Login

NA40-Business Continuity and Contingency Planning Policy

{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

Business Continuity and Contingency Planning Policy

1. Purpose

The purpose of this Business Continuity and Contingency Planning Policy is to ensure that {{org_field_name}} is fully prepared to continue the safe and effective delivery of its services during any disruption, whether anticipated or unforeseen. The agency is committed to providing uninterrupted staffing services to care homes and healthcare settings and to ensuring the safety and wellbeing of service users, clients, temporary workers, and other stakeholders during times of crisis. The aim is to minimise disruption to clients and uphold regulatory compliance even when external or internal circumstances impact the agency’s capacity to operate normally.

This policy supports {{org_field_name}}’s legal and contractual duties as an employment business supplying temporary workers in England. It is designed to support continuity of critical staffing, payroll, recruitment, compliance, safeguarding escalation, communication, record keeping and data protection functions during disruption.

This policy is aligned with the Employment Agencies Act 1973, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, the Agency Workers Regulations 2010, the Employment Rights Act 1996, the Working Time Regulations 1998, the National Minimum Wage Act 1998 and National Minimum Wage Regulations 2015, the Equality Act 2010, the Immigration, Asylum and Nationality Act 2006, the UK GDPR and Data Protection Act 2018, the Health and Safety at Work etc. Act 1974, the Safeguarding Vulnerable Groups Act 2006, the Police Act 1997, the Rehabilitation of Offenders Act 1974 and relevant DBS requirements.

Where {{org_field_name}} supplies staff to CQC-regulated clients, the agency will support those clients by supplying workers who have been recruited, checked and deployed in line with agreed contractual requirements. However, {{org_field_name}} does not itself provide regulated care, direct care delivery or carry on regulated activities requiring CQC registration unless the business model changes.

2. Scope

This policy applies to:

This policy covers disruptions including but not limited to pandemics, public health emergencies, IT failures, cyber-attacks, power failures, natural disasters, severe weather, office closures, staff shortages, and business-critical incidents.

This policy also applies where disruption affects legal or compliance-critical activities, including right-to-work checks, DBS checks, professional registration checks, reference checks, worker suitability checks, issuing or updating Key Information Documents, confirming assignment details, payroll processing, holiday pay, National Minimum Wage compliance, Agency Workers Regulations monitoring, safeguarding referrals, incident reporting, personal data breach management and communication with clients and workers.

3. Related Policies

4. Principles

{{org_field_name}} will ensure:

5. Risk Assessment and Business Impact Analysis

The director will:

Key risks considered include:

6. Business Continuity Objectives

{{org_field_name}} aims to:

7. Roles and Responsibilities

7.1 The Director

The director of {{org_field_name}} will:

7.2 Office Staff

Office staff will:

7.3 Temporary Workers

Temporary workers are expected to:

7.4 Employment Business Compliance During Disruption

During any disruption, {{org_field_name}} will continue to operate in accordance with the Employment Agencies Act 1973 and the Conduct of Employment Agencies and Employment Businesses Regulations 2003. The agency will ensure, as far as reasonably practicable, that disruption does not prevent it from providing required information to workers and clients, agreeing terms, confirming assignment details, maintaining records, checking suitability, and avoiding prohibited fees to work-seekers.

{{org_field_name}} will maintain arrangements to issue and retain Key Information Documents before agreeing terms with agency workers and will ensure that workers receive clear information about pay, deductions, holiday pay, benefits, employment business details, umbrella arrangements where applicable, and representative examples of take-home pay where required.

Where electronic systems are unavailable, the agency will use approved manual processes to record worker terms, client requirements, assignment details, pay rates, deductions, holiday arrangements, timesheets, cancellation information and communications.

7.5 Agency Workers Regulations Continuity

{{org_field_name}} will maintain arrangements to monitor Agency Workers Regulations 2010 qualifying periods and equal treatment rights during business disruption. This includes monitoring whether an agency worker has completed the relevant 12-week qualifying period in the same role with the same hirer, subject to applicable breaks and pauses.

The agency will continue to communicate with clients to obtain accurate information about relevant pay, duration of working time, night work, rest periods, rest breaks, annual leave and other basic working and employment conditions.

Day-one rights, including access to collective facilities and information about relevant vacancies, remain the responsibility of the hirer, but {{org_field_name}} will support workers by signposting concerns to the client and escalating unresolved issues where appropriate.

The agency will not use pay-between-assignments arrangements as a means of avoiding equal pay rights under the Agency Workers Regulations.

