Our Scope and Approach

We were asked by the National Preparedness Commission:

“To review the implementation and operation of the Civil Contingencies Act 2004, of the civil protection structures it introduced and its associated Regulations, guidance and key supporting enablers; and to make recommendations for improvements.”¹

This scope deliberately covered not only the content of the Civil Contingencies Act (‘the Act’) itself but also the supporting arrangements which give it real-life effect, on the ground, in delivering the intent of the UK Government and the UK Parliament. This report therefore intentionally has an operational focus.

In the same operational vein, we have also sought to build on experience and learning. The UK has experienced a wide range of emergencies over the last 20 years and gained a rich body of learning. So a major focus of our work was discussions with those on the front line – statutory bodies in England and Scotland, including inputs from all 38 English Local Resilience Forums; The Executive Office in Northern Ireland; regulated utilities with duties under the Act; businesses; voluntary and community groups; and dedicated individuals – to gather their operational experience of delivering the Act and its intentions, and of preparing for and responding to emergencies. We also gained valuable insights from discussions with a wide range of other bodies including Parliamentarians, Councillors, the National Audit Office and Information Commissioner’s Office, regulators and inspectorates, sector representative bodies, practitioners from other countries, the BBC, consultancies and higher education institutions. In total, we conducted 130 interviews with some 300 people. We also received 29 written submissions and 31 other pieces of evidence.

We have been inspired by the way in which so many people gave up so much of their time to contribute their experience and ideas for improvement – and by the passion and commitment they showed to making those improvements. That gave us great hope for the future. We wish to extend our thanks to everyone who contributed at a time when they were under great pressure.

Fit For the Present? Fit For the Future?

We shaped our work around two fundamental questions.

First, drawing on the evidence we received and other research, we reviewed the way in which UK resilience arrangements have developed since 2004, to enable us to reach a judgement on where resilience in the UK stands today and whether the original intent of the UK Government and the UK Parliament has been met.

Second, we reviewed whether the Act and its supporting arrangements would provide a solid legal and operational platform for building and sustaining the resilience of the UK over the next 20 years. We did so against the UK Government’s ambition to “make the UK the most resilient nation”².

Before reaching conclusions, we went back to the fundamentals. The world has changed over the past 20 years. So has business, the economy and society. They will change much further over the next 20 years. In particular, the risk picture the UK faces is less benign now than in 2004 and is likely to get worse.

So what should we be seeking to achieve in building UK resilience over the next 20 years, to address the challenges the UK is likely to face and the characteristics, attitudes and expectations of society? Who should be involved? Specifically, who should have legal duties? Which legal duties are relevant today, and in the future world? And what structures are needed to bring together the actions of the wide range of organisations and people – at national, regional and local levels, across the public, private and voluntary sectors, and in communities – into a cohesive whole in support of the shared endeavour of avoiding or minimising harm and disruption.

Although machinery and process are important, people are everything. Skilled, competent and confident people are the foundation of effective risk and emergency management. So we had a key focus on the pursuit of excellence. Are the skills and competences needed – by individuals and teams – well-defined? Do those involved have the level of skills and training they need to do a good job? What arrangements are in place to check that people do indeed have the skills they need and can demonstrate their competence, especially in the management of major emergencies?

And more broadly, what are the systemic arrangements for sustaining excellence in all resilience-building activities? What quality standards have been set? How are they applied? What are the arrangements to provide validation and assurance of the work done, at all levels? Do senior leaders of Resilience Partnerships³ have a good picture of the quality of the work of the Partnership? Does the Government have a good picture of the quality of resilience in the UK overall? Are the accountabilities of senior leaders clear? And are the arrangements in place for supporting political oversight and scrutiny mechanisms adequate?

Our Findings

The Act and the transformed resilience arrangements it introduced were a vital step down the road to building a Resilient Nation. They have served the UK well over the past 18 years. They provide a sound basic framework for emergency preparedness, response and recovery. And we were impressed by the quality of what local statutory bodies and Resilience Partnerships have delivered and are seeking to achieve in future, despite very limited levels of resourcing.

But the pace of development has not been sustained over the past decade. In some important areas, quality has degraded. As a result, UK resilience today has some serious weaknesses. It is not fit for future purpose in the world the UK is moving into.

The lack of development in the resilience field is in sharp contrast to the continuing positive development in other national security fields, especially cyber security and counter- terrorism, which was warmly commended by many of those we spoke to. It is also in sharp contrast to the progress made by a wide range of other countries over that time to build their risk and emergency management systems. Resilience in the UK has suffered strategic neglect. As the National Audit Office has observed:

“… [the] government’s operational management capability has changed little over the past 10 years. Government has often operated in a firefighting mode, reacting in an unplanned way to problems as they arise and surviving from day to day. Our evidence suggests that a fundamental shift in capability, capacity and resilience may be needed to cope better with future emergency responses.”⁴

Recovery will need action at two levels. First, there is a need to improve the quality and sustainability of current arrangements. Then we believe that there will be a need to undertake a further transformation, on broadly the same scale as that made after 2004, if UK resilience is to be fit for the future the UK faces – and to match the ambition that the UK is a truly Resilient Nation.

Our most significant diagnostics and recommendations⁵ for the actions that should be taken are set out below, in seven key areas which form the structure of our main report. None are new. They cover areas where resilience capability and capacity has degraded over the past decade, projects which have been started but have not progressed, good practice in other national security sectors which can be imported, programmes which are being pursued in some localities on their own initiative and which could be implemented more widely, or good practice in other leading countries which could readily be adopted by the UK.

Given the comparative lack of development of UK resilience over the last decade, our recommendations cover not only areas for direct improvement but also proposals for building in continuous improvement and the pursuit of excellence – and validation and assurance, accountability and political scrutiny arrangements which detect and arrest drift and decay.

Some of our recommendations are capable of being implemented quickly. Others will take time, especially as some will require new or amended legislation. And some will require modest investment: we estimate the aggregate cost were all our recommendations to be fully implemented at some £30-35m per year including contingency⁶.

Recognising the need to prioritise, we have set all of our recommendations against six tests of operational- and cost-effectiveness:

1. They would make a material contribution to building a more Resilient Nation, one which properly protects the safety and wellbeing of its citizens, its economic development and the environment.
2. They would in particular make a substantial contribution to the management of future ‘catastrophic’ emergencies with national or wide-scale consequences.
3. They would embed arrangements which provide clarity on what good looks like, and enable the identification for scrutiny and action of areas where quality was weak or degrading so that improvement action was needed.
4. They are what the public and Parliament would reasonably expect.
5. If extra resourcing would be required, the investment would be reasonable and proportionate to the operational value gained.
6. They are practicable and deliverable.

We have used our discussions with statutory bodies, businesses, and voluntary and community groups not only to gather their experience and ideas for improvements but also to test with them the practicality and deliverability of our proposals. We have been struck – and inspired – by the consistency of view across front-line organisations about the improvements needed, and by the ambition we have heard for future resilience in the UK. On the basis of those discussions, we believe that all of our recommendations would make a significant contribution to effective risk and emergency management in the UK. And we believe them to be deliverable, if the political will is there.

What is Resilience and a Truly Resilient Nation?

The current scope of ‘Resilience’ in the UK covers only part of the job. It has insufficient emphasis on preventing emergencies arising in the first place or at least reducing their likelihood, or of proactively designing resilience in to all aspects of our society and economy. The past 20 years has seen the development of international agreements – especially the Hyogo and Sendai Frameworks⁷ – and good practice in international bodies and in leading countries in developing risk reduction policies and programmes. But with some welcome exceptions, especially on climate change, current legislation, policy and operational practice covering the building of UK resilience remains focused on emergency preparedness, response and recovery.

A number of Resilience Partnerships have undertaken their own local risk reduction activities over many years, operating outside the terms of the Act. More recently, Resilience Partnerships have been asked by the UK Government to undertake risk reduction work in tackling supply chain and other issues which had the potential to cause serious harm and disruption. And there has been inspiring work in some parts of the UK – especially London, Greater Manchester and Hampshire – to build ‘Resilient Places’, using policies with a medium- and long-term horizon to tackle vulnerabilities, reduce the risk of emergencies arising and ‘design resilience in’. But those remain glorious exceptions, not promoted or pursued more widely. And there has until now been no systematic work to build the strategic resilience of the UK overall.

We recommend that risk reduction activities should be put onto the same legal and operational basis as emergency preparedness, response and recovery. The resulting new resilience framework for the UK should be fully aligned with the Sendai Framework. That should include putting in place mechanisms to gather the metrics recommended by the Sendai Framework to allow progress in building UK resilience to be tracked. We hope that the forthcoming Resilience Strategy will reflect that intention.

All Resilience Partnerships we spoke to would welcome the expansion of their work into this area. We believe that doing so would be feasible and cost effective, subject to:

• The scope being clearly defined
• Boundaries being placed around the new activity so that they do not become absorbed with tackling longstanding chronic issues in public service delivery
• The collaborative definition with the UK Government of expectations on how the new role should be delivered
• Sufficient resourcing

Therefore, we recommend that an amended Act or future legislation should include a new duty on risk reduction and prevention. Its execution should be covered in new, dedicated statutory and non-statutory guidance. And new arrangements, including fuller government support to Resilience Partnerships, should be put in place to encourage and support localities in the development of Local Resilience Strategies which seek to build deeper societal resilience across the medium- and long-term. The role of Resilience Partnerships in leading or providing substantial support to the development of Local Resilience Strategies should be recognised in statutory guidance.

Who Should Be Involved in Building UK Resilience?

Current resilience-building arrangements in the UK fully involve only some of those who could contribute, mainly confined to local statutory bodies, some government agencies and the regulated utilities. Arrangements for involving the voluntary sector do not fully recognise or capture the contribution they can make. Arrangements for involving the business sector are weak. And, despite good work over more than a decade on enabling communities to build their own resilience, Resilience Partnerships are struggling to make significant progress.

The Act, in creating new duties and structures rooted in the public sector, tackled the easier part of building UK resilience. The harder part – of engaging the ‘whole of society’ – remains more said than done. Yet the response to the COVID-19 pandemic showed once again what has been seen in previous major emergencies: the huge appetite and willingness on the part of individuals, communities, voluntary organisations and businesses to make a contribution – of time, money and materials – and how powerful that contribution can be when harnessed.

We propose three guiding principles for new arrangements which move the phrase

‘whole of society’ from being a cliché into having real operational meaning:

1. ‘Putting People First’ – extending emergency planning as a matter of routine into the identification of the consequences for people, taking account of the different vulnerabilities of different groups in each area, to provide the basis for developing a fuller and more detailed assessment of their potential needs. Needs-based planning will provide a basis for dialogue about how best to meet those needs and who is best placed to do so, whether from statutory bodies, businesses or groups in the voluntary and community sector (VCS). In particular, it would enable the involvement of a wider range of local organisations in building local And it would provide a focus in emergency planning for the populations most vulnerable to, and most disproportionately affected by, the consequences of emergencies because of their income, geography or other characteristics.
2. Proper planning and preparation. This can build on good work in some Resilience Partnerships to develop arrangements for capturing the contribution which VCS organisations, businesses and communities might make, and integrating that activity with the response of statutory bodies into a cohesive response framework, ensuring that important safeguards are met and that contributors are trained and plans are tested in exercises involving the organisations concerned.
3. Undertaking this work in a spirit of genuine partnership, most often judged through actions rather than words.

This revised approach would require the revision of current statutory guidance on emergency planning. But the changes needed properly to involve the whole of society go much wider.

For the VCS, we believe that the current ‘have regard to’ formula covering their involvement in resilience-building activity is not working and should be abolished. The response to the COVID-19 pandemic has shown once again the powerful contribution that local and national VCS organisations can make, including the ability to draw on their networks for knowledge and insights which can be used in the development of plans; important assets and capabilities; and, in many cases, the delivery of support to those directly or indirectly affected by an emergency. VCS organisations should have true partnership status in the resilience-building activities of local bodies, Resilience Partnerships and central government departments. This should be based on arrangements which provide clarity about which VCS organisations will provide which skills and capabilities in what circumstances, and confidence that those skills and capabilities can be mobilised quickly and effectively if necessary and integrated cohesively into the emergency response. It should also include arrangements for joint training and exercising where relevant. Engagement of the VCS should be captured in a new Resilience Standard.

The full involvement of business is another fundamental plank of the whole of society approach to building UK resilience. And yet, the vast majority of the businesses and business representative organisations we interviewed had had almost no engagement with UK Government on resilience matters in the years before the pandemic. Many observed that levels of engagement had declined sharply from those of a decade ago, although for most the position improved during the response to the COVID-19 pandemic. There was a strong sense of the UK Government viewing engagement as something that ‘needed to be done’.

This showed in the clear perception of there being an absence of thinking in government about the needs of business in resilience planning, let alone a readiness to give business a voice. As a result, there was a widely-held view that the government did not have a good understanding of business resilience, especially the resilience of supply chains. Even in cases where businesses had sought advice, several felt that the government did not wish to listen or engage.

The absence of routine engagement on resilience matters between government and business at national level was well behind access and engagement arrangements in other national security fields, which were widely praised. There was a widely-held view that more and better progress had been made on building a whole of society approach to addressing physical and cyber security threats than on building resilience.

Filling this gap is vital. And the appetite for greater levels of engagement is there, provided that it is attractive – properly managed, value-adding and operationally-focused – rather than a ‘talking shop’. The aim should be to improve the precision and quality of planning on both sides, thereby creating greater certainty where at present there is uncertainty. To achieve this, we believe that the relationship between the UK Government and business on resilience matters should be placed on a formal partnership footing with the creation of a Business Sector Resilience Partnership, with wide participation, supported by a dedicated team in the Civil Contingencies Secretariat. This would supplement existing business engagement arrangements managed by individual government departments within their sectors, and focus on national risks with wide-scale consequences and common and cross- cutting issues. Its work should be operationally-focused, and cover the assessment of risks and their consequences, risk reduction, the mitigations which might be put in place to address the impacts of emergencies on businesses, and the contribution which businesses might make in the response to major emergencies. A key feature of the new arrangements should be the greater visibility and approachability of officials towards the business sector.

Two early priorities for the work of the Partnership should be:

• The involvement of businesses in risk assessment, drawing on their knowledge and expertise; and the co-development of information and advice on risks, consequences and plans targeted on meeting the planning needs of businesses
• Capturing the contribution which businesses are ready to make to the response to a major emergency

The new arrangements should be set out in a new chapter in statutory guidance dedicated to business involvement in building the resilience of the UK. And engagement of the business sector in resilience-building should be captured in a new Resilience Standard.

There has been good developmental work over more than a decade on community resilience. Some areas are making good progress: some of the tools and techniques they have developed are good practice. And the recent creation of the National Consortium for Societal Resilience [UK+] involving over 60 bodies to support and enable future progress is very encouraging. But, despite this promise, many Resilience Partnerships are struggling. So we sought to identify where the blockers to progress lay, and what could be done to accelerate progress.

We judge that the development work has borne fruit: the most suitable approaches to involving and empowering communities are understood and being adopted. Some limited but important work is needed to provide Resilience Partnerships with the tools, templates and other resources they need. We recommend that the UK Government should pursue, including with the National Consortium, how Resilience Partnerships can be provided with practical hands-on peer support and advice to help them adapt and implement tried and tested approaches in their areas. And there would be significant benefits in integrating community resilience activity into multi-agency training and exercising.

It is clear that the major blockages are resourcing, and the commitment of senior leaders in local bodies and UK Government to making progress. On the former, we recommend the creation of a Community Resilience Co-ordinator post in each Resilience Partnership dedicated to the engagement of VCS organisations, businesses and communities. On the latter, after detailed discussion with Resilience Partnerships, we recommend that an amended Act or future legislation should include a new duty requiring designated local and national bodies to promote and support community resilience. The new arrangements should be captured in associated Regulations and a new dedicated chapter in statutory guidance. And the current Resilience Standard should be updated.

Duties Under the Current Civil Contingencies Act

The current duties in the Act remain broadly fit for purpose, subject to some updating, and with the extension of the emergency planning duty to support needs-based planning as described above.

But there is a pressing need to modernise some duties and substantially improve arrangements for their execution.

Risk Assessment

Too much time and energy is spent on risk assessment processes which can be better devoted to improving the quality and depth⁸ of analysis. The whole risk assessment process needs to be radically re-imagined, simplified and digitised, in close consultation with Resilience Partnerships. That will create capacity for much needed improvements. In particular, we believe that the recent move to focus on only a two-year time horizon in the National Security Risk Assessment (NSRA) is a mistake which should be reversed. A two-year horizon does not provide a sound platform for planning and capability-building for emerging societal hazards, especially those with complex cascading and compounding effects across multiple sectors. It does not address chronic risks which might worsen over time and reach a tipping point where the impacts become intolerable. And it does not provide an adequate basis for the work on Local Resilience Strategies we describe above. We recommend that risk assessment should be returned to the previous practice of having separate assessments that look ahead for five years and twenty years respectively, to enable longer-term prevention and preparedness activity.

New arrangements also need to embed concurrency, reflecting the changing future risk picture. And they need to provide for greater agility. We hope that the UK Government will use the new Situation Centre in the Cabinet Office as the hub of a network providing relevant, rapid and dynamic analysis of emerging and changing risks not only to UK Government departments but also to Resilience Partnerships and the Devolved Administrations.

The understandable need to protect genuinely sensitive information has been allowed to mushroom so that it has become an unnecessary barrier to sharing information in the National Security Risk Assessment (NSRA) and hence to resilience-building activity in Resilience Partnerships. This could be substantially fixed by simple process improvements – the classification of individual passages; and the inclusion of handling guidance within the NSRA – which should be pursued as a matter of urgency.

Public Awareness Raising

The duty in the Act to raise public awareness on risks, consequences and emergency plans is being met in only the most tokenistic way, substantially reducing the effectiveness of resilience activities across the business and voluntary sectors and in communities. In part, that stems from the provisions of statutory guidance which limits the information which

Resilience Partnerships are required to publish to only Community Risk Registers. Much more could and should be published. There is also a widespread perception of the cultural reluctance of UK Government to share information widely with the public, even on hazards where there are few, if any, national security sensitivities. This is in sharp contrast to the way in which the provision of public information has been tackled in the cyber security and counter-terrorism fields, which was widely commended by those we spoke to for finding the right balance between publication and protection of information.

We believe that the current culture needs to be turned on its head – there should be a presumption of publication of material on risks and their consequences, including that in the National Security Risk Assessment, and on national and local emergency plans, unless there are clear and justifiable national security or commercial reasons not to do so. We make detailed proposals in our main report for the public information actions that need to be taken.

Information Sharing: The Sharing of Personal Data

We received compelling evidence from public, private and voluntary sector organisations of the way in which actual or perceived restrictions on the ability of organisations to share personal data meant that those affected by emergencies, especially the COVID-19 pandemic, had not received support which was as effective or as timely as it should have been.

This is not a new issue. It arose in the immediate aftermath of the 2005 London bombings, after which the UK Government published guidance setting out a number of key principles to guide emergency planners and responders in their decision-making on information sharing. That has been superseded by more recent guidance issued by the Information

Commissioner’s Office on the principles to be used in decisions on data-sharing in emergencies. But the organisations we interviewed felt strongly that legal restrictions in primary law on the sharing of personal data trumped guidance with non-statutory force. This was especially the case in circumstances where decisions on the sharing of personal data were being made by relatively junior staff in highly-pressured circumstances. Many made the argument that the absence of an explicit exemption in the Data Protection Act 2018 for the sharing of data in such circumstances reinforced the presumption against sharing.

Although there would be value in better training on the new guidance, and in the development and use of Priority Service Registers, we do not believe that they will meet the humanitarian need. The uniform view of interviewees was that the sharing of data in an emergency should be covered by a specific exemption in the 2018 Data Protection Act, capable of being used quickly and with confidence by operational staff facing the urgent

demands of meeting people’s needs. We share that view and believe that a further exemption in the Data Protection Act should be created which allows for the sharing of personal data in cases of ‘urgent humanitarian necessity’. This formulation is intended to provide a legal ‘triple lock’ against misuse of the exemption. Those citing the exemption in the formal recording of their decision to share personal data in the response to an emergency would be required to demonstrate that the need to do so was:

• Urgent, as would be the case in an emergency;
• Intended to meet identified humanitarian need, most likely by reference to the identified or anticipated consequences of the emergency for the physical or mental well-being of those affected; and
• Necessary, to enable the provision of support which would not otherwise be provided, or of support where the actions of two or more agencies working together would result in a material difference to the quality or timeliness of the support provided.

An ideal opportunity exists to pursue this change as part of reforms to the UK’s data protection regime on which the UK Government has recently consulted.

Business Continuity Promotion

The duty on local authorities to promote business continuity is of a past age and should be abolished. The objective of seeking to improve the resilience of businesses and voluntary organisations remains worthwhile. But the best means of promoting organisational resilience needs to be rethought from first principles, including the standard to be promoted, the audiences that are best placed to receive and act on advice, the wide range of channels (including government bodies) for reaching those audiences, and the most efficient and consistent way of providing advice across those channels.

Who Should Have Duties?

There is limited need for change to the list of those bodies with the full suite of duties

placed upon them (the so-called ‘Category 1 responders’).

Despite best intentions in 2004, it is clear that the distinction made in the Act between statutory bodies with the full suite of duties and the much lighter set of duties placed on the regulated utilities and others (‘Category 2 responders’) no longer works. The involvement of Category 2 responders in the risk assessment, emergency planning and public communications work of Resilience Partnerships is vital, especially against the future risk perspective. But, although engagement by some utility sectors remains good, in others it has eroded over time, with damaging impacts on the quality of risk assessments and emergency planning and hence the response to emergencies. And there is a clear and growing sense that Category 2 responders are ‘second-class citizens’, eroding the sense of partnership on which resilience depends. We believe that their full engagement is best achieved by their designation with the full range of duties in the Act. We recognise the additional costs this will entail, but judge these to be small and heavily outweighed by the benefits for public safety which will be achieved. The administrative burden could, however, be reduced by engaging Category 2 responders at regional level; mutual cross-working, where one company effectively represents the interests of others in the sector; and the greater use of virtual attendance at meetings.

The Joint Committee which reviewed the Civil Contingencies Bill in 2003⁹ recommended placing duties on the UK Government and the Devolved Administrations as well as local bodies, to create a clear national civil contingencies framework. The then Government rejected that recommendation. Experience since 2004, and especially over the past decade, has shown that decision to be fundamentally wrong.

Effective resilience must be a shared endeavour. As recent experience has shown, UK Government departments have to carry their share of the load and have vital leadership, operational and enabling roles to fulfil. We heard powerful evidence of weaknesses in the discharge by UK Government departments of their responsibilities during the response to the COVID-19 pandemic. And many interviewees brought out the inherent double standard of the model of ‘do as we say, not as we do’. We recommend that the full suite of duties should be placed on the UK Government, and that Regulations and statutory guidance should provide a clear definition of the roles, responsibilities and accountabilities of relevant departments and agencies in the implementation of those duties.

Structures

Resilience Partnerships

The basic governance and collaboration structures introduced by the Act, founded in Resilience Partnerships at local level, remain a sound platform for the future although, drawing on experience, we would suggest that there would be value in the Scottish Government reviewing the roles and responsibilities of Partnerships in Scotland at local, regional and national levels, drawing on learning across the four UK Nations.

We have considered whether Partnerships should be given legal status but believe that doing so would risk legal confusion in an area where clarity is vital, erode the vital spirit of partnership on which resilience-building depends, and bring added cost and bureaucracy, and thus be counter-productive. But there is a need to give the Chairs of Resilience Partnerships ‘teeth’ in tackling under-performing organisations which are clearly not fulfilling their responsibilities. Some of this will come through tighter arrangements for the validation of performance and for bringing home the personal accountability of senior leaders which we cover below. But stronger arrangements for administrative escalation to, and timely intervention and enforcement by, the UK Government are clearly needed. It was disappointing to hear that, in those rare circumstances where local persuasion had not worked, the Chairs of the Partnerships involved had rarely felt able to escalate issues with under-performance to the relevant national authorities and that, where they had done so, the relevant UK Government department had conspicuously taken no action.

The recommendation above that resilience-building activities in the UK should in future cover risk reduction and prevention would in itself represent a substantial broadening of the role and workload of local bodies and Resilience Partnerships. But we believe that future governance and collaboration structures need also to reflect three further significant shifts.

First, a future risk picture which is markedly worse than in 2004 when the structures in use today were established. Resilience Partnerships will need in future to be capable of planning for and managing more emergencies on a national scale; more emergencies with cascading and compounding effects, with more wide-spread consequences for people’s wellbeing and way of life; and more concurrent emergencies.

Second, moving from the current rhetoric to an effective whole of society architecture for building resilience in the UK on the lines we propose above will need good, local leadership by public bodies working collectively.

Third, the expectations of the UK Government, which has over the last five years significantly shifted its expectations and use of English Local Resilience Forums (LRFs). One part of the shift has seen the greater engagement of LRFs in risk reduction and prevention activities. A second has been that the UK Government is increasingly looking to LRFs to act as a single collective, to receive and undertake tasks set by the UK Government and to report back as an entity.

These changes mean that Resilience Partnerships are in a fundamentally different position to that envisaged in 2004 and set out in Regulations and guidance. We therefore discussed with local bodies and Resilience Partnerships whether current structures remain the best vehicle for building future UK resilience. It is notable that the almost unanimous view of those we interviewed was that current structures on the current geography are fit for future purpose, and that continuity – of securing and then building on what has been achieved over the past 20 years – is important. We share that view. But if local bodies and the governance structures within which they operate are to be capable of fulfilling this wider and more challenging role, they need clarity about their future role and the expectations on them. And they need the tools to do a bigger job.

We recommend that the UK Government should as an early priority discuss and agree with Devolved Administrations and English LRFs a formal document which sets out the future role of local bodies and of Resilience Partnerships, and expectations on the way in which they will discharge that role. It should subsequently reflect the revised framework in an amended Act or future legislation, associated Regulations and supporting statutory and non- statutory guidance.

Designated local bodies and Resilience Partnerships are operating at levels of resourcing which are unsustainable even for achieving today’s ambitions, with significant impacts on staffing, skills development, and training and exercising which are causing real damage to their operational effectiveness. Current resourcing levels are insufficient to deliver existing policy let alone the additional tasks that come with the ambition of the UK being the most Resilient Nation. The key resource deficiencies which need to be addressed are at the heart of the work of the Partnership itself. We have identified five posts¹⁰ which are central to enabling a Partnership to fulfil its current and future roles, addressing the systemic weaknesses we identify in this report and taking on the new tasks we recommend.

But having the people is not enough. Clearly, they need to be trained, competent and confident in their roles. Much of this will lie with individual organisations. But there is one area – multi-agency exercising – where collective funding is needed, where the training is vital to operational effectiveness but where the impact of budget reductions over the past decade means that insufficient training has been undertaken.

We judge that the sustainable long-term funding package provided by the UK Government to English LRFs¹¹ should cover as a minimum the costs of the five core posts identified above plus one major multi-agency exercise per year in each LRF. This should be provided by the UK Government as either ring-fenced funding or specific grant, so that the sums available are visible to all partners. The UK Government should also fund the consequential increases to settlements for the Devolved Administrations. The UK Government should also develop and publish a standard funding formula for the top-up contributions made by those bodies designated as Category 1 responders under the Act. It should be based on the partnership principle that all Category 1 responders contribute their fair share calculated under the funding formula.

Metro Mayors

The Act, its associated Regulations and supporting guidance are silent on the role of Metro Mayors of combined authorities in local resilience-building activity. That is unsurprising, given the relative newness of devolution settlements. But Metro Mayors are here to stay and have a valuable role which needs to be recognised. Mayors provide a clearly visible point of local leadership, with significant local agency and authority. They are a major point of democratic accountability. And they have an important role in the work described above on ‘Place Based Resilience’.

Every devolution settlement, and hence the powers and responsibilities of each Metro Mayor, is different. And the devolution proposals in the Levelling Up White Paper¹² will add more variation. It is therefore unlikely that there is one solution to how best to recognise the role of Mayors in legislation. But it is important that that is done.

Regional Resilience Structures in England

Arrangements put in place after the abolition of regional resilience structures a decade ago are insufficient to capture the operational and efficiency benefits that could be achieved through cross-border collaboration between Resilience Partnerships, especially in the response to a national emergency such as the COVID-19 pandemic. It is clear that, over the past decade, regional collaboration has progressively eroded. Despite good support from individual Regional Resilience Advisers in DLUHC¹³, which English LRFs were keen to praise, the systemic support provided to regional collaboration by DLUHC is seen as weak.

There are effective regional collaboration arrangements in some parts of England (eg. the South West and North East), but not all. There are clear operational and efficiency benefits to putting regional collaboration arrangements onto a consistent, secure footing, underpinned by Regulations associated with the Act and supporting statutory guidance.

UK Government

The current distribution of stewardship responsibilities for resilience across UK Government departments is widely seen as weak and confusing – and operationally damaging in the response to a major emergency.

The majority of the VCS organisations we interviewed were clear that DCMS¹⁴, who have stewardship in the UK Government of the involvement of the VCS in building resilience, have not acted as an effective bridge between government and the VCS on resilience issues.

Several pointed out that DCMS officials were recruited and trained for a different set of attributes and skills. Most significantly, however, VCS organisations believed that having an intermediary layer between the Cabinet Office and VCS organisations would always impede operational clarity and effectiveness at the time it was most needed, in an emergency.

Opinion was divided on whether the role should sit in future with DLUHC or the Civil Contingencies Secretariat. But the compelling need for operational clarity in the response to an emergency meant that the majority of interviewees in the VCS and in Resilience Partnerships concluded that stewardship of the involvement of the VCS in building resilience should be moved from DCMS to the Civil Contingencies Secretariat.

