BUSINESS CONTINUITY

SCOPE:

This procedure applies to all divisions and departments in the company that are involved in maintaining business continuity.

PURPOSE:

This SOP describes the actions that should be taken to maintain business continuity.

REASON FOR REVISION:

To reflect changes in our company structure.

DEFINITIONS:

Business ContinuityManagement: A holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response which safeguards the interests of its key stakeholders, reputation, brand and value creating activities.

Disaster: Any event, whether natural or man made, that causes the failure of any critical equipment, system utility or service that is required to produce a pharmaceutical product to cGMP requirements or a share holder/ client/patient’s lack of confidence in Company.

Recovery: The action to be taken to reverse the disaster and to decide what actions need to be put in place.

RESPONSIBILITIES 

It is the responsibility of all Managers and their delegates to follow this SOP, to participate in the Rapid Response Team and to keep the Quality Affairs Division Manager informed of any changes that need to be made to this SOP.

It is the responsibility of the Managing Director, the Quality Affairs Division Manager or the Qualified Person to lead the Rapid Response Team, as appropriate.

It is the responsibility of the Quality Affairs Division Manager to update this SOP and to ensure compliance.

SAFTER CONSIDEATIONS:

All reasonable and necessary precautions must be taken in the event of a disaster to prevent harm or danger to oneself or to others in the execution of this procedure.

STATEMENT OF SOP:

There is a need for control over disasters that occur and the risk to product or company and hence the need for business contingency planning. All company employees are responsible to participate in such activities, with the ultimate responsibility being with the Managing Director.

In case of a disaster, staff on duty should contact their line managers or appointed deputies, plus others as appropriate to the situation.

Contact telephone numbers of key personnel are listed as follows:

Name

Position

Phone Numbers

The key persons listed above are responsible to contact their own staff as appropriate.

As required, a Rapid Response Team should be set up to evaluate the processes and activities running, evaluate critical issues of the stoppage and the potential impact on the company and / or quality of the product. The Team shall be led by the Managing Director, or, in his absence, the Quality Affairs Division Manager or the Qualified Person.

In the event that the Team cannot effectively operate from Company due to the nature of the disaster, an alternative operating site should be identified without delay.

The consequences of an electrical power failure are given in Appendix 1.

Action that should be taken in different circumstances is described in Appendix 2.

A Business Impact Form (Appendix 3) is completed by the Rapid Response Team and details of the level of the risk to each area are recorded. The impact levels are as follows:

Impact Level

Cause of Impact

A. Business survival threatened.

 

Time unavailable for trading:  >> 1 month.

1. Company is non-operational.

2. No longer trading

3. Business fraud.

4. Severe action by EU regulatory authorities.

5. Adverse press reports particularly headline news.

6. Any other scenario which is totally unacceptable to the company.

B. Serious damage

 

Time unavailable for trading: > 1 month.

1. Still in business but have been overtaken by main competitors.

2. Market value significantly down.

3. Adverse press reports in business pages.

4. Need to restructure; sell off some of the business.

5. Staff morale very low, losing people and unable to attract quality recruits, customers withdrawing trade.

6. Need to cancel developments and investments.

C. Significant damage

 

Time unavailable for trading: ≥ 1 week.

1. Have taken a serious knock, but just held position against nearest competitors, customers remaining but need discounts or deals to keep them happy.

2. Bad press coverage.

3. A few points of the share price.

4. Recruitment and growth limited

5. May have to put some developments on hold.

D. Minor impact

 

Time unavailable for trading: ≥ 1 day.

1. Minimal harm to company.

2. Unfriendly business sector press coverage.

3. Spend some money on recovery, but within acceptable business contingency. May even be able to turn the situation to advantage as an example of good management response.

E. No impact.

 

Time unavailable for trading: ≥ 1 hour.

 

1. Threat happened but did not affect the company.

2. Dealt with in the normal dynamics of business management.

All details and decisions should be included on the rear of this form or, in some cases, a deviation report issued.

Management should be continually informed of events and, as required, be included in the decision making process.

The Quality Affairs Division Manager and the Qualified Person should inform clients and the Maltese regulatory authorities if any GMP impact has occurred or is expected from the disaster.

All events must be logged and a report written on a frequent basis.

When all impact issues have been resolved a report must be prepared by the Managing Director or Qualified Person or both.

REFERENCE:

Policy on Business Continuity Planning

Policy for evacuating personnel in emergency situations

First Aid Practices and Requirements

Procedure to be followed in case of HVAC System Failure

APPENDICES:

Appendix 1:Matrix of quality critical consequences and impact if a power failure occurred.

Appendix 2:Action to be taken in handling disasters.

Appendix 3:Business Impact Form.