDJTR) into two departments—DoT and DJPR. On 1 July 2019, the government also merged Public Transport Victoria and VicRoads into DoT. DoT announced its final structure on 25 November 2019, which took effect from 9 December 2019.

Cenitex

Cenitex delivers a range of essential ICT services to departments and other agencies, such as network services, security and hosting, professional services, workplace computing, service management and cloud services. Cenitex’s ability to provide key ICT services during a disruption is an important element of business continuity in the VPS.

All departments, except for DET, rely on Cenitex for ICT.

We looked at how Cenitex managed remote service delivery for departments but did not review its business continuity arrangements. 

Other decision-making and business continuity groups

In response to the pandemic, the Victorian Government established the Crisis Council of Cabinet in April 2020 as the core decision-making forum for all COVID-19-related matters. New VPS missions supported the Crisis Council of Cabinet to help the state respond to and recover from the pandemic.

There are also several information-sharing groups that relate to business continuity. We outline these groups in Figure 1E. 

FIGURE 1E: Relevant information-sharing groups

Note: ¹Cenitex is not included in any of these groups.
Note: ²Meetings were put on hold in 2020 when the government established several other bodies to coordinate its response to COVID-19.
Source: VAGO, based on committee meeting minutes and departmental documentation.

In addition to these groups, some departments also set up their own interdepartmental working groups. For example, DJCS, DHHS, DJPR and DELWP had business continuity working groups to share ideas and help them work through issues as they occurred.

1.4 Prioritised services

Each department develops its own list of the prioritised services it needs to deliver. Failure to deliver these services is likely to cause significant damage to the department or its reputation. 

In 2017, DPC commissioned a project on behalf of GSRN to consider services from a whole-of-government perspective. The project aimed to: 

• strengthen the Victorian Government's resilience 
• define and identify 'mission critical' departmental services
• identify services that would be critical to the Victorian community during a major emergency or disaster
• enhance the government’s ability to maintain these services during a sustained disruption. 

As a result of this project, DPC identified 28 whole-of-government prioritised services, including 20 community-facing services and eight within-government support services. As Figure 1F shows, these services centre around four key themes.

FIGURE 1F: Key themes for whole-of-government prioritised services

Source: VAGO, based on GSRN's 'Identification of whole-of-community critical services delivered by Victorian Government departments’ report.

Back to top

Conclusion

The VPS was not adequately prepared for the COVID-19 pandemic. 

The VPS had limited central oversight and leadership on business continuity. This meant that it was not able to harness lessons learnt across all departments, and departments did not have a clear understanding of whole of government business continuity priorities in a large-scale disruption. 

Departments had various business continuity policies, procedures, plans and structures in place. However, not all BCPs and BIAs aligned with key elements of the ISO standard and were suitable for dealing with a complex and long-term disruption. This reduced their effectiveness during the disruption. 

2.1 Whole-of-government business continuity preparedness

Since at least 2018, the Risk IDC has continued to note in its risk scans that a statewide emergency (such as a natural disaster, pandemic, or health crisis) is a state-significant risk. Further, in 2019, it assessed that this risk would be of ‘severe consequence’ and was ‘likely to occur’. 

Various controls and mitigation strategies have been in place to minimise the impact of such a disruption. They focus on the state's emergency response and include:

• initiatives on emergency warnings, responding and monitoring 
• developing the National Disaster Risk Reduction Framework and the State Emergency Management Plan
• multi-agency emergency management exercises to test their preparedness, response, and recovery processes.

The mitigation strategies also involve:

• Emergency Management Victoria working with departments to develop surge workforce capacity to respond to an emergency
• planning for the Victorian Preparedness Goal across all departments, which is a long term project to:
• identify the key capabilities that departments require in an emergency
• improve staff training and skills to help departments’ response.

No department or agency is responsible for leading or delivering multi-agency exercises that specifically include business continuity. Each department is responsible for exercising and testing its own individual plans, which limits its understanding of how plans and departments interact in a large-scale disruption. 

Whole-of-government coordination

Victoria has structures for whole-of-government emergency management and coordination but not for business continuity. There is also no lead department to drive best practice for the whole sector or ensure that lessons learnt from earlier disruptions are captured and shared. 

