COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:1 of 10
1
R.POL.005.09
1 CORPORATE OBJECTIVES
1.1 Compass Group UK & Ireland is the leading provider of contract catering and support
services in the UK and Ireland. Our Corporate objectives are as follows:
Our vision
To be a world-class provider of contract foodservice and support services, renowned for
our great people, our great service, and our great results.
Our mission
Everyone in Compass is committed to consistently delivering superior service in the most
efficient way, for the shared benefit of our clients customers, shareholders and
employees.
Our guiding principles
- Health, Safety and Environment first
- Delivering for clients and consumers
- Developing our people and valuing diversity
- Profitable growth
- Constant focus on performance and efficiency.
Purpose of BCM Policy
The Board of Directors of Compass UK & Ireland recognise that the changing nature of
the environment in which we operate means that our ability to continue operation
uninterrupted may not be entirely within our control; as demonstrated during the recent
pandemic. We know from the experiences of others that the organisation could also be
seriously affected by an unforeseen incident such as loss of IT servcies. The purpose of
our Business Continuity Management Policy is for us to achieve our Corporate Objectives
even if we experience an unforeseen Incident.
Our customers are entitled to expect that we do everything possible to ensure minimum
disruption to our operations and the delivery of services upon which they rely. To this
end, Compass has a Business Continuity Management (BCM) programme with a set of
interlocking plans and arrangements (the Business Continuity Management System, or
BCMS) to ensure that Compass has a tried, tested and best practice response to
minimise the impact of significant disruptions.
This BCMS policy supports Compass by assuring that products and services are delivered
with our best endeavours despite disruptive events, maintaining SLAs wherever possible.
Our organisation’s overall risk management strategy and appetite is set out by The
Business Continuity Steering Group and the business, legal and regulatory drivers with
respect to continuity of operations, are defined by that group.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:2 of 10
2
R.POL.005.09
2 BUSINESS CONTINUITY MANAGEMENT OBJECTIVES
2.1 The BCM objectives are as follows:
• The preservation of life is our first priority, so as to ensure the safety and welfare of
Compass employees and staff and of any visitors who are in Compass premises (or client
site) at the time of an incident.
• To minimise the impact on Compass of any interruption to normal activities
; to a level
which is below the impact tolerance level stated in this policy.
• To contain any financial costs associated with interruptions or incidents to manageable
levels.
• To protect the Compass reputation as a reliable and resilient supplier of contract catering
and support services, and to ensure that business following any interruption is not
adversely affected by reduced levels of activity during an interruption.
3 EMERGENCY RESPONESE AND OPERATIONS
3.1 Head Office and Central Functions
Our head office and central functions are supported by comprehensive business
continuity plans. We have an Incident Management teams at each of our key locations at
Birmingham, Chertsey, Dublin and Aberdeen. The Tactical plan provides a coordinated
response and specifies the key personnel, resources, services and actions required for
effective recovery from an incident which is controlled by the Incident Management
Team. At an Operational level each department has its own section, which contains the
specific detail and processes required for recovery. Priority is given to maintaining our
critical support activities such as D&T, Payroll, Finance and HR.
3.2 Sectors
At a sector level each location will have a Tactical Plan which provides the response
structure at a local level and is owned by Operations Director/Regional Manager for each
site. The Operations Director/Regional Manager reports to the Managing Director of the
Sector who has strategic responsibility for the plan. The plan identifies the circumstances
in which the plan is invoked and will be integrated with the clients site Business
Continuity Plan. The plan links into the Compass central support structures for:
3.2.1 Supply Chain
We have a full supply contingency plan in place for food and disposables. Should a
nominated supplier be unable to supply the full order, our chefs onsite can contact our
Foodbuy Support Line who have a comprehensive database of approved suppliers. Our
Vendor Assurance teams undertake extensive quality control checks before a supplier
can be added to our approved supplier list.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:3 of 10
3
R.POL.005.09
3.2.2 Staff Shortages
Compass has its own internal resourcing agency, Constalation, which is able to provide
swift cover as and when required.
