Key messages
Improving civil contingencies planning

Prepared for the Auditor General for Scotland and the Accounts Commission
August 2009
Auditor General for Scotland
The Auditor General for Scotland is the Parliament’s watchdog for ensuring propriety and value for money in the spending of public funds. 

He is responsible for investigating whether public spending bodies achieve the best possible value for money and adhere to the highest standards of financial management. 

He is independent and not subject to the control of any member of the Scottish Government or the Parliament. 

The Auditor General is responsible for securing the audit of the Scottish Government and most other public sector bodies except local authorities and fire and police boards.

The following bodies fall within the remit of the Auditor General: 

•	directorates of the Scottish Government
•	government agencies, eg the Prison Service, Historic Scotland 
•	NHS bodies 
•	further education colleges 
•	Scottish Water 
•	NDPBs and others, eg Scottish Enterprise. 
The Accounts Commission
The Accounts Commission is a statutory, independent body which, through the audit process, assists local authorities in Scotland to achieve the highest standards of financial stewardship and the economic, efficient and effective use of their resources. The Commission has four main responsibilities:

•	securing the external audit, including the audit of Best Value and Community Planning
•	following up issues of concern identified through the audit, to ensure satisfactory resolutions
•	carrying out national performance studies to improve economy, efficiency and effectiveness in local government
•	issuing an annual direction to local authorities which sets out the range of performance information they are required to publish.
The Commission secures the audit of 32 councils and 41 joint boards (including police and fire and rescue services). Local authorities spend over £19 billion of public funds a year.

Audit Scotland is a statutory body set up in April 2000 under the Public Finance and Accountability (Scotland) Act 2000. It provides services to the Auditor General for Scotland and the Accounts Commission. Together they ensure that the Scottish Government and public sector bodies in Scotland are held to account for the proper, efficient and effective use of public funds.

Key messages
Introduction

1. Following events such as the terrorist attacks in the United States (2001), the foot and mouth outbreak in the UK (2001) and numerous floods, the Civil Contingencies Act 2004 (referred to as ‘the Act’) was introduced to establish a new legislative framework for civil protection across the UK. The legislation imposed new duties on public sector bodies and other relevant organisations to ensure that effective arrangements are in place to plan for, respond to and recover from emergencies, and to ensure that services can continue to be delivered in the event of disruption. 

2. The Contingency Planning (Scotland) Regulations 2005 describe how the provisions of the UK Act are to be implemented in Scotland. The Scottish Government guidance, Preparing Scotland, outlines the new arrangements and provides statutory guidance on how to apply the Regulations. 

3. The Civil Contingencies Act defines two categories of ‘responders’:

•	Category 1 responders – those public sector organisations providing vital services in an emergency, including local authorities, police forces, fire and rescue services, NHS boards, the Scottish Ambulance Service (SAS) and the Scottish Environment Protection Agency (SEPA).1  
•	Category 2 responders – those public and private sector organisations providing key infrastructure services. For example, Scottish Water and gas and electricity suppliers may have a role in responding to incidents such as flooding and utilities failure, which are two of the main risks facing Scotland.
The study
4. This study looked at what progress has been made since the Act was passed, assessed the pace of change and identified ways in which improvements can be made. 

5. Our emphasis was on the requirement for organisations to work together. We examined this generally, and specifically in relation to risk assessment, emergency and business continuity planning, training and exercises, and learning lessons. We also examined the resources and performance management processes that support these activities.

6. We did not look at how individual emergencies have been dealt with or make judgements on the level of preparedness of any individual organisation, sector or Scotland as a whole.

7. In carrying out this study we collected information through a survey of 64 Category 1 responders, as well as Strategic Coordinating Group (SCG) coordinators; interviews with SCG chairs and coordinators and representatives of relevant organisations; focus groups with NHS and local authority emergency planning officers; observation of meetings, training events and exercises; and a review of relevant documentation. 
The overall picture

8. Overall, we found that the Act has reinforced multi-agency working, and organisations are generally co-operating well with each other. Progress is being made to meet the main duties under the Act, but further improvements can be made and the pace of change could be accelerated in certain areas.

9. The Act requires a broader, more integrated approach to be taken to civil contingencies planning. However, we found that traditional aspects, such as response arrangements for emergencies, still tend to dominate. Arrangements for recovery and the continued delivery of services are less well developed.

10. Our 2006 report on Community Planning stated that joint working between organisations is challenging. This study identifies similar issues and areas for improvement relating to multi-agency working, such as information sharing and representation.

