Business continuity

Force majeure is an event, circumstances, or an effect that cannot be reasonably anticipated or controlled - often called an act of God, which includes natural disasters caused by weather and land movement. Force majeure also includes war, riots, air crash, labor stoppage, illness, disruption in utility supply by service providers, etc. There is some contradiction in this requirement as you can take effective action to maintain business continuity as a result of certain events that may be classified as force majeure or natural disasters. 

Carry out a risk assessment on your utilities, labor force, and suppliers and prepare contingency plans to minimize effect on business continuity. 

Business Continuity Planning (Disaster Recovery) A disaster recovery plan should be in place to ensure the continued operation of the laboratory in case of an adverse event that renders the instrument out of commission and hence causes interruption to the business processes which the system supports. Adverse events like the failure of the critical hardware components of the instrument and the failure of the application software do happen in the day-to-day operation of a laboratory. The disaster recovery plan should provide the necessary steps to restore the systems back to a functional state. The steps typically include instructions to reinstall the application software to the personal computer controlling the instrument, to reconfigure the instrument, and to restore the backup data to the instrument. 

Documentation Validation documents are current and the requirements are being met by the instrument, SOPs, operation manuals, business continuity plan, and location of the documents. 

DESIGNED and MANAGED a fee-based financial planning system incorporating investment, fringe benefits, business continuation, and estate planning. 

The deviation scenarios found in the previous step of the risk analysis must be assessed in terms of risk, which consists of assigning a level of severity and probability of occurrence to each scenario. This assessment is qualitative or semi-quantitative, but rarely quantitative, since a quantitative assessment requires a statistical database on failure frequency, which is difficult to obtain for the fine chemicals industry with such a huge diversity of processes. The severity is clearly linked to the consequences of the scenario or to the extent of possible damage. It may be assessed using different points of view, such as the impact on humans, the environment, property, the business continuity, or the company s reputation. Table 1.4 gives an example of such a set of criteria. In order to allow for a correct assessment, it is essential to describe the scenarios with all their consequences. This is often a demanding task for the team, which must interpret the available data in order to work out the consequences of a scenario, together with its chain of events. 

Business continuity procedures, including disaster recovery procedures, should ensure minimal disruption in the case of loss of data or any part of the system. It is necessary to ensure that the integrity of the data is not compromised during the return to normal operation. At the lowest level, this may mean the accidental deletion of a single file, in which case a procedure should be in place for restoring the most recently backed-up copy. At the other extreme, a disaster such as a fire could result in loss of the entire system. For this situation a procedure addressing the following should be in place ... 

The same understanding of what is critical, of what is an infrastructure and of what is entailed by the protection measures, have been a matter of discussion within countries and at the international level. These definitions, which are political in nature, more than technological, are influenced by the different perspectives taken by the problem stakeholders for instance, national defense, law enforcement, business continuity, and information assurance are four different domains that have their say on CIP. Moreover, even within governments there have been disagreements among the various policy standpoints—mainly originating from the requisite to link CIP initiatives with other on-going policies e.g., anti-terrorism, civil protection, security of supply, etc. 

National Fire Protection Administration (NFPA). (2004). 1600 Standard on Disaster/Emergency Management and Business Continuity Programs. Quincy, MA. 

Business continuity planning Recovery procedures Error tracking Supplier contracts Release security... 

SOPs for archiving, retention, and retrieval of software, data, documentation, and electronic records must be specified, tested, and approved before the system is approved for use. Business Continuity Planning... 

Procedures and plans supporting business continuity (Disaster Recovery Plans and Contingency Plans) must be specified, tested, and approved before the system is approved for use. Business Continuity Plans will normally be prepared for a business or an operational area rather than for individual computer systems. It is likely that the only way to verify the plan is to walk through a variety of disaster scenarios. Topics for consideration should include catastrophic hardware and software failures, fire/flood/lightning strikes, and security breaches. Alternative means of operation must be available in case of failure if critical data is required at short notice (e.g., in case of drug product recalls). Reference to verification of the Business Continuity Plans is appropriate during OQ/PQ. 

Prerequisites Validation (Summary) Report X X X X Backup and Restoration, Security, Training, Business Continuity Plans Response to Validation (Master) Plan including Statement... 

Check for existence of business continuity plans, including recovery after a catastophe Verify battery backup and UPS cut-in upon a power failure... 

System alarm/error messages Condition/readiness of business continuity measures Trip count for Uninterruptable Power Supplies (UPS)... 

Business Continuity Plans define how significant unplanned disruption to business operations (sometimes referred to as disasters) can be managed to enable the system recovery and business to resume. Disruptions may occur as a result of loss of data or outage of all or part of the computer system s functionality. The range of circumstances causing disruption can range from accidental deletion of a single data file to the loss of an entire data center from, for instance, fire. 

Business Continuity Plans are sometimes referred to as Disaster Recovery Plans or Contingency Plans. There are two basic scenarios ... 

Regulators are interested in business continuity as a means of securing the supply of drug products to the user community. The requirement for Business Continuity Plans covering computer systems is defined in EU GMP Annex 11 (the FDA has similar requirements). 

There are seven basic tasks to be completed for business continuity planning ... 

Verify business continuity plan through verification exercise. 

This approach to business continuity planning requires ... 

Loss of software support for aging versions of business critical systems can create significant business continuity and regulatory risks. Pharmaceutical and healthcare companies should provide a definitive statement on how they will maintain critical systems where support has historically been provided by third parties but that support is no longer available or set to expire. Measures need to be established to prevent adverse impact to product quality and product data and how they will ensure business continuity during any system outage. 

Business Continuity Plans should prompt the development of a media storage strategy for critical records (e.g., paper or fiche) to enable the retention of access to these records in the event of a system failure or access to critical records once the system has been switched off. 

Procedures and user manuals may be outdated, with users relying on typed or handwritten instruetions to supplement or replace old manuals. Procedures for operating the computer system should be reviewed and updated as necessary to reflect the current use of the system. Training reeords should be eurrent and refleet training in these npdated procedures. Access rights should be cheeked as appropriate and authorized. Role specifications may need to be updated. Business Continuity Plans should also be reviewed and amendments made as required. 

Adequate alternative arrangements need to be available in the event of a computer system breakdown to maintain access to electronic records for business continuity purposes. The time to bring the alternative arrangements into use should be related to the possible urgency to use them (e.g., access to electronic records to effect a recall must be available at short notice). 

---