3.2.3 IT Support (Data & Security)
Compass IT Support Services are on hand to provide technical support and advice
through the IT support line. They will despatch engineers to resolve hardware problems
and equipment failures such as till failure.
3.3 Unit Managers Emergency Manual
Each Unit Manager has an emergency manual which gives clear guidance on the
emergency procedures and what to do in the case of a wide range of incidents. This
manual is designed to work in conjunction with the Business Continuity Plan.
4 RISK MANAGEMENT
4.1 All of our business processes are regularly analysed for single points of failure, critical
resources in terms of people, applications, infrastructure and suppliers. Threats and risks
of each of these components are classified on our risk register. Once a risk has been
logged it will be subject to continual review, mitigation and assessment to ensure that it
remains under control.
5 SCOPE
5.1 In order to optimise the application of resources to the BCMS, the BCMS scope defines
areas of the Compass Group that are subject to its measures and that benefit from its
additional protection. These areas are set out in the following table:
5.2
Areas of Compass UK & Ireland falling within
the scope of the BCMS
Locations
All Compass Locations with the UK and
Ireland
Head Offices
Birmingham (Parklands)
Chertsey (Group)
Dublin (Parkview)
Aberdeen (ESS Support Services
Offshore)
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:4 of 10
4
R.POL.005.09
Areas of Compass UK & Ireland falling within
the scope of the BCMS
Sectors
Business and Industry
Defence and Government
Education
Healthcare & Senior Living
Offshore
Sports, leisure and Hospitability
FM Support Services
Supply Chain
Foodbuy Team
Ensuring a resilient Supply Chain through
its functions of:
Foodbuy Support Line
Category Development
Sourcing
Business Support
Supply Chain Team
Vendor Assurance
Resources
Telecommunications
Information systems
All data in use
Office buildings
Facilities
People
Disaster
recovery
We have a number of prevention and
detection tools in place which are
monitored by our security centre 24/7. All
critical applications have Technology
Continuity Plans and are regularly updated
and tested at least annually. Any failures
during testing is tracked by our
compliance team until remediated.
Sites also have both technical and / or
non-technical continuity plans (dependent
on site and requirements).
Stakeholders
Compass UK & Ireland Board,
Sector MDs
Shareholders
Customers
Staff and their families
Suppliers
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:5 of 10
5
R.POL.005.09
Areas of Compass UK & Ireland falling within
the scope of the BCMS
Incidents
and
Scenarios
Any incident leading directly to the
prolonged evacuation or unavailability of
Compass facilities.
Prolonged failure of the Compass internal
and/or customer-facing IT network
Absence due to illness, including
pandemics such as COVID-19 and
influenza, of significant numbers of
Compass Staff
Serious injuries or fatalities to an
employee, customer or member of the
public
Food safety incidents affecting a number
of customers
Any incident which damages the
environment including fire or flood
Theft/robbery; risk of legal action e.g.
closure notices; industrial/staff relations;
dawn raids, sabotage
Issues where clients/staff/public say they
will involve the media to seek resolution
Client/supplier issues e.g. risk of contract
following an incident
Timeline
based on
Business
Impact
Analysis
The assessment of impact and planning of
response and contingencies will be based
upon elapsed time following the
interruption of operational activities,
constituting the ‘timeline’ based on the
Business Impact Analysis.
The requirements of this policy relate only to the areas of Compass UK & Ireland listed in
the table above as being within the scope of the BCMS.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:6 of 10
6
R.POL.005.09
6 Business Continuity Management Principles
6.1 The BCMS is based upon ISO22301:2012 Business Continuity Management System
Requirements and includes the following components:
6.2
BCM
Component
Practical Requirement(s)
Business
Impact
Analysis
Assessment and analysis of Compass’s operational activities and
services, and their relative criticality.
Risk
Assessment
Assessment and analysis of the risk of occurrence of disruptions
to Compass’s activities and controls applied to reduce the risk to
an acceptable level.
Invocation
Arrangements
Documented, tried and tested procedures for invoking aspects of
the BCMS arrangements to deal appropriately with incidents.