11. The arrangements for civil contingencies planning are increasingly complex and clarity is needed about leadership, some roles and responsibilities, and priorities. 

12. More needs to be done to engage and support elected members in relation to civil contingencies planning, and to communicate effectively with the public.
 
13. Our report’s conclusions are summarised in nine key messages.

Key messages

1
 Overall, key organisations work well together, particularly through their Strategic Coordinating Groups, but barriers to joint working exist.

14. How different organisations work together locally is at the core of effective civil contingencies planning. When a disruptive event happens all major public services are likely to be involved. It is therefore important that these organisations, along with those in the private and voluntary sectors, work together to plan how to deal with such an event and to determine how they will help communities to recover.

15. The formal duty for multi-agency co-operation is met through the establishment of an SCG in each of the eight police force areas in Scotland. SCGs are intended to be a forum for joint civil contingencies planning in each area, and we found that they are making an effective contribution to this (Exhibit 1).

16. Since the implementation of the Act, SCGs have prioritised their immediate responsibilities around preparing for, and responding to, emergencies. There are a number of areas which are yet to be fully addressed, such as planning to ensure the continued delivery of services during an emergency and the recovery of communities after an emergency. There has also been limited joint working between SCGs, resulting in duplication and inefficient use of skills, expertise and resources.

17. One of the challenges SCGs face is ensuring that all the organisations involved in dealing with incidents are effectively included in planning for them. It can be difficult for SCGs to find a way of including all relevant organisations while still maintaining effective strategic decision-making. 

18. Not all organisations are consistently represented at SCG meetings, either because of non-attendance or attendance of individuals who do not have appropriate decision-making authority. 

19. Information sharing between organisations, particularly within SCG areas, is generally working well (Exhibit 2).

20. Category 1 responders reported that they are generally kept well informed by other Category 1 responders. Overall, they reported that Category 2 responders keep them less well informed, although there was some variation. For example, among the utility companies, which can play a key role in response and recovery, Scottish Water was viewed more positively than the gas and electricity companies.

21. However, we also found that effective joint working is limited by a number of factors, including the lack of a standard approach to sharing information (for example, not all Category 1 responders have secure email systems) and differences in key definitions, such as what constitutes an emergency. 

2
The Scottish Government has taken an active role in implementing the Act but this increased priority has placed greater demands on local responders.

22. Scottish Resilience (the part of the Scottish Government responsible for civil contingencies) has undertaken a lot of activity to support implementation of the Act, both at central and local levels. For example, it issues guidance, provides funding for SCG coordinator, Regional Resilience Adviser and training posts, sends nominated representatives to SCG meetings, and has established forums for the SCG chairs and coordinators.

23. However, the rise in civil contingencies activity by the Scottish and UK governments has resulted in some local responders finding it difficult to keep pace with developments. There has been a significant increase in staffing levels within central government but no apparent increase among local responders.

24. Legislation requires the Scottish and UK governments to consult each other in relation to civil contingencies planning, and there are formal links in place to support this. However, their relative roles and responsibilities are not always clearly defined or understood (for example, the extent to which UK government guidance relates to Scotland is not always apparent). A more cohesive approach could be taken.

3
 Governance and accountability arrangements for multi-agency working in civil contingencies planning are unclear.

25. SCGs are not statutory bodies and have no binding decision-making powers. Although SCGs appear to successfully manage joint decision-making, it is not clear who is accountable for decisions made at the strategic level. This raises questions for some partners (for example, around duty of care for employees).
 
26. Scottish ministers see themselves as having a lead role in civil contingencies planning. But there is a lack of clarity among local responders around the role and responsibilities of Scottish Government, the status of its relationship with the SCGs, the extent to which it can direct local civil contingencies activity and its accountability during an emergency.

27. There is growing interest in civil contingencies planning among politicians. However, we found little evidence of engagement with elected members to ensure they are aware of their responsibilities and can play an effective role.

4
 All SCGs have published a Community Risk Register but these have made a limited contribution to informing civil contingencies planning at a local or national level.

28. Responders within each SCG area should collaborate in producing a shared Community Risk Register (CRR), taking account of national and local risks, to form the basis of multi-agency planning in the SCG area. All SCGs have developed and published a CRR. 

29. The extent to which CRRs are used to inform local planning varies. Around a quarter (22 per cent) of Category 1 responders had not used their CRR to inform emergency planning processes. Almost half (41 per cent) had not used it to inform business continuity planning. 