However, there is some inter-agency collaboration on business continuity. As Figure 1E shows, this includes GSRN, the BCM—Multi-Agency Forum, ICRS (pre-April 2020) and PSAC (post-April 2020). Agencies use these forums to share lessons learnt and suggest improvements but there is no responsibility for tracking and implementing improvements. 

Understanding whole-of-government services 

In addition to central coordination, it is also important that the government understands and identifies the most important services that different departments deliver.

This helps the government decide and prioritise its resources and actions during a disruption. It also helps departments prepare for a statewide emergency.

On behalf of GSRN, DPC commissioned a project in 2017 to define and identify whole-of-community critical services across the sector. We outline these services in Section 1.4.

GSRN highlighted the importance of this work and stated that: 

‘Whilst all departments have lengthy lists of critical functions identified through 'bottom-up' business continuity processes, these lists do not necessarily reflect a strategic, whole-of-department top-down agreement as to the importance of the continuity of the services that these functions underpin’.

GSRN recommended that the government completes further work to address:

• staff redeployment in an emergency
• departments' dependencies and interdependencies, such as their relationships with other departments and third-party suppliers
• emergency management and cyber attacks.

In June 2018, ICRS approved an implementation strategy and paper on GSRN's report. It recommended that each department review its whole-of-community critical services to manage identified vulnerabilities, including:

• loss of specialist staff
• staffing resources for a prolonged emergency
• loss of access to ICT (departments noted dependencies, such as licences or specific ICT systems)
• poor communication between departments.

Departments introduced a number of strategies to address these issues, such as new ICT solutions. However, we found that weaknesses still exist, such as surge resourcing and access to technology. We discuss these issues in Chapter 3. 

Following a request from ICRS, DPC sought information on departments’ preparedness and received departments’ completed reviews in 2019 and January 2020. Some examples of vulnerabilities identified in these reviews include:

• departments' heavy reliance on third-party suppliers, such as Cenitex
• the need to redeploy staff to support service delivery during a major emergency. 

DPC advised us that there was some whole-of-government COVID-19 coordination through ICRS, and later PSAC. However, it did not provide advice to departments on the vulnerabilities identified. This was a missed opportunity to improve whole of government preparedness.

Whole-of-government training and exercising

The ISO standard requires departments to undertake exercising because it is an important part of preparing for disruptions. 

In October 2018, the then DEDJTR and DHHS led a multi-agency exercise on behalf of GSRN. This was known as Exercise Petunia and was based on a major influenza pandemic scenario. Its purpose was to understand:

• state arrangements and responses during and after a pandemic
• interdependencies and communications between the government during a complex event.

Exercise Petunia also identified that departments need to consider surge resourcing during a disruption. It observed that:

‘There will likely be a need for surge capacity during the recovery phase in order to address the backlog of works/activity resulting from the prolonged reduction in business as usual’.

While departments’ surge resourcing considerations focus on emergency response roles, there is also a need for surge capacity to backfill business-as-usual roles. This has been challenging for the VPS during COVID-19. We look at surge capacity issues further in Chapter 3.

Departments’ preparedness

Each department is responsible for having BCM systems and processes that align with the ISO standard to prepare them for a disruption. The rest of this chapter discusses departments’ business continuity governance, BIAs and BCPs prior to the COVID-19 pandemic. It also discusses how departments validate and improve their BCM.

2.2 Departments' BCM governance 

Effective BCM requires leadership and commitment from senior management and proper resourcing, reporting and monitoring. Departments detail these governance arrangements in their business continuity policies and procedures. 

Policies and procedures

A business continuity policy is a key document that outlines the purpose, context, scope and governance of an organisation’s BCM program. 

Prior to COVID-19, all departments had business continuity policies and procedures that outlined BCM roles, responsibilities and governance. While these mostly aligned with the ISO standard, we found gaps in all departments’ policies and procedures except for DET’s.

We also found that DJPR, DPC and DTF had policies and procedures that contained duplicated or overlapping information. This meant the documents were less effective and contained outdated, confusing or incorrect information. 

Accountability and reporting structures

Prior to COVID-19, all departments outlined BCM accountabilities for senior staff in their policies, procedures and/or plans. We found that DET demonstrated strong commitment to its BCM by providing regular BCM staff-wide communications and endorsing specific training programs and modules to uplift its BCM capability, which is in line with the ISO standard. However, DJCS, and DoT and DTF's secretaries did not articulate a clear commitment to BCM in their policies and procedures. 

