Annual Report and Accounts 2009-10 - Welfare Reform impact ...

Strategic aim 5
Business continuity in
24-48
hours.
Risk management
We regularly review the principal
risks that threaten the achievement
of our policies, aims and objectives.
These reviews identify the controls
in place to manage those risks at
strategic level, directorate level,
and programme and project level.
Potential risks are reported to the
SMB. The SMB then consider these
risks for inclusion in the Strategic
Risk Register.
Business continuity
We constantly analyse risks and
threats that could disrupt our
business – on a small and larger
scale. Our aim is to safeguard our
people and continue to deliver our
business for our users.
As part of the ongoing improvement
to business continuity, we reviewed
our plans and successfully tested
our disaster recovery suite.
The test established we could
continue business, at predetermined
levels, within 24-48 hours. The
results of the test were reported to
the Board of Trustees and the SMB.
Data security and data handling
This year we introduced additional
measures to ensure that data
security continues to conform to
Cabinet Office guidance.
We introduced a stronger focus on
our ‘clear desk’ policy. We provided
sufficient lockable furniture so that
all user files and business-sensitive
materials are securely locked away
each night.
All bulk and sensitive external
data transfers are governed by
strict policy. Data transfers require
authorisation by the individual
information asset owner and
the senior information and risk
owner (SIRO).
All transfers and data losses are
routinely reported to the Audit
Committee. The SIRO presented
his annual report to the Audit
Committee in February 2010 for
sign-off by the Chair of the Audit
Committee.
29 Annual Report and Accounts 2009-10