Similar issues arose in respect of the stewardship role fulfilled by DLUHC of the work of LRFs in England. Effective local-national resilience arrangements need an ‘expert centre’ in the UK Government, with officials who have the knowledge, skills and experience to enable them to interface effectively with staff of LRFs; who have the convening power to join up Whitehall, bringing together and rationalising if necessary commissions from several UK Government departments rather than each sending its own request separately to LRFs; and who, where necessary, have the authority (and courage, built on competence and experience) to intervene with local bodies or Resilience Partnerships who are under-performing. This would include receiving and acting on issues escalated by LRF Chairs, as described above.

Some interviewees saw advantages in keeping the role within DLUHC given their local government stewardship responsibilities. But others pointed out that membership of Resilience Partnerships went well beyond local government, and that other policy priorities would always command greater attention within the department. And here, too, there was a strongly-held view that having an intermediary layer between the Cabinet Office and responders would always impede operational clarity and effectiveness in the response to a major emergency. We believe that stewardship of local resilience activity in England should be moved from DLUHC to the Civil Contingencies Secretariat.

The transfer of stewardship roles would go some way to reducing the perceived fuzziness of responsibility and leadership in the UK Government. But there is further to go. A wide range of interviewees, from across all sectors, contrasted the clear vision, visible leadership and drive provided in other areas of national safety and security, especially in cyber security and counter-terrorism, with the more opaque arrangements for the leadership of resilience- building work at UK Government level (although interviewees did comment favourably on arrangements in Scotland). Unfavourable contrasts were also drawn with arrangements in other leading countries, especially the United States, a wide range of EU members and countries in the Asia-Pacific region.

The Scrutiny Committee which considered the draft Civil Contingencies Bill recommended that the then Government gave careful consideration to the establishment of a Civil Contingencies Agency. The Government did not proceed with the recommendation. With the benefit of learning and hindsight, we believe that judgement to have been wrong. We believe that the time has come for the creation of a single government body which should provide a single, visible point of focus for resilience in the UK. Its leadership should be clear and credible, visible to those working on resilience in all sectors and to the public, both in normal circumstances and in the leadership of a national emergency. It should have a clear mandate, with the authority, drive and resources to build UK resilience across all areas of risk and emergency management.

The precise form of such a body would be for the Prime Minister, acting on the advice of the Cabinet Secretary. It need not follow the form of the National Cyber Security Centre, or of Emergency Management Agencies in other countries, although those have been praised by those we have interviewed. But its desirable attributes would be likely to mean that it was a self-standing body rather than a secretariat of the Cabinet Office, with staff drawn not only from the Civil Service but also from all sectors, who are knowledgeable, experienced and credible with their stakeholders. It will need the authority, credibility and convening power to join up work across government departments. It should have corporate governance mechanisms which design in the full and effective involvement of the Devolved Administrations and of representatives of all sectors, as well as providing for independent Non-Executives with substantial experience in risk and emergency management who can provide experience and challenge. Its culture will need to reflect the operational imperatives of risk and, especially, emergency management: agile, flexible, data driven, and delivery- and outcome-focused. And it should have a demonstrable passion for the pursuit of learning, improvement and excellence.

The new body should build two important cultural underpinnings to its work.

First, a demonstrable desire to reach out to gather and share wisdom and experience, going much wider than the UK Resilience Forum¹⁵. This is about more than creating ‘talking shops’: it will be important that the voice and contribution of front-line responders, VCS organisations, businesses and those affected by past emergencies is embedded in the development of policy and operational practice, so that they are grounded in reality and people’s needs. Counter Terrorism Policing has shown what can be done, in a highly- sensitive area, to reach out not only to statutory bodies but also to VCS organisations, businesses, academics and, most importantly, people who have been personally affected by terrorist incidents, to give them a voice and enable them to make a contribution in the solving of problems, and in the shaping of policy and operational practice. If this can be done for counter-terrorism, we are certain that it can be done for the much less sensitive field of UK resilience.

Second, the body, and especially its leaders, should seek to rebuild and sustain with stakeholders the spirit of partnership in a shared enterprise. We heard too many times for comfort that that spirit had been seriously damaged in recent years. We hope that it can be rebuilt.

Doctrine and Guidance

Effective partnership working between organisations at national, regional and local levels rests heavily on a good understanding by everyone involved of what is to be achieved, and how that should best be done. Achieving a consistent approach and maximising the effectiveness and efficiency of the combined efforts of everyone involved is fundamental, especially, in the response to an emergency.

A major contributor to achieving this is having doctrine and guidance that is up-to-date, incorporates good practice, and that all organisations are aware of and can easily access and navigate. So it is gravely disappointing that so much of the key resilience doctrine and guidance has not been updated for a decade, especially the two major pieces of statutory and non-statutory guidance accompanying the Act: Emergency Preparedness¹⁶ and Emergency Response and Recovery¹⁷. Similarly, Responding to Emergencies: The UK Central Government Response. Concept of Operations¹⁸, a critical document which sets out UK arrangements for responding to and recovering from emergencies requiring co-ordinated central government action, has not been updated since April 2013.

Single- and multi-agency doctrine and guidance which act as the spine of coherent resilience-building activity across the resilience community need urgent – and then regular future – updating to ensure that they reflect developments in policy and operational practice and learning.

The volume of statutory and non-statutory guidance available to local bodies and Resilience Partnerships has grown significantly in the last decade. The absence of a central directory of all the guidance now published by the UK Government and other key bodies means that planners struggle to keep track. The UK Government should develop and publish digitally for use by local bodies, Resilience Partnerships and government departments, a simple map of current doctrine and guidance.

Legal and other developments over the last decade may mean that some areas of non- statutory guidance should now be made statutory. It is clearly important that the way in which services are delivered to meet people’s needs are compliant with current law and meet professional standards in the way in which they are delivered. Our judgement is that there is a strong case for substantial changes to the legal status of some doctrine and guidance. One example is whether the emergency co-ordination structures set out in current non-statutory guidance¹⁹ should be made statutory. The UK Government should examine whether legal and other developments, including the recommendations of public Inquiries, mean that some areas of non-statutory guidance, especially on safeguarding, humanitarian assistance and emergency co-ordination structures, should now be made statutory.

Terminology – including that which covers important principles and operational practices – varies across the wide range of single- and multi-agency doctrine and guidance. Since 2007, the Civil Contingencies Secretariat has helpfully led on production of a Lexicon of Civil Protection Terminology²⁰. But this has not been updated since 2013, is not being used consistently and has become unmanageable and not user-friendly. We recommend that the Lexicon should be refreshed, made a more accessible, user-friendly, reference document, and then used consistently to inform the writing of all single- and multi-agency doctrine and guidance.

Excellence

We note above that resilience capability and capacity has degraded over the past decade, projects have been started but have not progressed, and good practice in other national security sectors has not been imported. Quality has suffered.

Skills and Training

Although there is good practice in some sectors, especially the police and fire and rescue services and the NHS, it is clear from our research and interviews that current arrangements for the definition of the competences²¹ required of individuals and teams engaged in resilience-building activities are inconsistent and fall well short of what is needed.

That is not a position that can continue. In our view, it is the development of human capabilities which will make the greatest contribution to improving UK resilience. We have therefore identified the need for development of a Competence Strategy and associated Resilience Competence Framework for use by everyone with a substantial role in building UK resilience.

The Framework would need to cover both individual and team competences and could sensibly build on the previously-issued but rarely used National Occupational Standards, although these would need substantial updating and alignment with competence standards already in place in other sectors and regulatory regimes, and to be made more useable in front-line organisations. Once developed, the Framework should be subject to regular review.

We believe that the task of developing and promoting the Competence Strategy and Framework would, in the short term, fall to the Cabinet Office, working with stakeholders from all sectors, professional bodies, employers and the higher and further education sectors. However, we also recommend that the UK Government should pursue with existing professional bodies whether they would, collectively, wish over time and with Government support to create a governance and regulatory body for UK resilience.

Implementation of the Competence Strategy and Framework will need the provision of sufficient, high-quality, accredited training to enable individuals and teams to undertake the necessary professional development, along with arrangements for them to demonstrate and validate their competences on a regular basis. There is a culture of well- structured training and continuous professional development in the emergency services and in the health sector. But this is not seen in all designated local bodies. And often this training is, for understandable reasons, focused on the needs of a particular sector, with limited focus on multi-agency working.

The resilience training that is carried out is now mostly undertaken in Resilience Partnerships. That has many strengths. Training can be locally contextualised. It enables the provision of training to participants whose commitments would otherwise make it difficult for them to attend training courses at remote establishments. It means that training can be delivered to entire teams. It enables the provision of training to those (eg. in VCS organisations) who would otherwise struggle to arrange or afford their own training. And it is more cost-effective. It is clear that Partnerships are all striving to offer good training on these lines, despite having very limited resources. But they are caught between two areas of UK Government neglect. Despite their best efforts, they cannot on their own and at current levels of resourcing equip everyone with a significant resilience role with the competences they need. But the Government has failed properly to recognise and support the shift to in- house resilience training. The result is a training system that falls a long way short of what is needed, including in the content, quality and format of training offered by the Emergency Planning College which is clearly not addressing the needs of front-line organisations. Each Partnership is developing its own training programmes and materials, with risks of inconsistency as well as the obvious inefficiencies. And there are no arrangements for checking that the training provided is compliant with legislation and doctrine and is up-to- date.

We believe that there is a compelling need for a fundamental ‘reboot’ of the current resilience training ecosystem, including a fundamental reboot of the Emergency Planning College. That should be led by the UK Government and be set against the goal of providing the necessary training and development opportunities to allow everyone with a significant resilience role to develop the competences and confidence they need. It should build on good practice seen in other national security fields, including the use of modular courses and digital delivery, and the provision of training to organisations outside the public sector. It should have a heavy emphasis on training being provided in local areas to make it easier for individuals and teams to undertake training and development. That will need to be supported by the provision to Resilience Partnerships of centrally-produced and maintained – and accredited – core training materials which they can adapt and use. And it should be underpinned by a national register of recognised trainers and subject matter experts which Resilience Partnerships can call on.

Similarly, there are weaknesses in the provision of training to those with senior leadership roles, covering not only the work they do as individuals but also when working together as a team in the multi-agency leadership of the response to a major emergency. Not all Resilience Partnerships have the resources and capacity to undertake the training they would wish of their command teams. There is no requirement in some sectors for those likely to fill senior leadership positions in the management of an emergency to undertake the necessary training. And there are no arrangements to assure the collective competence of the command teams whose decisions will have direct consequences for the safety and wellbeing of the people affected by a major emergency.

The public will rightly expect the team managing the response to emergencies to be individually and collectively competent in fulfilling its role. In our view, the National Police Chiefs’ Council has set the benchmark, under which all police forces must have the capability and capacity to deploy trained and approved strategic commanders for civil emergencies.

We recommend that the same standard be applied to all other sectors, so that senior leaders from Category 1 responder bodies who are expected to be core members of Strategic Co-ordinating Groups in the response to a major emergency should be required to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD²², in order to be assessed as ‘approved’ to fulfil that role. This obligation should be mandated in an amended Act or future legislation and supporting statutory guidance.

We recognise that this will generate a significant increase in the training requirement. We applaud what has been done by the College of Policing to adapt their command team training courses and boost capacity to meet the needs of Resilience Partnerships. In the belief that they (and we hope other accredited training providers so that the provision of training does not rest on a monopoly) will generate sufficient capacity, we recommend that the new training obligation should be phased in over a three-year period. In recognition of the mutuality of the benefit gained, the UK Government should provide specific, time- limited co-funding of the costs.

In other public safety fields, command teams are subject to external assessment and validation regimes. We believe that to be a discipline which should have equal applicability for those managing the response to major emergencies which could cause at least as much, if not more, disruption and harm. We therefore tested with interviewees across a wide range of local bodies whether command teams should be formally ‘accredited’ for their demonstrated competence in the management of the response to major emergencies.

We share the view of the majority of interviewees that there is a need for arrangements by which the collective competence of command teams is demonstrated and assessed. But we suggest that the journey to formal accreditation should be taken as a number of steps. In the near term, the weight of evidence, and what we believe to be reasonable public expectations, point to the introduction of arrangements which stop short of formal accreditation but which do provide for the external assessment of the collective performance of command teams. We therefore recommend that an amended Act or future legislation and supporting statutory guidance should mandate that core members of Strategic Co-ordinating Groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, Resilience Partnerships should be required to put in place an improvement plan and to evidence improvement in the areas that fell short of the expected standard within a given timeframe.

There is an obvious need for civil servants in government departments performing resilience roles to have the knowledge, skills, attitudes and experience – including in emergency management – to perform their roles and to enable them to interface effectively with Resilience Partnerships. The need is given urgency by the substantial evidence we received of serious weaknesses in the competence of staff of UK Government departments engaged in the response to the COVID-19 pandemic, especially their lack of basic understanding of resilience structures and the basic principles of emergency management.

These weaknesses have been identified and are being addressed as part of the work of the Government Skills and Curriculum Unit in the Cabinet Office. However, as with local bodies, it cannot be left to ‘best efforts’ and chance that at least the core members of departments’ emergency management groups, and those who are expected to participate in cross- government emergency management groups, are individually and collectively competent to fulfil their leadership role in the management of major emergencies. The same disciplines of building and demonstrating individual and collective competence should apply as much to civil servants in UK Government departments as they do to staff of local bodies.

We therefore recommend that the Resilience Competence Framework described above should set out the competences required of civil servants with resilience roles. Training to allow individuals to achieve those competences should be incorporated into the training provision of the Government Skills and Curriculum Unit and, potentially, the new Leadership College for Government.

As with local bodies, departments must have the capability and capacity to deploy trained and approved civil servants for emergencies requiring a single department or cross- government response. So we recommend that senior leaders of departments who are expected to be core members of their emergency management groups should be required to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD, in order to be assessed as ‘approved’ to fulfil that role. This obligation should be mandated in an amended Act or future legislation and supporting statutory guidance.

These should also mandate that core members of departmental and cross-government emergency management groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. Again, if collective performance is assessed as being seriously weak in any areas, an improvement plan should be put in place with improvement evidenced in the areas that fell short of the expected standard within a given timeframe.

We were particularly mindful of the critical role played by Government Ministers and Special Advisers in the response to emergencies. It is vital that they too have a basic understanding of resilience structures at national level and the role and status of Strategic Co-ordinating Groups at local level, along with the basic principles of emergency management. We therefore recommend that the UK Government should consider how best to support Ministers in the development of the emergency management competences they need to lead a single department or cross-government response to a major emergency. Identified Ministers should also ideally undertake at least one cross-government command team exercise per year.

Links with Academic Institutions

Higher education institutions (HEIs) have an important role to play, in the education of people who work, or wish to work, in the resilience field, and in the contribution they can make from their research to the development of policy and operational practice. We therefore interviewed a number of HEIs on the courses they taught, the research they conducted, and especially the level of their engagement with the UK Government and Resilience Partnerships, to establish whether there was an effective two-way flow of information and learning.

HEIs consistently identified two areas of concern. First, the lack of a national Resilience Competence Framework for use in the development of courses and materials was seen as a barrier to ensuring that students were equipped with the right skills and knowledge to meet the needs of their future employers. Clearly, the Resilience Competence Framework, once produced, should be made available to HEIs to inform their course design and teaching.

The second and more significant gap was the absence of any meaningful engagement by the UK Government with HEIs. As a result, HEIs were not always sure, and felt unable readily to check, that their materials were up-to-date with government policy thinking or operational good practice. And the UK Government is clearly not exploiting the contribution which HEIs can make through their research to the development of policy and operational practice.

We recommend that the Civil Contingencies Secretariat should establish and promote a formal engagement mechanism with HEIs seeking advice on current resilience policy and operational practice, or who wish to pursue or promote research of benefit to UK resilience.

In contrast, the evidence from our interviews suggested that contacts between HEIs and Resilience Partnerships are stronger. There has been an observable recent development in linkages between Partnerships and HEIs in the same local area. But there was a general acceptance that there was scope for doing more, especially in areas where HEIs can offer analytical expertise in the development of risk assessments and emergency plans to more fully reflect local demographic, socio-economic and other data and information which they hold.

HEI research leads also noted that there was no single government department collating data on research topics which the UK Government and local bodies wished to see pursued, and then working with research funding bodies to commission this research. We recommend that the Civil Contingencies Secretariat should collate from across central government departments and Resilience Partnerships a list of those UK resilience issues which would benefit from further research and pursue this with HEIs and research funding bodies.

A Centre of Resilience Excellence

One clear overarching conclusion, drawn out in interviews across all sectors, is that, in the resilience field, the UK Government has focused heavily over the past decade on processes and products at the expense of people. It has not sufficiently invested in the knowledge base, occupational competence instruments, quality mechanisms and – above all – the visible signalling which encourages the pursuit of excellence in UK resilience. We have therefore tested in interviews the value of adopting in the resilience field the mechanism classically used in other fields, including other areas of national security, which wish to pursue and embed professionalism and quality – the creation of a Centre of Excellence.

We believe there is a pressing need to create a Centre of Resilience Excellence (CORE). We found widespread support for this concept. Its functions could include: leading the development of the Resilience Competence Framework and the fundamental transformation of the resilience training ecosystem we recommend above; providing specific training courses and command team exercising; more broadly, overseeing the availability of training courses and command team training and exercising across all providers in the UK; developing and making available to Resilience Partnerships a national register of recognised trainers, subject matter experts and providers of multi-agency emergency management training; facilitating mentoring, coaching and secondment opportunities; acting as a point of engagement for HEIs, including making connections between HEIs and Resilience

Partnerships; collating and promoting ‘Areas of Research Interest’ and analysing, synthesising and disseminating the findings of relevant UK and international research and lessons identified reports; creating and maintaining doctrine and guidance and a Knowledge Hub of reference materials; and providing thought leadership on resilience in the UK.

It would be wrong for the CORE to operate within its own silo. It needs to work with HEIs and a wide range of government training institutions, including not only the Emergency Planning College, College of Policing and the Fire Service College but also, for example, the Defence Academy and the Diplomatic Academy. There is clear value in drawing on academic teaching and research disciplines, as well as cross-fertilisation of training between different institutions and cultures, especially between the ‘civilian’ and ‘military’ fields, and between ‘home’ and ‘overseas’ experience and practice.

That means that it is unlikely that a Centre of Resilience Excellence could become self- financing. But, whilst it would need a small physical ‘head office’, we believe that, as well as its digital presence, its ability to draw on geographically-distributed hubs – both government sites and possibly those of HEIs – would sharply reduce costs whilst radically increasing engagement.

Creation of a Centre of Resilience Excellence would provide the visible signalling which encourages the pursuit of excellence in delivering the resilience agenda. In that vein, we believe that the creation of the CORE as part of the newly-created UK College for National Security²³ would be highly beneficial, provided that it was genuinely open to and able to meet the needs of all sectors – public, private, voluntary and community – and not just the UK Government as the current proposal implies. It should also be able to build strong linkages to, and possibly joint ventures with, HEIs not only on teaching but also, and especially, on research and learning.

Building a Learning and Continuous Improvement Culture

We heard from a wide range of interviewees that there is limited evidence at a national or local level of a learning and continuous improvement culture. This was sometimes portrayed as being due to a lack of time and resources. But, more worryingly, it was also attributed to a fundamental lack of desire to disturb the status quo, or to a perception that there was nothing to learn from others, including from international experience.

Interviewees particularly expressed their frustration that, despite the creation of Joint Organisational Learning (JOL) Online, which aims to collate and highlight lessons from exercises and emergencies, there is still not a systematic process to make sure that debriefs consistently take place following exercises and emergencies, that lessons identified are shared widely, and that they are then adopted and embedded in all relevant organisations and operational practices.

The development of a culture of continuous, systematic learning and improvement is well- trodden ground in other fields, with substantial experience which can be drawn into UK resilience. We recommend that, as the first two steps in turning perceptions around, the Cabinet Office should signal the need for, and encouragement of, a learning and continuous improvement culture; and demonstrate that commitment by putting in place systematic arrangements for its promotion and pursuit, led by the Centre of Resilience Excellence.

Validation and Assurance

The need for effective validation and assurance arrangements in an area of such significance for people’s safety and wellbeing has been widely accepted over the past 20 years. There is established practice in some risk areas, and in some sectors. But those arrangements do not cover all local bodies, all risks, or Resilience Partnerships as a whole.

Our interviews with front-line organisations and Resilience Partnerships brought out clearly that they would welcome arrangements through which it was possible to assess their performance and identify areas for improvement. And there was widespread agreement on the need for the results of all those assessments to be brought together by the UK Government into an overall assessment of the quality of resilience in the UK, areas of best practice on which Resilience Partnerships could draw, areas for system-wide improvement – and, especially, of how ready the UK is to tackle risks and respond effectively to emergencies.

Current validation and assurance arrangements are wholly inadequate against those goals. Performance standards have progressively developed over the period since 2010 but, critically, have no teeth. There are no current systematic, routine arrangements to monitor the performance of all bodies with legal duties, and of the way in which those bodies act in partnership. As far as we have been able to establish, at no stage has the UK Government used its powers in law to take formal intervention action with a designated local body or with a Resilience Partnership overall on performance grounds. And there are no systematic arrangements in place to generate an assessment in the centre of government of the overall quality of resilience in the UK, for use by UK Government Ministers and the UK Parliament.

We recommend improvements in two areas: to Resilience Standards, so that they are crystal clear about ‘what good looks like’; and more significantly on performance monitoring arrangements.

Resilience Standards

The National Resilience Standards published in 2020 have been widely welcomed. It is clear that they are being used in self-assessment by Resilience Partnerships and local bodies. They provide a sound basis for assessing performance. But they could usefully be crisper. And they need to be precise on the legal force of each of the three sub-sets of performance measures (“must/should/could”) against each Standard. Once revised, they should be adopted consistently by HMICFRS²⁴ and CQC²⁵ in their inspection regimes.

The fundamental gap which needs to be addressed is that, in the same way as UK Government departments do not have resilience duties in law, so there are effectively no standards governing their performance. This weakness matters and needs to be addressed, especially given the widespread criticisms we received about their competence in the management of the response to the COVID-19 pandemic. We recommend above that departments should be subject to the same set of legal duties as local bodies. We can see no valid reason why the performance of UK Government departments against their duties should not similarly be assessed against defined standards, which capture their vital leadership role in many areas of risk and emergency management. We recommend that the UK Government should develop and publish additional Resilience Standards covering the performance of UK Government departments.

The Act has provision for both the monitoring of performance and enforcement. But they are limited in their scope: statutory guidance supporting the Act makes clear the expectation that the powers would be narrowly and infrequently used. Unsurprisingly, as far as we have been able to establish, they have never been used.

Although useful, self-assessment by local bodies, Resilience Partnerships and UK Government departments against the Resilience Standards is simply not sufficient. As many front-line organisations have pointed out to us, there is a risk of organisations ‘marking their own homework’. And the single-agency inspection regimes managed by HMICFRS and CQC, although valuable, do not provide an assessment of the performance of all designated bodies acting in partnership. Ultimately, a genuinely rigorous performance monitoring regime requires external, independent review, drawing on people with expertise and experience, looking across the activities of the entire Resilience Partnership or government department, against well-defined standards.

We therefore recommend that multi-agency validation should be undertaken by a new team hosted by the Civil Contingencies Secretariat, staffed by experienced, knowledgeable practitioners who will carry credibility with those with whom they deal. The team need not be large. The focus of validation reviews should be on learning and improvement, with reviews conducted in a spirit of collaboration with the Resilience Partnership or department so that recommendations are more readily accepted and acted upon. Reviews would thus ideally be conducted at the request of and in support of the Chair of the Partnership or head of the government department concerned, with each Partnership or department being the subject of validation at least every three years. The local government Sector-Led Improvement model most closely mirrors the improvement regime we recommend.

In the same spirit, the reports of validation reviews should be provided in narrative form. And the multi-agency team should not walk away after their reviews but should instead be capable of providing support to Resilience Partnerships and departments in their improvement programmes, especially in signposting sources of best practice or expertise.

The Standards and their associated validation and assurance arrangements should be given status in law so that they provide a sound basis for assessing performance against legal duties and for driving improvement, and provide a stronger underpinning to the current weak provisions for monitoring and enforcement in the current Act.

Accountability

To support the increased emphasis on quality, there is a compelling need for greater clarity on accountability for quality, not only to political oversight and scrutiny arrangements at local and national levels but also to the British people and to future Inquiries.

There is a substantial ‘democratic deficit’ in the resilience field. The Act provides for only UK Government Ministers to have monitoring powers. There is an absence of recognition of the role and value of local political oversight and scrutiny mechanisms provided not only by local authority scrutiny committees but also by Police and Crime Commissioners, introduced over a decade ago, and more recently by Mayors of combined authorities. This is a significant weakness which needs to be addressed.

There is a similar gap in political accountability to the UK Parliament. The Act and its associated Regulations and supporting guidance are silent on the role of the UK Parliament or the provision of support by the UK Government to Parliamentary scrutiny. Our research suggests that Parliamentary scrutiny since 2004 has mainly been confined to reviews of the response to particular emergencies after the emergencies have occurred and inevitably with a scope confined narrowly to the particular risk event. There have been valuable reviews with a wider scope carried out by Committees of the House of Lords, especially that by the Select Committee on Risk Assessment and Risk Planning. But there appear to be no arrangements which provide for the systematic, forward-looking review by the UK Parliament of the quality of resilience arrangements in the UK overall, across all identified risks and covering all aspects of resilience.

Our strongly-held belief, reinforced by the clear view of those we interviewed, is that the quality of resilience in the UK would be greatly reinforced by stronger political oversight and scrutiny at all levels, and by enabling people and communities to scrutinise and challenge what public bodies are doing in their name. That leads us to recommend new legislative provisions on executive accountability, and clearly defined obligations on designated bodies to support democratic accountability arrangements.

Executive Accountability

The designation of Accountable Officers is a discipline already well embedded for some risks covered by local and national risk assessments. And it is widely used in other fields where the safety and wellbeing of people is a key consideration, such as the health sector.

There is no such clarity on the personal accountability of the heads of most bodies with duties under the Act for the way in which their organisations fulfil their responsibilities across all of the work of the Resilience Partnership. As our interviews showed, Chairs of Resilience Partnerships and others judged that the weight of responsibility and accountability is not felt and respected in all cases and seen in the actions of senior leaders. We therefore recommend that the Act and its associated Regulations should not only designate local bodies with legal duties but also make clear that the heads of those bodies have personal accountability for the performance of their organisations against those duties and associated standards.

Equally, we believe that UK Government departments should be subject to the same disciplines of accountability for their performance, to the UK Parliament. Ministers and Accounting Officers of designated departments should have personal accountability for the performance of their organisations against the duties placed on their departments and associated standards captured in an amended Act or future legislation.

Given current machinery of government structures and roles, accountability for cross- government activity should sit with the National Security Adviser or a nominated Deputy who should be appointed as the ‘UK Government Chief Resilience Officer’, a single, identifiable senior official who cares and is seen to care about the quality of resilience in the UK. The postholder should have responsibility for the quality and effectiveness of resilience-building activity across the UK, including that undertaken in central government departments and (subject to respecting the scope of devolved powers) by designated local bodies and Resilience Partnerships. He or she would be directly responsible for the new multi-agency validation team described above. He or she would act as effective ‘head of profession’ until new independent governance and regulation arrangements were put in place. The postholder should bring substantial operational experience of working in a front-line role in the resilience field and have credibility across all sectors. The accountability of the postholder and of a designated Cabinet Office Minister for the quality of resilience in the UK should be set out in an amended Act or future legislation.

The Obligation to Support Local Political Accountability

There is already a range of local political oversight and scrutiny mechanisms, often involving members of the public, including local authority scrutiny committees, Health and Wellbeing Boards, Police and Crime Panels and, to the degree that they are covered by devolution settlements, oversight structures maintained by Mayors and combined authorities.

These mechanisms cover most of the local bodies with duties under the Act, so that there is no obvious immediate need to create new political oversight structures. But we would recommend that Mayors, Elected Members, Police and Crime Commissioners and other elected or co-opted individuals come together to undertake multi-agency scrutiny of the multi-agency work of a Resilience Partnership.

To close the current gap, we recommend that the valuable role of local democratic engagement, oversight and scrutiny arrangements, and the obligation on bodies designated with duties under the Act to support those arrangements, should be set out clearly in an amended Act or future legislation and supporting guidance. We also recommend that the reports of multi-agency validation reviews of the work of Resilience Partnerships, together with the Action Plan agreed by the Partnership, should be published locally, for the information of the public and for use in local political scrutiny.

The Obligation to Support Accountability to the UK Parliament

By extension, we recommend that the important oversight and scrutiny role of the UK Parliament, and the obligation on the UK Government to support Parliament and its Select Committees in their work, should be set out clearly in an amended Act or future legislation and supporting guidance. This should include details of the documentation that departments should provide to Parliament and its Select Committees.

At departmental level, documentation should include Sector Security and Resilience Plans produced by Lead Government Departments as part of their pursuit of sector-wide resilience in the sectors they sponsor. It should also include the departmental validation reviews, and resulting Action Plans, described earlier.

The House of Lords Select Committee recommended that annual reports on UK resilience be signed off by Ministers and laid before Parliament for debate²⁶. We believe that that obligation should be captured in law, and that the UK Government should provide an annual ‘Resilience Report’ to the UK Parliament, prepared by the UK Government Chief Resilience Officer and submitted by the Cabinet Office Minister to Parliament. This should provide for Parliamentary review and scrutiny a summary assessment of the findings of validation reviews of Resilience Partnerships and of UK Government departments conducted in the year, together with agreed Action Plans; a report on the findings of any lessons identified reviews carried out during the year and progress in the implementation and embedding of lessons of all past reviews; a description of progress on the main risk reduction and emergency preparedness programmes, including the major programmes within individual sectors; and a summary analysis of the current state of UK resilience.

