« Previous | Contents | Next »
Listen
08 Audit and Monitoring
This chapter to be reviewed by March 2008
Summary
- The Act introduces a power for Scottish Ministers to monitor performance of the civil protection duties {section 9 (2)}.
- A process for audit and monitoring of local responders' performance of duties under the Act is being developed by the Scottish Executive.
- Audit Scotland is planning to start a national study jointly for the Accounts Commission and the Auditor General in late 2006, looking at how Category 1 responders perform against the Act - including their co-operation in Strategic Co-ordinating Groups ( SCGs) - and at the role of the Executive.
- A timetable for responders to report on compliance with the duties under the Act in Scotland is provided.
- Monitoring of local responders' performance by the Scottish Executive will be carried out through reporting by the SCGs.
- SCGs will also be requested to report on their own performance in co-operative and joint activities.
- This guidance provides an interim Performance Monitoring Guide to assist local responders and SCGs to report on their performance.
- The Act also provides a system for enforcement for Scottish Ministers and for Scottish Category 1 and 2 responders through the Court of Session {section 11}.
Introduction
8.1 This chapter provides guidance which should assist local responders to prepare for audit and monitoring. It complements Chapter 8, Section 2 of Preparing Scotland.
8.2 The process for auditing and monitoring implementation of the duties under the Civil Contingencies Act 2004 ('the Act') in Scotland is based on:
- the seven duties for Category 1 responders
- the duty for Category 2 responders to co-operate and share information
- the role of the Strategic Co-ordinating Groups ( SCGs) in co-operation and planning
8.3 This chapter covers:
- the role of the Scottish Executive
- the timetable for reporting on implementation of the Act in Scotland
- the role of Audit Scotland
- a performance monitoring guide and development of a performance
- monitoring framework ( PMF)
The role of the Scottish Executive
8.4 The Scottish Executive expects that Category 1 and 2 responders will be fulfilling their duties under the Act from November 2005 through their current arrangements. It also expects them to have developed a framework and programme, under the umbrella of each SCG, to take the work of reviewing and, if necessary, revising their arrangements forward effectively and to have completed the process by the end of the 2006 calendar year.
8.5 In 2006 the Executive, and in the future auditors, will monitor progress by responders against the Act, both individually and co-operatively in the SCGs, by developing and implementing a suitable performance management framework ( PMF). The PMF will provide the Executive with the information it requires to assess the extent to which the CCA is being applied on a consistent basis across Scotland and to identify any problem issues.
8.6 The Executive is in the early stages of specifying information it requires to collect and assess in order to monitor progress against the Act in Scotland. An outline of this information is given below in paragraphs 8.13 to 8.19 of this guidance.
8.7 An important side benefit of the Executive's PMF is that it will also equip SCGs and Category 1 responders with a toolkit they can apply locally, in between more formal evaluations by the Scottish Executive.
8.8 As responders progress their work, the Executive may request that particular aspects be an item on SCGs' and Category 1 responders' meeting agendas, but will give reasonable advance notice of this request and of any requirement for other information.
Reporting Timetable
8.9 The table below summarises when the Executive will expect Category 1 responders in Scotland to report on their compliance with the seven primary duties under the Act.
| Duty | Report - by end of |
|---|
1 | Co-operation - the SCG is to develop a programme of work to develop multi-agency aspects of duties under the Act | March 2006 |
2 | Risk Assessment - conduct risk assessments and compile a Community Risk Register | March 2006 |
Risk Assessment - publish a Community Risk Register ( CRR) | March 2006 |
3 | Emergency Planning - plans to be reviewed and revised Emergency Planning - plan maintenance arrangements in place | September 2006 |
4 | Business Continuity Planning | December 2006 |
5 | Business Continuity Advice (Local Authorities) | December 2006 |
6 | Communicating with the public | September 2006 |
7 | Warning and informing the public | September 2006 |
The role of Audit Scotland
8.10 Audit Scotland undertakes studies reviewing the performance of Scottish public bodies - on behalf of the Accounts Commission in relation to local authorities, and for the Auditor General for other public bodies. More information on these organisations can be found on the Internet at www.audit-scotland.gov.uk
8.11 In late 2006 Audit Scotland is planning to start a national study jointly for the Commission and the Auditor General, looking at how SCGs and Category 1 responders perform against the Act and at the role of the Executive. The scope of the study will be developed in the autumn of 2006, but it is likely to include:
- progress with the implementation of duties under the Act,
- performance against any indicators included in the proposed performance management framework,
- examples of good practice, and
- recommendations where required.
