Business Continuity Policy

Download the full Business Continuity Policy.

Should you require further information regarding this policy or access to the policy in an alternative format, then please contact the Risk and Business Continuity Manager, Legal, Governance, Risk and Compliance.

1. Introduction

This policy sets out the principles and framework for Business Continuity Management at City St George’s, University of London. It meets requirements of ISO 22301:2019, the Office for Students (OfS), and good practice in the higher education sector.

The merger of City, University of London with St George’s, University of London in August 2024 has created a multi-campus institution operating across Clerkenwell, Moorgate and Tooting, with shared services, cross-site IT infrastructure, and significant operational dependencies on NHS-owned estate. Recent major incidents including the Cyber incident (March 2026) and Hunter Wing flooding (July 2025) have demonstrated the critical importance of well-tested continuity arrangements.

2. Freedom of Speech and Academic Freedom

2.1. City St George’s, University of London, regards freedom of speech and academic freedom to be fundamental to delivering its mission as the University of business, practice and the professions. Its values in this respect are set out in a code of practice on freedom of speech and academic freedom, which explains how the University will uphold, secure, and promote freedom of speech within the law: https://www.citystgeorges.ac.uk/about/governance/policies/code-of-practice-on-freedom-of-speech

2.2. Nothing in this policy should be interpreted in any way that would be inconsistent with the code of practice and – in the event of any inconsistency – the provisions of the code will prevail.

2.3 The Office for Students ("OfS") operates a free speech complaints scheme. Under that scheme, the OfS can review complaints about free speech from non-student members, staff, applicants for academic posts and (actual or invited) visiting speakers. The scheme is free to use. Information about the complaints that the OfS can review is available on its website at: www.officeforstudents.org.uk/for-providers/freedom-of-speech/free-speech-complaints. Student complaints about freedom of speech issues are handled by the Office of the Independent Adjudicator for Higher Education (“OIA”). Information about how the OIA handles such complaints can be found on its website (https://www.oiahe.org.uk/resources-and-publications/latest-news-and-updates/oia-highlights-role-in-student-free-speech-complaints/).

3. Equality, Diversity and Inclusion

3.1. The University is committed to promoting equality, diversity and inclusion in all its activities, processes, and culture for our whole community, including staff, students and visitors.

3.2. The University will meet its obligations under the Equality Act 2010 in all its policies and will seek to eliminate discrimination based on age, caring responsibilities, disability, gender identity, gender reassignment, marital status, nationality, pregnancy, race and ethnic origin, religion and belief, sex, sexual orientation and socio-economic background.

4. Definitions

5. Policy

5.1. Purpose

The BCM aims are to:

• Provide a consistent BCMS framework across all Schools, Professional Services and shared services, supporting compliance with legal and regulatory requirements.
• Complement the University’s Risk Management framework by identifying and planning for high-impact scenarios where BCM is the appropriate mitigation strategy.
• Formalise critical service priorities and minimum service levels during disruption, and ensure critical processes are recovered before their non-performance threatens the institution.
• Ensure effective planning, training, testing, and continuous improvement to manage operational incidents.
• Identify and mitigate business continuity risk, including supply chain resilience and NHS estate dependencies.
• Promote a resilience culture embedded in strategy, management systems, change control, annual business planning, and staff values and behaviours.

5.2. Scope

The BCMS covers all services across City St George’s, University of London, including:

• All University campus sites.
• Schools and their supporting specialist facilities, including clinical skills and simulation facilities.
• All Professional and Academic Support Services.
• Outsourced provision and shared services.
• University-owned, operated, maintained, and insured buildings.
• NHS-occupied or NHS-maintained estate used by the University, including Hunter Wing and associated facilities, as well as relevant academic partner institutions and placement providers where continuity of service delivery is dependent on their operations.

5.3. Principles

By operating a BCMS aligned to ISO 22301:2019, City St George’s Senior Leadership Team is committed to:

• Establishing robust incident response and continuity arrangements to keep students, staff and visitors safe, and to protect the continuity of teaching and research.
• Ensuring effective, timely and coordinated communications during times of disruption.
• Ensuring the University has appropriate and rehearsed arrangements to detect, respond to, and recover time-sensitive and essential activities impacted by significant disruption.
• Identifying and planning for high-impact scenarios where BCM is the appropriate risk mitigation strategy.
• Understanding cross-site and NHS estate dependencies to reduce silos and deepen the management of risk.
• Operating a managed system to report, debrief and learn from incidents, to continually improve response and resilience.
• Ensuring resilience considerations are embedded into project change control and procurement so that new areas of risk are not introduced without appropriate understanding and mitigation.