We also found that: 

• as at January 2022, DPC and DH do not have dedicated business continuity resources
• DJPR did not set up its BCM function until late 2019 due to changes within its organisation.

This reduces their ability to focus on business continuity issues. 

Regularly reporting business continuity matters ensures that a department understands its readiness for a disruption and has recovery strategies in place that reflect its current operations. Departments report on their BCM program to their audit and risk management committee via their annual attestation under the Standing Directions and more frequently during large-scale disruptions. 

BCM training

The ISO standard requires that all staff who are involved in BCM have the appropriate level of training and experience. However, we found that prior to COVID-19, only DELWP, DET and DJCS had a dedicated BCM training program. 

We surveyed departments’ business continuity staff in August 2021 and asked them about their understanding and experience of BCM both prior to COVID-19 and at the date of the survey. Our survey results showed that prior to COVID-19:

• 13 per cent of respondents did not have any BCP experience
• 55 per cent of respondents experienced informal on-the-job training
• the remaining respondents reported that they received uncertified internal or external training (24 per cent) or had a business continuity qualification (8 per cent).

Most staff (64 per cent) indicated that they did not have any formal training at all or the training they received was after March 2020. Despite this, most staff reported that they understood their role in BCM. 

However, 20 per cent of staff did not know where to find their BCPs and 24 per cent did not know where to find their BCM policy prior to COVID-19, as Figure 2A shows. 

2.3 Business impact analysis

Departments need to clearly understand the activities and processes they deliver and how a disruption might affect them. A BIA is a key element of this.

Assessing prioritised services

The ISO standard requires departments to undertake BIAs at planned intervals or when their organisation significantly changes. However, three departments could not demonstrate that they did this prior to COVID-19:

• DPC had not undertaken any BIAs since 2016.
• DoT and DJPR (as DEDJTR) undertook BIAs in 2018. However, they did not undertake BIAs in 2019 after significant machinery of government changes that year. DoT stated that this is because it did not finalise its structure until December 2019.

This increases the risk that these departments did not have all of their services or mitigation strategies in their BCPs.

It is also important that departments conduct and drive BIAs, not individual business units. As GSRN’s guide ‘Key Success Factors in business continuity management (2015)’ says:

‘It is often difficult for managers to objectively determine the criticality of their own business processes in terms of supporting the agreed key services. The tendency is for individuals to consider their process as more critical than it actually is, thus requiring significantly more investment in either interim workarounds or speedy function resumption than is necessary or desirable on a cost-benefit basis’.

Undertaking BIAs at a business unit level can lead to unrealistic RTO and MTPD timeframes. It also makes prioritising services in complex scenarios more difficult. 

We found that DET, DELWP and DJCS had assessed their services from a whole of organisation view and had organisation-wide BIAs prior to COVID 19. However, only DET had evidence of both executive approval for its organisation-wide BIA and BIAs that met the ISO standard. 

We also found common gaps in departments’ BIAs, which we detail in Appendix D. 

Note: *DJPR and DoT had significant machinery of government changes in January 2019. As a result, both departments had not updated their BIAs prior to COVID-19 (March 2020).

2.4 Business continuity plans

Departments should use the information they gather through BIAs to design solutions to help them respond to disruptions. Departments document these solutions in their BCPs, which can be strategic or operational.

A pandemic plan is a specific type of response plan that helps an organisation to respond to the unique challenges of a pandemic. As departments are large and complex, it is good to have a pandemic plan as well as strategic and operational BCPs. BCP triggers should direct departments to activate their pandemic plan if necessary. 

A department’s ability to understand its strategic priorities is particularly important during complex disruptions that affect multiple units or agencies. This helps the department focus its resources on its core objectives. The ISO standard does not specifically require organisations to have an organisation-wide BCP but it states that they must have plans that are appropriate to their scale and size.