8.12 The exact timing for the study has still to be finalised. However, it is likely that the audit approach will be developed in late 2006, with audit work being undertaken during 2007. Audit Scotland will publish the findings from the study in a national report, probably in late 2007.
Interim Performance Monitoring for the Seven Duties
8.13 Category 1 responders, individually or working together in the SCGs, should use the Performance Monitoring Guide described in Annex 1 of this chapter to monitor performance and to structure reports on their progress to the SCGs.
8.14SCG Chairs should also require regular reporting from the SCG secretariat on performance of the SCG itself in terms of its aims, objectives and programme of work for multi-agency aspects of co-operation and preparation (see paragraphs. 8.18 and 8.19).
8.15 In the spirit of continuous improvement, an assessment of performance against the Performance Monitoring Guide should be a standing agenda item for SCGs rather than a topic which is dealt with only when monitoring by the Executive or an approach by Audit Scotland is imminent.
8.16 The performance monitoring guide in Annex 1 should be used by local responders and the SCG secretariat, as appropriate at each stage of the work programme, to structure reports to the SCGs on progress. These should be used as the basis for combined reports from each SCG to the Scottish Executive as timetabled in paragraph 8.9.
Proposed Performance Monitoring Framework
8.17 Revised guidance, including a structured PMF, will be developed by the Scottish Executive in light of Audit Scotland's national report.
Performance Monitoring for the Strategic Co-ordinating Groups
8.18 The Regulations place a duty on Scottish Category 1 responders who have functions within a particular police area to join together (along with any general Category 1 responders with functions in that area) to form a single group who are required to co-operate with each other. The Regulations refer to any such group as a 'Strategic Co-ordinating Group'. The Regulations also place duties on Category 2 responders regarding their participation in the SCGs. The Act and Regulations do not place duties on the SCG as it is not a legal entity in its own right however duties are placed on the responders who are part of the group to ensure that it operates effectively.
8.19 Outline indicators for co-operative performance in SCGs are:
- The SCG has an effective organisation and administration including:
- a regular cycle of meetings
- adequate circulation of papers before and following meetings
- effective processing and dissemination of incoming information
- a formal structure for taking forward plan preparation at a strategic and
- multi-agency level for the area.
- All Category 1 Responders, and Category 2 as required, are effectively represented on the SCG at a suitably senior level.
- Category 1 responders are effectively represented at all meetings.
- SCG has clear aims, objectives and a programme of work.
Note: For those SCGs which have appointed co-ordinators, the co-ordinator's performance will be reviewed separately under the terms of the Scottish Executive's conditions of grant.
Category 2 Responders
8.20 Scottish Category 2 responders' compliance in co-operation and information sharing will be monitored initially through reporting by the SCGs.
8.21 General Category 2 responders with functions exercisable in Scotland will be audited through their normal regulatory regimes.
Enforcement
8.22 Section 2, Chapter 8, paragraphs 8.10 to 8.13 (Regulatory Guidance) of Preparing Scotland provide detailed information on enforcement.