7.6 Payroll, Holiday Pay and National Minimum Wage Continuity

Payroll is a critical business function. {{org_field_name}} will maintain contingency arrangements to ensure workers are paid accurately and on time wherever reasonably practicable, including manual timesheet verification, alternative payroll access, emergency payroll contacts and backup records of agreed pay rates and hours worked.

During disruption, the agency will continue to comply with National Minimum Wage requirements, Working Time Regulations requirements and holiday pay rules. For irregular-hours and part-year workers, the agency will apply the current statutory holiday entitlement and holiday pay rules applicable to leave years beginning on or after 1 April 2024, including lawful use of rolled-up holiday pay only where permitted and clearly shown to the worker.

Any payroll error, underpayment, unlawful deduction, holiday pay error or National Minimum Wage risk identified during a disruption must be escalated to the director immediately, investigated, corrected and recorded.

7.7 Right to Work Continuity

{{org_field_name}} will not deploy any worker unless a compliant right-to-work check has been completed before work starts, unless a lawful Home Office process confirms that the person may work. The agency will maintain contingency arrangements for right-to-work checks, including access to Home Office online checking services, share code checks, document verification processes, follow-up check reminders and secure storage of evidence.

Where disruption affects the agency’s ability to verify right to work, the worker must not be supplied until the check has been completed and recorded. Where a time-limited right to work is held, the agency will maintain a system for follow-up checks and will not rely on expired evidence.

Any concern that a worker does not have the right to work, has provided false documents, or is working in breach of immigration conditions must be escalated immediately to the director.

7.8 Safeguarding, DBS and Regulated Activity Continuity

{{org_field_name}} will maintain safe recruitment and safeguarding escalation processes during disruption. Workers must not be supplied into roles involving regulated activity, vulnerable adults, children, clinical duties or client-specified safeguarding requirements unless the required DBS, barred list, professional registration, reference, identity, right-to-work and suitability checks have been completed and recorded.

DBS certificate information and any related safeguarding information must be handled securely, used only for the purpose for which it was obtained, shared only where lawful and necessary, retained only for as long as necessary, and destroyed securely when no longer required.

Where {{org_field_name}} is acting as a personnel supplier and becomes aware of information that may trigger a legal duty to refer to the DBS, the director will ensure that the matter is assessed promptly and that any required referral is made. This applies even where a matter has also been referred to a local authority safeguarding team, the police, a client organisation or a professional regulator.

Safeguarding concerns arising during disruption must be escalated without delay in accordance with the Safeguarding Adults and Children Policy.

7.9 Data Protection and Personal Data Breach Continuity

{{org_field_name}} will maintain appropriate technical and organisational measures to protect personal data during disruption, including candidate, worker, client, payroll, health, DBS, right-to-work, safeguarding and assignment records.

Where a cyber incident, IT failure, loss of device, email error, unauthorised access, ransomware attack, data loss or accidental disclosure occurs, the incident must be reported immediately to the director or designated data protection lead.

The director or designated data protection lead will assess whether the incident is a personal data breach under UK GDPR, whether it is likely to result in a risk to individuals’ rights and freedoms, and whether notification to the Information Commissioner’s Office is required. Where notification is required, this will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to individuals, affected individuals will also be informed without undue delay.

All suspected and confirmed personal data breaches must be recorded, including the facts of the incident, effects, remedial action taken, decisions about notification, and learning points.

7.10 Cyber Security and IT Disaster Recovery

{{org_field_name}} will maintain cyber security and IT disaster recovery arrangements proportionate to the size and risk profile of the business. These arrangements will include secure backups, access controls, multi-factor authentication where available, secure password practices, device security, anti-malware protection, software updates, phishing awareness, secure remote working and supplier management.

The agency will maintain backup access to critical information needed to continue safe operations, including client contacts, worker contacts, emergency contacts, availability records, assignment records, payroll contacts, safeguarding contacts, insurance contacts, IT support contacts and key supplier contacts.

Where a cyber incident affects access to systems, the agency will activate manual contingency processes for rostering, communication, compliance verification, timesheets, payroll and incident recording.

The director will consider National Cyber Security Centre guidance, including Cyber Essentials principles, when reviewing cyber resilience and business continuity arrangements.

7.11 Health and Safety During Assignments

{{org_field_name}} will take reasonably practicable steps to ensure that temporary workers are supplied only to assignments where health and safety arrangements have been considered and communicated. During disruption, the agency will continue to obtain and share relevant information from clients about workplace risks, infection prevention arrangements, PPE requirements, fire safety, lone working, manual handling, travel disruption, violence and aggression risks, and emergency reporting procedures.