While all departments had BCPs at a business group or divisional level prior to COVID-19:

• DHHS, DJCS, DJPR, DoT and DTF did not have a specific influenza pandemic response plan (as recommended by the Victorian action plan for influenza pandemic) to manage pandemic-related risks, such as losing staff, disruptions to service delivery and social distancing requirements due to capacity limits. In particular:
  • DHHS did not have a pandemic plan for its department (despite coordinating the development of the Victorian action plan for influenza pandemic)
  • DJCS incorporated pandemic strategies into its BCPs
  • DJPR and DoT had not approved a new pandemic plan since their machinery of government changes 
• only DELWP, DET and DTF had an organisation-wide BCP that included a consolidated view of their overall prioritised services to ensure they had considered them and had appropriate response strategies. This is helpful due to the scale and variety of BCPs and prioritised services within departments. 

Complexity and focus 

According to the Business Continuity Institute’s Good Practice Guidelines 2018 Edition, BCPs should be focused, concise, specific and easy to use because organisations rely on them in high-pressure, time-limited situations. We found that:

• except for DJCS and DJPR, departments have overly complex and/or inconsistent BCPs. Many BCPs include information that is already in their BCM procedures, frameworks and/or policies
• DTF has a BCP summary in a one-page format, which makes it easy for staff to quickly understand their key actions and responsibilities in a disruption. This is good practice, but only a small number of its group BCPs are in this format. 

Further, all departments’ BCPs focused on short-term or localised disruptions, which is a common business continuity practice. While short-term disruptions can be complex in themselves, it is also important to have flexible and living BCPs and strategies to address disruptions that affect the whole department, multiple departments or the sector over a long period of time. This is supported by Exercise Petunia in 2018, which found that departments needed to plan for more sustained disruptions and coordination across all sectors. The Business Continuity Institute's Good Practice Guidelines 2018 Edition also suggests that agencies should devise short, medium and long term strategies depending on the type of crisis.

DELWP acknowledged the importance of planning for a complex, long-term disruption following a significant fire in one of its buildings in 2018. It established its Critical Incident Management Framework in 2015 and updated it in 2019 following the fire. This framework provides integrated guidance on emergency management, business continuity, disaster recovery and crisis management. 

Assessing BCPs against the ISO standard

Prior to COVID-19, only DET had BCPs that were all up to date and aligned with the ISO standard. This is still the case. Common gaps, which we provide more detail on in Appendix D, include:

Despite Exercise Petunia’s observations before the pandemic, departments still do not have BCPs that prioritise all of their essential services and assess the scalability of their services. 

2.5 Validating and improving BCM

As highlighted by the ISO standard, departments should

validate their BCM arrangements on a regular basis to ensure they are suitable and effective to use during a disruption. During this process a department should:

• review its BCM arrangements, including policies, plans and procedures
• conduct exercises to train for, test, assess, practise and improve its business continuity performance
• conduct internal and external audits of its BCM
• complete PIRs.

Conducting exercises

Departments use many different types of exercises to test and validate their BCM performance. These exercises range from simple discussion-based desktop exercises to familiarise staff with their BCPs to live, complex, full-scale exercises where a department activates a BCP.

Despite its importance, only DET and DJCS had a clear program for exercising, validating and tracking recommendations for their entire BCM program prior to COVID-19. Appendix D contains further details about this.

Further, departments often limit their testing to desktop exercises. While desktop exercises can increase BCP teams’ awareness, they often only evaluate broad principles and may not provide a true indication of how effective a department’s BCP response will be in an actual event.

Internal and external audits and reviews

Internal and external audits and reviews can help departments assess the effectiveness and practicality of their business continuity processes. Audit findings allow departments to identify weaknesses in their BCM programs and develop action plans to uplift their capability. 

However, only DET, DHHS, DJPR, DoT and DTF had conducted audits or reviews of their BCM program in the two years prior to COVID-19. 

Post-incident reviews 

Real-life disruptions give valuable insights on how effective a department’s response to an incident was. A department should complete a PIR following a disruption to harness learning opportunities by both reinforcing strengths in its business continuity processes and identifying any gaps. Departments can also use recent disruptions as an alternative to undertaking an exercise for a similar type of event.

DET, DELWP, DHHS, DJCS and DPC completed PIRs for disruptions that occurred prior to COVID-19. These PIRs related to sustained power ICT outages, water disruptions and electrical faults. We discuss post-COVID-19 PIRs in Section 3.5.