Annex 1
1. Co-operation ( Note: See also paragraphs 8.18 and 8.19)
Key Issues | Example Evidence |
|---|
1.1 Direct co-operation between local responders at one-to-one and SCG levels operates effectively. | Evidence of shared aims, objectives, functional working; engagement of C2 responders. Partnership working; senior managers' awareness and approval; sharing of detailed information on SCG and other meetings; lead responders; SCG lead at different times; multi agency planning (generic, specific); performance review. |
1.2 The SCG has a clear programme of work for the Category 1 responders to co-operate in fulfilling their duties under the Act and for the development of multi-agency and generic emergency response arrangements at the SCG area level. | Evidence of Strategic Priorities linked to risk assessment. |
1.3 SCG cross-boundary working is operating with Local Resilience Forums in England where appropriate. | Correspondence, SCG agenda items and minutes. |
1.4 Voluntary organisations are effectively engaged with the work of local responders and the SCG at the appropriate level. | Evidence of engagement at all levels, sub-groups and functional working. |
2. Information Sharing
Key Issues | Example Evidence |
|---|
2.1 Effective information sharing has been conducted between Category 1 and 2 responders. | Evidence of policy for sharing information; dissemination of information; formal requests and responses; risk assessments; sharing plans. |
2.2 Information sharing between Category 1 and 2 responders has facilitated the effective performance of the civil protection duties. | Evidence of lessons identified; contact arrangements; record keeping. |
2.3 Sensitive Information - Responders have arrangements in place to manage the sharing of information and adhere to the duty to manage it. | Evidence of processes/policies; links to Freedom of Information, Data protection and Environmental Information legislation; secure storage and access arrangements. |
3. Risk Assessment
Key Issues | Example Evidence |
|---|
3.1 Lead responsibility for assessing risks is clearly identified and agreed in the SCG. | Item on SCG agenda/minutes. Identified in risk assessments/ CRR. |
3.2 Individual responder risk assessments have been completed that identify the sources of risk, assess their likelihood and impacts, and rank them in terms of their overall risk. | Responder risk assessments are available for each risk. Risk have been considered/assessed in addition to those in guidance. |
3.3 Community Risk Registers ( CRR) have been compiled. | A CRR is available. |
3.4 CRRs have been approved by the SCG. | Item on SCG agenda/minutes. |
3.5 CRRs have been shared with the Scottish Executive and with Local Resilience Fora ( LRFs) in England where appropriate. | Correspondence. |
3.6 CRRs are being used to inform emergency planning and business continuity planning. | Evidence that plans are considered/assessed against risks. |
3.7 CRRs have been published and are easily accessed by people in the community. | CRR published on internet website of agreed category 1 responder. Links to this site are placed on other responder's websites. |
4. Emergency Planning
Key Issues | Example Evidence |
|---|
4.1 Responsibility for emergency planning issues is clearly defined within the organisation at the corporate management level. | Minutes of emergency planning meetings. Reports to senior management/ management groups. |
4.2 Multi-agency generic planning, including generic capabilities, is flexible enough to mobilise staff and resources in relation to a wide range of possible scenarios in the SCG area or in adjacent areas if required. | Plans available with generic functions and relevant staff responsibilities clearly identified. Plans available which are consistent with multi-agency generic structures. Mutual aid arrangements. Generic plans are measured against risks for which specific plans are required. |
4.3 Emergency plans are integrated with internal business continuity plans. | Evidence of linking between arrangements to deliver functions in emergency response plans and in business continuity plans. |
4.4 Specific emergency plans address specialist requirements and are integrated with generic plans. | Specific plans are linked to identified risks. Links to generic arrangements are clear. Involvement of any national arrangements are identified and integrated. |
4.5 Clarity - Plans are clear, unambiguous and easy to use. | Documented evidence of consultation with relevant staff and incorporation of feedback during plan preparation process. Feedback from relevant staff in responder organisations. |
4.6 Content - Robust call-out and activation procedures are in place. | Evidence of testing call-out procedures. Records of effectiveness in exercise and actual emergency debriefs. |
4.7 The needs of the vulnerable members of society are identified. | Documented arrangements in plans. Evidence of co-ordinated working with relevant agencies and voluntary organisations in plan preparation. |
4.8 Plans contain clear arrangements for involvement of voluntary organisations. | Call-out arrangements for voluntary organisations are in plans. Roles and responsibilities of voluntary organisations are defined and agreed. |
4.9 Training and Exercising - There is a programme in place for training key staff and raising awareness throughout the organisation and its key stakeholders. | Local area training programme. Key staff identified from plans. Evidence of newsletters or other information dissemination methods. Training session records and staff training records. |