5.4. Roles and responsibilities

6. Procedure

The BCMS operates through the following key procedures:

6.1. Business Impact Analysis

Each School and Professional Service will conduct a BIA to identify critical processes, their dependencies, recovery time objectives, and the impacts of disruption. BIA results are analysed to identify the focus of BCPs, single points of failure, and risk acceptance levels.

6.2. Business Continuity Plans

Critical processes identified through Business Impact Analyses (BIAs) will guide the development of Business Continuity Plans (BCPs), incorporating appropriate mitigation and recovery strategies.

BCPs are required for all organisational areas responsible for delivering critical activities, including academic schools, professional services, and key operational functions where disruption would have a material impact on the University’s ability to deliver its strategic, regulatory, or student-facing obligations.

Plans will be reviewed annually and following any major incident. All BCPs are stored on the Business Continuity SharePoint Hub.

6.3. Incident Management

The University Incident Management Plan provides the framework for coordinating response to incidents. The IMP is managed centrally and is the responsibility of the DP(O) and RBCSG. It is supported by threat-specific and consequence management plans, building-specific plans, and service BCPs.

6.4. Root Cause Analysis and Lessons Learnt

All Silver and above incidents will be subject to a formal debrief and root cause analysis process. Lessons learnt must be recorded in 4Risk and tracked to closure via the Business Continuity Incidents Log and Action Tracker.

6.5. Testing and Exercising

BCPs will be tested through table-top exercises and scenario-based testing to validate command structures, communications protocols, and recovery procedures. Testing is planned on a prioritised and risk-based schedule. Testing completion is monitored and reported to RBCSG quarterly. In addition, all Silver and above incidents are subject to a formal lessons-learned exercise.

6.6. NHS Estate Dependencies

Where the University occupies or relies upon NHS-owned or NHS-maintained estate (including Hunter Wing, Tooting Campus), continuity arrangements must account for the dependency on a third-party landlord and infrastructure.

Formal Memoranda of Understanding (MoUs) with NHS Trust partners will define respective responsibilities and continuity obligations. Pending the establishment of formal MoUs, interim arrangements are in place, including agreed responsibility matrices and operational protocols, which support coordination and continuity of service delivery across shared estate and services.

These arrangements are subject to review and oversight by the Risk and Business Continuity Steering Group (RBCSG).

6.7. Risk Appetite Alignment

Business Continuity Management (BCM) operates as a key control mechanism within the University’s Risk Management Framework and supports the management of risks in line with the approved Risk Appetite Statement.

Business continuity arrangements are required where:

• The potential impact of disruption exceeds defined risk appetite thresholds.
• The Maximum Tolerable Period of Disruption (MTPD) for a service is short relative to its criticality.
• Failure to deliver a service would result in material regulatory, financial, safety, or reputational consequences.

Recovery objectives defined through Business Impact Analysis (BIA), including Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), must be proportionate to the University’s risk appetite and aligned to the tolerance levels agreed for critical services.

Where residual risk remains outside appetite:

• This must be explicitly documented within the relevant risk register.
• Escalation must be made via the Risk and Business Continuity Steering Group (RBCSG).
• Formal acceptance must be approved at the appropriate governance level.

BCM therefore provides assurance that the University can operate within its defined risk appetite during periods of disruption.

6.8. Assurance and Oversight

The University applies a Three Lines of Defence model to provide assurance over the effectiveness of Business Continuity Management:

First Line (Operational Management): Schools and Professional Services are responsible for maintaining Business Impact Analyses (BIAs) and Business Continuity Plans (BCPs), ensuring plans are current, tested, and embedded within local operations, and for identifying and managing continuity risks within their areas.

Second Line (Risk and BCM Function): The Risk and Business Continuity function provides oversight by setting BCM policy, standards, and guidance; monitoring compliance with BCMS requirements; reviewing BIA/BCP quality and testing outcomes; and maintaining the central incident log, action tracker, and reporting to RBCSG.

Third Line (Independent Assurance): Internal Audit provides independent assurance by reviewing the design and effectiveness of the BCMS, assessing governance, controls, and compliance with policy, and reporting findings to the Audit and Risk Committee (ARC).

This model ensures a structured and auditable approach to resilience across the institution.

