Inspectors slam council for failing to develop disaster recovery plan

Barking & Dagenham council is developing its first authority-wide business continuity plan after being slammed by Whitehall...

Barking & Dagenham council is developing its first authority-wide business continuity plan after being slammed by Whitehall inspectors.

The Benefit Fraud Inspectorate, which is a government agency, found the council's benefits section lacked a formal business continuity plan.

It also reported that the benefits section had "no information security policy or IT security strategy in place", and that no information security education or training was provided to staff to make them aware of threats.

A council spokesman admitted other departments also lacked business continuity arrangements and said an authority-wide plan was being developed.

The council said it had contingency plans for benefits data, but not for hardware to process the data in an emergency.

The agency carried out its inspection last November and told the council to "produce a documented disaster recovery plan covering all its hardware and software, and test this plan annually using the results to refine and improve its plan".

Since the inspection, the council has not implemented a working business continuity plan. "We have piloted a business continuity plan in various departments - including benefits - but so far we have not implemented it," said a spokesman.

"We intend to introduce a council-wide business continuity plan. We have established a business continuity framework that the council will operate within," he said.

Councillor Terry Wade, a member of Barking & Dagenham's executive, said in part the shortcomings were because of staff changes and the council's intention to install a new combined revenues and benefits system.

The council invited tenders for the system in May 2003 but is still evaluating six shortlisted bidders and does not expect the system to go live until the end of 2005.

Paul Skerman, a consultant at local authority IT directors' organisation Socitm Consulting, said, "Local authorities are not going deeply enough into business continuity. Many chief executives do not know what it means. This is because of the number of targets they have to meet.

"It takes disasters to get things done, although I am surprised the council still does not have a business continuity system in place."

Read more on IT risk management