30. There is no comprehensive Scottish-level risk assessment process or risk register document, although the Scottish Government is currently looking at ways to address this. Variation in the presentation and type of information included in CRRs has so far limited their contribution to the development of any Scottish-level assessment of risks. 

31. In 2008, the Cabinet Office published a National Risk Register and although this was intended to cover the whole of the UK, the Scottish Government had limited involvement in its development.

32. The public is generally not well informed about risks and not all Category 1 responders have arrangements in place for informing the public during an emergency.

5
 Most Category 1 responders have a generic emergency plan in place and have been involved in developing multi-agency arrangements for their SCG area. However, planning for business continuity management and recovery are not as well developed.

33. The approach to civil contingencies planning in Scotland is designed to manage the response to, and recovery from, any emergency, irrespective of nature, cause or size. This approach is called generic emergency planning.

34. Most Category 1 responders (80 per cent) have produced their own generic emergency plans and the remaining organisations are developing one. 

35. Scottish Government guidance, Preparing Scotland, suggests what Category 1 responders should include in their generic emergency plans. We found all formally agreed plans identify key roles and responsibilities and include agreed management and coordinating arrangements, and communication procedures. However, more than half do not include details of how to identify vulnerable people in an emergency, and information on exercising and training procedures. 

36. Of the eight SCGs, five have an agreed multi-agency generic emergency plan in place. The remaining three have plans in development. All but one Category 1 responder has had some input into developing joint, formal civil contingencies arrangements within their SCG area.

37. Business continuity management planning is essential to avoid disruption to services in the event of an emergency. However, these arrangements are not well developed and less than half (47 per cent) of Category 1 responders have a formally agreed corporate business continuity plan.

38. Local authorities should provide general advice and assistance on business continuity to local businesses and voluntary organisations but we found a quarter (eight) are not yet doing so. 

6
 Complex training and exercising requirements place significant demands on local responders, making participation and effective coordination difficult. 

39. As well as the training and exercising requirements of the Act, responders also have statutory duties for participating in training and exercising under other legislation. This includes areas overseen by the Health and Safety Executive (HSE) and the Civil Aviation Authority. In addition, training is arranged at organisational, sector, regional and national (UK and Scottish) levels. Together these place considerable demands on responders.

40. In 2006, the Scottish Government established the Scottish Resilience Development Service (ScoRDS) to coordinate national exercises and workshops, deliver training and support the sharing of knowledge and good practice. 

41. Local responders value multi-agency training and exercising but some NHS and local authority practitioners feel that ScoRDS events do not always meet local needs and expectations, or take account of local or regional scheduled events. This reflects the difficulty ScoRDs has in trying to reflect national as well as local priorities. 

42. Despite the demands of training and exercising placed on Category 1 responders, we found that nearly all (94 per cent) of those with a generic emergency plan had tested it in the last two years. Of  those, over half identified shortcomings which led to improvements to their plans and preparations. 

43. However, around a quarter of Category 1 responders with a corporate business continuity plan had never tested it.

7
  Lessons from incidents and exercises are not shared widely or systematically put into practice.

44. The sharing of good practice and lessons learned varies and is often limited to exercise or incident participants or organisations within an SCG area. Wider and more systematic distribution could increase the value of exercises, promote consistency among responders and contribute to improving resilience in Scotland. 
 
45. In addition, there is no clear mechanism to ensure lessons identified are put into practice, further reducing the potential value of training and exercising.

8
 There is no clear information on how much is spent on civil contingencies planning across Scotland. 

46. Category 1 responders have limited cost information, and different recording practices, within and between sectors, make it difficult to calculate how much is spent on civil contingencies planning across Scotland. Six of the 64 Category 1 responders did not provide us with any expenditure information.

47. Scottish Government support, funding and guidance for organisations involved in emergency planning and response, at the time of our audit, was provided by the Civil Contingencies Unit (CCU) within Scottish Resilience. The CCU spent £4 million in 2008/09, an increase of 28 per cent on the previous year. This reflects the increased priority given to civil contingencies planning by the Scottish Government. However, as with other organisations, the total spend is likely to be higher because of unknown costs associated with civil contingencies activity within other departments.

48. Setting up a cost centre when an emergency is declared is recognised as good practice, but only 20 of the 64 Category 1 responders provided us with costs associated with actual incidents, some of which were estimated. Incident costs are variable but can be significant. For example, the costs incurred by Strathclyde police due to the Glasgow airport attack in 2007 were reported to be £1.7 million.

