Test

Welcome to the Business Resilience SAQ

Please answer each question as accurately as possible based on what your business has in place today, rather than what you intend to develop.

Name

Business Name

Phone

Island of Operation

DOMAIN 1

Risk, Planning & Leadership

1. Has your business identified and prioritized the hazards and disruptions most likely to affect its operations?

We have not considered or identified them.

We can name some possible disruptions, but they are not documented.

We have a partial written list, but have not assessed or prioritized the risks.

We have documented and prioritized our main risks based on likelihood and potential impact.

We review our risks regularly and use the findings to update plans and protective measures.

2. Has your business taken practical measures to reduce the likelihood or severity of physical damage and disruption?

No specific risk-reduction measures are in place.

Some basic precautions are taken, but they are informal or inconsistent.

Several measures are in place for obvious hazards, but important gaps remain.

Appropriate protective measures are documented and maintained for our principal risks.

Protective measures are routinely inspected, maintained and improved based on risk reviews or lessons learned.

3. Does your business have a written Business Continuity Plan?

No plan exists.

We have informal arrangements or notes, but no written plan.

A written plan is currently being developed.

A written plan has been completed, approved and shared with relevant people.

The plan has been completed, shared, tested and updated.

4. Has your business identified its critical products, services and activities and how long each can be interrupted before the impact becomes serious?

No.

Management has a general idea, but nothing is documented.

Some critical activities have been identified, but acceptable downtime has not been fully determined.

Critical activities, acceptable downtime and recovery priorities are documented.

This information is regularly reviewed, tested and linked to continuity strategies.

5. For each critical activity, has your business compared the maximum downtime it can tolerate with how quickly it can realistically restore that activity?

No. We have not considered either timeframe.

We have a rough idea of one or both timeframes, but nothing is documented.

We have estimated both timeframes for some critical activities.

Both timeframes are documented for all critical activities and important gaps are identified.

Recovery arrangements have been designed and tested so that realistic recovery times meet or improve on our acceptable downtime.

6. Are decision-making authority, emergency responsibilities and backup leadership arrangements clearly assigned?

No responsibilities or backup arrangements have been assigned.

One owner or senior person is expected to handle everything, with no clear backup.

Some responsibilities and backups have been discussed, but are not fully documented.

Responsibilities, authority and backup personnel are documented and communicated.

The arrangements have been practised, tested or confirmed and are regularly updated.

DOMAIN 2

People, Warning & Communications

7. Does your business maintain current emergency contact information and a process for notifying and accounting for employees?

No current contact list or process exists.

The contact list is incomplete or outdated.

A current contact list exists, but there is no agreed notification or accountability process.

A current list, notification sequence and accountability process are in place.

The process has been tested, includes alternate communication channels and is regularly updated.

7b. Does your business maintain current emergency contact information for a trusted person who could assist or take necessary action if you were unavailable?

No trusted emergency contact or process has been identified.

A trusted person is known informally, but contact details or responsibilities are not clearly documented.

Current contact information exists, but the person has not been fully briefed on what may be required.

A trusted contact is documented, understands what actions may be required, and knows how to access essential information.

The arrangement has been confirmed or tested, includes alternate communication methods, and is reviewed regularly.

8. Do employees receive guidance or training on what to do before, during and after a disruption?

No guidance or training is provided.

Employees receive informal advice only.

Some employees have received one-time or limited training.

All relevant employees are trained, and new employees are briefed.

Training is repeated regularly and includes exercises or practical testing.

8b. Are you prepared and familiar with what you should do before, during and after a disruption affecting your business?

I have not identified or considered what actions I should take.

I have a general idea of what I would do, but nothing is documented.

Some preparedness and emergency actions have been identified, but arrangements are incomplete.

Key actions for safety, communication and business continuity are documented and accessible.

The arrangements are reviewed regularly and have been practised or tested where practical.

9. Are backup personnel available and prepared to perform critical duties if key people are unavailable?

Critical activities depend on one person, with no backup.

Single-person dependencies are recognized, but no backup is prepared.

Backups have been identified for some critical roles.

Backup responsibilities and cross-training arrangements are documented.

Handovers have been practised and backup arrangements are regularly reviewed.

9b. If you became unavailable, could a trusted person access essential information or take necessary action to protect or continue the business?

No trusted person has been identified and no backup arrangement exists.

Someone may be able to help, but they have not been prepared or given the information they would need.

A trusted person has been identified and has access to some essential information.

The trusted person’s responsibilities and access arrangements are documented and understood.

The arrangement has been practiced or confirmed and is reviewed regularly.

10. Does your business monitor trusted official warnings and have clear triggers for taking protective or continuity actions?

No person or process is assigned to monitor warnings, and no action triggers exist.

We monitor warnings informally but decide what to do at the time.

Trusted sources and some likely actions have been identified.

Responsibility, trusted sources and action triggers are documented.

Triggers are linked to specific actions, responsibilities and timelines and are reviewed before high-risk periods.

11. Does your business have a plan for communicating with employees, customers, suppliers and other key stakeholders during a disruption?

No communications plan

Communications would be handled informally as events unfold.

Key audiences and channels have been identified.

A written plan, contact list and draft messages are available.

The process has been tested, includes alternate channels and identifies who can approve and issue information.

12. Has your business planned how it will support employees during and immediately after a disruption?

This has not been considered.

Employee needs would be handled case by case.

Some arrangements have been discussed but are not documented.

Arrangements for safety, work location, communication, leave/pay and wellbeing are documented.

The arrangements have been communicated, resourced and reviewed.

12b. Have you planned how you would maintain your own safety, availability and essential support arrangements during and immediately after a disruption?

This has not been considered.

I would deal with personal and business needs as they arise.

Some support or continuity arrangements have been considered but are not documented.

Arrangements for safety, communication, work location, dependants and essential support are documented.

The arrangements have been communicated to relevant trusted persons, resourced and reviewed.

Welcome to the Business Resilience SAQ

Risk, Planning & Leadership

People, Warning & Communications

People, Warning & Communications

Leave a Reply

Leave a Reply Cancel reply

WHO ARE WE

WHAT WE DO

CONTACT US