The Role of the National Audit Office

The National Audit Office (NAO) has widely drawn powers under the National Audit Act 1983 to examine the economy, efficiency and effectiveness with which government bodies have used their resources and to report the results of this work to the UK Parliament. Against a backdrop of an increasing focus on risk and resilience, we have discussed with the NAO the application of its powers to the scrutiny of the UK Government’s work on building resilience in the UK.

The NAO already covers resilience as appropriate in its routine scrutiny of departments, but we invite the Comptroller and Auditor General to take account of departmental Sector Security and Resilience Plans, together with the UK Government’s annual Resilience Report to the UK Parliament, to inform decisions about future examinations by the National Audit Office and its scrutiny of resilience-building work in the UK.

Our Scope

The Aim of the Independent Review of the Civil Contingencies Act 2004 (“the Act”) was:

“To review the implementation and operation of the Civil Contingencies Act 2004, of the civil protection structures it introduced and its associated Regulations, guidance and key supporting enablers; and to make recommendations for improvements.”

Our Scope therefore covered not only the content of the Act itself but also the supporting arrangements which give it real-life operational effect, on the ground, in delivering the intent of the UK Government and UK Parliament. The full Terms of Reference are at Annex A.

The Act and its most significant supporting arrangements were developed and put in place almost 20 years ago. The UK has experienced a wide range of emergencies over that period and gained much learning. So we set ourselves two goals. First, looking backwards, to ensure through an extensive series of interviews across all sectors that we had a good understanding of how resilience arrangements have developed since 2004, and where resilience in the UK stands today, to allow a judgement on whether the intent of the UK Government and UK Parliament has been met. Second, looking forwards, to develop conclusions and recommendations which would, if implemented, mean that the UK had a solid legal and operational foundation for building and sustaining the resilience of the UK over the next 20 years.

We²⁷ therefore asked a number of fundamental questions before drawing conclusions on the need for changes to the current Act and its supporting arrangements:

1.  What is the future perspective? What are the risks the UK faces and especially their potential consequences? And what will be the societal framework within which resilience-building work will be set: resilience is, ultimately, about society – its characteristics, adaptability, attitudes and expectations – within which resilience- building activities are set and on whose behalf they are carried We cover this at Chapter 2.
2. What should we be trying to achieve? What changes are needed to reflect the future risk picture and society’s expectations? What would success look like in that future? What goals should we set? Are those different to the goals which underpin the current Act and its supporting arrangements? (Chapter 3).
3. Who should be involved in achieving those goals? How best should the contributions of all of those who should or wish to make a contribution be harnessed? (Chapter 4). And specifically, which organisations should have duties in law setting out their responsibilities? (Chapter 5).
4. Drawing on that analysis, do the current duties in the Act need to change? And do arrangements for their execution need to be updated? (Chapter 6).
5. What governance and collaboration structures do we need to bring together the wide range of organisations and individuals involved, in partnership, to achieve the identified goals? How do those compare with current structures? What changes would provide the best platform for building a truly Resilient Nation? (Chapter 7).
6. Although machinery and process are important, people are everything. So what arrangements are needed to pursue excellence in what is done to protect people, the economy and the environment? (Chapter 8). And, recognising that the UK experiences major emergencies less often than other countries, what validation and assurance arrangements are needed to ensure that quality is sustained, even in the ‘quiet years’ when attention will inevitably drift to other issues? (Chapter 9).
7. In support of the pursuit of quality, is there a need for greater clarity on the personal accountability of senior leaders for the quality of the work of their organisations in building UK resilience? (Chapter 10).
8. And hence, what are the legislative consequences? Is there a need to revise the current Act or to develop new legislation? What new legislative ground should be covered? Recommendations that may require new or amended primary legislation are shown in blue in the Summary of Recommendations.

Our Values

Four Values guided our approach:

1. Putting People First: How to do the best for people? What would they reasonably expect – of Government; of statutory bodies; of businesses; of voluntary and community organisations; of their Parliaments – in preventing, preparing for, responding to and recovering from emergencies? How best can they be involved? How best can they hold those with statutory duties to account?
2. Respect: We respect what has been, and is being, done by dedicated resilience practitioners and others to minimise harm and disruption.
3. Ambition: Experience of the wide-scale and enduring impact of COVID-19 on people, society and the economy, together with the deteriorating future risk picture, demonstrates clearly the need to be ambitious in building the resilience of the UK. The UK Government has set that ambition: its “proposed vision for the National Resilience Strategy is to make the UK the most resilient nation”²⁸.
4. Evidence-based and impartial: Our conclusions and recommendations are based on the evidence we have read²⁹ and We will publish all evidence submitted, other than that provided in confidence; and make our materials available to the COVID-19 Inquiry.

Our Approach

A major focus of our work has been discussions with those on the front line – statutory bodies in England and Scotland; regulated utilities with duties under the Act; businesses; voluntary and community groups; and dedicated individuals – to gather their hard operational experience of delivering the Act and its intentions, and of preparing for and responding to emergencies. We were also briefed on recently-developed arrangements in Northern Ireland. We regret that we were unable to secure a contribution from the Welsh Government.

We have also had valuable discussions with a wide range of other bodies including Parliamentarians, Councillors and officers of the Local Government Association, the National Audit Office and Information Commissioner’s Office, regulators and inspectorates, those involved in the Counter Terrorism Advisory Network, sector representative bodies, government training colleges, practitioners from other countries, the BBC, consultancies, higher education institutions and ‘think tanks’, all of whom have valuable insights from their work.

We have engaged throughout the duration of our Review with the Civil Contingencies Secretariat (CCS³⁰) in the Cabinet Office, and the Resilience and Recovery Directorate (RED) in the Department for Levelling Up, Housing and Communities (DLUHC), and more recently with the Civil Society and Youth Directorate in the Department for Digital, Culture, Media and Sport (DCMS). We are grateful for the support they have provided, including their readiness to take our emerging conclusions and recommendations as a significant input into their work on the Resilience Strategy³¹ and the formal Quinquennial Review of the Civil Contingencies Act³². Unfortunately, we were unable to secure significant input from any other UK Government departments.

Summary of Metrics

We conducted 130 interviews with 294 people, estimated at some 250-300 hours of discussion. We also received 29 written submissions and 31 other pieces of evidence.

Contributions received by sector included:

• 211 contributions from Category 1 and 2 responder bodies, including input from all 38 English Local Resilience Forums, and members of Scottish Resilience Partnerships
• 40 contributions from individual businesses and business representative bodies
• 35 contributions from voluntary, charitable and community sector bodies
• 12 contributions from higher education institutions
• 27 contributions from individuals

A full list of contributors can be found at Annex C.

We have been inspired by the way in which so many people gave up so much of their time to contribute their ideas for improvement, and by the commitment they showed to making those improvements. That gave us great hope for the future.

We wish to extend our thanks to everyone who contributed at a time when they were under great pressure.

Devolution

Resilience is a highly devolved matter. We hope that we have throughout this report respected differences in law and practice between the UK Nations. In that context, because the title used in law for the governance and collaboration structures which oversee resilience-building at local and regional levels varies between the Nations³³, we use the phrase ‘Resilience Partnerships’ in discussion and recommendations on points of general applicability, recognising that on most issues detailed arrangements for implementation will be a matter for the Government of each of the Devolved Administrations. We use the phrase ‘Local Resilience Forums’ to cover arrangements specifically in England.

What we have not covered

We were conscious of the Prime Minister’s commitment to a formal, independent COVID-19 Inquiry. We therefore considered well-evidenced experience drawn from the response to the COVID-19 pandemic which had general applicability to risk and emergency management in the UK but excluded issues specific to the management of the pandemic, which will be for the Inquiry. Our Review therefore did not cover Part 2 of the Act, on Emergency Powers.

Inevitably, we gathered valuable evidence on a wide range of issues which fell outside the scope of our Review. We hope that by publishing our evidence we can pass on the baton to others who wish to take forward work in those areas, including:

• The need for changes to the regulatory regimes which cover the work of the regulated utilities of relevance to building a Resilient Nation, including especially the inherent resilience of their assets and networks
• Putting practical arrangements for the provision of support to victims of emergencies which do not arise from a crime onto the same footing as the support provided to victims of terrorism and other crimes
• The merits of making changes to current law and practice covering the restricted funds of charities which enable the reallocation of funds in cases of urgent humanitarian necessity during a national emergency with wide-scale and enduring consequences
• Teaching on resilience and preparedness in schools³⁴
• In line with the recommendations of the Sendai Declaration³⁵ and Framework³⁶, to which the UK is a party, the alignment of UK resilience strategy, policies and practices with the Sustainable Development Goals³⁷ and Paris Agreement³⁸

Further Information

For further information on the evidence and analysis underpinning our Review, contact:

• Bruce Mann: [email protected]
• Kathy Settle: [email protected]
• Andy Towler: [email protected]

In our research and interviews, we have sought to learn from a rich body of relevant experience gained over the past 20 years in the implementation of the Act and the management of major emergencies. We have also looked to the future, to support the goal of developing conclusions and recommendations which would, if implemented, mean that the UK had a solid legal and operational foundation for building and sustaining the resilience of the UK over the next 20 years.

Classically, reviews of this nature would look first at the future risk picture. We do so below, but with an emphasis on the ‘so what’ – the implications of that risk picture for resilience- building activities in the UK.

But resilience is, ultimately, about society – its characteristics, adaptability, attitudes and expectations – within which resilience-building activities are set and on whose behalf they are carried out. It is notable that few reviews, including successive national security strategies, venture into this space. But we believe it to be an important driver in shaping what is done, why and by whom. So we have also described what we believe to be some of the important features of the societal framework within which future resilience-building activity in the UK will be set.

The Future Risk Picture

We have not sought to start with a classical risk assessment. That is already well-trodden ground. There are many readily-available sources including the UK Government’s recent Integrated Review³⁹ and Climate Change Risk Assessment⁴⁰, the World Economic Forum’s annual Global Risks Report⁴¹ and the review of Global Strategic Trends⁴² published by the Ministry of Defence. These paint part of the picture on individual risks, including important global risk drivers for UK resilience:

1. The impact of climate change.
2. A deteriorating international security environment.
3. The greater risk of proliferation of chemical, biological, radiological and nuclear (CBRN) weapons.
4. Vulnerabilities inherent in global and domestic just-in-time supply chains, as have most recently been exposed by the COVID-19 pandemic.
5. The growing risk of anti-microbial resistance and of infectious diseases, especially the UK Government’s judgements that:

“Infectious disease outbreaks are likely to be more frequent to 2030.”

and that:

“Another novel pandemic remains a realistic possibility.”⁴³

To these can be added domestically-driven risks, including:

1. The risk of failure of ageing critical infrastructure:

“The UK is not unique in also having to face up to the vulnerability of its ageing critical infrastructure, which has suffered from decades of under- investment and inadequate maintenance and replacement regimes. At the same time, society’s growing reliance on ever more complex and interconnected systems – while no doubt increasing efficiency in many ways – creates its own vulnerabilities. Too many interconnections and too much interdependence risk cascade collapse if one element fails. New systems have been overlaid on top of legacy systems in such a way that in some cases they are almost impossible to disentangle, as well as being beyond the experience of many of those responsible for running and maintaining them.”⁴⁴

1. The increased technological dependence of our society and economy, and the:

“… increasing complexity and interdependence of the networks underpinning daily life [which] have left us vulnerable to cascading failures which could proliferate rapidly and cause widespread devastation.”⁴⁵

The Implications for Resilience

We have sought to bring out below the other part of this future risk picture – the ‘so what’: the consequences for UK resilience, as an important part of the framework for our analysis and conclusions.

The main drivers of ‘national’ risk in the UK – that is, the potential for emergencies on a wider than local or regional scale – are global risk drivers, which affect most if not all nations.

The first key judgement is that, whilst all have been present in some form over the past 20 years, they are in aggregate clearly worsening.

A second is that global trends paint a future which is more uncertain and diverse, complex and unpredictable, increasing the need for high-quality analysis, imagination and agility in resilience planning. The key underlying characteristic of most global risk drivers is that they are for the most part ‘anthropogenic’: many arise as the downside of developments in society, the economy, and in science and technology that have been for the most part beneficial. One real risk driver is therefore of the economic “herd behaviour and “group-think” in corporations and professions and among regulators” identified by the OECD⁴⁶ as a common weakness in effective risk management, which seizes the upside opportunities without taking account of the associated risks and the potentially more widespread downside consequences, including especially on the systems and services on which decent human life depends. All of the risks have been recognised and are subject to risk management regimes, especially in the UK. But effective global risk management requires concerted global action. And, as the Integrated Review notes:

“Today, however, the international order is more fragmented, characterised by intensifying competition between states over interests, norms and values.”⁴⁷

There is thus an increasing likelihood that a national risk event will be the product of multiple global risk drivers acting in combination, with links appearing suddenly, apparently randomly and (in the absence of adequate analysis) without warning between normally unconnected domains.

Resilience-building arrangements in the UK over the next 20 years will therefore need:

1. To recognise that the inherent risk picture today is worse than in 2004 and is likely to deteriorate further.
2. Investment in complex analysis, especially on risks, their inter-connectedness and their potential consequences. There will be a greater premium on high-quality risk and impact assessments covering this more complex ground; and then in mapping those impacts against societal and economic vulnerabilities to identify the potential consequences for harm and disruption to people’s safety and wellbeing, the economy and the environment.
3. Imagination, challenge and agility in key processes, especially to avoid the inherent cognitive biases: the future may well not be the same as the past; and what was good enough in the past may well not be good enough for the future.
4. Recognition of the value of risk reduction activities, especially those targeted on risks with wide-scale or potentially cascading consequences, including of risks which occur overseas but whose consequences cascade into the UK.
5. Planning and response arrangements which address the increasing likelihood of ‘national’ risks with wide-scale consequences, requiring the involvement of a wide range of national and local organisations in a cohesive, collaborative response.
6. Recognition in risk assessments of the growing likelihood of multiple, concurrent emergencies, and the provision of sufficient capacity and capability to manage them effectively. Responder organisations will need to be capable of a higher, more continuous operational load, requiring investment in the resilience of people and of teams to avoid ‘burn out’.
7. Similarly, risk assessments which identify and assess the growing likelihood of greater cascading and compounding effects, so that they provide a sound basis for building emergency plans and capabilities. Emergency response arrangements will need the ability to tackle effectively:
   1. Emergencies which, because of cascading and compounding effects, grow in the scale of the consequences which need to be addressed.
   2. Emergencies which, because of cascading effects, ‘shape shift’, so that responders may be required to tackle successive emergencies, often in wholly different fields.
8. Recognition of the higher likelihood of risks starting and developing in the private sector, especially the providers of essential services in the regulated utilities and elsewhere.

Societal and Public Expectations

Research on societal and public expectations of UK resilience arrangements is surprisingly limited⁴⁸. We have, however, drawn out below from research and recent experience – which we cite for debate – five ‘societal drivers’ which we believe are important features of the societal framework within which future resilience-building activity in the UK will be set.

Competence, Confidence – and Trust

The first and foremost is an expectation of professionalism and demonstrable competence in those engaged in resilience-building activities, and especially in the management of major emergencies. This matters because it is one key component of the bedrock of public confidence and trust on which an effective collective response depends. For the management of extreme risks, trust has to work both ways – in the way in which the Government and statutory bodies through their attitudes and actions show their respect for and trust in the British people; and in the confidence and trust which people have in the actions of the Government and statutory bodies. As Reform point out, the COVID-19 pandemic has shown once again that:

“In times of crisis what we want from our leaders changes. What matters now is competency – identified by the OECD as a core driver of political trust.”⁴⁹

and that trust matters:

“In times of crisis, public trust in government is key to ensure compliance with any measures citizens are asked to take. Perceptions of incompetence foster mistrust, meaning people may be less likely to follow the rules – which in turn makes the State less resilient in the face of adversity.”⁵⁰

It is unsurprising that the Grenfell and Manchester Arena Inquiries are examining issues of competence. And, significantly, early research on the main factors which explain variations in infection and fatality rates in the COVID-19 pandemic has found that:

“… higher levels of trust (government and interpersonal) had large, statistically significant associations with fewer infections … No other social factors (economic inequality or trust in science), state capacity measures (government effectiveness or state fragility), or features of political systems (electoral democracy or populism) had a statistically significant association with infections or [fatality rates].”

and that:

“When a virus emerges with high potential for spread, government must be able to convince citizens to adopt essential public health measures. Doing so often requires behaviour change … This study accords with previous research that suggests that the success of that effort depends on two forms of trust: trust in governments and interpersonal trust.”⁵¹

Risk and emergency management classically tends to focus on the tangible – assets and capabilities, processes and systems. Those are essential planks in building a solid foundation for UK resilience. But building resilience for the future major risks we face will need to include more organic and emotional ingredients, including especially public confidence and trust.

Joined-Up Working

The second is an expectation of effective and efficient joint working across all organisations, sectors and levels to manage risks and emergencies – at local level, between national and local levels, and between the four UK Nations. People live and work across borders.

Businesses operate across borders. And risks and their consequences cross borders. Especially for the more extreme risks the UK is likely to face, effective cross-sector and cross- boundary collaboration, at political and operational levels, will be essential in mitigating their potential consequences. And, as recent experience with COVID-19 but also with a

series of major ‘Storms’ and the shortage of haulage drivers has shown, the public have a low tolerance for ‘buck passing’ which seeks to deflect blame either for weaknesses in preparedness or for inadequacies in emergency response, especially for risk events which are predictable and predicted.

Accountability and Democratic Consent

The third is a trend towards greater citizen challenge and desire to hold to account; and the converse, of the need to build and sustain democratic consent. This can be seen in the progressive development of formal scrutiny and accountability arrangements involving

citizens, as for example in other fields covering people’s safety and wellbeing such as the inclusion of ‘lay’ members on Police and Crime Panels and on Health and Wellbeing Boards.

It can be seen in less formal expressions, including in particular risk areas, such as flood prevention. And the impact of the erosion of democratic consent, often as a result of losing public trust, has been seen very significantly in the management of the response to the COVID-19 pandemic.

A Readiness to Invest in Resilience

Research by Demos found signals of the fourth – people’s willingness to support greater investment in resilience, possibly because they can sense the worsening risk picture described above. Demos found that, of the respondents to their very large-scale interactive survey:

“52% were willing to support or strongly support the idea of the government “spending a lot of money on preparing for potential future disasters, even if they are unlikely to happen and the money would be wasted if they do not happen.” Only 13% opposed this approach.

This may be because of increased fears that disasters will become more frequent. In our … consultation, 86% agreed that: “What used to be thought of as a rare disaster now seems to happen with more frequency”.”⁵²

Involvement

Finally, the response to the COVID-19 pandemic has demonstrated, again, the readiness of individuals and families to pursue their own resilience. And, more widely, it has shown vividly the readiness of individuals, communities, voluntary and community groups, and businesses to reach out to support those in need. Here, too, Demos has powerful research from its and others’ polling:

“… ONS data suggests that 66% of people thought that if they needed help, then other local community members would support them during the pandemic … And people want this to continue … Nearly three quarters of us believe that volunteers playing a greater role in public services would be good for society, and good for public services.”⁵³

Demos draw on this to judge that:

“Communities have shown that they are one of the most effective elements of disaster and emergency relief. All our resilience planning should include efforts to build up social capital and community infrastructure that can be flexibly deployed at times of crisis.”⁵⁴

But this needs to be done with care.

First, and connected to the issue of competency, Demos note that:

“The greatest political risk associated with a movement to increase volunteering and improve community connection is if this is seen as a way to cover up for cuts.”⁵⁵

And, of critical importance to resilience frameworks and structures:

“Most efforts by the national government to mobilise the hyper-local will struggle. National government is too remote and too bureaucratic to be able to initiate or grow community networks and neighbourhood organisations, which have to be largely self- organised to last. So it should not try.”⁵⁶

Second, experience has shown that the public expect to be enabled to engage in emergency relief within a properly defined, developed and executed framework for action. Poorly thought through initiatives which excite public attention and commitment but which are not followed through – or, worse, cannot practicably be followed through – breed disillusionment and cynicism, eroding public trust.

The 2021 Integrated Review set out, as part of the Prime Minister’s vision for the UK in 2030,

the ambition that:

“We will have built back better from COVID-19 with a strong economic recovery and greater national resilience to threats and hazards in the physical and digital worlds.”⁵⁷

The Call for Evidence on the forthcoming Resilience Strategy set out a higher ambition:

“Our proposed vision for the National Resilience Strategy is to make the UK the most resilient nation.”⁵⁸ (Our emphasis)

These statements beg two questions:

• What is ‘Resilience’?
• And what are the actions that should be taken to build resilience within the future risk and societal framework described in the previous Chapter?

In this Chapter, we set out our suggested answers to these questions drawing on developments in thinking and practice – internationally, and in some parts of the UK – since passage of the Act in 2004, as the basis for asking a third question:

• Is the purpose of the Civil Contingencies Act, and the scope of the actions it covers, sufficient to allow the Act and its supporting arrangements to play their full part in building a truly Resilient Nation?

What is Resilience?

Unfortunately, as the House of Lords Select Committee on Risk Assessment and Risk Planning notes, “there are many definitions of resilience”⁵⁹ – to which we would add that different definitions can often be used inter-changeably and hence confusingly. ‘Resilience’ can thus be used:

• Synonymously (and increasingly historically, although common in 2004) with preparedness to respond to disruptive events when they arise
• More broadly, to cover not only the ability to resist and respond to disruptive events but also to ‘bounce back’ from them, including to ‘build back better’⁶⁰
• To capture a deeper sense of adaptiveness, seen in the development of the adaptive capacity of individuals, organisations, communities and societies to absorb shocks and stresses whilst sustaining their basic structures and an acceptable level of functioning
• More broadly still, to extend the sense of adaptiveness and adaptive capacity explicitly to anticipation: seeking to gain strategic notice of longer-term disruptive challenges as the basis for taking action to avoid, or at least to mitigate, risks through reductions in their likelihood or potential impact

Rarely do UK Government publications define resilience, although we assume that the forthcoming Resilience Strategy will do so. Thus, several definitions are in play, although most now adopt a broad view. For example, a Cabinet Office report in 2011 on building infrastructure resilience against natural hazards included as a definition:

“… the ability of assets, networks and systems to anticipate, absorb, adapt to and/or rapidly recover from a disruptive event.”⁶¹

but noted that:

“In its broadest sense, [resilience] is more than an ability to bounce back and recover from adversity and extends to the broader adaptive capacity gained from an understanding of the risks and uncertainties in our environment.”⁶² (Our emphasis)

Scottish Guidance on Resilience adopts the broader sense of adaptiveness in defining resilience as:

“The capacity of an individual, community or system to adapt in order to sustain an acceptable level of function, structure and identity.”⁶³

The definition published by the United Nations Office for Disaster Risk Reduction (UNDRR) is helpful in setting out the various actions that should be taken to build resilience and the end goal of sustaining basic structures and functions:

“The ability of a system, community or society exposed to hazards to resist, absorb, accommodate, adapt to, transform and recover from the effects of a hazard in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions through risk management.”⁶⁴

Its scope is, however, essentially restricted to disaster management – from resisting the effects of disruptive events to recovery from them – and does not therefore fully address the value of building adaptive capacity and drawing on it to anticipate and mitigate longer-term disruptive challenges.

The Call for Evidence on the Resilience Strategy does not provide a proposed definition of resilience, but signals that, when published, it is likely to go beyond the traditional definition of withstanding and quickly recovering from disruptive events to being more proactive:

“As a country, we cannot afford to be passive and wait for things to happen to us. We need to understand our vulnerabilities, pre-empt challenges before they arise, ensure we are prepared for them, and mitigate the impacts. Then, when events do occur, we should be ready to withstand and recover.”⁶⁵

It is, however, ambiguous at this stage on whether the Strategy will cover the building of adaptive capacity, especially as a basis for anticipating and tackling longer-term disruptive challenges:

“Whilst the … Strategy will not encompass HMG’s approach to all long-term policy challenges, it will focus on the impacts of such challenges and where those might lead to acute crises in the future.” (Our emphasis)

and:

“A number of existing governmental strategies focus specifically on addressing and building resilience to individual risks. The new National Resilience Strategy will sit alongside and complement those strategies. It will consider the need for continued long-term focus and investment in addressing risks, as well as our capability to address the common causes and impact of risks, and systemic vulnerabilities.”⁶⁶ (Original emphasis)

We hope that, in line with what we believe to be good practice internationally and in some parts of the UK, the Strategy will indeed cover the building of adaptive capacity as a basis for anticipating and mitigating longer-term disruptive challenges. This Review has been conducted on that basis.

What Actions Should Be Taken To Build Resilience?

There have been three significant steps over the past 30 years in the development of international thinking and practice on the steps which should be taken to build resilience, which we believe should provide the framework and guiding principles for action in the UK.

The first international strategy on Disaster Prevention, Preparedness and Mitigation was agreed in 1994⁶⁷ and updated in the Hyogo Framework for Action 2005-2015⁶⁸. Both highlighted the need to adopt an integrated approach to disaster risks, encompassing all sections of society, at national and local levels, and taking action on:

• The identification, assessment and monitoring of risks, and enhancing early warning
• Risk reduction
• Strengthening preparedness for an effective response at all levels⁶⁹

Reviews of the Hyogo Framework found that lack of clarity on ownership of disaster risk reduction was limiting progress, a symptom of the multi-disciplinary evolution of disaster risk reduction which resulted in serious issues of institutional overlap, lack of policy co- ordination and limited accountability⁷⁰. The current disaster risk reduction agenda, defined in the UN’s Sendai Declaration⁷¹ and the accompanying Sendai Framework 2015-2030⁷², acknowledges and seeks to address these issues. It identifies the need:

• For enhanced work on risk reduction through reducing exposure and vulnerability
• To continue strengthening good governance in disaster risk reduction strategies
• For a broader and more people-centred preventive approach to disaster risk

It sets disaster risk reduction within the framework of sustainable development, and of tackling climate change as one of the drivers of disaster risk. Guiding principles which we regard as being highly relevant to this Review record that effective disaster risk reduction:

1. Requires an all-of-society engagement and partnership.
2. Depends on co-ordination mechanisms within and across sectors and with relevant stakeholders at all levels.
3. Requires the empowerment of local authorities and local communities to reduce disaster risk.
4. Requires inclusive, risk-informed decision-making based on the open exchange and dissemination of disaggregated data, as well as on easily accessible, up-to-date, comprehensible, science-based non-sensitive risk information.⁷³

The Framework sets four ‘Priorities for Action’:

Priority 1: Understanding disaster risk.

Priority 2: Strengthening disaster risk governance to manage disaster risk. Priority 3: Investing in disaster risk reduction for resilience.

Priority 4: Enhancing disaster preparedness for effective response and to “Build Back Better” in recovery, rehabilitation and reconstruction.⁷⁴

Associated with these priorities is a series of non-legally binding targets covering reductions globally in mortality and numbers of people affected by disasters; in economic losses; and in disaster damage to infrastructure and disruption to basic services⁷⁵.

A further target is to “Substantially increase the number of countries with national and local disaster risk reduction strategies by 2020.”⁷⁶ Although it is a party to the Declaration, the UK does not have a Disaster Risk Reduction Strategy: we assume that the forthcoming Resilience Strategy is intended to meet this overdue commitment.

We believe that the Sendai Framework provides a strong framework and guiding principles for risk management and resilience-building in the UK and have therefore used it to guide the analysis and conclusions of our Review.

How Do UK Arrangements Compare?

Resilience-building is thus based on:

• A set of actions, often expressed as a logical and iterative sequence;
• Which enable the development of a set of physical and social capabilities, seen either in building strengths or reducing vulnerabilities; in order to
• Achieve positive risk management outcomes from the actions taken.

This approach is reflected in the UK in the Integrated Emergency Management concept and the Resilience Capabilities Programme⁷⁷. Integrated Emergency Management (IEM) is the concept upon which the UK’s resilience-building activities are based. It is:

“… geared to the idea of building greater overall resilience in the face of a broad range of disruptive challenges.”⁷⁸

IEM applies to all hazards. It comprises “… six activities which are fundamental to an

integrated approach:

• Anticipation
• Assessment
• Prevention
• Preparation
• Response; and
• Recovery Management”⁷⁹

These align well with the Priorities for Action in the Sendai Framework. But they are not followed through fully into the Act:

Figure 1: How the seven civil protection duties fit together⁸⁰

which covers preventive activity only in two limited ways: business continuity management; and a requirement on designated bodies to maintain emergency plans:

“… for the purpose of ensuring that if an emergency occurs or is likely to occur the person or body is able to perform his or its functions so far as necessary or desirable for the purpose of:

• preventing the emergency;
• reducing, controlling or mitigating its effects …”⁸¹ (Our emphasis)

The restriction of preventive activity to the avoidance of imminent emergencies is amplified in statutory guidance which states that:

“Prevention is an important component of integrated emergency management. The Act does not deal with it to any great extent because it is largely a matter for other legislation … Prevention under the Act is limited to actions that help prevent an emergency which may be about to occur.”⁸²

With the benefit of hindsight and experience, we believe the deliberate exclusion of risk reduction and prevention from the Act, associated Regulations and its supporting guidance to be wrong. The UK has in place some powerful risk reduction regimes covering some of the major risks which feature in national and local risk assessments, most notably in the Control of Major Accident Hazards⁸³ regime, and aviation and maritime safety. Beyond that, flood risk management dominates UK prevention programmes, at both national and local levels. And the Climate Change Adaptation Programme is tackling identified risks across the medium- and longer-term, especially “risks to people and the economy from climate-related failure of the power system” identified as a Priority Risk Area⁸⁴. But not all major risks are covered. And, as our interviews have shown, the focus of the Act on emergency preparedness and response has tended to discourage risk reduction action at local level, where it can have significant benefits.