Disaster
Recovery
Arrangements for the restoration of services or the provision of
alternative enabling resources.
BC Planning
Documented plans at Administration Centre, Sector and unit
levels, which set out key actions to be taken in response to a
variety of scenarios and showing how activities will be restored.
Culture
An ongoing programme of training and awareness activities aimed
at maximizing the awareness of BCM amongst all staff and
stakeholders and securing collaborative ‘buy-in’ so as to ensure
the continued and proactive operability and maintenance of the
BCMS.
Testing
An ongoing programme of activities that test all aspects of the
BCMS, thereby proving its adequacy and operability and providing
assurance to the Compass UK & Ireland Board of Directors.
7 BUSINESS IMPACT ANALYSIS
7.1 The key objective of the BCMS is the limitation of impacts arising from a disruptive
incident with an appropriate combination of proactive (avoidance) and reactive
(response) measures. However, it is recognised that Compass must be prepared to
accept a certain level of impact in the event of an interruption, not least so as to limit
the level of expenditure on risk controls and resilience measures to that which is
appropriate for the Compass risk appetite.
7.2 Compass will review the criteria for the assessment of impact. These criteria will include,
but will not be limited to, impacts whose nature is:
• Financial
• Reputational
• Affects customer service/satisfaction.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:7 of 10
7
R.POL.005.09
The table below defines the levels of impact that are used in making assessments.
Level
Impact
Very
High
Impact that is likely to terminate Compass’s existence
High
Impact that exceeds the Compass’s risk tolerance, but
from which it would expect to eventually recover
Medium
Major loss of business value
Low
Significant loss of business value
Very
Low
Minor loss of business value
7.3 The Compass UK & Ireland policy is that any risk with a Very High impact must be
mitigated and that very low impact levels are automatically accepted.
8 Maximum Acceptable Outage
8.1 Generally, the impact experienced following a disruptive incident will continue to
increase with time, until the service is resumed. The priority and resource resilience
given to each activity is established on an objective basis, so the Maximum Acceptable
Outage (MAO) is a function of the rate of increase of impact in relation to the Minimum
Business Continuity Objective for the activity.
8.2 For each activity, the MAO is the point on the timeline at or before which the activity
must be resumed, so that the resulting impact will be within the MAO.
8.3 The Recovery Time Objective (RTO) for each activity may be a time period shorter than
the MAO, and certainly not longer, allowing for the gradual recovery of activities and
where the activity can, in any event, be recovered much more quickly.
8.4 Business Impact Analysis will be carried out using the Compass BIA template and the
use of this template will reflect these principles.
8.5 Crisis Management Plan
This Strategic Plan provides a UK & Ireland Response to a high impact incident which has
the potential to affect multiple sites across the business. Examples of such incidents
include food contamination, industrial disputes, natural disasters, terrorism and
sabotage.
The Crisis Management Team (CMT) is a small team so that it can operate effectively
and quickly. The CMT will assess the severity of the incident and the wider implications.
They will then agree a strategy and response and from a business continuity perspective,
create a plan of action, mobilising the necessary resources. The UK and Ireland
Executive will be kept up to date and provide strategic oversight of the crisis.
Each member of the Crisis Management Team will have a designated alternate and can
be contacted using the AlertMedia crisis communication system.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:8 of 10
8
R.POL.005.09
Name
Role
Alternate
Mark Armstrong
CMT Leader
Nick Bracken
Jodi Lea
Legal
Howard James
Marios Panayiotou
Finance
Hollie Wintle
Finola Carey
HR
Susan Lee
Lucy Hunt
Communications
Melanie Downs
Nick Bracken
Resilience
David Crowe
9 RESPONSIBILITIES
9.1 The Managing Director is accountable to the Board of Directors to achieve our Corporate
Objectives even if we experience an unforeseen Incident and to maintain Compass Group
as a robust and resilient organisation.
9.2 The Crisis Management Team, determines the scope, provides resources, develops
timeframes and defines responsibilities for the Business Continuity Management System.