6.9. Incident Response and Recovery Lifecycle

The University manages incidents through a structured lifecycle to ensure clarity of roles, decision-making, and recovery:

• Detection and Escalation: Identification of a disruption and activation of appropriate response structures (Bronze, Silver, Gold).
• Response and Stabilisation: Immediate actions taken to protect life, safety, and critical operations.
• Continuity and Service Recovery: Implementation of Business Continuity Plans to maintain or restore critical services within agreed tolerances (MTPD/RTO).
• Recovery and Restoration: Transition from continuity arrangements to a stable operating state, which may include a revised new normal.
• Review and Improvement: Formal debrief, root cause analysis, and tracking of lessons learnt through 4Risk to completion.

Clear transition points between Incident Management and Business Continuity must be maintained to ensure effective coordination throughout.

6.10. Incident Communications

Effective communication during incidents is critical to maintaining trust, safety, and operational effectiveness. The University adopts a structured communication approach based on:

• Single Source of Truth: All incident information is coordinated centrally to ensure consistency and accuracy.
• Defined Authority: Communications are led by the Chair of Silver (or delegated authority), consulting the Gold Commander as necessary, and supported by Communications teams.
• Operational communications (staff and students): clear, timely, action-focused.
• Strategic communications (SLT, Council): concise, risk-informed updates.
• External communications (regulators, partners, media): controlled, accurate, and compliant.

Communication protocols must align with regulatory requirements, including timely notification to bodies such as the Office for Students (OfS) and, where relevant, the Information Commissioner’s Office (ICO).

6.11. Third-Party and NHS Estate Dependencies

Where the University relies on third-party infrastructure, including NHS-owned or NHS-managed estate, Business Continuity Plans must explicitly account for these dependencies. This includes:

• Identification of critical services reliant on external infrastructure.
• Clear understanding of roles and responsibilities between the University and third-party providers.
• Defined escalation routes and communication protocols during incidents.
• Alignment of continuity arrangements with partner organisations.

Formal agreements, including Memoranda of Understanding (MoUs), Service Level Agreements (SLAs), or responsibility matrices, must be established where appropriate. Where such agreements are not yet formalised:

• Interim arrangements must be documented.
• Risks must be recorded and actively managed through the risk register.
• Oversight must be provided via the RBCSG.

This ensures continuity risks arising from external dependencies are understood, controlled, and subject to governance oversight.

7. Advice and Guidance

For advice and guidance regarding business continuity management, please contact the Risk and Business Continuity Manager via the Business Continuity SharePoint Hub. City St George’s - Incident Management and Business Continuity.

All Business Continuity documentation, templates, and supporting materials are held on the Business Continuity SharePoint Hub with restricted access for designated BCM personnel.

8. Legal and Regulatory Responsibilities

Martyn’s Law (Terrorism (Protection of Premises) Act 2025) places statutory duties on the University as an Enhanced Tier premises to have in place public protection procedures covering evacuation, invacuation, lockdown and communication, and where applicable public protection measures to reduce vulnerability to terrorism. The University as a corporate body is the Responsible Person under the Act, with the President holding overall accountability and the Deputy President, Operations as the senior delegated lead. Governance for Martyn’s Law is integrated within the University’s existing health and safety governance structure, with compliance reported through the University Health and Safety and Wellbeing Committee to the Audit and Risk Committee (ARC). Detailed governance, delegation, operational procedures, and risk register position are set out in the University’s dedicated Martyn’s Law policy and procedures.

Where a Martyn’s Law-related event activates the BCM framework, the BCM Silver structure provides supporting governance for incident response coordination. The Risk and Business Continuity Manager is responsible for ensuring BCM plans appropriately cross-reference relevant public protection procedures.

9. Failure to Comply

Failure to comply with this policy may result in:

• Inadequate preparedness to respond to and recover from incidents, potentially resulting in significant operational, financial, legal, and reputational damage to the University.
• Non-compliance with regulatory requirements including Office for Students (OfS) expectations regarding business continuity and risk management.
• Disciplinary action in accordance with university policies for staff who fail to fulfil their designated BCM responsibilities.
• Escalation to the RBCSG, Audit and Risk Committee (ARC), and Senior Leadership Team where Schools or Professional Services fail to maintain current BCPs or provide required assurance.

10. Review

This policy is reviewed annually by the Risk and Business Continuity Manager in consultation with the RBCSG or following a major incident. Changes are approved by the Audit and Risk Committee (ARC) on the recommendation of Senior Leadership Team (SLT).