49. Most Category 1 responders and SCGs have yet to develop robust performance management and monitoring arrangements to assess the impact and outcomes of their civil contingencies planning work.

9 There is potential for more collaboration between organisations to increase capacity and make more effective use  of resources.

50. Dealing with and recovering from emergencies can place significant demands on the financial, human and physical resources of individual organisations. Mutual aid agreements formally set out the arrangements between organisations to provide each other with assistance through the provision of additional resources during and after an emergency. 

51. The emergency services have formal mutual aid arrangements in place, but these are less developed in other sectors and at SCG level. Most local authority mutual aid arrangements across Scotland are reactive and informal and may not 
be reliable.

52. Except among the emergency services, information systems that provide details of resources available to respond to an emergency are limited.

53. However, some organisations are now sharing emergency and business continuity planning expertise through jointly funded teams working from a single location. The emergency services have also jointly procured some equipment. 

54. Progress across Scotland in developing collaborative approaches to resourcing civil contingencies planning has generally been slow. Improved partnership working could significantly increase efficiency and effectiveness. 
Recommendations

•	The Scottish Government and SCG partners should agree a standard approach to the sharing of civil contingencies planning information across Scotland.
•	SCG partners should review their membership to ensure key organisations are represented appropriately, and work to maximise the benefits of effective joint working, including across SCG boundaries.
•	The Scottish Government should review how it engages with those individuals who have day-to-day responsibility for civil contingencies planning, and ensure that it provides clear and consistent information.
•	In consultation with SCG partners, the Scottish Government should clarify the governance and accountability arrangements for decisions made by the SCGs and for its own role during an emergency.
•	Councils, police forces and fire and rescue services should ensure elected members are aware of their role in an emergency and of developments in civil contingencies planning.
•		SCG partners and the Scottish Government should work together to ensure that the full potential of CRRs in informing risk assessment and planning at local and national levels is realised.
•	The Scottish and UK governments, SCGs and individual organisations should work together to improve cross-border and cross-boundary planning.
•	Local responders should ensure that they have up-to-date emergency and business continuity plans, and recovery arrangements, and that staff are fully aware of their roles and responsibilities.
•	Local authorities must ensure they are providing business continuity management advice and assistance to local businesses and voluntary organisations. SCG partners should consider how they could add value to this process.
•	The Scottish Government and local responders should work together to improve public awareness of the risks we face and to ensure effective communication procedures are in place during and after an incident.
•		SCG partners and the Scottish Government should work together to ensure the effective targeting and coordination of exercises and training.	
•		Category 1 responders must ensure they are meeting the statutory requirement to exercise all of their emergency and business continuity plans. 
•	SCG partners and the Scottish and UK governments should ensure that lessons learned from training and exercising activities are systematically shared and that monitoring arrangements are in place to ensure their effective implementation.
•	SCG partners and the Scottish Government should work together to develop and apply a consistent framework for managing and reporting expenditure, to demonstrate value for money and seek to deliver increased efficiencies and improved resilience through further partnership working.
•	Category 1 and 2 responders should develop formal mutual aid agreements. These agreements should take account of cross-border and cross-boundary arrangements, and the voluntary and private sectors.
•	Local responders, SCGs and the Scottish Government should develop arrangements for managing, monitoring and reporting their performance.
55. In addition to this key messages document and our main report, we have produced: 

•		a self-assessment checklist for Category 1 responders to support improvement and the implementation of our recommendations (Appendix 2 of main report)
•		additional material on our website, including data from our survey of Category 1 responders and some examples of current practice. This is intended for use by those directly involved in civil contingencies planning. 
www.audit-scotland.gov.uk

1	There are also three UK-wide Category 1 responders operating in Scotland which cover matters not devolved to the Scottish Parliament – they are the British Transport Police, the Health Protection Agency and the Maritime & Coastguard Agency.
Acknowledgements:
The study was managed by Becki Lancaster, supported by Justine Menzies, Kirsten Paterson and Corrinne Forsyth. The team worked under the general direction of Miranda Alcock (Portfolio Manager) and Ronnie Nicol (Assistant Director of Public Reporting Local Government).

We would like to thank the study advisory group (Appendix 1), which comprised a range of experts from the civil contingencies field, for providing valuable advice and acting as a sounding board for the project team throughout the study.
We would particularly like to thank everyone from those organisations across Scotland who participated in the audit.