We believe it to be wrong for some major risks to be covered by risk reduction activities while other risks of similar magnitude are not, and for local risk reduction activities to be discouraged. The Sendai Framework recognises that success is as much about avoiding emergencies in the first place by implementing risk reduction strategies which seek to limit exposure, manage the hazard or reduce the vulnerability of people, infrastructure and the environment to harm and damage. Successive studies have shown the economic benefits of doing so⁸⁵. And, whilst UK resilience arrangements were generally praised, a review in 2013 by the United Nations, OECD and European Commission noted that:

“… [there is] scope for improvement in terms of the five [Hyogo Framework] Priorities for Action to improve resilience to disasters. For example, a new momentum should enlarge the focus of the UK resilience approach from emergency preparedness and response towards more prevention and vulnerability reduction. In particular, risks with potentially large impacts and high likelihoods, especially when these are growing, could be better managed through vulnerability reduction than through preparing and responding to the event.”⁸⁶

The Act’s focus on emergency preparedness and response is understandable given that this was the primary focus of many of the actions recommended to rectify the serious deficiencies in UK emergency response arrangements exposed by the series of major emergencies in 2000 and 2001, which triggered work on the Act. But it is disappointing that the need to adopt a wider focus, to include preventive activity, was not recognised after Hyogo (2005), the international peer review in 2013 and especially after Sendai (2015), which the UK played a leading role in promoting.

The Integrated Review implicitly recognises the need for a greater focus on risk reduction and prevention in articulating the:

“… need to build our resilience across England, Scotland, Wales and Northern Ireland: addressing the root causes of risks, and increasing the UK’s preparedness to withstand and recover from crises when they occur.”⁸⁷ (Our emphasis)

We understand that the need for a stronger emphasis on prevention is also a key theme emerging from the Call for Evidence on the Resilience Strategy and Quinquennial Review of the Act. We hope that the forthcoming Resilience Strategy will put risk reduction and prevention onto the same legal and operational basis as emergency preparedness, response and recovery, and adopt the principles and approach set out in the Sendai Declaration and Framework.

Legislative Implications

Putting risk prevention activity in the UK onto the same systematic legal and operational basis as emergency preparedness, response and recovery may be achieved through the use of the Civil Contingencies Act if its scope will allow, or through new legislation.

Recommendation 1: An amended Act or future legislation, and associated Regulations, should set risk reduction and prevention activities onto the same legal and operational basis as emergency preparedness, enabling the full range of risk management action at national and local levels.

Recommendation 2: An amended Act or future legislation should include a new duty on risk reduction and prevention placed on all Category 1 responders.

Recommendation 3: The execution of the new duty on risk reduction and prevention should be addressed in new statutory and non-statutory guidance, aligned to the Sendai Framework, Sustainable Development Goals and the Paris Agreement.

In line with the Sendai Framework, we hope, too, that the UK Government will put in place the mechanisms to gather metrics, at UK and locality level⁸⁸, which will allow progress in building UK resilience to be tracked⁸⁹, including gathering sufficient information to allow the UK to provide data to the UN against the global targets for substantial reductions in disaster loss set out in the Sendai Framework⁹⁰.

Recommendation 4: The UK Government should put in place mechanisms to gather metrics, at UK and locality level, to allow progress in building UK resilience to be tracked, and to provide data into the UN Disaster Risk Reduction programme.

Implications For Resilience Partnerships

We have discussed with a wide range of interviewees from Resilience Partnerships, especially their Chairs, whether current structures could co-ordinate activity on a new duty on risk reduction and prevention.

We have been impressed by their recognition of the challenges the UK faces, their willingness to adapt and adopt new areas of work, and to work together to help address those challenges. It is clear that several Resilience Partnerships are in fact already working on risk reduction and prevention activities although they are conscious that they are operating outside statutory frameworks which can raise internal issues of prioritisation and resourcing. It is also clear that it will be both feasible and cost-effective to incorporate risk reduction and prevention activities as part of the routine business of Resilience Partnerships alongside their current work on emergency preparedness, thereby creating a fully integrated risk and emergency management system to build local and national resilience in line with the principles of the Sendai Framework:

“If you’re not aiming to prevent risks occurring, what’s the point?”⁹¹

“Need to bring together government agencies and responders to work together and

look at how to build (back) resilience, especially risk reduction and prevention activity.

At present LRFs are focused on preparing to respond with no appropriately led and co-ordinated activity to prevent risks arising in the first place.”⁹²

“Development of emergency plans falls to LRFs. Who does risk reduction sit with? Where does responsibility sit for developing risk mitigation and prevention initiatives? If a risk is identified that is unacceptable, who makes that judgement and who leads on mitigating / reducing that risk? Especially for risks whose likelihood and/or impact grows over time rather than being a sudden shock? … LRFs have to be part of the risk reduction system as much as they are part of the emergency preparedness and response system. They are a trusted local delivery organisation. But no driver or legislation to make that happen.”⁹³

“Cannot and should not go back to 2004. Natural change has occurred, work has expanded, and that work is valuable.”⁹⁴

“Should see it as evolution, an area where Act must be amended. Right place for LRFs to be. LRF works as a convening power and can be more powerful given inherent teamwork/partnership. Extends beyond structures to other dynamics, especially trust. Hard to quantify, but vital.”⁹⁵

All Partnerships would welcome the expansion of their role into this area, subject to there being:

• A clearly defined scope, and boundaries around the new activity
• Clearly defined expectations
• Sufficient resourcing

Interviewees were clear that Resilience Partnerships are not the appropriate vehicle for tackling long-term chronic issues in the delivery of public services unless and until they are assessed as reaching a tipping point where there may be immediate and significant damaging consequences:

“LRFs are victim of their own success: people use them to solve problems because they work. Give an LRF a job and it can make it happen. Agree that LRFs should have the wider role on prevention. But need to find the boundaries around it …”⁹⁶

“… prevention and policy around chronic risks are a good place for the Mayor to be involved.”⁹⁷

But they do have the right organisations around the table, with the right ethos, to tackle local risks over the short- and medium-term which, if they arose, would result in harm and disruption, with a serious impact on people’s safety and wellbeing:

“Spring Mill tyre fire highlighted that there were around nine tyre sites in West Yorkshire which are fire and pollution risks. Set up the West Yorkshire LRF Waste Site Task and Finish Group chaired by the Environment Agency which meets (approx.) every 6 weeks and is working to prevent future fires on the sites and to take action to remove the problem … No one obvious lead for the tyres issue: if the LRF hadn’t brought the sub-group together, the problem wouldn’t have been resolved.”⁹⁸

Our expectation is that Resilience Partnerships would not necessarily lead on risk reduction programmes, which would be the responsibility of the most appropriate individual partner organisations, as now. But Partnerships do provide an appropriate forum for:

1. Preparing an assessment of risks and their consequences for the locality, over the short- and medium-term.
2. Evaluating and prioritising the whole spectrum of available prevention and preparedness measures, taking into account local risk appetite, ideally determined collectively by local political leaders:
   “… there should be far greater political involvement in setting risk appetite: how much risk is a locality prepared to accept?”⁹⁹
3. Where prevention and preparedness programmes are within local capability and capacity, commissioning those programmes from individual organisations or, if appropriate, taking them forward on a multi-agency basis.
4. Where prevention and preparedness programmes are beyond local capacity and capability, or where they are clearly better led by the UK Government, working collaboratively with UK Government departments and agencies in their implementation.

It is fundamental to this approach that UK Government departments and agencies support Resilience Partnerships in:

1. Risk and consequence assessment, over short- and medium-term horizons.
2. The integration where necessary of work at local level on risk reduction and prevention with that being taken forward under national programmes.
3. Providing support from subject matter experts to Partnerships on prevention as well as preparedness programmes.
4. Working collaboratively with Partnerships on risk reduction and prevention programmes which are led by the UK Government.
5. Supporting Partnerships as necessary in their responsiveness to local democratic accountability arrangements, including political oversight and scrutiny mechanisms.

A greater emphasis on risk reduction and prevention would mirror practice in other countries which have adopted the Sendai Framework’s Priorities for Action in their resilience-building work. Thus, the Swedish Civil Contingencies Agency integrates prevention and preparedness. In France, a Steering Committee approach is used, bringing together leads from across responsible departments under the direction of a Director General for Risk Prevention to co-ordinate policy and oversee implementation. In Germany, an inter- ministerial Working Group oversees German national disaster risk reduction, implemented through the Federal Office of Civil Protection and Disaster Assistance (BBK). The BBK serves as an information hub for organisations and initiatives involved in disaster risk reduction to ensure the implementation of the Sendai Framework. It is also a centre of expertise in all matters relating to national disaster risk reduction issues.

Recommendation 5: The role of Resilience Partnerships should be expanded to cover risk reduction and prevention as well as emergency preparedness, response and recovery.

The implications of this wider ambition for the future expectations of Resilience Partnerships and for their resourcing are covered in the Local Governance and Collaboration Structures section.

Resilient Places Are The Foundation Of A Resilient Nation

Tackling risk reduction and prevention – seeking to prevent emergencies arising in the first place – is in our view a vital next step in developing UK resilience. Our judgement is that the integration of this additional work can be delivered over the next few years and broadly within existing mechanisms with the enhancements set out in the Structures chapter, especially the Resourcing of Local Bodies and Resilience Partnerships section.

However, if the UK is to be a truly Resilient Nation, there is a need to go further to:

• Identify and assess longer-term risks and their consequences
• Proactively ‘design resilience in’, to all aspects of our society and economy

This approach – of building ‘societal resilience’ – is not new. The OECD identified in 2011 that:

“There are several strategic concepts available to aid risk managers. Generally, this involves a combination of two techniques:

• Designing or reinforcing complex systems to be more robust, redundant and/or diverse as appropriate; and
• Building societal resilience to unknown events by drawing from experience with extreme events that share some similarity in nature or scale.”¹⁰⁰ (Our emphasis)

This thinking and the OECD’s recommendations – including fostering the resilience of vulnerable populations and reinforcing the resilience of businesses to global shocks – go beyond the near-term risk reduction and prevention activities described above to reach into the inherent characteristics of society and the economy. The World Economic Forum (WEF) built on the OECD’s work to develop in 2012 a model for national resilience¹⁰¹, particularly to external risks beyond the capacity of a single country to influence or control. Under this approach, countries are resilient if they can withstand shocks in and across all sectors of society and the economy. The WEF argued that judgements on whether countries were likely to be able to do so required assessment of two main and five subsidiary qualities (see Figure 2 below}:

• ‘Resilience characteristics’ – of robustness, redundancy and resourcefulness to resist and withstand shocks and adapt to changing conditions
• ‘Resilience performance’ – the ability to respond and recover should disruption occur

Figure 2: Countries as ‘Macro-Systems’ with Five Sub-Systems and Five Components¹⁰²

Although this ‘Systems’ model masks the inter-related nature of the sectors, it remains a useful illustration. In particular, it brings out that it is neither desirable nor feasible for governments to seek to fill all gaps in resilience themselves. Instead, it is essential to harness the capabilities and energies of others alongside those of the wider public sector.

A recent update by the WEF refreshes this analysis to reflect emerging lessons from the COVID-19 pandemic, identifying resilience-building actions seen through:

1. A Government lens – including especially the use of forward-looking risk assessments and reviews of Resilience Strategies to target areas of government intervention; and making the building of long-term resilience a central tenet underpinning major critical infrastructure capital investment.
2. A Business lens – including greater private sector participation in strategic forums.
3. A Community lens – including improved communication processes, better devolution of decision-making authorities, stronger co-ordination of on-the-ground efforts between central government specialist agencies and local administrations, and better resilience capacity-building at local and national levels.¹⁰³

We address these principles further in later sections.

Resilient Places

Our interviews identified three Resilience Partnerships – London, Greater Manchester and Hampshire and the Isle of Wight – which have adopted this deeper approach, ‘designing resilience in’ as a vehicle for tackling and mitigating the stresses generated by systemic and longer-term risks such as climate change as well as the more immediate acute shocks set out in national and local risk assessments.

The London City Resilience Strategy¹⁰⁴ explicitly identifies the value of building resilience of people and communities and of infrastructure, and of designing resilience into governance processes. The London LRF sits at the heart of the work.

London City Resilience Strategy 2020

The London City Resilience Strategy 2020, owned by the Mayor of London who launched it in February 2020, takes a broad and long view of what city resilience means, by considering immediate risks and looking at a wider range of shocks and stresses to determine how best to respond to them. The aim of the Strategy is to look at the long- term shocks and stresses that are likely to affect the material wellbeing of the city between now and 2050:

• Shocks: sudden impact events that can immediately disrupt a city and may have wide-ranging and unexpected impacts (eg. terror attack, flooding, cyber-attack, infrastructure failure, disease pandemic)
• Stresses: chronic issues that weaken the fabric of a city and can eventually lead to a major shock (eg. inequality, poor air quality, food insecurity)

The Strategy identifies three cross-cutting opportunities that will make London a more resilient city. These resilience opportunities should not be viewed in isolation, as they are interconnected:

• Resilience for People: Building resilience for London’s Communities
• Resilience for Place: Developing resilience for London’s physical environment and infrastructure
• Resilience for Process: Designing resilience into governance

The Strategy outlines projects that are aimed at building resilience to one or more risks. Each project description explains why the work should be undertaken, identifies key shocks and stresses, and the resilience value of completing the project. Given the wide- ranging scope of the programme, it brings together a wider grouping of stakeholders than traditional Resilience Forum members, although the LRF still sits at the heart of the ongoing work. This wider input of partners has been hugely beneficial in forging wider links and broadening the understanding of resilience.

To manage its implementation, London has invested beyond the initial Rockefeller Foundation funding to maintain a two person Urban Resilience Team under the direction of London’s Chief Resilience Officer. They work closely with the London Resilience Group and report to the LRF to dovetail this longer-term adaptation strategy into the overall vision of ‘Enabling London to be a Resilient City’.

The Greater Manchester Resilience Strategy¹⁰⁵ has the same goal of designing resilience in, especially resilience of communities and of place. It is led by the Greater Manchester Resilience Forum.

Greater Manchester’s Resilience Strategy

Greater Manchester’s Resilience Strategy 2020-2030, launched in 2020, builds on nearly two decades of multi-agency working to plan and to respond to civil risks and emergencies within the context of the Civil Contingencies Act 2004. It incorporates learning from work in Greater Manchester and across the world to reduce the risk of disasters and crises. It has been created using processes and tools developed by the global Resilient Cities Network and United Nation’s Making Cities Resilient initiative, both of which aim to strengthen urban resilience and deliver global ambitions set out in the Sendai Framework for Disaster Risk Reduction 2015-2030.

The Strategy reflects the commitment of leaders across Greater Manchester to resilience, giving resilience visibility as a core strategic priority and designing resilience into broader strategic agendas. Activity to deliver the Strategy’s vision “in this changing and complex world, to create one of the most resilient places where everyone can grow up, get on and age well together” is centred around five themes: community resilience; leadership and governance; resilience of place; enhancing resilience practice; and sustaining effective emergency management. With a 10-year timeframe, the Strategy aligns to the medium- term time horizon of the Greater Manchester Strategy.

Accountability for delivery sits with the Greater Manchester Resilience Forum, with regular reporting to Greater Manchester’s political lead for resilience. However, given the Strategy’s reach across different city-region policy areas, it is embedded in work programmes of many of Greater Manchester’s thematic strategic partnerships including the Strategic Infrastructure Board, Natural Capital Group and Economic Resilience Group.

The Strategy enables a specific focus on resilience as a cross-cutting theme for the city- region and ensures its place in shaping the city-region’s strategic direction. It offers a framework for new and existing initiatives, whether investing in working together at a local level, advocating for national change to support Greater Manchester’s communities, or drawing on international relationships to enhance Greater Manchester’s resilience.

In Hampshire and the Isle of Wight, the LRF is also leading on work which goes beyond emergency preparedness, response and recovery to seek to build the deeper resilience of communities and businesses.

Resilient Places – Hampshire and the Isle of Wight

LRFs have a powerful role in bringing senior leaders together, to ask the big strategic question – What does resilience really mean for our communities?

The ability to prepare for and withstand shocks, and then bounce back from them, makes sense but does not adequately address how senior leaders, working together, can shape their whole organisations, their policies, and their planning and public service delivery frameworks to achieve the deeper resilience of their communities.

So Hampshire and Isle of Wight LRF is looking at ways in which the LRF can pursue that deeper goal, including through collaboration with those agencies specialising in prevention: Can we really understand our communities and what makes them vulnerable? Can we engage with our communities and businesses to make them more resilient, so that we are more resilient as a place? Can we communicate effectively enough about risks, in a way which encourages individuals, groups and businesses to act?

In doing so, the LRF has drawn on learning from the response to the COVID-19 pandemic on how working collaboratively in the response to the crisis allowed partners to change organisational direction and support a greater, community-focussed effort. This has led to enhanced strategic relationships and a greater understanding of the place of health at the heart of communities, recognising that the health sector, in its many forms, can be hampered by its large and complex structures that can lead it away from ‘place’.

This is a medium-term programme, going well beyond the time horizon of a two-year National Security Risk Assessment (NSRA), requiring sustained investment and the engagement of Category 1 responder partners and others, especially the voluntary sector. The idea is that, through a better understanding of our communities and their vulnerabilities, it will be possible to work with them and support them to be more resilient. Although focused initially on resilience, many of the features of a ‘Resilient Place’ would, of course, be of wider social benefit.

The LRF has used pilot funding to support projects, reporting ultimately to its Executive Group, focused on ‘Shaping Resilience’ within Hampshire and the Isle of Wight in this way. The goal is to develop the outcomes of ‘Shaping Resilience’, bringing in innovation

and aspiration, in a way which dovetails with organisations’ core functions. There are real opportunities for growth, not only of the LRF and its strategic leaders, but also in the improved collaboration of organisations in all sectors and at all levels, building together the enhanced resilience of communities.

These initiatives, which draw on international good practice, are inspiring, and show what could be done across the rest of the UK. We believe that a truly Resilient Nation would not only have in place legislation and supporting arrangements which sought to prevent or respond to near-term emergencies, but would also have in place Local Resilience Strategies which sought to build the deeper resilience of communities and to build resilience into governance, including policy-making and service delivery. In our view, a truly Resilient Nation can only be built on Resilient Places¹⁰⁶. And, as experience has shown, Resilience Partnerships have a fundamental role in that work.

We hope that the forthcoming Resilience Strategy will recognise the value of developing Local Resilience Strategies¹⁰⁷ and the leading role of Resilience Partnerships in that work. We hope too that it will recognise the support which they will need from government. That includes joint working to integrate national and local programmes, the provision of the necessary information and support to enable localities to assess longer-term risks and consequences – and the provision of the necessary legal and policy frameworks.

We have considered whether the development of Local Resilience Strategies on this basis should be mandated in law. After discussion with some Resilience Partnerships, we judge that they should not: it will be best to encourage and facilitate their development over the next five years, with progress being reviewed at the next Quinquennial Review of the Act. But the role of Resilience Partnerships in leading or providing substantial support to the work should be recognised in statutory guidance.

Recommendation 6: The UK Government should encourage and support localities in the development of Local Resilience Strategies which seek to build deeper societal resilience, drawing on the work of the London, Greater Manchester and Hampshire and Isle of Wight Resilience Partnerships. Statutory guidance should reflect the role of Resilience Partnerships in leading or providing significant support to the development of Local Resilience Strategies.

Resilient Nation

Building societal resilience cannot only be done at locality level. It will require the UK Government, working with the Devolved Administrations, to work towards making all sectors of society inherently resilient. And that work will require successive Governments to look beyond the short-term, to ensure that strategies, policies and programmes build national security – in all of its dimensions – and resilience against medium- to long-term trends in the risk landscape.¹⁰⁸

As the Call for Evidence notes, “[a] number of existing governmental strategies focus specifically on addressing and building resilience to individual risks”¹⁰⁹. These include especially the National Adaptation Programme¹¹⁰ for climate change, which seeks to build resilience across public, private¹¹¹ and voluntary and community sectors on the basis of a long-term risk assessment and prioritised action plan. The Programme usefully includes work supported by the Cabinet Office and Resilience Partnerships on infrastructure resilience, and the inclusion of climate effects in local community resilience activities. And some of the proposals in the Levelling Up White Paper¹¹² will have broader benefits for resilience- building, especially in the development of social capital and addressing the inequalities that lead to social vulnerabilities.

This work goes well beyond the terms of the Civil Contingencies Act – indeed, much is covered by separate legislation – and hence the scope of this Review. And, whereas the proposals made earlier in this Chapter can be achieved within existing structures, work to build a Resilient Nation across the medium- and longer-term and across all sectors of society on the lines set out above is likely to require more fundamental changes to government strategies, policies and structures – indeed, the Government’s whole approach. Given the need for such an integrated view of long-term work to build the resilience of the UK, the UK Government’s expressed intention that:

“The new National Resilience Strategy will sit alongside and complement those strategies.” ¹¹³

is a welcome first step down that road. We hope that it will provide the basis for the steps which will need to follow.

A Renewed Approach

It is self-evident that, to be truly effective, risk and emergency management needs to engage the ‘whole of society’, bringing together the actions of a wide range of organisations and people – at national, regional and local levels, across the public, private and voluntary sectors, and in communities – into a cohesive whole in support of the shared endeavour of avoiding or minimising harm and disruption:

“Making every level of government, every organisation and every community more resilient will create a kind of societal herd immunity, ensuring that the UK is better able to address future global crises – whether it is a new pandemic, a massive cyber attack or climate change. This is also true for each household and every individual. Everyone must play their part. Genuinely, as somebody once said, we are all in it together.”¹¹⁴

As noted in the What Actions Should Be Taken to Build Resilience section, engaging all of society is a guiding principle of the Sendai Framework for disaster risk reduction. And the response to the COVID-19 pandemic showed once again what has been seen in previous major emergencies: the huge appetite and willingness on the part of individuals, communities, voluntary organisations and businesses to make a contribution – of time, money and materials – and how powerful that contribution can be when harnessed.

The spirit and the phrase are not new: they have been around for longer than the Act has been in place. Thus, the 2001 Anderson Report on the foot-and-mouth outbreak noted that:

“Whatever central government does and however well, it cannot defeat a major outbreak of animal disease on its own. It needs to co-ordinate the support and services of many others, including those most directly affected.”¹¹⁵

A description in 2007 by the Government’s then Security and Intelligence Co-ordinator of the UK’s developing arrangements for building resilience in the period shortly after passage of Act noted that:

“… a key challenge for civil protection planning in the UK is to enable the active involvement of all sections of society …”¹¹⁶

114 Harris, Lord T. (2021). Strengthening the UK’s National Resilience: The Tasks Ahead. RUSI Commentary (webpage)

115 Anderson, Dr Iain (2002). Foot And Mouth Disease 2001: Lessons to be Learned Inquiry Report. Page 1

116 Hennessy, Professor P. (Ed) (2007). The New Protective State: Government, Intelligence and Terrorism. Page 55

Demos published Resilient Nation in 2009 with useful prescriptions¹¹⁷. More recently, the 2015 National Security Strategy noted that:

“The UK’s resilience depends on all of us – the emergency services, local and central government, businesses, communities and individual members of the public.”

and expressed an intention to:

“… expand and deepen the Government’s partnership with the private and voluntary sectors, and with communities and individuals, as it is on those relationships that the resilience of the UK ultimately rests.”¹¹⁸

This was repeated in the 2021 Integrated Review which sets out as a priority action:

“…[establishing] a ‘whole of society’ approach to resilience, so that individuals, businesses and organisations all play a part in building resilience across the UK. We will seek to develop an integrated approach, bringing together all levels of government, [Critical National Infrastructure], the wider private sector, civil society and the public.”¹¹⁹

And the Call for Evidence on the forthcoming Resilience Strategy set out the principle that, in achieving the vision of the UK being “the most resilient nation”:

“We should energise and empower everyone who can make a contribution. To be truly resilient, all parts of society should play a role in building the UK’s resilience … governments, local partners and the voluntary sector need to ensure that each contributor is able to participate through appropriate measures. Partnerships

between the Government and all its partners must be strengthened. This may include:

• enabling proportionate legislation, standards and practice;
• providing the necessary tools, skills and knowledge;
• … rigorous and frequent testing and exercising …;
• strengthening the roles and responsibilities of Local Resilience Forums;
• collaborating with voluntary, charity, faith groups and business sectors to make best use of their capability, capacity and networks …”¹²⁰ (Original emphasis)

This renewed ambition is welcome, for our research and evidence shows that, despite many years of good intent, there is much further to go. There has, for example, been good work over more than a decade on community resilience although, as we describe in the Building Community Resilience section, the general view that emerged from our interviews was that, with some notable exceptions, Resilience Partnerships are struggling to make significant progress. Arrangements for involving the business sector are weak. And, as we describe in the Voluntary and Community Sector section, there have been worthwhile improvements in recent years in the involvement of the voluntary and community sector. But ‘whole of society’ remains more said than done.

In this Chapter, we offer proposals based on many hours of detailed debate with local bodies, Resilience Partnerships, businesses, organisations in the voluntary and community sector (VCS) and others working in the field, for whose suggestions we are very grateful.

Three Principles behind a Renewed Approach

Our discussions brought out three key principles which we suggest should underpin a renewed approach.

Putting People First – Moving to Needs-Based Planning

The first is putting people and their needs first. The response to most major emergencies usually involves fixing an immediate crisis and stopping things getting worse – putting out the fire, erecting flood defences. But the key goal is to minimise harm to people and their families, and especially to identify and meet the needs of those affected. This principle is at the front of responders’ minds when an emergency actually occurs. But we heard that emergency planning can often be rather antiseptic, stopping at the stage of identifying the physical impacts – the spread and depth of the water, the number of people potentially needing evacuation and shelter – rather than identifying the very human consequences of emergencies for people and their likely physical, social, psychological and economic needs.

Extending emergency planning as a matter of routine into the identification of the consequences for people, taking account of the different vulnerabilities of different groups in each area, will provide the basis for developing a much fuller and more detailed assessment of their potential needs. And that will in turn provide a basis for dialogue about how best to meet those needs and who is best placed to do so:

“People at all levels … often make assumptions about what communities need without asking them. People give the help they think people need rather than using people like National Flood Forum who understand what people actually need.”¹²¹

“… creation of national partnership of victim support services via the Home Office is not well known to LRFs, etc. Victims are provided with a range of services (trauma first aid, virtual care worker, bereavement services, NHS support, especially mental health) which can last for years. But LRFs, and local authorities especially, may not know about them and, therefore, seek to recreate them in their recovery planning. Lack of shared knowledge and integration between both worlds results in confusion, overlap and duplication.”¹²²

Our interviews showed that some Resilience Partnerships are doing this, but not all. They echoed the findings of a survey by the British Red Cross in 2019 which found that the majority of the 27 emergency plans they surveyed did not:

“… [include] a definition of vulnerability, and not all plans included measures for identifying and helping vulnerable people.”

which led them to recommend that:

“… as part of their duty to assess risk under the CCA, LRFs should be explicitly required to identify the specific needs and vulnerabilities of their community in particular emergencies, and their plans should address these needs accordingly.”¹²³

We share this view. Making people and their needs – immediate and longer-term; physical, social and psychological^{124, 125} – the focus of needs-based emergency planning will:

1. Enable the involvement of all organisations and individuals who wish to or should make a contribution to identifying and meeting those needs, whether from the statutory agencies, VCS organisations, businesses or communities.
2. In particular, enable the involvement of a much wider range of local organisations in building local It is clear from our interviews that there is a wide swathe of organisations who are not fully engaged, or engaged at all, in resilience-building activity at local level who have the ability – as seen in the response to the COVID-19 pandemic – to make a powerful contribution, especially in reaching and supporting some key populations.
3. In particular, drawing on learning from the response to the COVID-19 pandemic, provide a focus in emergency planning for the populations most vulnerable to, and most disproportionately affected by, the consequences of emergencies because of their income, geography or other characteristics.

Proper Planning and Preparation

But broadening the ability in principle of a much wider range of organisations and individuals to make a contribution will not be enough. As the Call for Evidence¹²⁶ brings out, effective emergency response is founded on proper planning and preparation. So there will be a need in emergency planning to:

1. Capture and record the contribution which VCS organisations, businesses and communities might make, and the roles and responsibilities of each
2. Decide how that activity should best be integrated with the response of statutory bodies into a cohesive response framework.
3. Ensure that contributors are trained and plans are tested in exercises involving the organisations concerned.

There is already good practice here which can readily be drawn on. We heard of impressive work in a number of Resilience Partnerships to capture potential contributions in a structured Capability Matrix¹²⁷ and similar tools, to embed those contributions in emergency plans and to put in place the necessary training and exercising. That work included, in some functional areas, ensuring that important safeguards were met (eg. in the provision of care to vulnerable people).

Partnership

Finally, it was clear from our interviews that the glue which holds all of this together is a spirit of genuine partnership, most often judged through actions rather than words. We heard clear distinctions between the views expressed by designated local bodies and those offered by other organisations on whether that spirit of partnership was felt to exist – or whether some potential contributors felt marginalised. It is clear that building and sustaining the right ethos needs continuous attention.

The Bedfordshire case study below, which we suggest could have wider applicability, shows a clear drive and ambition to build on local community capabilities and goodwill, and what can be achieved with limited investment.

Resilient Bedfordshire – Building Whole of Society Participation in Preparedness and Response

Bedfordshire LRF want to create a ‘Resilient Bedfordshire’ where everyone can be

involved in the response to emergencies.

Emergency volunteers in Bedfordshire are co-ordinated through the Bedfordshire Local Emergency Volunteers Executive Committee (BLEVEC). In an emergency, members of the Partnership work together as a single team with the emergency services, health organisations and local councils to help those affected. Organisations involved in the partnership can offer a wide range of support, ranging from 4x4s, aircraft, search and rescue and transport, to first-aid, food provision, emotional and practical support, including for specific groups of vulnerable people, and managing volunteers and donated items.