Implementing improvements

Exercising, internal and external audits and PIRs are valuable because they help departments continuously improve their BCM capabilities. This has helped some departments address issues prior to COVID-19 and uplift their readiness to respond to the pandemic by:

• confirming that business continuity staff contacts are up to date and staff are familiar with their roles and responsibilities 
• improving staff awareness and knowledge of business continuity
• identifying and implementing process improvements
• optimising communication during a disruption.

Figure 2B provides an example of how DELWP learnt from a past disruption to improve its BCM capabilities prior to COVID-19. 

FIGURE 2B: Case study: Learning from prior disruptions

Source: VAGO, based on information from DELWP.

Back to top

Conclusion

Departments responded quickly and flexibly to COVID-19 and continue to do so. Departments’ BCM processes, structures and strategies have helped them quickly set up teams, make decisions and communicate to staff. 

However, departments were not sufficiently prepared for a complex disruption. This meant they had to invest resources into developing documents, streamlining processes, upgrading technology and transitioning to remote working during the early stages of the pandemic. 

While departments report that they continued to operate their prioritised services within their business continuity timeframes, a lack of sufficient data means that departments have limited assurance that they were able to do so.

3.1 DPC’s role during COVID-19

While various bodies were responsible for managing aspects of the state’s emergency response to COVID-19, there was limited whole-of-government focus on business as usual services. 

As there was no lead business continuity agency prior to COVID-19, DPC took on this role. However, as it is not one of DPC’s permanent functions, it has been limited to key aspects of the pandemic response, including: 

• supporting the VPS missions 
• reviewing departments’ BCPs and pandemic plans
• developing and managing whole-of-VPS communications
• helping the VPS transition to remote working.

Supporting the VPS missions 

DPC established a specific unit to oversee the VPS missions’ work programs. It also chaired PSAC, which met weekly in the early stages of the pandemic. Meeting minutes suggested that these meetings:

• considered whole-of-government issues, such as staff wellbeing and remote working 
• discussed COVID-19 initiatives underway, such as health advice and post-pandemic work reforms.

Reviewing BCPs and pandemic plans

In March 2020, DPC reviewed departments’ BCPs and pandemic plans to ensure they were prepared to manage the risk of service disruptions.

DPC found that departments needed to undertake further work on their plans and it developed a list of issues for them to address. However, DPC advised us that it has not monitored if departments have successfully addressed these issues because this is outside its role. This is a missed opportunity to improve departments’ preparedness for service disruptions. 

We reviewed departments’ BCPs and pandemic plans and assessed them against key issues (including those that DPC identified). In March 2020, DJPR, DoT and DTF finalised their pandemic plans and DELWP, DET and DPC updated theirs. However, DJCS, DH and DFFH still do not have a standalone pandemic plan. 

We also found that the remaining departments addressed some (but not all) of DPC’s improvement suggestions. For example:

Inter-agency communication

DPC coordinated whole-of-government COVID-19 communications, including information to share across the VPS. However, prior to COVID-19 there was no written guidance on how departments should: 

• communicate or escalate whole-of-government issues 
• access or share resources within the VPS to deal with surge resourcing issues
• prioritise services at a whole-of-government level. 

Several departments told us that there were initial delays and confusion about communicating whole of government issues. This included issues around the requirement to work from home, if staff could take office equipment home or communicating to staff about a positive COVID-19 case.

3.2 Departments’ BCM arrangements during COVID-19

Departments used their BCM arrangements during COVID-19 to varying degrees:

• All used their incident response structures, except for DoT, which developed a specific COVID-19 task force.
• Some activated their BCPs.
• Most developed specific COVID-19 guidance or amended their pandemic plans to assist them early in the pandemic. 

As discussed in Chapter 2, departments’ BCPs were not designed for a complex long term disruption, so departments heavily relied on their incident response structures and staff flexibility during this time. 

Incident response structures

Incident response structures help a department to clearly understand who is responsible during a disruption and how it should make decisions.

These structures, which include senior leadership and operational staff, have allowed departments to make decisions quickly during the pandemic. All departments used BCM incident management teams to respond to COVID-19, except DoT, which developed a specific COVID-19 task force, and DELWP, which used its critical incident management team. All departments’ incident management teams: 

• meet regularly
• involve key and senior stakeholders
• have enabled whole-of-department coordination and communication.