4.10 Plans include provisions for carrying out exercises at appropriate intervals. | Exercise arrangements documented in plans. Local area exercise programme. Documented exercise records and reports. Staff exercising records. |
4.11 There is a documented process for measuring the effectiveness of emergency arrangements and capturing and taking forward the lessons identified. | Notes of debrief meetings. Action plans. Review of actions at SCG or other plan preparation/review meetings |
4.12 Review and Evaluation - CRRs are being used as the basis for reviewing and revising emergency response arrangements at individual local responder and SCG level. | Documented plan review process and timetable. Links to risk assessment, exercise, and actual event debriefs. Notes from plan review meetings at SCG and responder levels. Documented timetables for CRR and plan review. Resulting updates/changes to arrangements documented. |
4.13 Plans are considered for revision as a result of revised risk assessments. | There is an established review process and identified trigger points. Notes from risk assessment and plan review meetings. |
4.14 Maintenance - A clear procedure is in place to ensure that arrangements are kept up to date. | Documented issue of version controlled updates. Plan update acknowledgement systems for recipients. |
5. Business Continuity Planning
Key Issues | Example Evidence |
|---|
5.1 Responsibility for business continuity issues is clearly defined within the organisation at the corporate management level. | Minutes of BCM meetings. Reports to senior management/ management groups. |
5.2 Critical functions and processes within the responder organisation have been identified and have been agreed by senior management. | Documented procedures for identifying and reviewing functions. Minutes of review meetings. Reports to senior management/management groups. |
5.3 A robust business impact analysis has been undertaken, drawing on assessments of risk carried out under the Act. | Documented risk assessment process. Links to risk assessment process and CRRs for emergency response. Reports. |
5.4 Risk assessment has been used to focus effort on the areas of greatest need and to develop appropriate continuity strategies. | Documented procedures to review and rank risk assessments and functions. Procedures for developing BCM plans. Meeting minutes. Reports. BCM plans. |
5.5 Responsibility for business continuity issues is well embedded within functions. | Minutes of meetings/ with functional managers and response staff. Reports. Feedback mechanisms for function managers and staff. |
5.6 The generic business continuity plan is flexible enough to maintain continuity through a range of different risks. | Plan has generic and corporate management arrangements and is based on risk assessment. |
5.7 Clarity - Plans are clear, unambiguous and easy to use. | Documented evidence of consultation with relevant staff in functional units and incorporation of feedback during plan preparation process. |
5.8 Content - A clear procedure exists for invoking the business continuity plan ( BCP). | Arrangements are documented in plans. |
5.9 BCPs identify objectives, personnel involved, and co-ordinating arrangements. | Evidence from plans. |
5.10 BCPs outline arrangements for communicating with partners, stakeholders and the media. | Arrangements documented in plans. |
5.11 Training and Exercising - There is a programme in place for training key staff and raising awareness throughout the organisation and its key stakeholders. | Organisational training and exercising programme. Key staff are identified in plans. Evidence of newsletters or other information dissemination methods. |
5.12 There is a balanced programme of exercise types which tests the full range of capabilities. | Scenarios from exercises. |
5.13 The exercise programme has clear objectives. | Documented exercise programme objectives. |
5.14 There is a documented process for measuring the effectiveness of emergency arrangements and capturing and taking forward the lessons identified. | Notes of exercise debrief meetings. Action plans. Review of actions at plan preparation/review meetings. |
5.15 Review and Evaluation - Risk assessment, risk revisions, and CRRs are being used as the basis for reviewing and revising Business Continuity Plans. | Notes of risk assessment and plan review meetings. Updates of plans. |
5.16 Plans are considered for revision as a result of revised risk assessments. | There is an established review process and identified trigger points. Notes from risk assessment and plan review meetings. |
5.17 Maintenance - A clear procedure is in place to ensure that the BCP arrangements are kept up to date. | Timetable for BCP review. Notes of plan review meetings. Issue of version controlled updates. Plan update acknowledgement systems for recipients. |
6. Communicating with the Public
Key Issues | Example Evidence |
|---|
6.1 Public Awareness and Education - All or parts of the relevant risk assessments and emergency plans have been published in a format that the public will find useful. | CRRs and relevant plans are available on internet websites. Websites are signposted in other public information documents from responders or on their websites. |
