Business Continuity Exercise Summary and Improvement Action Plan
NHS DSP Toolkit Submission Support Document
Organisation: VCare Consultancy Services Limited
Registered Office: 60 Kingsway, Kingswood, Bristol BS15 8AH
CQC Provider ID: 1-20392841337
Location ID: 1-20394829713
Document Owner: Registered Manager
Review Date: Annually or following significant incident
1. Purpose of the Exercise
VCare Consultancy Services Limited undertook a business continuity and operational resilience review exercise to assess the organisation’s ability to continue delivery of safe regulated care services during significant operational disruption, cyber incidents, staff shortages, digital system outages or emergency situations.
The exercise reviewed:
- Continuity of care delivery for vulnerable service users.
- Access to care records and operational systems.
- Communication arrangements.
- Staffing resilience.
- Incident escalation arrangements.
- Information governance and cyber security risks.
- Emergency management and recovery arrangements.
The exercise involved senior management review of operational procedures, existing business continuity arrangements and organisational response capabilities.
2. Key Issues Identified During the Exercise
Ref | Issue Identified | Potential Impact |
|---|---|---|
BC1 | Reliance on digital systems for care records and communication | Temporary inability to access electronic care records during system outage or cyber incident |
BC2 | Risk of phishing emails or cyber-related staff error | Potential compromise of sensitive personal data or operational disruption |
BC3 | Staff shortages due to sickness, emergency events or increased demand | Delays to care delivery or increased operational pressure |
BC4 | Limited formal documentation of business continuity testing outcomes | Reduced audit trail and governance evidence |
BC5 | Need for improved emergency contact escalation procedures | Potential delays in communication during incidents |
Ref | Improvement Action | Responsible Owner | Timescale |
|---|---|---|---|
BC1 | Review and strengthen contingency arrangements for access to essential care records during digital system disruption | Registered Manager | Within 3 months |
BC2 | Continue staff cyber awareness and data protection training, including phishing awareness reminders | Senior Management / Registered Manager | Ongoing – reviewed quarterly |
BC3 | Maintain contingency staffing arrangements and emergency rota escalation procedures | Care Coordination Team / Registered Manager | Ongoing |
BC4 | Introduce formal documented annual business continuity testing and review process | Registered Manager | Within 6 months |
BC5 | Update emergency contact lists and escalation procedures for operational incidents | Senior Management | Within 2 months |
BC6 | Continue review of secure password management and access controls across organisational systems | Senior Management | Ongoing |
BC7 | Review business continuity arrangements following any significant operational or cyber incident | Registered Manager | Following incidents and annually |
4. Existing Controls and Mitigation Measures
VCare Consultancy Services Limited currently maintains a number of operational controls to support business continuity and resilience, including:
- Use of digital care management systems including Carebeans and QCS.
- Password protected systems and restricted access arrangements.
- Cloud-based operational systems.
- Management escalation procedures.
- Incident reporting procedures.
- Safeguarding and emergency escalation processes.
- Workforce contingency planning.
- Ongoing staff supervision and mandatory training.
- Secure storage and management of personal information.
- Regular review of operational risks.
5. Governance and Review
The outcomes of the business continuity exercise and associated improvement actions have been reviewed by senior management and will continue to form part of VCare Consultancy Services Limited’s ongoing governance, information governance and operational resilience arrangements.
This document will be reviewed annually, following significant operational disruption, or following any major cyber or information governance incident.
Approved by:
Tavleen Sharma – registered manager
Director
VCare Consultancy Services Limited
Date: 04-05-2026