Clients remain responsible for day-to-day direction, supervision and workplace safety arrangements at their premises, but {{org_field_name}} will not ignore concerns raised by workers. Any worker concern about unsafe conditions, inadequate PPE, unsafe staffing, excessive hours, lack of breaks, violence, harassment, discrimination or being asked to work beyond competence must be escalated and risk assessed.

Where the agency reasonably believes an assignment presents an unacceptable risk to a worker, service user or client, the agency may refuse, pause or withdraw supply until the risk has been addressed.

7.12 Modern Slavery and Labour Exploitation Continuity

{{org_field_name}} will remain alert to signs of modern slavery, labour exploitation, debt bondage, worker coercion, unlawful fee charging, document retention, unsafe transport, unsafe accommodation, threats, intimidation, excessive working hours or workers being controlled by another person.

Disruption must not be used as a reason to relax recruitment, identity, right-to-work, payroll, safeguarding or welfare checks. Any concern about labour exploitation or modern slavery must be escalated immediately to the director and managed in accordance with the Modern Slavery and Labour Exploitation Policy.

Where legally required, {{org_field_name}} will maintain a modern slavery statement. Where not legally required, the agency will still maintain proportionate anti-slavery procedures because of the risk profile of temporary labour supply.

8. Contingency Measures

8.1 Staff Shortages

In the event of staff shortages, {{org_field_name}} will:

8.2 IT and Communication Failures

In the event of IT or communication failure, {{org_field_name}} will:

8.3 Office Closure

In the event of office closure, {{org_field_name}} will:

8.4 Pandemic or Public Health Emergency

During a pandemic or public health emergency, {{org_field_name}} will:

8.5 Payroll System Failure

In the event of payroll system failure, {{org_field_name}} will:

8.6 Loss of Access to Compliance Records

In the event that {{org_field_name}} cannot access compliance records, the agency will not assume that a worker is compliant. Before confirming or continuing an assignment, the agency must verify required checks using backup records, secure copies, client-held evidence where appropriate, or direct confirmation from the relevant source.

Required checks may include identity, right to work, DBS, barred list checks where applicable, professional registration, references, training, occupational health or fitness information, client-specific requirements, terms of engagement and assignment details.

If compliance cannot be verified, the worker must not be newly deployed until the issue is resolved, unless the director has completed and documented a lawful, proportionate and client-approved risk assessment.

8.7 Major Client Disruption or Withdrawal of Assignments

Where a client closes, suspends placements, experiences an outbreak, loses registration, becomes subject to enforcement action, cancels large numbers of shifts, or raises concerns about supplied workers, {{org_field_name}} will:

9. Communication During Disruption

The director will:

Clients will be informed:

Temporary workers will be informed:

10. Testing, Monitoring, and Reviewing

The director will:

11. Documentation and Record Keeping

The director will ensure that:

12. Supporting Temporary Workers During Disruption

{{org_field_name}} will:

13. Director’s Governance and Oversight

As {{org_field_name}} is not registered with CQC and does not have a CQC registered manager, the director will retain overall responsibility for business continuity governance and oversight.

 The director will:

14. Commitment to Clients and Stakeholders

{{org_field_name}} is committed to:

15. Legal and Regulatory Framework

This policy should be read in the context of the following legislation, regulations and guidance, where applicable to {{org_field_name}}’s activities as an employment business and temporary staffing agency in England:

{{org_field_name}} recognises that it is not a CQC-registered provider and does not provide regulated care. The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and CQC assessment framework are therefore relevant mainly to the agency’s CQC-regulated clients, unless {{org_field_name}} changes its services so that it directly carries on regulated activities.

16. Policy Review

This policy will be reviewed at least annually by the director of {{org_field_name}} or sooner where there is a significant incident, near miss, client concern, safeguarding issue, data breach, cyber incident, payroll failure, regulatory change, change in employment law, change in public health guidance, change in immigration or right-to-work requirements, change in DBS requirements, change in agency worker regulation, change in the agency’s operating model, or material change in client contractual requirements.

The director will specifically monitor developments relating to the Employment Agencies Act 1973, the Conduct Regulations, Agency Workers Regulations 2010, Employment Rights Act 1996, Employment Rights Act 2025 implementation, Working Time Regulations 1998, National Minimum Wage legislation, Equality Act 2010, right-to-work requirements, UK GDPR, DBS requirements, health and safety law and modern slavery requirements.

All amendments will be communicated clearly to relevant office staff, temporary workers, clients, suppliers and other stakeholders where the changes affect their responsibilities or rights.

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.

Leave a Reply

Your email address will not be published. Required fields are marked *