6.2 Publicity materials have regard to other local, regional and national publications. | Links or references to other relevant publications are included in publicity material. |
6.3 Publicity materials employ clear and simple language, using media appropriate to the audience. | Evidence of pre-testing of material with members of stakeholder groups. Review and production by publicity/ communications sections of organisations. |
6.4 Publicity materials are available for vulnerable people and in languages other than English, as appropriate to the needs of the local community. | Published material in languages other than English. Evidence of consultation with social policy sections of organisations during preparation. Evidence of consultation with local authority social work sections, voluntary organisations and others with practical knowledge of local community. |
6.5 Warning, Informing and Advising the Public - Arrangements to warn, inform and advise the public are in place. | Documented arrangements, stand-alone or incorporated into generic or specific plans. |
6.6 There is clarity between local responders about the responsibilities for warning and informing; lead responders have been agreed. | Documented arrangements, SCG minutes. |
6.7 Arrangements have been made to ensure that vulnerable people can be warned effectively. | Documented arrangements and plans. Evidence of co-ordinated working with relevant agencies and voluntary organisations. |
6.8 Arrangements for issuing messages are designed with the target audience in mind. | Evidence of research and consultation with relevant agencies. Documented arrangements. |
6.9 There is effective liaison with the local media. | Evidence of consultation correspondence or meetings. Documented contact and dissemination arrangements. |
6.10 Personnel who would deal with the media in an emergency, or who deliver public information lines, have received appropriate training. | Documented training programme and records of training. Appropriate staff identified in plans. |
6.11 Training and Exercising - All arrangements are tested and exercised on a regular basis. | Public communication is featured as a separate item or identified as part of a range of functions exercised in an area programme. |
6.12 There is a documented process for measuring the effectiveness of the arrangements and capturing and taking forward the lessons identified. | Notes of debriefing meetings. Action plans. Review of actions at SCG or other plan preparation meetings/minutes. |
6.13 Review and Evaluation - Arrangements are considered for revision as a result of revised risk assessments. | Documented plan review process and timetable with link to risk assessments. Notes of SCG and responder plan review meetings with updates/changes documented. |
6.14 Maintenance - A clear procedure is in place to ensure that the arrangements are kept up to date. | Documented review and update. Local review timetable for plans. Documented update issue and acknowledgement. |
7. Business Continuity Advice for Business and Voluntary Organisations ( Local Authority only)
Key Issues | Example Evidence |
|---|
7.1 Ownership - The allocation of responsibilities is clear, where the authority has entered into collaborative arrangements with other organisations. | Minuted/documented evidence of agreed arrangements. |
7.2 A senior responsible manager has been identified within the authority to 'own' the arrangements. | Meeting minutes with details of agreement and ownership assigned to responsible individual. Correspondence with acknowledgement by owner. |
7.3 Strategy - The local authority has a business continuity management ( BCM) advice and assistance strategy. | Items on agenda/minutes of strategy discussion meetings. Strategy documentation. |
7.4 Other Category 1 and 2 responders (especially other local authorities) have been consulted in the preparation of the strategy. | Correspondence with other responders. Agenda/minutes of meetings with collation/consideration of matters raised and incorporation into strategy documentation. |
7.5 The strategy reflects other local responders' business continuity work with business and voluntary organisations. | Evidence of liaison/consultation with other responders on BCM. |
7.6 The local authority has a clear policy for dealing with requests for detailed business continuity advice. | Staff are identified to deal with process. Documented procedures. |
7.7 Delivery - The programme addresses the needs of the business and voluntary sector community and the risk profile of the area. | Agenda/minutes of consultation/discussion meetings. Correspondence with business and voluntary sector. |
7.8 The authority has made available information on BCM issues through relevant mechanisms. | Information available on relevant websites. Mailings to local businesses. Leaflets in libraries. Local business/economic forum or Chamber of Commerce involved. |
7.9 Review and Evaluation - There is an established review process with identified trigger points. | Documented process. Agenda items/minutes of review or plan preparation meetings. |
7.10 The authority has got a mechanism and success measures for assessing the effectiveness of its BCM advice and assistance activity. | Evaluation arrangements - annual review or liaison meeting. |
7.11 The review process involves a full range of stakeholders consulted in developing the strategy. | Agendas/minutes of stakeholder meetings. Correspondence with stakeholders. |
« Previous | Contents | Next »