9.3 The Head of Risk and Resilience, Nick Bracken is responsible for:
• Development and implementation of the BCMS
• Business Continuity Training Plan
• Business Continuity Exercising Plan
• Build and maintain positive relationships with clients and their BC reps.
• Provision of specialist expertise and experience to ensure the business meets its BC
obligations.
• Tactical support to units.
• Audits to check standards; prepare units; investigate incidents
9.4 Operation Directors/Regional Managers are responsible for the tactical response
structure and maintenance of the Sector Business Continuity Plans.
9.5 Head Office Function Directors/Managers are responsible for the tactical response
structure and maintenance of the Head Office Business Continuity Plans.
9.6 The Head of HR is responsible for ensuring that the detailed BCMS requirements of
individual roles are contained in their job descriptions.
9.7 Unit Managers are responsible for the operational response structure and maintenance of
the Sector Business Continuity Plan.
9.8 Approvals of any and all material changes to the BCMS policy will be approved by the
Chair of the Crisis Management Team.
9.9 The chair of the Crisis Management Team will report to the Board of Directors on a
regular basis that, through appropriate testing of the BCMS and fulfilment of all
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:9 of 10
9
R.POL.005.09
maintenance actions in respect of plans and contingencies, that Compass business
interruption risks are being appropriately and effectively managed.
10 Testing and Maintenance
10.1 The BCMS will be tested on a regular basis, including:
• Desktop rehearsal of Head Office Business Continuity plans at least every 12 months.
• Desktop rehearsal of Sector Continuity Plans at least every at least every 12 months
• An exercise of outsourced Disaster Recovery arrangements at least every 12 months.
• A ‘unit-level’ exercise (on rotation of sectors) involving units managers at least every 12
months
• Post exercise reports will be submitted to the Head of Risk and Resilience and reviewed
by the Crisis Management Team to identify any learning outcomes and business
improvements.
10.2 A detailed testing plan will be subject to approval annually by The Crisis Management
Team.
10.3 Changes in business strategy, legislation, and risk (either financial or operational) are
notified to the Business Continuity Manager by the Incident Management Team Leaders
and Sector Plan owners as and when they occur, and the business continuity
arrangements – and the test programme – are updated to take account of these
changes.
10.4 It is a requirement of the change control procedure that changes to business processes,
assets and systems should be reflected in the business continuity arrangements.
Specifically, changes to personnel, addresses or telephone numbers, locations,
equipment, systems, facilities, contracts or key customers, must be incorporated into
updated versions of the business continuity plans. The plan should be reviewed on a
quarterly basis.
11 Training and Awareness
11.1 Compass Group recognises that the BCMS will be most effective when all
employees/staff and stakeholders have an appropriate level of awareness of resilience,
contingencies and response plans.
11.2 The Head of Risk and Resilience is responsible for developing and implementing a BCMS
awareness and education programme.
11.3 All Unit Managers will be required to familiarise themselves with Unit Managers
Emergency Manual and its processes.
COMPASS GROUP UK & IRELAND
BUSINESS CONTINUITY
MANAGEMENT POLICY STATEMENT
Document Control
Issue No: 9
Issue Date: October 2023
Page:10 of 10
10
R.POL.005.09
12 Document Owner and Approval
The Chair of the Business Continuity Steering Group is the owner of this document and is
responsible for ensuring that this policy is reviewed in line with the requirements of the
BCMS.
The current version of this document is available to all members of staff on the Compass
Group Health and Safety Website.
This document is approved by the Chair of The Crisis Management Team on the issue
date shown and is issued on a version controlled basis under his signature.
Signature: Date:
Change History Record
Issue
Description of Change
Approval
Date of Issue
1
Initial Issue
Roger Downing
March 2015
2
Annual Review
Roger Downing
March 2016
3
Annual Review
Roger Downing
March 2017
4
Annual Review
Andy May
March 2018
5
Annual Review
Mark Armstrong
May 2019
6
Annual Review
Mark Armstrong
December 2020
7
Annual Review
Mark Armstrong
September 2021
8
Annual Review
Mark Armstrong
December 2022
9
Annual Review
Mark Armstrong
October 2023