The network currently includes:

• Highly-trained Commanders and Duty Officers who represent the Partnership on SCGs and TCGs. There are currently 35 Commanders and 7 Duty Officers
• 55 VCS member organisations who offer specialist services and capabilities
• Over 40 independent emergency volunteers who can deploy anywhere in Bedfordshire to help fulfil many general roles in emergency response and recovery
• 26 local town or village Community Emergency Response Teams (CERTs) – small teams of volunteers based in their town or village, who provide critical local information, advice and support, identify all available Assistance Centres, and in some cases develop a Community Emergency Plan for their area
• 10 Emergency Faith Advisors who provide culturally- and religiously-appropriate emotional support to those affected, operating as part of a team which may include other groups providing secular support, such as the Samaritans. The Advisors play an important additional role in advising all other volunteers of the religious and cultural practices of different faiths
• Businesses which recognise their corporate social responsibilities and want to be involved in emergency response and recovery, offering services such as food, donated goods, transport, storage, buildings and staff time, either free or at cost for more specialist services

The Partnership is managed by a Committee with representatives from each member organisation and from each CERT. The Committee provides a forum to discuss topical issues, lessons identified from incidents and improvements for the future.

The services of the Partnership can be requested by phone 24/7, and WhatsApp groups are in place with all members and CERTs for fast call-out deployment, information- gathering and communications. Training sessions (mostly virtual) are held each month, which all members are welcome to attend. General emergency volunteers are DBS cleared and undergo an induction by the Partnership or their voluntary organisation. Commanders receive more intensive training and exercising, receive an ‘SC level’ security clearance, have a ResilienceDirect account, and are equipped with an ID Card, uniform, JESIP Commander Tabard and PPE grab bag.

The analysis below sets out for the three key sectors – VCS organisations, businesses and communities – what might be done to embed these three principles in operationally-focused activity to achieve a genuinely ‘whole of society’ approach to building UK resilience.

What the Act Requires

It is clear that – as hinted at in the Call for Evidence¹²⁸ – embedding these principles will require changes to the Act, its associated Regulations and supporting guidance.

The Act and Regulations embed the rather antiseptic approach described by some interviewees. The Act requires local bodies to:

“… maintain plans for the purpose of ensuring that if an emergency occurs or is likely to occur the person or body is able to perform his or its functions so far as necessary or desirable for the purpose of:

• preventing the emergency
• reducing, controlling or mitigating its effects …”¹²⁹

The tone and language used above is not immediately human-centred – nowhere does it talk explicitly about the care of people affected by the emergency. Similarly, Regulations¹³⁰ focus more on process than people – the development of plans; the different uses of generic, specific and multi-agency plans; the need to reflect in planning the activities of voluntary organisations; procedures for determining whether an emergency has occurred; training and exercising plans; and plan revision.

Statutory guidance includes useful material on the way in which emergency plans should cover the vulnerable and those affected by an emergency¹³¹. But that material occupies only a handful of pages in a 70-page document, which again is otherwise heavily focused on process rather than people.

We suggest that statutory guidance in this area should be turned inside out, to be driven by people’s needs rather than process. Material on “preventing the emergency”¹³² would in any case be covered by new guidance on risk reduction and prevention, in line with the recommendations in the Legislative Implications section in the What is Resilience and a Truly Resilient Nation? chapter. Material on “reducing, controlling or mitigating its effects” should require local bodies and Resilience Partnerships to extend emergency planning into the identification of the consequences of emergencies for people and their likely physical, social, psychological, and economic needs, based on an assessment of vulnerabilities. That should form the basis for identifying and capturing the contribution which the full range of local statutory bodies, VCS organisations, businesses and communities might make, acting in partnership, to meeting those needs. And material on training and exercising should reflect the value of ensuring that people outside the statutory agencies receive the necessary training to fulfil their identified role effectively, and that plans which involve a wide range of contributors are tested in exercises which involve those organisations.

Recommendation 7: Statutory guidance on the execution of the Emergency Planning duty should be fundamentally revised to put people first, through a move to needs-based planning. It should be re-developed around a main theme of identifying the consequences for people of major emergencies and their potential physical, social, psychological and economic needs; and then using that analysis as the basis for determining which organisations are best placed to meet those needs, from whichever sector, subject to the necessary safeguards. It should embed existing good practice developed in some Resilience Partnerships on the identification and recording of potential contributions through the use of a Capability Matrix and other similar tools, and then ensuring that contributors are trained and plans are tested in exercises involving the organisations concerned. Relevant Regulations on the execution of the duty should be revised to adopt a human-centred rather than process-based approach.

The Voluntary and Community Sector

What Does the Act Require?

The involvement of the voluntary and community sector (VCS) in emergency preparedness and response, and the way in which that involvement should be captured in law, has been the subject of much debate over the past 20 years. The debate has sometimes gone down what we believe to be the blind alley of whether VCS organisations should have duties in law equivalent to those of local statutory bodies. The key issue is our view is how best to ensure that local bodies, Resilience Partnerships and central government recognise in all of their resilience activities the powerful strengths and trusted voice which VCS organisations can bring and enable their full involvement, whilst respecting their widely differing skills and capabilities. It is clear from our research and interviews that the Act and its current supporting arrangements do not adequately do this.

20 years ago, the Joint Committee on the draft Civil Contingencies Bill noted that:

“… The Government has chosen not to include the voluntary sector as Category 1 and 2 Responders because “the skills and expertise available to the voluntary sector may vary from place to place”.”¹³³

The concern of the then Government was that:

“… we did not impose legal duties on organisations which, by their character, were unable to necessarily secure a uniform level of provision or service across the entirety of the country.”¹³⁴

The Committee noted that there was varying opinion within the voluntary sector about whether they wished to be included as a Category 1 or 2 responder, but that “most did not believe that they should have a statutory duty placed upon them”¹³⁵. But evidence to the Bill Committee identified what we believe to be the key principle governing their involvement:

“… We see ourselves as partners, albeit supportive partners …”¹³⁶ (Our emphasis)

The Committee recommended that:

“Given the plethora of voluntary organisations and the individual requirements of local areas, we recommend that Category 1 responders be given flexibility to identify and consult with the most relevant organisations in their area.”¹³⁷

In the event, supporting Regulations to the Act require that Category 1 responders, in carrying out their duty on emergency planning:

“… must have regard to the activities of voluntary organisations which carry on activities:

• In the area in which the functions of that general Category 1 responder are exercisable; and
• which are relevant in an ”¹³⁸ (Our emphasis)

The ambiguity of the so-called ‘have regard to’ formula is made worse in its amplification in statutory guidance, the first two sentences of which carry a sense of implied reluctance:

“In some circumstances, emergencies can overstretch the resources of the emergency services, local authorities and other local responders during the response and recovery phases of an emergency. The value of involving the voluntary sector at every stage in order to provide additional support has been demonstrated on many occasions.”¹³⁹ (Our emphasis)

The response to the COVID-19 pandemic has shown once again the powerful contribution which VCS organisations can make, including the ability to draw on their networks for:

• Knowledge and insights which can be used in the development of prevention and preparedness plans
• Important assets and capabilities
• In many cases, the delivery of support to those affected by an emergency

VCS Engagement in Wirral

Wirral Council has a long-standing history of working closely with the voluntary and community sector (VCS). Even before the COVID-19 pandemic, it had worked with the sector to develop the ABCD principles* and a Community of Practice – a monthly meeting of the sector and Public Health to encourage collaboration.

During the response to the pandemic, the Council worked closely with the VCS to:

1. Gather insight from communities to inform and tailor the response and communications to fit people’s needs
2. Disseminate key messages to local communities through local trusted organisations
3. Support local communities and ensure their needs were being met

A Humanitarian Cell brought together partner organisations, VCS bodies and Council teams to manage the welfare response in the Borough. It reported into both the Wirral COVID-19 Hub and the Merseyside Tactical Co-ordinating Group (TCG) and allowed VCS organisations to see that issues were being escalated and addressed, thereby ensuring buy-in from all.

One major issue it addressed through a Food Sub-Group was problems of access to food by Wirral’s most vulnerable households arising out of disrupted supply chains and people self-isolating or shielding. This brought together activity between the public, private and voluntary sectors, including the co-location of resources in an Emergency Food Hub operated by the Council and two key community-based partners. This work has subsequently extended to co-ordinating activity to tackle financial issues such as fuel poverty; working with two local charities to target support at those households who have accessed help multiple times throughout the pandemic; and working with two local charities to clear fuel debt for Wirral’s most vulnerable households.

In total, over 20,000 emergency food hampers have been delivered and over 7,000 financial awards made to vulnerable households.

A joint assessment of the effectiveness of the Humanitarian Cell by its members and the Council identified that the ingredients that made it successful included:

• Cross-sector collaboration, trust and (true) partnership in the achievement of a common goal
• Utilising local intelligence, and engaging local organisations
• Speed and agility, including reducing bureaucratic constraints
• Listening, open communication and sharing information
• Supporting each other emotionally

The success of the Humanitarian Cell has acted as a stimulus for work led by the sector to develop a Strategy on how VCS bodies will work together with the Council and partners across the Wirral Partnership in future. A proposal will be taken forward in June 2022.

* Asset-Based Community Development (ABCD) is a methodology for the sustainable development of communities based on their strengths and potentials. It involves assessing the resources, skills, and experience available in a community; organising the community around issues that move its members into action; and then determining and taking appropriate action. This method uses the community’s own assets and resources as the basis for development; it empowers the people of the community by encouraging them to use what they already possess.

A significant number of the VCS organisations we interviewed were clear that their ability to provide support in the response to the COVID-19 pandemic, especially in its earliest stages, was impeded by the lack of prior knowledge in the UK Government and in Resilience Partnerships of the capabilities of the sector, and of engagement between the sector and the UK Government:

“… clear that some parts of Whitehall don’t have a very developed understanding of communities and the voluntary sector, and the positive role they can play. Even in the Call for Evidence … on the Resilience Strategy, the reference to the VCS was rather downplayed as an add-on and not described as an essential part of the picture – despite COVID showing that that is clearly not the case …”¹⁴⁰

“Many communities and groups acted on their own initiative during COVID … Need better frameworks to ensure that differing groups know better how they can help and who to approach …”¹⁴¹

“If Government wants the sector to respond better and quicker in the time of an emergency, then it will need investment in recognition, information, collaboration.”¹⁴²

And it is clear from our interviews with VCS organisations and English LRFs that the scale of involvement of VCS organisations in their work varies widely. In some, it approaches the sense of partnership which we believe to be vital. In others, however, it is much less:

“How best to build more effective relationships and engagement with LRFs is a tough issue because it is such a variable picture across the country. It works really well in some areas with strong personal relationships; in other areas engagement is not particularly effective … Partly a funding issue, partly an attitude issue … partly an issue about how best to brigade and co-ordinate disparate VCS organisations.”¹⁴³

“Robustness of [engagement with LRFs] is directly dependent on individual relationships, so preparedness is not consistent. But local relationships are a source of great strength when they are good.”¹⁴⁴

The evidence from our research and interviews is thus that the ‘have regard to’ formula is not working. The involvement of VCS organisations in emergency planning and response is patchy. And it does not capture the sense of partnership highlighted in 2003 and which underpins the whole of society approach to emergency planning set out above, which seeks to engage on an equal footing everyone with a contribution to make to meeting the needs of those who are directly or indirectly affected by a significant emergency.

The House of Lords Select Committee on Risk Assessment and Risk Planning recommended that:

“The Government should clarify what “have regard to the activities of voluntary organisations” means and outline what best practice in voluntary sector engagement would look like through the production of improved guidance for LRFs.”¹⁴⁵

We would go further. We believe that there is now a need for a fundamental shift in the involvement of the VCS, away from the ‘have regard to’ formula to the recognition in legislation and supporting guidance of the principle of VCS organisations being partners from the outset in the resilience-building activities of local bodies, Resilience Partnerships and the UK Government:

“Need now is to build prior knowledge, understanding and trust between government and VCS. Government needs to take VCS seriously as a partner in emergency preparedness and response … has to be a strategic-level change, driven mutually by government and the sector. Government cannot walk away from its responsibility to encourage and support the change needed for the benefit of UK resilience overall.”¹⁴⁶

“Government has to recognise that communities, including Faith communities, want to be involved and that Government and the statutory authorities have a responsibility to reach out ... Claiming that some communities are ‘hard to reach’ is a poor excuse for inaction, too often made by public bodies.”¹⁴⁷

And that involvement should go wider than emergency planning, to cover:

1. Supporting public sector bodies in the provision of much greater information to the public and communities of interest on risks, their consequences and the actions which individuals, families and communities can take to improve their own safety.
2. Prevention activity.
3. Emergency response and recovery.

In some areas, involvement could extend as far as VCS organisations being involved in the co-design of plans, especially where that would build on existing partnerships between statutory bodies and VCS organisations in the routine delivery of public services.

Recommendation 8: The formula in Regulations by which designated local bodies are required to ‘have regard to’ the capabilities of the VCS in carrying out their duty on emergency planning should be abolished. Regulations associated with an amended Act or future legislation should provide for VCS organisations to have partnership status in the resilience-building activities of local bodies, Resilience Partnerships and central government departments. Engagement of the VCS in resilience-building at local level should be captured in a new Resilience Standard.

The analysis below sets out recommendations, drawing from our research and interviews, in four areas where this sense of partnership should be given operational effect, in a way which would tackle the weaknesses and build on the good practice identified:

• Capability planning
• Training and exercising
• Local structures
• National structures

Capabilities, Training and Exercising – The Need for Clarity, Confidence and Trust

The first two areas – capability planning, and training and exercising – address the points made by both local bodies and VCS organisations about the limited prior involvement of VCS organisations in emergency planning. The evidence we received brought out not only the significant benefits of stronger collaboration for the quality of support provided to those affected by an emergency but also the important point that building greater levels of knowledge and understanding on both sides will build higher levels of confidence and trust. We suggest that the goal should be that all organisations involved should have:

• Clarity about which VCS organisations will provide which skills and capabilities in

what circumstances, within a framework where roles and responsibilities are clear

• Confidence that those skills and capabilities can be mobilised quickly and effectively if necessary, and can be integrated cohesively into the emergency response

Capabilities

Current statutory guidance covers well the need for clarity on capabilities:

“Category 1 responders must consider and discuss with relevant voluntary organisations, the capabilities that those organisations … have to offer, and whether those capabilities should be built into response and recovery plans. Agreements reached should be captured in plans and signed off by all interested parties.”¹⁴⁸

But we believe that guidance could now go further, drawing on developments and learning in the decade since it was last updated.

At the local level, we have been impressed by the way in which some Resilience Partnerships have brought together the skills and capabilities potentially available from all contributors into a Capability Matrix, including also contact details for the organisations involved. This provides a thorough basis for planning before an emergency. It also provides a valuable source of information if, as is inevitable, additional capabilities are required to meet unforeseen consequences or, indeed, emergencies arise which are unexpected. We believe that this practice could be promoted in statutory guidance.

Recommendation 9: Statutory guidance to the Act or successor legislation should promote the development and use by Resilience Partnerships of a Capability Matrix to capture the skills and capabilities potentially available from local VCS organisations, for use in emergency planning and response.

More significantly, however, although current guidance does cover¹⁴⁹ some of the more obvious VCS organisations and their skills and capabilities, the response to the COVID-19 pandemic and to previous major emergencies has highlighted the much wider range of VCS organisations able to make a valuable contribution. Some of these, such as faith groups, play a key role in reaching particular communities of interest, but are barely covered in current guidance. Other organisations and networks have been created or developed in the decade since the guidance was last updated. And guidance is limited in its coverage of some important national VCS organisations and networks on which Resilience Partnerships might draw.

The most notable gap in current guidance that needs to be fixed is recognition of the Voluntary and Community Sector Emergencies Partnership (VCSEP), created in 2017 to address the lack of co-ordination between VCS organisations which was judged to be having negative consequences for the delivery of support to those affected by emergencies. The Partnership moved to a bigger concept of operations during the COVID-19 pandemic, so that it now encompasses almost 200 organisations. The VCSEP has three roles, shown in Figure 3 below:

Figure 3: The Three VCSEP Pillars¹⁵⁰

A second is the creation of the National Emergencies Trust, which

“…raises funds to support the survivors of national emergencies and their loved ones.”¹⁵¹

The Trust envisages that its emergency appeals will help people in four main ways:

1. For those who sustain injuries, supporting their physical rehabilitation to enable them to maintain their quality of life.
2. Helping survivors who experience trauma to access mental health
3. Providing bereavement support to the families and loved ones of those who lose their lives during emergencies.
4. Helping those facing financial hardship to meet immediate needs, and to rebuild their lives and their livelihoods following an emergency.¹⁵²

Other notable groups and networks not covered in statutory guidance who can provide valuable insights and information on the potential needs of affected groups, or make a

significant contribution to meeting people’s needs in the response to an emergency, include:

1. Organisations whose primary role goes wider than support in emergencies, especially in addressing wider social and psycho-social needs, such as Age UK, MIND, CRUSE.
2. Faith groups and communities, whose important role we believe to be badly underplayed in As the paper by Danny Kruger M.P. on a new social covenant points out:
   “Their values, their concern for the spiritual wellbeing of individuals and society, provide a motivation and commitment that often exceeds that of paid professionals. They have deep roots in local communities and are there for the long term … and they operate both nationally and at the hyperlocal level. The networks of a faith community … are a source of huge resilience and opportunities for the people they seek to help.”¹⁵³
3. Groups with the ability to reach particular communities of interest, such as Business in the Community, the LGBT+ Consortium and the National Flood Forum.
4. Other national capabilities or networks, including Community Foundations, NAVCA, local infrastructure organisations, Victim Support and REACT Disaster Response.

It is important that Resilience Partnerships know which organisations exist and what skills and capabilities they might offer. But it does not seem sensible that each area should have to conduct its own research on the diverse range of VCS organisations and networks which operate on a national or regional basis. We believe that the assembly of that picture, into a shared National Capability Matrix, could be facilitated by the VCSEP and be made available for VCS organisations and Resilience Partnerships to access – and add to with local organisations and capabilities – as a shared online resource. We welcome the intention of the VCSEP also to offer a ‘brokerage’ service which provides dynamic support to local bodies and Resilience Partnerships who are seeking to identify VCS organisations who might contribute to the response to a major emergency.

Recommendation 10: Statutory guidance to the Act or successor legislation should include much fuller information on the broader range of VCS organisations, and their skills and capabilities, which experience has shown to have an important contribution to make in the response to a major emergency.

Recommendation 11: The VCSEP should be invited to work with Resilience Partnerships and VCS partners iteratively to test and develop the concept of a National Capability Matrix of the VCS organisations, and their skills and capabilities, which operate on a national or regional basis, able to be used by Resilience Partnerships and VCS organisations as a shared online resource.

Recommendation 12: We welcome the intention of the VCSEP to provide a ‘brokering’ facility by which local bodies and Resilience Partnerships can identify VCS organisations, and which VCS organisations locally can use to more easily signpost and navigate partners to offer support, in the response to a major emergency.

Training and Exercising

If VCS organisations are to be treated as partners in resilience-building activities, they clearly need training to equip them for their potential role. In many areas of capability, this will be the responsibility of the organisations themselves. But it is clear from our research and interviews that there are some areas where the provision of common, consistent training between public sector bodies and VCS organisations will have significant advantages, including of:

• Cost-effectiveness: training materials need be developed only once, rather than by each organisation
• Coherence: for some training, there will be significant advantages in volunteers being trained on the same basis as staff of local bodies, whether in operational areas or administrative matters (eg. observance of data privacy Regulations)
• Compliance: for training in areas where everyone involved needs to be clear on the need for their actions to be compliant with legal obligations (eg. safeguarding)

Existing guidance covers this area well, in recommending that:

“… Category 1 responders and voluntary agencies should aim for joint training and exercising (including involving the community/volunteers where possible). It is very important that voluntary organisations understand the management framework of the response and how they should be positioned and integrated into the response as a whole … Joint exercising will identify any problems, ensure plans and procedures are up to date and foster working relationships.”¹⁵⁴

The gap is therefore not in the quality of current guidance but in the degree to which it is followed through. It is clear that the involvement of VCS organisations in joint training and exercising is patchy. Although there are examples of high levels of involvement, in the majority of Resilience Partnerships their involvement is limited, mainly as a result of resource constraints. In large part, tackling this weakness will therefore be dependent on Resilience Partnerships having more sustainable levels of resourcing; we revert to this issue in the Resourcing of Local Bodies and Resilience Partnerships section. But we believe that some limited cost steps can be taken to reduce the barriers to the greater uptake of training, especially by:

1. Central government and the VCSEP working together to identify specific areas where joint, common and consistent training would be of value.
2. On the basis of that analysis, the UK Government or Resilience Partnerships making available to VCS organisations for their use if they wish the relevant core training materials described in the Rebooting the Training Ecosystem section, produced for use by local bodies, Resilience Partnerships and government Doing so would have compelling operational and efficiency advantages.¹⁵⁵

Recommendation 13: The UK Government should work with the VCSEP to identify specific functional areas where joint, common and consistent training between local bodies and VCS organisations would have operational and efficiency benefits.

Recommendation 14 (linked to Recommendation 84): The core training materials provided to local bodies, Resilience Partnerships and government departments for adaptation and use in their own in-house training should be made equally available to VCS organisations for their own use should they wish.

Common and consistent training will be especially important for those organisations and their volunteers who have a direct interface to Strategic and Tactical Co-ordinating Groups in the response to an emergency.

And the engagement of VCS organisations will be vital in exercises which test emergency plans which rely on a substantial contribution from VCS organisations in meeting people’s needs. The Resourcing of Local Bodies and Resilience Partnerships section sets out proposals for the greater resourcing of exercises which should help meet this need.

Recommendation 15: Statutory guidance to the Act or successor legislation should continue to encourage local bodies and Resilience Partnerships to involve VCS organisations in relevant in-house training and exercising.

Local and National Structures

Local Structures

Current statutory guidance offers four models¹⁵⁶ for engaging the VCS in the work of Resilience Partnerships, based on:

• Engagement through the LRF itself
• Establishing a voluntary sector sub-group of the LRF
• Creating bilateral links on the basis of functions
• Creating bilateral links on the basis of capabilities

It should properly be for each Resilience Partnership to decide how best it wishes to structure the involvement of VCS organisations: in practice, they may choose to use more than one of these models. We were, however, attracted to a further model described by some English LRFs, of structures based on the principle of ‘Putting People First’ by focusing on the outcome to be achieved – the effective provision of support to those affected by the emergency. Such a model would allow for the greater engagement we would hope to see of local VCS organisations in meeting local needs, supplemented as necessary by national VCS organisations.

Recommendation 16: Statutory guidance to the Act or successor legislation should include a model for the engagement of the VCS (and other) organisations based on the principle of ‘Putting People First’ by focusing on the outcome to be achieved – of providing effective support to those affected by the emergency.

Guidance is silent on who should chair the preferred engagement arrangements. Our research and interviews have identified that this can be a contested area, especially in the perceived preference given to national bodies who may not be as aware of the local area, its population and its needs as are local VCS organisations. We believe that it would be wholly within the spirit of partnership for VCS organisations themselves to select the Chairs of any sub-groups led by the VCS or their representatives on other committees set up by Resilience Partnerships, and for this to be encouraged in statutory guidance.

Recommendation 17: Statutory guidance to the Act or successor legislation should make clear that it is for VCS organisations themselves to select the Chairs of any sub-groups led by the VCS or their representatives on other committees set up by Resilience Partnerships.

National Structures

The creation and subsequent development of the VCSEP has provided an important bridge in the strategic relationship between the UK Government and the sector, a relationship which a high proportion of interviewees commented was missing at the start of the response to the COVID-19 pandemic. The Partnership has the potential to make a significant contribution in the areas for improvement highlighted above. Our interviews with individual VCS organisations brought out clearly that they were supportive of the Partnership in principle, although there were commonly-held views on the need for it, in its continuing development, to be demonstrably a partnership of equals pursuing a shared agenda; and for it to have an tight focus on emergency preparedness and response. We hope that the recent expansion of its membership and the spirit of collaboration and partnership embedded in recently- developed governing documents will help address these concerns.

We hope that it will also help tackle a further commonly-held view that competitiveness within the sector has historically impeded the depth of support provided to those in need. The establishment of the Partnership was clearly intended to address this issue, and the evidence we received suggests that it is making progress in doing so.

We were told that the UK Government contributed to the start-up costs of the Partnership but that it was unclear whether further UK Government contributions to its continuing operating costs (estimated at somewhat less than £1m per year) would be made. We believe that the work of the Partnership has significant potential benefit for the Government and Resilience Partnerships, and that this mutuality of benefit should be recognised though the Government co-resourcing its costs.

Recommendation 18: The UK Government should recognise the potential mutual benefits provided by the VCSEP by co-resourcing its annual operating costs.

The Better Involvement of Business

Business has a vital role to play in our society, enabling economic growth and prosperity. From multinational corporations to small and medium-sized enterprises, businesses form part of the fabric of our society. Businesses of all sizes are part of our communities. They provide jobs, goods and services, including those on which decent life depends. As the COVID-19 pandemic has shown, they too are affected by the consequences of major emergencies which, if they cause disruption to the supply of their goods and services, can cascade into harm and suffering to people. And the reverse is true: properly involved, they can make a substantial contribution in the response to a major emergency, relieving harm and suffering.

Resilient businesses are also an important component of a Resilient Nation in the eyes of investors, and the confidence they can take in the UK as a place for investment. As a wide range of ‘resilient nation’ surveys show, if businesses can demonstrate the robustness of their own resilience as part of the broader resilience of the United Kingdom, they and the country are more attractive to investors. Investors want to be assured that they are investing in businesses which are resilient, which operate in a stable environment and also, when working with partners, are part of a resilient supply chain.

The full involvement of business is therefore a fundamental plank of a ‘whole of society’ approach to building UK resilience. And yet, the vast majority of the wide range of general¹⁵⁷ businesses and business representative organisations we interviewed had had almost no engagement with the UK Government on resilience matters in the years before the pandemic. Many observed that levels of engagement had declined sharply from those of a decade ago, although for most the position improved during the response to the COVID-19 pandemic. There was a strong sense of the government viewing engagement as something that ‘needed to be done’. This showed in the clear perception of there being an absence of thinking in government about the needs of business in resilience planning, let alone a readiness to give business a voice. As a result, there was a widely-held view that the government did not have a good understanding of business resilience, especially the resilience of supply chains. Even in cases where businesses had sought advice, several felt that the government did not wish to listen or engage.

We found better levels of engagement with businesses at local level. And we heard of good engagement in some regulated sectors, led by individual government departments. But the absence of routine engagement on resilience matters between the centre of government and business at national level was striking – and well behind access and engagement arrangements in other security fields.

Engagement by the National Cyber Security Centre (NCSC), the Centre for the Protection of National Infrastructure (CPNI) and Counter Terrorism Policing were routinely commended. CT Policing was particularly praised for the way in which it had, in recent years, taken the best of the private and public sectors and combined them into a partnership which has clear purpose, confidence and engagement, built on mutual trust and respect, with a clear focus on operational outcomes – knowledge, understanding and capability. There was a widely- held view that more and better progress had been made on building a whole of society approach to addressing physical and cyber threats than on building resilience:

“[NCSC, CT Policing, CPNI] are good benchmarks for what should be done in the resilience field:

• Engage senior leaders as well as operational level people…
• Not command and control, top down,
• Greater sharing of information on risks and consequences so can work together collaboratively

People are more encouraged to engage.”¹⁵⁸

Filling this gap is vital – and never more so. The impacts of the COVID-19 pandemic and other recent incidents have been far-reaching, and exposed vulnerabilities, in business operations and supply chains:

“When we assessed the supply chain, we discovered some hair-raising dependencies on overseas markets. COVID fundamentally changed the way government thinks about critical risk in the context of supply.”¹⁵⁹

And we found in our research and interviews that the appetite for greater levels of engagement is there, provided that it is attractive – properly managed, value-adding and operationally-focused – rather than being another ‘talking shop’. The aim should be to improve the precision and quality of planning on both sides, thereby creating greater certainty where at present there is uncertainty:

“Business are looking for a win-win solution to benefit them and communities. A fuller approach from government forces them to think about their own business continuity and organisational resilience; government needs to provide better information and support to them in doing that. And engagement at that deeper level allows government to ask businesses how they can help in a crisis, and businesses to make offers of support to government. Business needs to be shaping the dialogue with government. And government needs to make the dialogue attractive and relevant with observably welcome engagement. Senior business leaders and resilience professionals in business would engage if structures were in place.”¹⁶⁰

This finding is echoed in the most recent Deloitte and Reform The State of the State report which notes that:

“… interviewees from business told us that they want government to be more coherent and granular in their plans, have a more nuanced approach to risk and take a more collegiate view of collaboration.”

and that:

“The pandemic has reset government and business relations because they co-created solutions…”¹⁶¹

The prospects for taking forward the conclusion of the House of Lords Select Committee that “… the Government [should] undertake more structured and open engagement with business and industry on risk and resilience”¹⁶² are therefore promising. Key areas for dialogue identified in our interviews were:

1. The development of a shared understanding of the future risk picture and the consequences with which businesses might have to deal, described in terms and presented in a form which is meaningful to business. There was widespread recognition that the risk picture has changed dramatically over the past decade and is likely to continue to do so. There was a clear appetite for discussion on emerging risks such as climate change, cyber security and growing regional instability; a better shared understanding of supply chains and their resilience; and for developing a fuller understanding of the shifting picture on the management of risk, especially with the move to home-working.
2. The joint development of mitigations, for businesses, for society and for the economy. This would include at least consultation on or – better – the co- development of relevant new resilience policies. Businesses were clearly ready to shape the resilience dialogue with government, but on the basis that policies were developed with business rather than being presented as a fait accompli.