Minutes from these meetings show that departments have made many complex decisions during COVID-19. Departments have used these meetings to consider their response, reassess their prioritised services and respond to changing health advice. 

While incident response structures are an essential part of departments’ COVID-19 response, they have some limitations. For example, they:

• centralise decision-making, which resulted in some delays at a local level. For example, regional DELWP staff waited nearly six hours for its central office to authorise and issue communications about a suspected COVID-19 case
• may rely on advice from other government departments, such as the whole of government position on workforce or health issues.

Activating BCPs

A department’s decision to activate its BCPs is discretionary. While BCPs list factors that staff should consider when making activation decisions, these are broad. For example, BCPs often require a department to assess the impact of a disruption and if it is likely to affect its prioritised services or damage its reputation.

While all departments activated their crisis or incident management teams, they did not all activate their BCPs consistently. For example:

DELWP and DET had specific activation criteria to help staff understand when they should use their BCPs during the pandemic. For example, a business unit should activate its BCP if it experiences staff absenteeism between 25 to 30 per cent. 

DHHS and DJCS also considered specific mitigation strategies during staff absences of 10, 25 and 40 per cent. This is good practice because it helps business units clearly understand when they should activate their BCPs. However, most departments have not had significant levels of staff absenteeism from COVID 19.

3.3 Departments' workforce capacity

During the pandemic, the VPS workforce had to quickly adapt to non-traditional workplace arrangements and handle surge resourcing requirements. Departments’ ability to effectively respond to these changing conditions helped them to continue delivering services in a new working environment.

While departments had BCPs, they did not have strategies to prepare them for remote working and surge capacity during a long-term disruption. There also was no whole-of-government policy for staff redeployment for continuity of government services. This meant that departments responded reactively to COVID-19 and devoted their resources to developing new remote working processes and addressing surge capacity issues. 

Remote working

Remote working was crucial to departments’ pandemic responses. It helped them to continue delivering services when social distancing measures were introduced.

While some services cannot be delivered remotely, such as prison services or emergency child protection, all departments were able to transition most of their workforce to a remote working environment. This took a significant amount of time and investment. 

DELWP, DHHS, DJCS, DJPR and DoT could not immediately transition their entire workforce to a remote working environment due to their lack of preparedness, technology limitations, size and complexity. This meant that these departments had to do extra work to increase their remote working capabilities.

Departments’ technology capabilities varied, with some departments being more prepared to transition staff to a remote working environment than others. Prior to COVID-19, DET, DPC and DTF had equipped most or all their workforce with laptops and remote access, which assisted their remote working transition.

On the other hand, DELWP, DHHS, DJCS, DJPR and DoT had to source and allocate more equipment for their staff when there were global supply issues for ICT equipment. Figure 3A outlines some of the ICT-related challenges that DHHS experienced at the start of the pandemic.

FIGURE 3A: Case study: ICT challenges during DHHS’s transition to remote working

Note: *Other includes staff who did not respond to the equipment survey at the time.
Source: VAGO, based on information from DHHS.

Cenitex

The Victorian Government’s March 2020 work from home direction required departments to immediately transition their workforce to remote working.

As Figure 3B shows, this urgent directive put stress on Cenitex and the network.

Cenitex service requests also increased from 22 104 in February 2020 to 33 389 to March 2020 with a corresponding increase in average Cenitex handling times from 7 minutes 33 seconds in February 2020 to 13 minutes 37 seconds in April 2020. 

Cenitex's capacity to deliver at this scale was not tested prior to COVID-19. Further, while departments can engage with Cenitex for disaster recovery design, only DJCS uses this service.

Prior to March 2020, Cenitex was improving its outdated remote working technology to service departments. At the time, departments’ demand for Go Connect licences was low, which caused scalability issues at the start of the pandemic. Departments that use Cenitex experienced connectivity issues at the start of the pandemic due to the overwhelming demand.

Cenitex brought forward its new technology to address these connectivity issues. Departments and Cenitex also introduced workarounds, such as advising staff to log off when not using the system and stagger use. 

It took Cenitex at least four weeks after the Victorian Government’s work from home direction to stabilise its services and enable most public servants to work remotely. 

Surge resources

There is currently no whole-of-government strategy on how departments can re-prioritise VPS resources in response to a large-scale disruption. 