In the aftermath of the COVID-19 pandemic, there is thus a real willingness and opportunity to learn and improve:

“Real opportunity at the moment as resilience is on the agenda for every Board …

Door is wide open for that engagement to begin.”¹⁶³

The analysis below covers the two main ingredients to doing so – information and dialogue –

set against the current provisions of the Act.

What Does the Act Require?

It is notable that the Act, its associated Regulations and supporting statutory guidance contains almost no material on the involvement of general business and business representative organisations in resilience-building activities.

Coverage in the Act itself is, essentially, restricted to the provision of business continuity advice and assistance to businesses and others¹⁶⁴, covered in the Business Continuity Promotion Duty section.

Unlike the voluntary and community sector, which has a dedicated Chapter in statutory guidance¹⁶⁵, the engagement of business is bundled together with a wide range of other organisations in a Chapter on the “Other Sectors that should be involved in Emergency Planning”. The Chapter includes advice that:

“… organisations which are not required to participate under the Act should be encouraged to take part in forums and co-operate in planning arrangements wherever this is appropriate.”¹⁶⁶

This omits, however, the valuable contribution which businesses might make to other areas of resilience activity, especially risk assessment and risk reduction, and building supply chain resilience. Furthermore, guidance is silent on the valuable role – as the response to the COVID-19 pandemic has shown – of business representative organisations, especially in acting as the trusted intermediary between their members and the government and other statutory bodies. And, more broadly, it simply fails to recognise the vital role of business in building UK resilience. It provides a very poor platform for the consistent, routine dialogue needed specifically with business and business representative organisations on issues such as:

1. Risks and their consequences, in terms which are meaningful to business and which can be used in their organisational resilience and business continuity planning.
2. The risk reduction measures which might be put in place to seek to avoid or minimise the harm arising from disruption in the supply of goods and services, especially through work on supply chain resilience.

1. The mitigations which might be put in place to reduce the impact on businesses not only of risks and their consequences but also of the measures put in place as part of the emergency response.
2. Those areas where businesses are able to make a material contribution to the response, especially in meeting the needs of those affected by the

The House of Lords Select Committee has recommended that:

“The Government should provide a forum, made up of representatives of trade associations and professional bodies, which should meet in advance of and following the production of the [National Security Risk Assessment] or twice a year, whichever is more frequent … This body should be used to ascertain … information about business sector capabilities, inform business and industry of risks which may require a response on their part, and allow the Government to seek out best practice.” ¹⁶⁷

A forum of that nature would be useful. But we would go further. The Voluntary and Community Sector section above describes the development in recent years of the Voluntary and Community Sector Emergencies Partnership (VCSEP) as a mechanism to capture the spirit of partnership and collaboration in resilience-building activities between government and VCS organisations. We believe that the relationship between government and business on resilience matters should be treated as being of at least equal importance, and placed on the same formal partnership footing, with analogous arrangements put in place to take forward on a collaborative basis operationally-focused work in the four areas described above:

“COVID has created a much stronger relationship with government and industry but it will require investment in effort to sustain it.” ¹⁶⁸

Such a Business Sector Resilience Partnership is not intended to replace or cut across existing arrangements led by individual government departments for engagement with businesses in their sectors on resilience matters. The evidence we heard suggests that these are generally working well. They should clearly continue. Lead Government Departments, with regulators where relevant, would remain responsible for engagement within their sectors, covering the whole sector and supply chain, with the results captured in Sector Security and Resilience Plans¹⁶⁹ and subject to the accountability arrangements set out in the Accountability chapter.

Rather, we believe that the Business Sector Resilience Partnership should address wide- scale, national (‘catastrophic’) level risks rather than those which can be addressed by individual departments within their sectors, or where businesses judge that they do not need support. By extension, it should also cover common and cross-cutting issues applicable to a wide range of risks, especially cascading consequences given the levels of inter- connectedness in society and the economy. Doing so would recognise the likelihood, described in the Future Risk Picture section, of more frequent and more complex emergencies, including a greater likelihood of emergencies on a national scale, with wide- scale impacts across all sectors of business and society. And it would recognise that some businesses’ operating models treat resilience on a national – or even multi-national – basis:

“Fuller dialogue with government enables fuller discussion within companies, allows both sides to do the thinking and collective decision-making beforehand, especially on the difficult issues …”¹⁷⁰

Participation should go wider than the bodies recommended by the House of Lords Select Committee for their proposed Forum, to include the main business representative bodies, a wide spread of businesses, and the main business resilience-focused consultancies. It should enable, if members wished, the development of networks and communities of interest. And it could include greater collaboration on research:

“… scope for greater collaboration on research and development on risk mitigation. BEIS work in nuclear industry good. A similar model could be applied to other risks that the private sector is worried about …”¹⁷¹

Unlike the VCSEP, there is no obvious case for a standing secretariat. We were impressed by the range of existing collaborative networks already in place within the business sector and by the scope and depth of their work. We suggest that the other side of the Partnership should be led by a ‘Business Resilience Team’ in the Civil Contingencies Secretariat, with explicit responsibilities for leading and co-ordinating the cross-government Partnership with business on building UK resilience. The Team would ensure that each Lead Government Department had an effective programme of engagement with businesses in the sectors it sponsors. Working with departments, it would additionally have the role of bringing information and issues from individual sectors back to the centre of government and ensuring that they are acted on where necessary. The Team would also work with Resilience Partnerships to ensure that they were aware of work being taken forward at national level and were supported in their own work. And – one of the most significant points from our interviews – it should show that in the greater visibility and approachability of officials towards the sector.

There is no compelling case for mandating that similar arrangements should be established by the Devolved Administrations or at local and regional levels. The Devolved Administrations already have established forums for dialogue with business. Many local authorities have established business networks, to which resilience matters can be added as necessary. And we heard of effective arrangements generally between LRFs in England and businesses and business representative organisations in their area. The Business Resilience Team should provide support for this work.

Recommendation 19: The UK Government should develop with business a formal Business Sector Resilience Partnership focusing on resilience matters. This should supplement existing business engagement arrangements managed by Lead Government Departments within their sectors and focus on wide-scale national risks and common and cross-cutting issues. Participation should go widely, to cover business representative bodies and a wide spread of businesses and business resilience-focused consultancies. Its work should be operationally-focused, and cover the assessment of risks and their consequences, risk reduction, the mitigations which might be put in place to address the impacts of emergencies on businesses, and the contribution which businesses might make in the response to major emergencies.

Recommendation 20: The Business Sector Resilience Partnership should be supported by a Business Resilience Team in the Civil Contingencies Secretariat, responsible for leading cross-government work with business on resilience matters. Its work should include ensuring that each Lead Government Department in its resilience-building activity has an established programme of engagement with businesses in the sectors it sponsors, and that cross-cutting issues raised by individual sectors are acted on where necessary. It should also support the Devolved Administrations and Resilience Partnerships in their engagement with businesses in their areas.

Recommendation 21: There should be a new chapter in statutory guidance dedicated to business involvement in building the resilience of the UK. Engagement of the business sector in resilience-building should be captured in a new Resilience Standard.

Early Priorities for the Business Sector Resilience Partnership

Two very clear early priorities for the work of the Partnership emerged from our research and interviews:

1. The provision of information and advice targeted on meeting the planning needs of
2. Capturing the contribution which businesses are ready to make to the response to a major emergency, drawing on the lessons of the response to the COVID-19

The Provision of Information – Both Ways

The New Culture section sets out our analysis and recommendations on the need to move to a “new culture” under which the UK Government, supported by Resilience Partnerships, provides much fuller information on risks, their consequences and the broad shape of response plans. The provision of ‘broadcast’ information will, however, not be sufficient.

Significant effort will be required to present the material in a way which is useful, to promote the material and to interpret it for users – including especially the material targeted on meeting the needs of businesses, for their use in organisational resilience and business continuity planning:

“Government puts out strategies … and thinks ‘job done’, but business needs the detail under it. There’s a mismatch in the level of granularity.”¹⁷²

This is the single most significant area of improvement identified in our interviews with businesses and business representative organisations. Even the few who had looked at the National Risk Register had found it of no or limited value in their work:

“Estimate only around 30% of clients have looked at a Community Risk Register (CRR) or 10% have looked at the National Risk Register (NRR).”¹⁷³

The clear view was that the material provided by the UK Government stopped at the end of the relatively easy first stage – a description of risks. The harder part – taking the risk commentary and turning it into material which supported downstream action – was absent. Businesses were clear that they needed to know more about how risks might arise, what the resulting emergency might look and feel like, what would and should be done as a result, and sources of advice and expertise:

“… [National Risk Register] looks and feels like a box-ticking exercise. Needs more specific information on risks, consequences, scenarios. And should not just stop at publication like it does at present: should be the basis for more discussion, collaboration and partnership-working on risk and planning with government and other Category 2 responders… Would be especially important to have discussions with government on cascading consequences and cross-sector risk and planning issues.”¹⁷⁴

“Need information which supports outcome- and scenario-based planning. If outcome focused and allowed to factor in all threats and hazards, then Boards are better placed to fund projects set against their risk appetite and which tackle multiple risks rather than looking at risks individually.”¹⁷⁵

That would require a fundamental change in tone and pitch, and from paper to digital:

“Principles of information and guidance should be:

• Keep it simple – no geek-speak
• Make it easy for people to do something – for companies to adopt and for Directors to go through in Board meetings.”¹⁷⁶

And it should involve a change in approach, to one which sought the involvement of businesses in risk assessment, drawing on their knowledge (including of supply chain risks) and expertise. That might extend to the co-development and co-branding of materials:

“Could be jointly branded with business organisations. For example, Institute of Directors teamed up with Health and Safety Executive to produce guidance for Directors on meeting their health and safety requirements in law. Rooted in complex law but guidance kept simple: principles, steps to go through, things to put in place. Good partnership.”¹⁷⁷

The UK Government made a first step down this road some time ago, with the publication in 2014 and 2015 of National Business Resilience Planning Assumptions¹⁷⁸, based on the then (classified) National Risk Assessment, which were intended to:

“… summarise the Government’s assessment of the potential impact of a range of national hazards … as a reference tool to support and inform resilience planning by businesses.”

These went markedly further than the National Risk Register in seeking to draw out for planners information on potential consequences which could be used directly in organisational resilience and business continuity planning. The Civil Contingencies Secretariat has advised us that, unsurprisingly, “[d]ue to the frequency and ongoing nature of responses over the past few years …the Business Resilience Planning Assumptions have not been maintained /updated as frequently as we would wish”. They nonetheless indicate what we believe to be the right direction of travel for the future in their focus on providing information targeted on meeting business needs. But there is a long way further to go.

Recommendation 22: The Business Sector Resilience Partnership should, as a first early priority, co-develop and disseminate information and advice on risks, their consequences and response plans targeted on meeting the needs of businesses, for their use in organisational resilience and business continuity planning.

Capturing Business Contributions

We heard several depressing case studies of where, in the absence of prior dialogue and planning, capabilities available to business had not been mobilised, or had not been mobilised as quickly as they might have been, to relieve harm and distress during the early response to the COVID-19 pandemic. Capturing the contributions which businesses are ready to make before an emergency arises, in a proactive and systematic way rather than as a reaction to events, was the second most significant area of improvement identified in our interviews with businesses and business representative organisations.

A significant proportion of the major businesses we interviewed were clear that they saw making a contribution to the response to an emergency as a key part of their ESG¹⁷⁹ approach. A number have been doing this for some years, since well before the COVID-19 pandemic. All recognised that it was in the nature of emergency planning and response that in some cases their support would be sought and provided ad hoc to address unforeseen needs. But all were clear that operating only on a reactive basis was the wrong approach, and that there was a clear need for stronger capability planning before an emergency:

“John Lewis have a lot to offer: wide audience, wide range of locations, high quality warehousing, etc. With dialogue and planning, government could use their capabilities much better.”¹⁸⁰

“Chambers of Commerce can help on mutual aid. HGV driver shortage generated an issue with delivery of food supplies to vulnerable people. Suffolk [Chamber of Commerce] … could have made connections with some hauliers with spare capacity who could have been asked to deliver food to food stations if needed. Could have done that thinking before the emergency happened. Built trusted relationships between Chambers of Commerce and public sector over the past 10 years so why isn’t that type of planning done in advance?”¹⁸¹

We recommend above that emergency planning should as a matter of routine identify the consequences for people of major emergencies and their potential physical, social, psychological and economic needs; and then use that analysis as the basis for determining which organisations are best placed to meet those needs, from whichever sector, subject to the necessary safeguards. It also recommends that potential contributions are recorded through the use of a Capability Matrix and other similar tools, and that potential contributors are trained and plans are tested in exercises involving the organisations concerned.

Much of this activity will take place within Resilience Partnerships, building on good practice already developed. But we believe that, as with the voluntary sector, there may well be value in iteratively testing and developing a National Capability Matrix of the businesses who operate on a national or regional basis who would be ready to make a contribution to the response to a major emergency, and the skills, assets and capabilities they could offer, able to be used by government, Resilience Partnerships and businesses as a shared online resource.

Recommendation 23: A second early priority for the Business Sector Resilience Partnership should be the development of a National Capability Matrix of the skills, assets and capabilities offered by businesses which operate on a national and regional basis for use in the response to major emergencies.

Building Community Resilience

The Integrated Review set out as one of its priority actions:

“To establish a ‘whole-of-society’ approach to resilience, so that individuals, businesses and organisations all play a part in building resilience across the UK.”¹⁸²

The Call for Evidence on the forthcoming Resilience Strategy amplified the ambition to include:

“… a revived effort to inform and empower all of society and support greater community responsibility and resilience.”¹⁸³ (Our emphasis)

This ambition captures well an approach to building UK resilience which not only involves communities, whether defined by geography or interest, and individual citizens, but also empowers them to make the contribution they wish in preventing, preparing for, responding to and recovering from emergencies. On a practical level, this activity can take many forms, from household-level preparedness and checking on vulnerable neighbours to organised community groups with their own community level emergency plans. But:

“It is important that ‘whole of society resilience’ does not mean “let’s get everyone to look after themselves”. The support provided within communities (by family, friends, neighbours, religious organisations, voluntary groups, etc.) is as important at the role played by Category 1 and Category 2 responders, but neither can replace the other.”¹⁸⁴

The concept of community resilience is neither new nor revolutionary, drawing on the fundamental human instinct to support each other during adversity. Examples of

‘community resilience’ can be seen in every type of major emergency that has affected the UK, from wartime through to the response to COVID-19. Work on the resilience-based expression of community resilience started a little after passage of the Act, having been triggered by lessons identified from the summer floods of 2007. The 2008 National Security Strategy thus recorded the UK Government’s commitment:

“The British people have repeatedly shown their resilience in the face of severe disruptions whether from war, terrorism, or natural disasters. Communities and individuals harness local resources and expertise to help themselves, in a way that complements the response of the emergency services. That kind of community resilience is already well organised in some parts of the United Kingdom, and we will consider what contribution we can make to support and extend it, building on the foundations of the Civil Contingencies Act and on the lessons of emergencies over the past few years.”¹⁸⁵

This was developed in the Pitt Review of lessons identified from the summer 2007 floods, which concluded that:

“The Review believes that individuals and communities would benefit from more comprehensive, targeted advice from the Government …”

and recommended that:

“The Government should establish a programme to support and encourage individuals and communities to be better prepared and more self-reliant during emergencies, allowing the authorities to focus on those areas and people in greatest need.”¹⁸⁶

Following the Pitt Review, the Civil Contingencies Secretariat established the first national community resilience programme. In recognition of the fact that thinking on community resilience was in its infancy in the UK, the Civil Contingencies Secretariat took two immediate steps to build the evidence base. The first was to work with Demos to produce what became the Resilient Nation report published in 2009. This highlighted that:

“… responsibility for resilience must rest on individuals not only on institutions.” ¹⁸⁷

and described:

“… how we can build and sustain community resilience with support from central and local government, relevant agencies, the emergency services and voluntary organisations.” ¹⁸⁸

and ended by outlining:

“… how government departments, relevant agencies and local authorities can shape and influence existing models of best practice around the country by adopting the four Es of community resilience: engagement, education, empowerment and encouragement.” ¹⁸⁹

The second was the establishment in 2009 (jointly with the US Federal Emergency Management Agency) of an informal Multi-National Resilience Policy Group which involved participants from 10 countries:

“The primary motivation for their exchange … was a learning task: How can government authorities support community resilience activities without overwhelming local residences and their leaders, crushing initiative and creativity, and undermining local efforts that, more often than not, are responsible for successfully preparing, responding to and recovering from disasters?”¹⁹⁰

The learning and insights generated by this international group, together with the analysis in the Demos Report, informed the UK Government’s development of the first Strategic National Framework on Community Resilience¹⁹¹, published in 2011, which was accompanied by toolkits and templates for use by responders and community groups.

Thinking and practice on community resilience in the UK has continued to evolve over the subsequent decade, with the value of community resilience being increasingly well- documented by the academic community. And other nations now have well-developed approaches to emergency management fully incorporating the concept into their activities¹⁹². Thus, the US National Institute of Science and Technology runs a programme to develop community resilience at the local level by developing nationally applicable tools, outreach approaches and success measurement, recognising the ability of community resilience to:

“… reduce the direct and indirect costs due to natural, technological, and human- caused hazard events.”¹⁹³

This is one of a number of federal programmes that supports the development of community resilience across a range of government agencies. In Germany, the notion of community involvement in disaster response is formalised in the Bundesanstalt Technisches Hilfswerk (THW) – essentially a volunteer-led civil protection organisation with the look and feel of a formal emergency service¹⁹⁴. And the National Emergency Management Agency in New Zealand runs the ‘Get Ready’ campaign – a national communications campaign on how to prepare for risk at the household and community level – which is built on people having good relationships with neighbours and being prepared to help when the worst happens¹⁹⁵.

The UK Government, in its 2015 National Security Strategy, reconfirmed the value of building community resilience:

“The UK’s resilience depends on all of us – the emergency services, local and central government, businesses, communities and individual members of the public.” ¹⁹⁶

and committed that it would:

“… expand and deepen the government’s partnership with the private and voluntary sectors, and with communities and individuals, as it is on these relationships that the resilience of the UK ultimately rests.” ¹⁹⁷

An updated Community Resilience Framework for Practitioners was issued in 2016, along with revised tools and templates¹⁹⁸.

The National Security Capability Review in 2018 again confirmed the UK Government’s commitment to a whole of society approach to resilience:

“National resilience is truly collective, depending on all of us – emergency responders, local and central government, the Armed Forces, businesses, communities and individual members of the public.” ¹⁹⁹

And in 2019, the Civil Contingencies Secretariat produced a further updated Community Resilience Development Framework²⁰⁰ which reflected the wider landscape of activities and capabilities being captured under the term ‘community resilience’ (individual resilience, social action, voluntary capabilities), aligned with the priorities of the UK Government’s Civil Society Strategy²⁰¹ published in 2018. The updated Framework also reflected the experience gained over many years to set out a number of ways in which local bodies could support communities and voluntary sector organisations to build resilience at the community level, drawing on real-world case studies and other relevant documents and guidelines.

But, despite good work over more than a decade on community resilience at national and local levels, the general view that emerged from our research and interviews was that, with some notable exceptions, Resilience Partnerships are struggling to make significant progress. And yet everyone agrees that it needs to be done. As the House of Lords Select Committee observed:

“The COVID-19 pandemic has shown that communities can step up and help ensure national safety. The Government must see our people as an essential building block of any response and as active participants in creating resilience. They must provide them with the support and information to help them prepare for the risks they face.”²⁰²

The analysis below therefore covers the key factors identified in interviews which may be holding back progress:

• Is the best approach to involving and empowering communities understood and being adopted by those involved in Resilience Partnerships and in other organisations such as Town and Parish Councils?

“People who engage from communities need to feel through the way in which they are engaged that they are properly engaged … They need to be given an opportunity to talk about what they have been through and identify lessons and areas for improvement. Authorities need to engage in existing community and social networks and structures (often outside normal office hours), not only to gain views but also to increase social awareness. Plenty of networks and groups that can be tapped into. ‘Go where the people are’. Make the discussion relevant. Make engagement easy … Communities are not hard to reach; just need to get rid of ‘snobbishness’.”²⁰³

“Proper engagement can help people at risk by helping them to understand what is going on and why. Don’t just tell them they are at high risk and need to develop a plan. Being flooded is a hard concept to understand; people don’t realise what, say, being 1m deep in water really looks like. That is only achieved through meaningful engagement so people are really embedded in the process. Proper engagement needs local expertise and input, people who understand the geography and demography of their own community. It’s not sensible to write a plan without that knowledge or else whatever is planned is going to go wrong.”²⁰⁴

“… need to recognise that communities are not always place based. Could be based on interest.”²⁰⁵

“Capacity and potential in communities is remarkable. But it cannot be taken for granted. Structures and support need to be put in place to harness community goodwill so that it can interface effectively with the actions of statutory authorities. Devolution of control and power to communities is an important means of enabling that.”²⁰⁶

• Do Resilience Partnerships, Town and Parish Councils and communities have the tools, templates and other resources they need?
• Are Resilience Partnerships adequately resourced for this work?
• Is there sufficient commitment, especially of senior leaders in local bodies and central government to enable progress?

set against the requirements of the Act, its associated Regulations and supporting statutory guidance.

What Does the Act Require?

Community resilience is not covered in the Act or its associated Regulations. This is unsurprising given their narrow focus on the roles and responsibilities of local public sector bodies and the regulated utilities, with only marginal references to the activities of others.

Community resilience is briefly covered in statutory guidance²⁰⁷ in its chapter on emergency planning, including providing links to the updated Framework and tools. It positively encourages local bodies to involve communities in their planning:

“Involving the community in the production of emergency plans whenever possible and practical, and supporting communities to develop their own emergency plans, will enable community members to play an active role in supporting responders in the response to, and recovery from, emergencies … This should encompass relevant voluntary, business and community organisations operating in the area covered by the plan.” ²⁰⁸

However, unhelpfully, the chapter on communicating with the public also advises Resilience Partnerships that:

“The duty to make the public aware of the risks of emergencies does not extend to a requirement to assist individuals/organisations in developing community resilience or to promote community resilience …” ²⁰⁹ (Our emphasis)

which reduces the impact of the earlier encouragement.

Is the Best Approach Understood and Being Adopted?

Approaches to engaging and empowering communities have been well developed and tested over the past decade, drawing both on academic research and practical experience on the ground. We received evidence of outstanding work from several local areas. For example, Cumbria LRF have developed a series of principles for their LRF-wide community resilience programme, based on their many years of experience:

Community Resilience in Cumbria

Cumbria LRF has developed its approach to community resilience for more than a decade. A succession of emergencies, including severe flooding in 2009 and 2015, and the ‘Beast from the East’ in 2018, have repeatedly shown that many communities in the county have to manage the response to emergencies before the emergency services are able to reach them. And there is recognition that communities are their own best organisers and that, with some infrastructure support, much can be achieved in a bottom-up, organic

way. That means there is no ‘one size fits all’, and communities cannot be ‘made to plan’. Building bridges which enable discussions on resilience in an inclusive way is better than mandating processes.

The purpose of the community resilience programme is to provide support to communities of interest and of geography to enable them to plan for their future, and thereby to build resilience to challenges. The programme works to six key principles:

1. There is more to community resilience than community emergency planning. There are over 40 community emergency plans. Other communities have had a conversation about the main risks they face and how they might deal with them but have not written a formal plan. Experience has shown, however, that communities without a formal plan can respond very effectively to incidents. So the LRF encourages activities that help to develop local relationships, and supports the social infrastructure that enables them to happen: over 200 projects have been supported.

2. Make friends before you need Structures and plans are important, but it is easier for people to work collaboratively during an incident if they already know and trust the individuals and organisations involved. So the LRF seeks to build relationships between communities and emergency responders – for example, by involving local communities and voluntary organisations when exercising emergency plans, and holding briefing sessions for community groups to improve their knowledge around key risks and plans.
3. Communities to COBR. An approach which seeks to ensure that community knowledge informs not only emergency plans but also strategic decision-making during incidents.
4. Community resilience activity will be led by communities by default. Community-led social action is a key component of Cumbria’s approach. This means that different communities have taken different approaches, based on the skills and assets available locally, and local geography.
5. Community Resilience means tackling It is well established that individuals and communities who are already disadvantaged tend to be disproportionately affected by emergencies.
6. Community Resilience requires investment, including funding for a Community Resilience Co-ordinator, and work to maintain and grow the capacity to support community-level activity.

The programme is overseen by a steering group of involved organisations and wider network groups to bring all partners into the discussions, including local authorities, the Cumbria Community Foundation, agencies working on flooding (with the LRF’s work being built into the Environment Agency and DEFRA Innovative Resilience Programme) and VCS partners.

And we heard compelling evidence of cases where community resilience activity had led to demonstrable improvement in the ability of communities to respond to crises – such as work in Test Valley to empower communities on a range of issues using recognised community engagement techniques which had led to community emergency plans being deployed during flooding.

Community Resilience in Test Valley

A number of communities in Test Valley in Hampshire suffered significant flooding in the winter of 2014. Following the event, a number of agencies came together to look at what had worked well in terms of the response. One of the points of interest that arose was that some communities that had been flooded had not required much by way of help from the blue light services or the local authorities. On closer analysis, it was apparent that these communities had already gone some way to develop their own community resilience plans.

As a result, work was undertaken to identify some of the factors which explained why some communities had developed their own resilience plans and others had not. Whilst they were in part driven by a perceived threat to their community, other key factors included the willingness of local councillors, parish councils or other local institutions to co-ordinate and support the work.

A peer learning forum was established in the area to learn about these experiences and how other communities could also develop their community resilience. This community- to-community learning has had a significant impact on the number of communities engaged in local resilience in Test Valley. In other areas of Hampshire, organisations, such as Fire and Rescue, had promoted the idea of local resilience planning without a great deal of success.

In addition, the forum has helped develop close relationships across agencies and within local communities. Anecdotal evidence suggests that, whilst different communities do have different capabilities and assets, it is the existence of strong local networks, active communities and institutions that make community resilience more likely to succeed.

Test Valley Borough Council, working with local parish councils, has for several years invested in ways to help communities develop their assets and capacity. This has included the introduction of a community councillor model, a place-based community team and the decentralisation of funding pots.

Local community resilience in Test Valley was severely tested during the COVID-19 pandemic. However, the resilience network at community level remained strong. This meant that the local authorities within Test Valley had less direct involvement in, for example, the delivery of food parcels and medicines than some other councils. At the same time, calls to the Hampshire helpline were amongst the lowest in the County.

Councillor Phil Lashbrook, the member champion for community resilience in the Borough, says that it is vital that agencies, such as councils, invest in community capacity if they want local resilience to succeed. “It’s something that takes time and a long-term strategy. Communities are suspicious of organisations that want to impose frameworks on them. However, if local authorities build trust and nurture capacity, community resilience can have a huge impact”.

We also heard from Thames Valley LRF, who have developed a very interesting data-driven, analytical approach to their programme. This measures community vulnerability to risk and has a maturity model to assess the development of resilience in communities, and uses these to support the development of community-level emergency plans and to prioritise activity, recognising that resources will always be limited:

Community Resilience in Thames Valley

Thames Valley LRF encompasses multiple local authorities, fire and rescue services and other agencies interfacing with communities which makes work to build community resilience complex. It has therefore embarked on a project to assess community resilience across the Thames Valley whose aim is to provide a unified understanding across all organisations of the resilience of communities which will allow the sharing of resources, avoid duplication of effort and enable the prioritisation of areas for building communities’ resilience.

To do this, it has created a community resilience database, which measures:

• How developed is the current resilience of communities, measured through a maturity model
• The vulnerability of communities, measured through census data
• The risks in a community area, measured through risk assessment

The output of this work is shown in a series of maps (produced in GIS) which map the areas with the greatest risk and vulnerability against those with the most developed maturity, thereby allowing the identification of those areas with the greatest risk and the lowest resilience for priority action.

Thames Valley LRF recognises the current limitations of this work, including that vulnerability is currently inferred from data on parameters such as people’s age, accommodation types and access to services. But the LRF is striving to move the vulnerability assessment to being based on data on the actual needs of communities, linking with health services, utilities, charities, and other agencies. The work has

therefore led the LRF to work with a wide range of other public agencies, and with the private and voluntary sectors, such as Thames Water and Age UK.

The expected benefits of the work include being able to identify and prioritise work to build community resilience, as well as allowing the partnership to share resources more effectively (including, for example, Duke of Cornwall teaching materials) and identify which agencies are best placed to lead on work in each community. The LRF has already supported 69 communities to put a community emergency plan in place, with 33 more communities having plans in development.

We also heard of national initiatives, such as the Communities Prepared National Group²¹⁰ established to provide a forum for local bodies and the UK Government to share good practice and lessons identified in community engagement and capability-building, to advise government on policy and projects related to community resilience, and to identify opportunities for co-ordination of community resilience-related work.

And most recently, the National Consortium for Societal Resilience [UK+] – an initiative led by the University of Manchester and Thames Valley LRF – was launched in September 2021 to bring together Resilience Partnerships with partners in the voluntary sector, businesses, the higher education sector and communities to develop and share good practice on community level preparedness activity:

The National Consortium for Societal Resilience [UK+]

One response to the Integrated Review’s ambitions for “a whole-of-society approach to resilience”211 was the creation of a partnership called The National Consortium for Societal Resilience [UK+], abbreviated to NCSR+.

The NCSR+, which launched on 13 October 2021, was initiated by Ben Axelsen (Thames Valley LRF) and Duncan Shaw (The University of Manchester) and involves over 60 member organisations that are central to building resilience in the UK[+].

NCSR+ members believe that whole-of-society resilience must be built from inside communities, utilising available partnerships offering important support, facilitation, and intervention within a national framework of guidance and good practices. This explains why building whole-of-society resilience is not top-down from national or local government, because society is not controlled by them. However, resilience building cannot only be bottom-up by society, because then those communities that lack agency can be further left behind as they fail to mobilise around this challenge. This means that whole-of-societal resilience has to be co-produced – a partnership between:

• Resilience partnerships: Local Resilience Forums (LRFs – England and Wales), Emergency Preparedness Groups (EPGs – Northern Ireland) and Regional Resilience Partnerships (RRPs – Scotland)
• Sector partners: Organisations that support the creation of local resilience through collaborative working with resilience partnerships, including the voluntary sector, business representative bodies, and the higher education sector
• Community: The individuals, neighbourhoods, businesses and organisations that share a characteristic such as being co-located

The voices of each of these three constituents are represented by NCSR+ members, although local communities will initially be represented through existing links that resilience partnerships and sector partners have with communities.

The Vision of the NCSR+ is “To enhance the UK[+]’s whole-of-society approach to resilience, so that individuals, community groups, businesses and organisations can all play a meaningful part in building the local resilience of our society”212. Its Objectives are for NCSR+ members to work together to:

• Sustain a supportive national eco-system to:
  • Establish concepts, language, and principals
  • Strengthen relationships with each other and whole-of-society
• Learn about:
  • Different perspectives and priorities across resilience partnerships and sector partners~
  • How others have built whole-of-society resilience
  • Lessons that are translatable to the UK[+] context

• Develop nationally-consistent approaches including:
  • A new foundation to establish a solid basis on which to build whole-of- society resilience
  • New local activities to build on that foundation
• Trial, implement, and evaluate the nationally-consistent approaches into members’ local activities

• Promulgate information and resources under the NCSR+’s neutral identity, including:

• • Existing information and resources given over to the NCSR+
  • New information and resources produced by the NCSR+

• Develop and implement an evaluation methodology to assess the changing confidence and maturity of whole-of-society resilience:
  • From the perspective of the NCSR+ members
  • From the perspective of whole-of-society

The NCSR+ is hosted by The University of Manchester and more information can be found on their website as www.ambs.ac.uk/NCSR

From the evidence we have heard, we conclude that the most effective approaches to building community resilience are known, with the components explained in a number of documents (covered in more detail below) and being demonstrated in a number of Resilience Partnerships. However, not all Resilience Partnerships understand how best to apply the theory in their local areas:

“What does a community mean? How do we do community resilience? Who should be engaged…? There are big rural vs metropolitan differences.”²¹³

and, as one Resilience Partnership noted:

“Need to make sure that every community gets the same support and consistent delivery from LRFs across the UK. Shouldn’t be a postcode lottery.”²¹⁴

Our judgement, based on the evidence gathered from Resilience Partnerships who are struggling to make progress, is that an effective peer support network is vital in providing practical hands-on support and advice to help all Resilience Partnerships successfully to interpret the theory and support the development of community resilience in their areas. We believe that, based on its stated aspirations, the NCSR+ could be one important means of providing this supportive peer network.

The only area which, based on the evidence we heard, may be under-powered is the engagement of communities in training and exercising. We heard from a number of interviewees that there would be significant benefits in integrating community resilience activity into multi-agency training and exercising. This would enable those involved in communities to see at first-hand how emergency responders operate. It would also allow responders to understand how and where community-level capabilities could support more formal emergency response activity (eg. in the community operation of rest centres).

Recommendation 24: The UK Government should explore, including with the National Consortium for Societal Resilience [UK+], how Resilience Partnerships can be provided with the practical hands-on peer support and advice they need to enable them to promote community resilience development in their areas.

Recommendation 25: The UK Government should include advice in statutory guidance on community participation in formal training and exercising activities organised at Resilience Partnership level, including advice on the appropriate legal and safeguarding issues.

Do Resilience Partnerships Have the Tools, Templates and Other Resources They Need?

As well as the updated Community Resilience Development Framework, and the supporting and updated tools and templates, the relevant Resilience Standard²¹⁵ also includes a useful schedule of “Guidance and supporting knowledge”. Our evidence indicates that the most successful community resilience initiatives draw on well-established principles of community engagement, seen in a range of other public policy areas, so it is helpful that the schedule includes good practice principles for enabling social action²¹⁶.

There will be a continuing role for the UK Government, possibly working with the NCSR+, to continue to develop guidance, resources and tools for Resilience Partnerships. An early priority should be statutory guidance, which has not been updated since 2011:

“… the important value-added role that can be played by local voluntary and community groups needs to be fully recognised. Guidance needs to be fundamentally changed to reflect that.”²¹⁷

A second will be the development of standard tools and templates for use by Resilience Partnerships. We heard from many Partnerships that, although there is a great deal of useful material, including tools and templates, on the ResilienceDirect shared platform, these have not been brought through into a single, common toolkit which embeds learning and good practice. Here as in other areas, there will be benefit in the Civil Contingencies Secretariat, possibly working jointly with the NCSR+, producing a single recommended suite of materials²¹⁸, for adaptation and use by Resilience Partnerships, avoiding each Partnership having to reinvent the wheel.

We also heard from some English LRFs that they would welcome advice on mapping community vulnerabilities, likely needs, assets and capabilities and support in identifying and accessing data sets to support that work. But we conclude that, with limited but important further work, the necessary tools, template and other resources needed are in place.

Are Resilience Partnerships Adequately Resourced for this Work?

The third issue we tested was whether Resilience Partnerships are adequately resourced for this work. The simple answer is that they are not.

Local bodies were clear that budget reductions in the period since 2010 have led them progressively to focus resourcing on areas where they have legal duties. Despite the obvious benefits, building community resilience is not a legal obligation on local bodies and therefore receives very limited, if any, funding in the majority of Resilience Partnerships:

“Communities know what the risks and consequences are. Need to capitalise on this but not had resources to do so.”²¹⁹

Not that a great deal of funding is needed. We heard evidence from the Partnerships which are making good progress on how a well-managed programme will engage a wide range of contributors, including especially a range of local authority services, some UK Government bodies (eg. the Environment Agency), and some voluntary groups focused on community action and empowerment:

“Extra resourcing for community resilience welcome. [Our LRF] is currently running a few locally resourced and independent fixed-term pilot projects on how they support local communities to become more resilient. These should be incorporated into an LRF-led programme of work that involves all responders but especially parish and town councils (who have the local knowledge). Harder in LRFs like Norfolk with highly dispersed populations, but possible with sufficient resourcing.”²²⁰

“[Our LRF is] using pilot funding to create Community Resilience Hubs based initially around fire stations with equipment / training to use in times of need.”²²¹

One common factor was that the most successful programmes had a dedicated Community Resilience Co-ordinator. The benefits of, and need for, such a co-ordinator and facilitator is highlighted as good practice in UK Government guidance on Enabling Social Action which identifies the need to:

“Recognise that paid facilitators can increase the capacity of residents to volunteer and support new groups to engage.”²²²

Having a funded, permanent post would ensure that community resilience was able to become a mainstream part of the work of Resilience Partnerships, providing sufficient capacity to enable a direct relationship to be established between Partnerships and the many communities they serve. Regular networking between postholders would also enable the provision of peer support as well as the effective and timely sharing of information and best practice. The Resourcing of Local Bodies and Resilience Partnerships section which describes the sustainable funding package needed for Resilience Partnerships therefore includes funding for such a post. The skills and experience required would most usefully focus on community outreach and may not, therefore, require someone with an emergency planning background:

“Staff in LRF organisations need development to help them understand a community development approach to enable them to work alongside communities. Need to move towards systems leadership, not command and control. Communities don’t work in hierarchies and in everyday settings don’t respond to command and control. Move attitudes and behaviours from organisations to place, from silo bred thematic organisations that are remote from the communities they serve.”²²³

Recommendation 26 (linked to Recommendation 69): The UK Government should encourage the Community Resilience Co-ordinators in each Resilience Partnership to form a network to enable the provision of peer support as well as the effective and timely sharing of information and best practice.

Is There Sufficient Commitment?

The final issue we tested was whether those involved in building community resilience believed that senior leaders, locally and nationally, were sufficiently committed to the work. We also tested whether, to encourage that commitment, there was a case for introducing a new duty under the Act requiring local bodies to promote and support community resilience.

It is clear from the evidence that we received that community resilience is seen as a vital element in building a whole of society approach to resilience. No-one disputes the clear benefits that might be achieved by empowering individuals and communities to take action to prevent, prepare for, respond to and recover from emergencies, with the support of designated local bodies. The investment needed to enable stronger progress is small. So it was unsurprising that, although we received a range of views on the merits of introducing a new duty, the weight of opinion was that doing so would be likely to drive faster progress – provided that it was properly funded:

“Need much fuller publication of information to support ‘whole of society’ engagement, especially community resilience. That work needs to be embedded in structures and funded, with clear guidance on how to implement and templates and tools behind it. Replace BCM promotion duty with building community resilience as a duty on all Cat 1s and 2s. Businesses and their supply chains should all be involved.”²²⁴

Interviewees recognised the potential to link to other duties in the Act, and noted that there is in place a National Resilience Standard for Community Resilience Development²²⁵ which has a desired outcome that:

“The LRF and partner organisations have a strategic and co-ordinated approach to activity that enables community and voluntary networks (which includes individuals, businesses, community groups and voluntary organisations) to behave in a resilient way and take action to support one another and members of the public.”²²⁶

However, although helpful, the clear view was that the Standard on its own, without legal backing requiring its delivery, was insufficient. The language does not reflect the importance of community participation in whole of society resilience, nor does it maximise the opportunity for building on the good work that is already underway. And now was felt to be the right time to seize the opportunity arising from the outpouring of practical community resilience support seen during the response to the COVID-19 pandemic.

Creating a new duty would significantly raise the profile of community resilience as a policy and enable more structured support at local and national level. Because building community resilience has to be a shared endeavour, any new duty should apply to all bodies, both locally and nationally:

“Seen as a local authority issue to lead but should be an issue for all partners.”²²⁷

with activity co-ordinated nationally through the Civil Contingencies Secretariat and through Resilience Partnerships at local level to avoid duplication and mixed messages to the public:

“Other people in local authorities are doing work in that space which needs to be fully integrated with whatever is done under the LRF banner.”²²⁸

The new duty should focus on promoting and supporting community-led actions rather than dictating specific activity. The key components of the new duty, which would need to be reflected in Regulations, a new dedicated Chapter in statutory guidance and an updated National Resilience Standard, should capture learning and good practice and focus in particular on:

1. Actively engaging with communities to support their real-world understanding of the risks that may affect them, the consequences and the likely response. The need for better sharing of information about risks, their consequences and response plans is covered in more detail in the New Culture
2. Enabling individuals, households and community groups to consider the specific actions they could take to prevent, prepare, respond to and recover from emergencies. This should include settings such as schools with concentrations of people, especially those who might be potentially vulnerable to the consequences of an emergency.
3. Using vulnerability assessments and capability-mapping to identify those communities that should be prioritised for support.
4. Identifying potential community capacity and resilience
5. Encouraging and supporting the creation or adaptation of community groups to use their resources and skills in resilience-building activities, including how best they can interface with statutory response structures.
6. The inclusion of community groups in multi-agency training and

Recommendation 27: A new duty should be added to an amended Act or future legislation requiring designated local and national bodies to promote and support community resilience, with delivery of the duty at local level being co-ordinated through Resilience Partnerships, and nationally through the Civil Contingencies Secretariat. Key elements of the successful execution of the duty should be clearly articulated in Regulations associated with the Act and developed further in a dedicated Chapter in statutory guidance. The National Resilience Standard for Community Resilience Development should be updated accordingly, to provide a clear roadmap for Resilience Partnerships to fulfil the requirements of the duty and build their own capabilities to support local activity.

What Does The Act Require?

As noted in the Renewed Approach section at the beginning of the Involving the Whole of Society chapter, effective risk and emergency management involves bringing together the actions of a wide range of organisations – at national, regional and local levels, across the public, private and voluntary sectors, and in communities – into a cohesive whole in support of the shared endeavour of avoiding or minimising harm and disruption.

One key lesson of the poor preparedness for and handling of the major emergencies of 2000 and 2001 was the need for the key elements of effective resilience-building to be mandated as duties in law. A second was that this shared endeavour needed to be captured within a legal framework which drove both collaboration and consistency across the wide range of organisations involved. Thus, the Act:

1. To promote consistency, placed the same suite of functional duties (eg. risk assessment; emergency planning) on to a wide range of bodies, with supporting statutory guidance on how those duties should be executed.
2. Also placed on designated bodies two duties – of co-operation, and of information- sharing – intended to promote collaboration between them.

These two sets of duties were placed on local statutory bodies and some UK Government bodies with local operational footprints. However, the then Government deliberately decided to reduce the burden on private sector companies – mainly the regulated utilities – by placing on them only duties of co-operation and information-sharing. This decision also reflected the fact that many of the companies involved were subject to separate regulatory regimes which required them to undertake some resilience-related activities.

The Act and its associated Regulations therefore provide for two ‘Categories’ of bodies, with

common, but sharply different sets, of duties as shown in Figure 4:

Figure 4 – Designated Bodies and their Duties under the Civil Contingencies Act

The analysis in the Duties chapter considers, for each duty, whether there is a need for changes to the law itself, or to arrangements for the execution of the duty. First, however, we consider whether, based on the analysis in the previous two Chapters on what we should be seeking to achieve in building UK resilience and who might be involved in doing that, whether there is a need to change the list of organisations who have specific legal duties placed upon them under the Act.

We have done so against the recommendation in the Legislative Implications section in the What is Resilience and a Truly Resilient Nation? chapter that the Act or successor legislation should be widened in scope, to include risk reduction and prevention as well as emergency preparedness. In undertaking an assessment of who needs to be involved, our start point has therefore been to identify which organisations can play a major role in risk reduction and prevention – in avoiding or reducing the likelihood of emergencies arising in the first place – as well as identifying those organisations which can play a major role in preparing for and responding to emergencies if they occur. Our research and interviews would suggest:

1. Broadly, the continuing designation of the bodies currently identified as Category 1
2. Amending the duties placed on Category 2 responders so that they are the same as those placed on Category 1 responders.
3. A number of new organisations being considered for addition to the designated responder list.

These three areas are covered in turn below.

The Designation of Core Bodies – Category 1 Responders

Many of the organisations designated in the Act have a role in both risk reduction and emergency preparedness, especially the emergency services, local authorities and specified health bodies. We received no evidence that any existing Category 1 bodies should have their designation removed.

We did, however, receive substantial evidence on the potential impact of the proposed re- organisation of the NHS under the UK Government’s Health and Care Bill²³². Evidence focused especially on the proposed subsuming of Clinical Commissioning Groups (CCGs) – currently Category 2 responders – into Integrated Care Systems managed by Integrated Care Boards (ICBs). Interviewees judged that, given their role in marshalling the activities of a wide range of bodies within the NHS family, the proposed ICBs should have Category 1 responder status. But interviewees were also clear that other NHS bodies, especially mental health Trusts, also had vital roles to play in the response to an emergency and should be designated, alongside acute Trusts:

“All health organisations should have some responsibilities to assist in doing LRF work. Mental health bodies should also be a Cat 1 responder. Physical and mental health should have parity. Integrated Care Boards need to be Cat 1 responders.”²³³

We are sympathetic to the proposal that ICBs should be designated as Category 1 responders. But, clearly, there will be a need to work through, once the Health and Care Bill has received Royal Assent, the implications for all NHS bodies post-reorganisation.

Recommendation 28: All existing Category 1 organisations should remain designated in Schedule 1 of the Act or successor legislation, except that the designation of NHS bodies should be reviewed once the Health and Care Bill has received Royal Assent. There are strong arguments for Integrated Care Boards to be designated as Category 1 responders; and for mental health Trusts to be placed on the same footing as acute Trusts.

The Designation of Co-Operating Bodies – Category 2 Responders

We have noted above the policy reasons which led to the regulated utilities, transport providers and others having a lighter set of duties than local statutory bodies, confined to information sharing and co-operation. The 2005 Regulations associated with the Act sought to underpin effective co-operation between Category 2 responders and other local bodies, including their engagement in the detailed work of Resilience Partnerships, through the so- called ‘Right to Invite, Right to attend’ formula:

“For the purposes of enabling general Category 2 responders to comply with [their duties], the general Category 1 responders … must –

• keep each general Category 2 responder …. informed of –
•  

when meetings of the local resilience forum are to take place;

•  

the location of such meetings;

•  

the matters which are likely to be discussed at such meetings;

•  

make arrangements for a general Category 2 responder to attend any such meetings where the general Category 2 responder wishes to do so;

• and consider whether a general Category 2 responder should be invited to attend such a meeting.”²³⁴

Regulations also sought to minimise burdens through allowing for Category 2 responders to:

“… be effectively represented by another responder at meetings of the Chief Officers Group for the local resilience area …”²³⁵

In the first post-implementation review of the operation of the Act in 2009²³⁶:

“… both Category 1 and 2 responders identified that there was an issue with the co- operation and information sharing duties in the Act. The Category 1 responders believed they did not receive the co-operation they needed from Category 2 responders, and Category 2 responders felt that Category 1 responders placed unreasonable demands on them.”²³⁷

As a result, amendments were made to the Regulations in 2012²³⁸ which were “designed:

• To clarify what is required of both Category 1 and 2 responders in fulfilling the co- operation and information sharing duties as set out in the Act; and
• To add flexibility to the ways in which fulfilment of the duties can be achieved therefore reducing the burden, especially on Category 2 responders.”²³⁹

In particular, the changes to the Regulations were intended to facilitate:

“… the introduction of protocols which will permit Category 1 responders to release some Category 2 responders from some of their obligations under the Act to engage at the local level within the local resilience area, on condition that those Category 2 responders meet those obligations in other ways which are acceptable to the Category 1 responders in that local resilience area, namely:

• Engaging in co-operation at the multi-LRF level;
• Making relevant information available at a national level (while continuing to engage with Category 1 responders at the local level in specified instances, as agreed).”²⁴⁰

It was made clear that the intention was that:

“Protocols will facilitate Category 2 responders’ co-operation, ensuring that co- operation can take place in accordance with new principles in guidance on the Right Issue, at the Right Time, at the Right Level. This will introduce new flexibility which will give responders a new ability to work more efficiently and more effectively together.”

The UK Government’s post-implementation review²⁴¹ in March 2017 assessed the success of those changes against a series of pre-set Success Criteria, with available evidence showing:

“Success criteria: Protocols are routinely in place

Evidence: Responders broadly agree that information-sharing protocols are useful, but that there are still challenges in accessing information (however, there is no available data on the frequency of protocols being in place)

Success criteria: The principles of responder engagement are embedded in practice

Evidence: Extensive evidence of good practice at the local tier, implying that these principles have been at least partially adopted.” ²⁴²

We have further tested whether the ‘Right to Invite, Right to Attend‘ formula, as amended by the change to the principle of ‘Right Issue, at the Right Time, at the Right Level’, is generating the level and quality of engagement needed between Category 2 responders and local bodies, particularly in the following areas:

1. Risk assessment, recognising that several of the most significant risks (eg. the loss of power, telecommunications or water) would start in the essential services sectors, and the potential cascading and compounding impacts between the sectors.
2. Emergency planning where, as recent ‘Storms’ have shown, essential service providers will have a major role in reducing harm and disruption.
3. Warning and informing the public before and during an

Our evidence has shown that, despite the best intentions in 2004 and 2012, the level of engagement between local bodies and Category 2 responders has declined over time, especially as senior managers in the companies involved have reduced resources devoted to emergency preparedness. However, we did receive evidence that the situation was better in Scotland:

“Scottish Government put utilities under pressure to come to the table and they have done over the past five years.”²⁴³

Worse, a position has progressively developed where Category 2 responders feel that they are, or are regarded as being, “second class citizens”, including by not being invited to be fully involved in the work of the LRF, eroding the vital spirit of partnership on which resilience-building is founded.

Engagement by water companies was, generally, viewed in our interviews to be reasonably good:

“Water companies are better. Very good people locally (Anglian Water and Essex and Suffolk Water).”²⁴⁴

“No issues with water sector: South West Water completely engaged, come to all the meetings, lead on assessing their risks.”²⁴⁵

“Surprised that other utilities don’t appear to be represented at LRFs. Would expect to see water suppliers for discussions on flooding for example. Environment Agency are present. In Surrey, water suppliers are invited and don’t come.”²⁴⁶

Engagement with power companies was, generally, judged to be reasonable, although there were wider variations:

“…electricity good; gas less so.”²⁴⁷

“Good engagement on risk with some Cat 2 responders (eg. Severn Trent; Western Power; SSE) …”²⁴⁸

“Power worst. Never see Western Power Distribution. Lead person links with 7-8 LRFs and doesn’t have the resources to do a proper job.”²⁴⁹

Engagement by the telecommunications sector was generally judged to be poor, with a few specific exceptions:

“Never seen telecoms, only the other utility providers.”²⁵⁰

“One telecoms provider refused to attend a severe weather SCG meeting where their input was critical.”²⁵¹

“Telecoms engaged as [it] is uniquely local with a local provider for a significant part of the area.”²⁵²

“Telecoms sub-group works well: BT person who leads it lives in the county. But recognise that won’t be the case across the UK.”²⁵³

As OFCOM have noted, part of the reason for this may be fundamental changes in the telecommunications market since 2004:

“Market has changed fundamentally in last 20 years. Many different network and retail providers, so unsurprising that original expectations in 2004 of industry engagement have faded … there are not local telecoms teams that naturally sit alongside LRFs – which means that you need to work out the most effective mechanisms to get telecoms companies engaged.”²⁵⁴

Engagement with transport providers was variable:

“Transport: good inputs from rail, airports, National Highways. Ports … difficult.”²⁵⁵

It is clear that, despite the valuable contribution to the work of Resilience Partnerships made by a range of Category 2 responders, the ‘Right to Invite, Right to Attend‘ formula, as amended by the ‘Right Issue, at the Right Time, at the Right Level’ principle, does not provide the consistent, high-quality engagement needed of Category 2 responders in risk assessment and emergency planning to provide a solid foundation for their effective involvement in the response to emergencies:

“… If people aren’t there in peacetime, will they be there in an emergency? … ‘Right to invite / right to attend’ is fine, but not working well enough at the moment.”²⁵⁶

“Cat 2s have a duty to engage already and experience is mixed so needs to be regulated so that they are engaged.”²⁵⁷

We are particularly mindful of the future risk perspective facing the UK – including the impacts of the leading effects of climate change, increased technological dependence and the risks associated with ageing infrastructure – which in our view only increases the need to ensure that the providers of essential services are fully engaged in all resilience-building activity. And there will be a premium on activity by the utility and transport providers to prevent risks arising in the first place, especially those caused by infrastructure vulnerabilities or failure to mitigate cascading and compounding impacts between operators.

We are also conscious of societal expectations, as clearly illustrated in Storm Arwen²⁵⁸ which saw electricity disruption to almost one million customers, with a small but significant proportion experiencing a disruption of up to 11 days²⁵⁹. The public very reasonably has increasing expectations of Category 2 organisations to demonstrate their competence in both avoiding disruption and in quickly restoring services when disrupted, working in close collaboration with other local bodies in their area.

The goal here has been well-expressed by the National Infrastructure Commission260:

The UK’s economic infrastructure has, for the most part, proved resilient to shocks and stresses over recent years. However, over the past year, major floods and the UK’s worst power cut for a decade have offered a glimpse of the disruption that can happen when something goes wrong. While the flooding was localised and the power cut short term, both had significant impacts on families and businesses. The risks of disruption will be exacerbated by climate and other changes.

Resilient infrastructure can continue to provide the services the UK relies on despite shocks and has the capacity to adapt and transform to longer term chronic stresses, risks and opportunities.

To deliver resilient infrastructure, a framework for resilience is required that:

• better anticipates future shocks and stresses by facing up to uncomfortable truths
• improves actions to resist, absorb and recover from shocks and stresses by testing
• for vulnerabilities and addressing them
• values resilience properly
• drives adaptation before it is too late.

Much of this will be achieved through policy and regulatory regimes. But we believe that full engagement in resilience-building activities at local level will be an important foundation.

We have, therefore, considered the option of placing the full suite of Category 1 duties on Category 2 responders.

During our interviews, Category 2 responders themselves cited the benefits they obtained, or would obtain, from their fuller engagement in risk assessment, emergency planning and, especially, exercises, even if their ability to provide input was limited:

“Cat 1s do not always consider Cat 2s in their planning where they believe it is not directly related, however there may be points they have not considered where they could add value; this is a weakness. Society is so interconnected that no one organisation can or should own the entire planning process. Good risk assessment and planning needs the right inputs from a wide range of organisations so they can be considered and developed in the round.”²⁶¹

“Would like to do more exercises cross-sector in the key interdependency areas – power, fuel, water. When BT presented to Water UK a few years ago, water suppliers were surprised that BT needed water for cooling which wasn’t built into water suppliers’ plans. Shows the benefits of engagement on planning and exercising.”²⁶²

However, the strongest arguments for the benefits of the full involvement of Category 2 responders came from Category 1 responders who universally stated that this was critical to their work and to reducing disruption and harm to people in their communities:

“Cat 2s can provide a valuable input, especially on concurrent and interdependence/ cascading risks. If not got everyone round the table, then missing useful detail. Need to get co-operation and information sharing from Cat 2s on risk assessment too.”²⁶³

As a result, almost all Category 1 responders stated that Category 2 responders should be given the full suite of duties:

“Cat 2 responders in power, water and communications sectors should have full range of Cat 1 duties.”²⁶⁴

“Need to move Cat 2s from being second class citizens to being on a par with Cat 1s: they should feel like equal partners.”²⁶⁵

“…differentiation in duties between Cat 1 and 2s not helpful. Should be the same duties for both.”²⁶⁶

“Cat 2 bodies …. can feel like second class citizens, and don’t have the resources to engage as fully as needed … their engagement is vital.”²⁶⁷

“When Cat 2s are engaged, they provide excellent support and situational awareness. Cat 2 status in general feels like second class citizenship. Why do we have Cat 2s?

They are integral to all aspects of the work of the LRF, and to response. No good operational reason for differentiation. They need to be full partners.”²⁶⁸

“Had real difficulties with power companies understanding of multi-agency response in Storm Arwen … change is definitely much needed. Significant issues on roles and responsibilities, in preparation and in response. And that feeds into trust and confidence. Confidence lost in Storm Arwen over information-sharing and who should lead on what issues, and when. Cat 2s have to be held accountable so that they have to engage, as in other risks areas (eg. nuclear). Cat 2 bodies see their responsibilities differently, the SCG looking at it from the needs of people affected. They need to be on an equal footing with other Cat 1 bodies …”²⁶⁹

We also considered whether operators should be required to have effective organisational resilience so that they themselves are able to sustain operations even during emergencies:

“Infrastructure resilience is clearly key to future resilience. Need to lever in full Cat 2 support. These organisations lacked their own resilient infrastructure when Storm Arwen response extended beyond the first 24hrs. Need to stress test high impact incidents on the operational continuity of organisations.”²⁷⁰

Our evidence would strongly support the recent recommendation of the House of Lords Select Committee on Risk Assessment and Risk Planning that:

“A statutory duty should be placed on all public and private regulated bodies who operate critical national infrastructure to produce and publish an audited business continuity plan.”²⁷¹

Despite the strong case being made, we were also mindful of the financial implications of placing additional duties on Category 2 responders. We assess the additional resource burden in practice to be relatively small, mainly comprising additional staff to participate in the activities of Resilience Partnerships. But there are three obvious ways of working which, individually or taken together, would reduce the additional cost:

1. Engaging Category 2 responders at multi-LRF / regional level, especially in risk assessment. The benefits of this approach were cited by both Resilience Partnerships and Category 2 responders, who also made reference to the analogous arrangement for pan-Scotland working:
   

   “…need to see how to engage them at regional level where that is more efficient or better operationally. Used to be an East of England multi-agency support group to engage Cat 2s regionally, facilitated by Anglian Water, which was a casualty of their restructure. Cat 2s were well represented and could engage with multiple LRFs at once.”²⁷²
   “Regional layer would add value in getting connectivity and consistency of approach across LRF areas. Cross-fertilisation of ideas would be good. And society is more blurred now, with people living and working in different areas … Fewer meetings would be good but may end up having to do local and regional meetings so may end up with more meetings.”²⁷³
   “Better in Scotland, where there is a more structured hierarchy including a designated single point of contact for the emergency services. A lot easier and less resource intensive way for them to engage.”²⁷⁴
   

   We revert to this in the Regional Resilience Structures in England section.

2. Mutual cross-working, where one company effectively represents the interests of others in the sector, as allowed for in the Regulations and described earlier. This system is already operating in the water sector, for example, where one water company – usually the one with the most customers in a Resilience Partnership area – takes the lead in attending Resilience Partnership meetings on behalf of all the companies operating in that area.
3. The greater use of virtual attendance at meetings:

“Been better since everyone moved to virtual working. Working regionally and virtually means that Cat 2 partners can more easily service multiple LRFs.”²⁷⁵

“London LRF do calls every Friday but they only last 20 minutes – if that was the model in the rest of the UK, we wouldn’t be complaining. They make it easy to collaborate. Very well managed meetings. Pleasure to work with.”²⁷⁶

Interviewees also reflected that, for the regulated utilities, what would be a small additional resource burden could be added by Regulators to the utilities’ relevant pricing formula.

Finally, we tested – including with one Regulator – whether the goal of fuller engagement by Category 2 bodies would be best achieved by placing duties on them under the Civil Contingencies Act or future legislation or by changes to the regulatory regimes governing their activities. We decided that, on balance, the Act provided the better route for the reasons set out below, although we recognise that the UK Government will wish to test this further, including through consultation with the regulators and companies concerned:

1. Not all relevant Category 2 responders are covered by regulatory
2. Putting the duties in one place, and applying them equally and consistently across all bodies, strengthens the spirit of partnership and collaboration which, as noted above, was a key original goal of the Act.
3. Having a single set of common duties, with associated common standards for performance, facilitates the radically-improved arrangements for validation and assurance we recommend in the Validation and Assurance
4. Having a single set of duties and performance standards avoids the complexities of sustaining alignment between different legal and policy regimes:

“…better overall to tackle better engagement of Cat 2s via the [Act] than via regulatory regimes. Would also avoid interface issues between multiple regimes (eg. in updating guidance so it remains consistent across regimes).”²⁷⁷

We conclude that the full engagement of Category 2 responders in local resilience-building activity would bring significant benefits for UK resilience and that the additional costs would be relatively limited. The case for giving Category 2 responders the full suite of duties placed on Category 1 responders is compelling.