Prior to COVID-19, only DELWP, DJCS and DHHS had strategies in some of their BCPs to manage surge resources. However, this was limited to emergency management. For example, DELWP addresses its need for surge resources in its emergency management activities by training staff in other divisions to deliver emergency management roles. 

Redirecting staff to emergency roles can affect other work within the department. DELWP recognised this during the 2020 bushfires and considered whole of department resourcing and strategies to address and monitor this. 

Jobs and Skills Exchange

In May 2020, the Jobs and Skills Exchange launched a ‘COVID-19 mobilisation’ program. This promoted departmental 'surge opportunities' for staff from sector agencies who were out of work due to the lockdowns. The program provided candidates from impacted agencies, for example Arts Centre Melbourne, with the opportunity to be placed into surge-related roles in departments.

The program attracted approximately 2 000 applicants. However, only 134 applicants (less than 7 per cent), successfully gained job placements in another department or government agency. This is mostly because there was a mismatch in the skills needed to fill vacant surge positions.

Departments also used the Jobs and Skills Exchange to advertise secondment opportunities and backfill roles. However, departments do not have to indicate whether advertised positions are vacancies due to COVID-19, surge capacity related or business as usual roles, which limits the ability to assess the program's effectiveness. 

3.4 Maintaining prioritised services

During a disruption, an organisation may need to temporarily suspend some of its services to allow it to focus on its prioritised services. This is an important part of the business continuity process. 

All departments reported that their prioritised services did not exceed their listed MTPDs. However, departments cannot substantiate this claim because they have limited data on their prioritised services, particularly at a whole-of-department level and against their MTPDs.

Staff views of COVID-19’s impact

Our survey asked departments’ business continuity staff if COVID-19 disrupted their prioritised services between March 2020 and March 2021. Nearly 60 per cent of respondents reported that there was no disruption to services due to COVID-19.

Of those that did experience a disruption, 43 per cent said they were not able to restore some or all of their services within their MTPDs, which Figure 3C shows.

Reporting on disruptions

Most departments rely on ad hoc reporting and PIRs after a disruption to understand the impact it had on their services. They also use incident management processes to report on the ongoing impacts of a disruption. 

For example, DHHS provided regular reports to its executive staff on prioritised services during COVID-19, such as child protection. This reporting covered case loads and backlogs to help outline ongoing risks.

However, departments’ reporting through these processes is often qualitative and focused on specific services. No department systematically reports against its business continuity RTOs or MTPDs. As a result, departments are unable to determine how effective their BCM arrangements are in maintaining their prioritised services.

Quality of services during COVID-19

Business continuity focuses on ensuring that services are up and running within minimum timeframes after a disruption. It does not consider if a disruption has impacted the quality of a service.

Departments faced many service delivery challenges during COVID-19. These challenges, which departments have highlighted in their annual reports, caused a drop in VPS-wide performance in the 2019–20 and 2020–21 BP3s, which Figure 3D shows.

Customer-facing services

Customer-facing services had a higher risk of being impacted by COVID-19 due to social distancing measures. Figure 3E provides an example of how COVID-19 impacted VicRoads’ registration and licensing division.

FIGURE 3E: Case study: COVID-19’s impact on driving tests

Source: VAGO, based on information from DoT (VicRoads’ registration and licensing division).

3.5 Lessons learnt

It is important for departments to review their response to a major disruption. This can help them replicate their successes and avoid repeating failures in similar future events.

Although COVID-19 is ongoing, DELWP, DJCS, DPC and DTF have conducted PIRs or wider reviews of their BCM program. While it did not conduct a PIR, DET discussed its COVID 19 learnings with its executive board and other internal committees.

We acknowledge that many departments are still in the middle of responding to the pandemic. However, by not reviewing their learnings to date, departments limit their ability to identify and take early action to address risks and implement improvements. 

Despite this, COVID-19 has created opportunities for departments to make positive changes, such as accelerating their digital transformation or adopting more efficient processes. 

Improving BCM policies, plans and procedures

The COVID-19 pandemic has allowed all departments to adapt and improve their business continuity policies, procedures and plans. 

We assessed departments' BCM documentation against the ISO standard both prior to COVID-19 and after March 2020. 

Sharing information with other departments

There are several cross-department information-sharing groups that relate to business continuity, including the BCM—Multi-Agency Forum. 

While the forum postponed its meetings at the peak of the pandemic in 2020, it resumed meeting on 19 November 2020. Departments have used this forum to share better-practice procedures and discuss lessons learnt from COVID-19. 

However, there is no central body to ensure that departments implement whole of government learnings from this forum or other groups.

Improving remote working technology

The pandemic has made departments rethink how they work and, in some cases, accelerated their digital transformation plans. 

Meeting minutes from departments’ incident management teams suggest that they rolled out new technology-related processes and projects, such as electronic approval processes and Microsoft Teams, within weeks during the early stages of the pandemic. This would usually take months or years.

This presents an opportunity for departments to apply some of their leanings, such as the value of streamlining processes and adopting new technology earlier, to future ICT projects.

Remote working has increased other risks though, such as:

• privacy concerns
• cybersecurity threats
• occupational health and safety risks.

Departments have advised their staff about the importance of privacy and occupational health and safety (for example, ergonomic desk set-ups) as remote working continues. However, departments need to further manage these risks as new challenges arise, such as work-life balance or security risks, that were not as common in an office-based environment.

Back to top

Click the link below to download a PDF copy of Appendix A. Submissions and comments.

 

Click here to download Appendix A. Submissions and comments

Back to top

Back to top

What we assessed

This audit used the following lines of inquiry and criteria:

Audit scope

This audit focused on departments’ business continuity preparedness and response. We included Cenitex in the audit due to its role in providing essential ICT services. We did not look at Cenitex’s BCM processes. The audit also did not include emergency management and portfolio entities.

Our methods

As part of the audit we:

• reviewed departments’ policies, procedures, plans and BIAs and assessed if they met relevant standards and requirements (both before and during COVID-19) 
• used data from Cenitex and departments to assess if departments were able to effectively transition to remote working
• reviewed departments’ prioritised services using available data, BP3 measures and departments’ documentation
• met with relevant key staff at each department
• conducted a survey of business continuity personnel.

Survey analysis

In July and August 2021, we surveyed all nine Victorian Government departments. We did this to understand staff experiences and views about the adequacy of their department’s BCM.

We sent the survey to 493 business continuity staff across nine departments. We received 194 responses (a response rate of 40 per cent). As the survey was optional, there was a risk that respondents did not accurately represent business continuity at the whole-of-government level due to self-selection. 

We have included our survey results in this report. All survey result percentages have a margin of error of plus or minus 5.5 per cent at the 95 per cent confidence level unless we state otherwise. This margin of error does not affect the qualitative findings in this report.

Compliance

We conducted our audit in accordance with the Audit Act 1994 and Assurance Engagements ASAE 3500 Performance Engagements. We complied with the independence and other relevant ethical requirements related to assurance engagements.

Unless otherwise indicated, any persons named in this report are not the subject of adverse comment or opinion.

Back to top

BIAs prior to COVID-19

Figure D1 outlines our assessment of departments’ BIAs prior to COVID-19.

FIGURE D1: Our assessment of departments’ BIAs prior to COVID-19

Notes: 
✓ = Met
P = Partially met (for example, evidence in some BIAs but not all)
✕ = Not met
Source: VAGO assessment of departments’ documents.

BCPs prior to COVID-19

Figure D2 outlines our assessment of departments' BCPs against key elements of the ISO standard. 

FIGURE D2: BCP consistency with key elements of the ISO standard and BCP coverage of services prior to COVID-19

Note: We have assessed a department as not meeting an element if we have evidence that it did not capture all of its prioritised services in its 2019 BCPs, or if it had BCPs that were not updated in the previous two years, which would increase the risk that it had not captured all of its prioritised services. 
✓ = Met
P = Partially met (for example, evidence in some plans but not all)
✕ = Not met 
*This is not an ISO requirement but it is a relevant element of BCP coverage in a pandemic.
Source: VAGO assessment of departments’ documents.

Exercising and validating BCM

Figure D3 shows our assessment of departments' exercising and validating process. 

FIGURE D3: Departments’ exercising and validation of BCM
 

Notes: 
✓ = Met
P = Partially met
✕ = Not met 
N/A = Not applicable
Source: VAGO assessment of departments’ documents.

Back to top