Recommendation 29: The full suite of Category 1 responder duties should be placed on the organisations currently designated under the Act as Co-operating Bodies (Category 2 responders). The UK Government should pursue and capture in statutory guidance ways in which the additional burdens of fulfilling the new duties might be reduced, for example by activity undertaken at multi-LRF / regional level.

The Designation of New Bodies

Duties to be Placed on the UK Government

When the Act was put in place, a decision was made by the then UK Government not to place legal duties on the UK Government despite the obvious disparity with the placing of duties on local statutory bodies and a handful of government agencies with local delivery footprints. This policy decision is recognised in the title of Part 1 of the Act itself – “Local Arrangements For Civil Protection” (our emphasis).

The Joint Committee on the Draft Civil Contingencies Bill²⁷⁸ received some evidence which suggested that placing duties on central (and regional) tiers of government and the Devolved Administrations would enhance the creation of a clear national civil contingencies framework²⁷⁹. Other evidence to the Committee suggested this would not add much value to the process as there were already non-statutory relationships and procedures in place²⁸⁰.

In his evidence, the then Minister of State at the Cabinet Office said that placing duties on UK Government departments would be difficult to achieve:

“The Minister in charge of the Bill told us: “It is difficult to see how a sensible, meaningful duty could be imposed on central Government by way of statute”.”²⁸¹

However, the Committee confirmed that there were numerous examples of legislation imposing duties on Secretaries of State²⁸² and stated that:

“Given that central and regional government and the Welsh Assembly Government do in reality plan for and respond to emergency situations, we can see no reason for not according them a statutory duty to do so. At the moment, the Bill appears to be very ‘bottom heavy’, with all statutory duties being accorded to local providers and a cloak of invisibility being drawn over the regional and central tiers. It is entirely conceivable that a local emergency could turn into a regional one and then a national one. Given this potential, it is vital that the role of the regional and central tiers is clarified and codified, so that the chain of responsibilities is obvious to all. Without a statutory duty on central or regional tiers, it is difficult to see how the comprehensive national framework that the Government hopes to attain through this Bill can be achieved.”²⁸³

They concluded with a recommendation that:

“… the role and responsibilities of Government Departments, the National Assembly for Wales and regional government are outlined on the face of the Bill and that they are given a statutory duty to undertake their responsibilities.”²⁸⁴

The Government decided not to act on that recommendation.

Experience since 2004, and especially over the past decade, has shown this decision to be fundamentally wrong. Effective resilience can only be achieved as a shared endeavour, with the UK Government working in full partnership with the Governments of the Devolved Administrations and with designated local bodies. Central government departments have to carry their share of the load and have a vital leadership, operational and enabling roles to fulfil. This is particular the case for those departments designated as Lead Government Departments²⁸⁵, with identified roles – but not duties – on risk assessment, emergency planning and response. And it is especially the case for the Cabinet Office, as the home of the National Security Adviser and the Civil Contingencies Secretariat, which not only has the same roles but also provides overall leadership for the entire system.

The requirement for UK Government to have legal duties was emphasised repeatedly by interviewees, especially Category 1 responders, who particularly brought out the double standard inherent in the current approach, with government operating a model of ‘do as we say, not as we do’:

“Have to have duties on central government departments the same as those on Cat 1 bodies. They have equal responsibilities.”²⁸⁶

As well as the inherent unfairness of the existing position, interviewees also emphasised that placing duties equally on UK Government departments would create more of a sense of equal partners working together to achieve a shared aim:

“There is sometimes a feeling that HMG and LRFs are not of the same standing, and that there is not a mutual basis of respect and trust in the relationship.”²⁸⁷

We share this view, especially in light of the evidence we have heard on weaknesses in the discharge by UK Government departments of their lead department responsibilities. There is no logical reason why the activities undertaken by UK Government departments, and hence the duties to be placed on UK Government, should not be exactly the same as those for designated Category 1 responders at local level:

• Risk identification and assessment
• Risk reduction
• Emergency planning
• Public awareness raising
• Warning and informing the public
• Organisational resilience/business continuity management
• Information sharing
• Co-operation

although the exact nature of the work to be completed under each duty will obviously vary from that of local responders. For example, UK Government departments will work together to produce a National Security Risk Assessment as opposed to the Community Risk Register produced by Resilience Partnerships. And the Civil Contingencies Secretariat and Lead Government Departments will be responsible for producing strategies, policies and guidance for delivery by local responders as well as undertaking direct delivery themselves.

Some of these activities are already covered in a guidance document²⁸⁸ on the responsibilities of Lead Government Departments produced in 2004, but the content needs to be updated and then incorporated into statutory guidance. This new material should differentiate clearly the roles and responsibilities of:

• The Cabinet Office, and especially the National Security Adviser and his or her deputies, and the Civil Contingencies Secretariat
• Lead Government Departments
• Other departments who might act in support of the Cabinet Office and Lead Government Departments in delivering the duties placed on Government as a whole

Recommendation 30: The full suite of Category 1 responder duties should be placed on the UK Government. Associated Regulations and statutory guidance should set out the roles, responsibilities and accountabilities of relevant departments and agencies in the implementation of those duties, differentiating clearly between the Cabinet Office, Lead Government Departments and other departments and agencies who act in support.

We revert in the Validation and Assurance chapter to the definition of Standards for the execution of those duties, and for the coverage of the performance of UK Government departments in a radically improved validation and assurance regime.

Other Organisations

The list of designated responders at Schedule 1 to the Act will need to be updated to reflect organisational developments which have taken place since the last Quinquennial Review of the Act and those which are in prospect. The impact of re-organisation of the NHS under the Health and Care Bill is covered in the Designation of Core Bodies – Category 1 Responders section. In addition, a number of organisations who could be considered for inclusion were raised during our evidence-gathering.

The first group comprises those organisations which have an important role in both risk reduction and emergency preparedness and response:

1. The Animal and Plant Health Agency (APHA) – an executive agency of the Department for Environment, Food & Rural Affairs, which also works on behalf of the Scottish Government and Welsh They work to safeguard animal and plant health for the benefit of people, the environment and the economy.²⁸⁹
2. The Food Standards Agency (FSA) – the independent government body working to protect public health and consumers’ wider interests in relation to food in England, Wales and Northern Ireland. Their mission is food we can trust.²⁹⁰
3. The Meteorological Office – the national meteorological service for the UK who provide critical weather services and climate science.²⁹¹
4. Internal Drainage Boards²⁹², given their important role in reducing flood risk to people and property:

“On flooding, [we] struggle with Internal Drainage Boards. A lot of flooding episodes come from drainage ditches owned and maintained by IDBs. They do some prevention work but never want to get involved in emergency response, on the basis that they aren’t a Cat 1 or 2 responder.”²⁹³

The second group comprises those companies who provide critical services whose loss would cause harm and disruption, or whose facilities could themselves cause harm and disruption in the event of a major accident. These include:

1. Companies who own or operate Critical National Infrastructure²⁹⁴ which provides vital services to the public. Logically, because they provide essential services, all such operators should be designated.
2. Operators of COMAH sites and other industrial sites when they hit the COMAH threshold²⁹⁵ – Site operators are regulated through The Control of Major Accident Hazards (COMAH) Regulations²⁹⁶ which ensure that operating companies take all necessary measures to prevent major accidents involving dangerous substances and limit the consequences to people and the environment of any major accidents which occur. We note that the Joint Committee on the Draft Civil Contingencies Bill recommended bringing COMAH site operators under the auspices of the Act:

“Given their potential to cause, as well as their ability to respond to a major disaster, we recommend that the Government consider whether to include in Category 2 all operators of establishments subject to the Control of Major Accident Hazards (COMAH) Regulations …”²⁹⁷

298. A similar arrangement should be considered for operators of sites falling under the Radiation (Emergency Preparedness and Public Information) Regulations (REPPIR)²⁹⁸.
299. The UK Oil Pipeline System – This transports 5 billion litres of product each year from ingress points via import terminals on the Thames and at the Essar Stanlow refinery and egress points into West London, Hemel Hempstead and Kingsbury as well as a spur to Northampton Terminal. The pipeline is operated and maintained by the British Pipeline Agency (BPA). UKOP is currently owned by a consortium of five shareholders – Essar Midlands Ltd, BP, Shell, Valero and Total²⁹⁹.

1985. The Oil and Pipelines Agency – a statutory public corporation, sponsored by the Secretary of State for Defence, formed in 1986 by virtue of the Oil and Pipelines Act The Agency manages, operates and maintains six Naval Oil Fuel Depots and a Petroleum Storage Depot on behalf of the Ministry of Defence³⁰⁰.
1986. The Crown Estate, which manages around half of the foreshore (the land between mean high and mean low water mark) around England, Wales and Northern Ireland. In this capacity, it leases and licences tidal land and seabed for port and harbours infrastructure, moorings and marinas, and cables, pipelines and outfalls³⁰¹. It plays an active role in the UK’s offshore wind sector, including leasing sites, and provide rights for thousands of kilometres of telecommunications and power cables on the seabed, as well as for oil and gas pipelines³⁰².

Representations were also made to us by St John Ambulance that, given their auxiliary status during the response to the COVID-19 pandemic, they should be added to the list of designated responders. We are sympathetic to this request. St John Ambulance support NHS Ambulance Trusts, who draw on their resources and use them under both NHS procurement arrangements and on a commercial basis on front-line operations and for the provision of medical support at events. Importantly, they operate to NHS Core Standards³⁰³, which can be assessed and validated for quality, and are registered by the CQC³⁰⁴.

Finally, representations were made to us by the British Red Cross (BRC) that their status as an auxiliary to the UK Government in the humanitarian field should be recognised in law. The BRC has particular, well-proven and highly valuable capabilities in planning, needs assessment and humanitarian assistance for emergencies, especially those which occur overseas, which we believe should be recognised in statutory guidance.

Recommendation 31: The UK Government should consider with the organisations concerned whether the Animal and Plant Health Agency, the Food Standards Agency, the Meteorological Office, Inland Drainage Boards, operators of COMAH and REPPIR sites, the UK Oil Pipeline System, the Oil and Pipelines Agency, The Crown Estate, and St John Ambulance and other charitable ambulance services should be considered for addition to the Schedule of designated bodies with legal duties under the Act or successor legislation.

Recommendation 32: The status of the British Red Cross as an auxiliary to the UK Government, and its particular and valuable capabilities in planning, needs assessment and humanitarian assistance for emergencies, especially those which occur overseas, should be recognised in statutory guidance.

The Ministry of Defence and the Armed Forces

Although the Armed Forces have a long history of providing support to the civil authorities, the question of their designation was not substantively addressed in debate on the Civil Contingencies Bill³⁰⁵ in 2003, notwithstanding the significant contribution made by the Armed Forces to the response to the emergencies in 2000 and 2001 which prompted work on the Bill. The issue has arisen occasionally in the period since 2004 although, interestingly, it did not arise in our interviews. But we considered nonetheless whether circumstances had changed in the past 20 years to merit designation, especially in light of the substantial and valuable deployment of the Armed Forces in support of government departments and local statutory bodies during the response to the COVID-19 pandemic.

The current position is well set out in the recent update by the Ministry of Defence of their Joint Doctrine Publication (JDP) 02, UK Operations: The Defence Contribution to Resilience (4th Edition)^306.. This recognises that:

“Defence has a key role supporting lead government departments, devolved administrations and civil authorities as they prepare, respond and recover from disruptive challenges and major national events.”³⁰⁷

It also seeks to frame – and bound – that contribution:

“Defence supports the civil authorities in ensuring resilience in the UK through either augmentation and/or providing specific capabilities. Enduring contributions are generally limited to only those where:

• it is unreasonable or unrealistic to expect the civil authorities to develop their own capabilities; or
• delivering the capability offers significant and demonstrable benefit for

The above points are not applicable to military aid to the civil authorities (MACA) tasks relating to industrial action or the undertaking of activity in support of service level agreements.”³⁰⁸

Arrangements for the provision of military aid to the civil authorities (MACA) are of most relevance to UK resilience. Here, the MOD sets out the key principles governing that contribution:

“The provision of Defence assistance is governed by four principles. MACA may be

authorised when:

• there is a definite need to act and the tasks our Armed Forces are being asked to perform are clear;
• other options, including mutual aid, commercial alternatives and the voluntary sector, have been discounted, and either
• the civil authority lacks the necessary capability to fulfil the task and it is unreasonable or prohibitively expensive to expect it to develop one; or
• the civil authority has all or some capability or capacity, but it may not be available immediately, or to the required scale, and the urgency of the task requires rapid external support from the MOD.

In exceptional circumstances Defence ministers can choose to temporarily waive these criteria. This may happen when there are major events of national and international importance, or an event that is catastrophic, or potentially so, in nature. Equally, in some cases intervention may be required earlier than the criteria indicate to reduce the risk of events deteriorating and/or to reduce the scale of any subsequent Defence support.”³⁰⁹ (Our emphasis)

Finally, the document makes clear that defence planning for the size and shape of the Armed Forces, or for the capabilities they deploy, does not make specific provision for MACA tasks:

“The MOD does not usually generate forces or hold equipment specifically for resilience tasks. This is because:

• the requirement is unpredictable in scale, duration and capability;
• Defence is often able to meet requirements from spare capacity; and
• it would involve using Defence’s budget to pay for other government departments’ responsibilities.”³¹⁰

The principles governing the provision of military aid to the civil authorities is often characterised as the Armed Forces being the provider of ‘last resort’, a characterisation recently repeated by the Defence Secretary³¹¹. Underpinning this approach are two key concerns:

1. That the Armed Forces should not be asked to make up for avoidable shortfalls in the emergency response capabilities of civil bodies.
2. That the Armed Forces may be committed to operations and military tasks elsewhere, so that defence capabilities may not in practice be available or could only be provided at significant cost to the achievement of other important goals.

We believe that, for the vast majority of emergencies, the principles surrounding the use of MACA hold good. A fundamental principle of effective resilience has to be that the civil authorities are sufficiently prepared for emergencies. As the House of Commons Defence Committee in its review of the contribution of the Armed Forces to the response to the COVID-19 pandemic has observed:

“The Government must take steps to ensure that the civilian agencies which have statutory responsibilities prepare properly, and that Defence does not become the default ‘first responder’ to make good deficiencies exposed by a developing crisis.”³¹²

The Committee drew on this to recommend that the Government:

“Strengthen civil crisis response capabilities to ensure Defence does not become the ‘responder of first resort’.”³¹³

We address in the Validation and Assurance chapter the radically improved arrangements for validating the capacity and performance of designated bodies with duties under the Act or successor legislation which we hope will help to address the Committee’s concern. But it is clear that there remains no general case for the designation of the Armed Forces under the Act.

We do, however, believe that, for “major events of national and international importance, or an event that is catastrophic, or potentially so, in nature” there may be a position for the Armed Forces which lies between ‘first resort’ and ‘last resort’. In circumstances where the Government is, in effect, mobilising a national effort to tackle a catastrophic emergency, it would seem perverse that the Armed Forces would be asked to stand to one side. They are as much a part of a ‘whole of society’ response to an emergency on that scale as other parts of society. This area should be one important component of the future development of resilience in the UK, drawing on lessons from the response to the pandemic.

Recommendation 33: There remains no case for the designation of the Armed Forces with duties under the Act or successor legislation. But the UK Government should review the contribution which should be made by the Armed Forces, alongside all other parts of society, to the response to future national, wide-scale catastrophic emergencies and, if appropriate, take the conclusions into future legislation and statutory guidance.

Previous Chapters have covered what we should be seeking to achieve in building UK resilience, who might be involved and whether there is a need to change the list of bodies who have specific legal duties placed upon them under the Act. This Chapter considers whether the duties themselves need to change, or arrangements for their execution.

It does so against the unanimous view of those we interviewed – and ours – that most of the duties in the Act remained sound and fit for purpose. But it is clear from our research and interviews that, unsurprisingly, there is a need for updating, and in some areas wholescale revision, of some of the duties to take account of experience and developments over the past 20 years. The analysis below reviews each duty and makes recommendations for the changes we believe are needed so that they address the needs of the next 20 years.

The Risk Assessment Duty

The anticipation and assessment of the risks that can affect people, the economy and the environment is a vital underpinning to all resilience activity. It enables planning which seeks to prevent risks arising or to reduce their likelihood. It enables emergency managers to build and test plans and capabilities which seek to mitigate their consequences. And, importantly, it provides an objective basis for the prioritisation of activity and resources.

What Does the Act Require?

The UK developed the first National Risk Assessment in 2005, in parallel with the introduction of linked local (and regional) risk assessments. These are covered by a simple duty in the Act on local bodies that they shall:

“ … from time to time assess the risk of an emergency arising …”³¹⁴

Regulations to the Act constrain the scope of this duty to being only:

“… in relation to an emergency which affects or may affect the area in which the functions of the Category 1 responder are exercisable.”³¹⁵

Statutory guidance³¹⁶ provides substantial material for local bodies, in particular on the purpose of the duty:

“ …to:

• ensure that Category 1 responders have an accurate and shared understanding of the risks that they face so that planning has a sound foundation and is proportionate to the risks;
• provide a rational basis for the prioritisation of objectives and work programmes and the allocation of resources;
• enable Category 1 responders to assess the adequacy of their plans and capabilities, highlighting existing measures that are appropriate, and allow gaps to be identified;
• facilitate joined-up local planning, based on consistent planning assumptions;
• enable Category 1 responders to provide an accessible overview of the emergency planning and business continuity planning context for the public and officials; and
• inform and reflect national risk assessments that support emergency planning

and capability development at these levels.”³¹⁷

The duty in the Act to assess risk, and the linkage between risk assessment at national and local levels, has been a vital underpinning to resilience activity in the UK. It is clear from the evidence we have gathered that the duty should remain.

Recommendation 34: The risk assessment duty in the Act remains fit for purpose and should remain at the core of resilience activity in the UK.

Are Changes Needed to Arrangements for the Execution of the Duty?

However, there is compelling evidence to suggest that the current approach to the assessment of risk has serious deficiencies – in methodology, in process, and in access and engagement – which reduce the potential value of the risk assessments produced and mean that time which could be better spent using risk assessment in resilience-building activity is being spent on non-value-added process.

Methodology

No risk assessment methodology will ever be ‘perfect’, or ‘final’. Risks will change in nature and likelihood over time. So will society and infrastructure, altering inherent vulnerability and exposure. And even the most objective risk assessment methodology will require the inclusion of professional judgements by its authors, capable of being contested and changed.

It is understandable, therefore, that the national risk assessment process has been the subject of continuous development since 2004. The UK Government, in its Integrated Review, announced a further review:

“… which will address all aspects of the underlying methodology, including how we account for interdependencies, cascading and compound risks.”³¹⁸

The most significant change to the risk assessment process was the evolution in 2010 to the UK having both the National Risk Assessment focussing on core ‘disaster’ risks over a five- year period and a National Security Risk Assessment (NSRA). The goal of the latter was to:

“…go further than just assessing domestic civil emergencies … [to] consider for the first time all aspects of national security.”³¹⁹

covering:

“… the full range of existing and potential risks to our national security which might materialise over a five and 20 year horizon.”³²⁰

and intended:

“… to give us strategic notice about future threats to enable us to plan our response and capabilities in advance.”³²¹ (Our emphasis)

Continuous development of the UK’s risk assessment methodology has been informed, especially in the 2019 iteration, by the conclusions of external scrutiny. These have included the Royal Academy of Engineering³²² and Parliament³²³, most recently through the House of Lords Select Committee on Risk Assessment and Risk Planning³²⁴. The Committee’s report contains a wide range of recommendations³²⁵ on changes to the NSRA which go wider than the remit of our Review. But we have in our research and interviews identified three areas where front-line organisations considered that weaknesses in the current methodology hindered effective resilience-building activity at local and regional levels.

The Need for a Longer Timeframe

The previous separate five-year National Risk Assessment and 20-year National Security Risk Assessment where in 2019 amalgamated into a single NSRA, with a two-year horizon. The Cabinet Office has explained that the reason for combining the assessments was that:

“… having a single consistent product coming out of government that assesses all risks on the same basis and allows people to judge malicious and non-malicious risks alongside each other is … more valuable than a system where we have two registers alongside each other, using different methodologies.”³²⁶

and that the reason for adopting a two-year timeframe was:

“The shorter the timeframe, the more nuanced a story we can construct about the risk. On longer timeframes, we have a greater degree of uncertainty about the direction the risk takes … ultimately the purpose is not to make the best possible articulation of what the risk might be; the purpose is to aid planning … that greater specificity has benefits for organisations as they are choosing what to focus their planning on … the response to the overwhelming majority of these emergencies can be improved within a relatively short timeframe. Two years, one year or months is enough to make a very significant step forward in preparedness …”³²⁷

We profoundly disagree with this view, which we understand is driven by the difficulty of assessing malicious threats at timeframes longer than two years³²⁸. So, more importantly, do local responders who are using the NSRA to inform their own local risk assessments and resilience-building activity:

“Also need to consider long-term risk preparedness. Two year time horizon of the NSRA is too short to bring in climate change risks. Need to look at things in different time periods: risks which are 5-10-20 years away are still important for capacity building and local response even if they are not likely to happen imminently. Covering those helps with community resilience and preparedness activities: want to get communities thinking in good time about what they can do to help prevent and prepare for the risks.”³²⁹

“Where is climate change and how does this feed into future risk and consequences covered? Not in NSRA, which is too short term.”³³⁰

First, two years is not long enough for capability-building in some key areas, especially for emerging societal hazards, especially those with complex cascading and compounding effects across multiple sectors. If the NSRA is to be used to inform and prioritise preparedness activity across all risks, as set out in statutory guidance, then its timescale and methodology needs to provide the best possible prior understanding of those risks in sufficient time to allow effective action.

Second, a two-year timetable does not provide the “strategic notice” sought in 2010 about the scale and likelihood of future threats such as the effects of climate change or emerging infectious diseases. And that restricts the ability to develop insight into the need for long- term investment in risk reduction activity and artificially limiting the time available for capability-building, which may take many years to implement.

Nor does it cover the ‘chronic risks’ and vulnerabilities inherent in society at national and local levels which may worsen over a period of time until they reach a tipping point where they are judged to be intolerable, requiring treatment. We recommend in the Resilient Places section that the UK Government should encourage and support localities in the development of Local Resilience Strategies which seek to build deeper societal resilience, on the lines of the work done in London, Manchester and Hampshire and the Isle of Wight. Risk assessments with a two-year horizon will be an inadequate basis for long-term policy-making (eg. in planning, housing and transportation policies) or investment decisions (eg. in the resilience of key elements of local and national infrastructure).

The House of Lords Select Committee has recommended that:

“The NSRA should move to a five-year timeline, with risks refreshed and reassessed annually.”

and that:

“Chronic risks, chronologically unpredictable risks, low-likelihood risks and the most significant risks should also be accompanied by a long-term assessment of 15 years.”³³¹

We share the same view. The changes made in 2019 were a mistake and should be reversed.

Recommendation 35: The current two-year timeline for the National Security Risk Assessment does not provide a sound platform for effective resilience-building activity at national and local levels. It does not sufficiently inform planning and capability-building for emerging societal hazards, especially those with complex cascading and compounding effects across multiple sectors, and including chronic risks which might worsen over an extended period of time. Nor is it an adequate basis for long-term policy-making or investment decisions for risk reduction and prevention projects which will be implemented over several years. Risk assessment should be returned to the previous practice of having separate assessments that look ahead for five years and twenty years respectively, to enable longer-term prevention and preparedness activity.

Embedding Concurrency

The current NSRA methodology focusses on the assessment of single risk scenarios. It carries the implied assumption that each will occur and be addressed independently.

We note in the Future Risk Picture section the likelihood that the UK will face more emergencies with cascading and compounding consequences – in effect, that one emergency will generate another – and the higher likelihood of more emergencies happening concurrently. Both mean that Resilience Partnerships will increasingly be required to manage concurrent emergencies as a matter of routine. Clearly, the requirement to respond to concurrent emergencies will place significant strains on emergency response capabilities, especially specialist capabilities or those whose capacity is inherently limited. It will therefore be important to understand which risks might occur concurrently, and their combined potential impact, as a basis for assessing the adequacy of emergency response capacity and capabilities:

“Government does need to look at interdependencies between risks more deeply to identify unknown, unseen consequences and tell the LRF what interdependencies and cascading and compounding risks to plan for.”³³²

“With concurrency concerns over the past two winters, this issue has come to the fore. But the process is still ad-hoc and doesn’t assess where concurrent risks have the potential to affect capacity and capability.”³³³

“One area which [our] LRF has at the top of its risk register is combinations of risk. May be the only LRF which looks at concurrency in this way: amplifying risk. Individual risks occurring not as common as everyone imagines.”³³⁴

The UK has moved more fully into considering concurrency over the past two years, with special initiatives during the COVID-19 pandemic to consider the concurrent impacts of ‘winter pressures’ on the NHS and related human services alongside other risks (including those associated with withdrawal from the European Union). This should now be embedded in risk assessment processes as a matter of routine.

Recommendation 36: Risk assessment at national and local levels should identify and analyse areas where risks are likely to arise concurrently, either because of the cascading and compounding consequences of a major emergency or because likelihood assessment identifies a significant potential for simultaneous emergencies.

Building in Agility

Many front-line organisations commented on the apparent lack of agility in the current risk assessment process, fixed on a two-year cycle and with no ability to track and assess evolving risks or those which significantly change their nature or likelihood between risk assessment cycles:

“Speed and agility of risk assessment process [needs improving]. Some national risks need addressing outside annual NSRA cycle but don’t get that attention, which risks everyone being unaware and unprepared.”³³⁵

“Could the risk cycle be extended, say from two years to five years rather than constant reiteration? May need more dynamic risks to be updated more frequently, but some risks barely change over an extended period.”³³⁶

It is clear from our interviews that some Resilience Partnerships are undertaking more dynamic risk assessment and embedding changing assessments into the work of the Partnership. And for some risks (eg. weather and flood forecasting), there are effective arrangements in place to provide early warning to Resilience Partnerships (and the public) about emerging risks and their potential impacts which may require the activation of emergency response arrangements. But this falls well short of the systematic, nationwide provision of information on potential near-term risks and their consequences which we believe is one of the hallmarks of a truly Resilient Nation, giving organisations and individuals the best possible notice to adapt and prepare.

In practice, this may be an issue of communication – and the willingness of the UK Government to communicate – rather than indicative of weaknesses in risk assessment. We understand that the Cabinet Office produces a range of shorter-term risk assessments, shared across UK Government departments but not with Resilience Partnerships. Some of the information in those assessments may be sensitive. Equally, however, there will be information which can readily be shared, and used by Resilience Partnerships as the basis for dynamic local risk assessments and focused near-term emergency planning.

The Integrated Review announced the establishment of a new Situation Centre:

“… to provide live data and rapid analysis, supporting collaboration across government and informing crisis decision-making.”³³⁷

Given the role of the Situation Centre and the importance of risk prevention and preparedness activity at local level, the omission of Resilience Partnerships (as well as business, voluntary and other organisations) from this statement is striking. We hope that the Situation Centre can become the hub of a network providing relevant, rapid and dynamic analysis of emerging and changing risks to Resilience Partnerships and the Devolved Administrations as well as UK Government departments.

Recommendation 37: The UK Government should use the new Situation Centre as the hub of a network providing relevant, rapid and dynamic analysis of emerging and changing risks to Resilience Partnerships and the Devolved Administrations as well as central government departments.

Process

Developing a comprehensive, consistent and meaningful assessment of the risks that could affect the UK at national and local levels will always be a complex and, to a greater or lesser extent, bureaucratic, process. But we were struck by the uniform and strongly-expressed view of those we interviewed that too much time was spent on non-value added process in preparing risk assessments which could be better spent in using the risk assessments in risk reduction and emergency planning activity. It is clear that the risk assessment process can be radically simplified and re-imagined in four areas.

Make Only Value-Added Changes to Methodology

We heard consistently from Resilience Partnerships that successive changes over the past decade in national risk assessment methodology have had no or limited impact in the placing of risks in their local risk assessments. They have therefore been of no material value to local resilience-building activity yet have placed significant resource demands on all local bodies engaged in risk assessment:

“Constant reviews of the methodology and changing guidance doesn’t help … Spend too much time on the assessment, not enough on using it in risk mitigation.”³³⁸

“Government keeps changing the methodology every two years which doesn’t help. Get familiar with it and then it changes again, for no obvious value-added reason. The top risks are still the top risks: pandemic, coastal flooding, etc. Some of the mid-range risks might move a bit within the medium band, but nothing has changed in a significant or meaningful way.”³³⁹

“There is a lack of consistency with the risk assessments. Some processes are over- engineered and prescriptive that create challenges for the LRF structure, whilst for others there is a complete lack of clarity and guidance … Process is too bureaucratic … Risk assessment model should be more influenced by LRFs and their needs. The act of doing risk assessment is seen as the success, not the work that flows from it. Becomes a tick box exercise.”³⁴⁰

“People in CCS doing risk assessment change a lot. All come in with their own ideas and want to change things for no good reason. Changes need to be value-adding; and should be subject to engagement with stakeholders.”³⁴¹

“Risk Assessment process is long and bureaucratic. Takes time from other work and should be simplified. Methodology keeps changing and it’s not always obvious why to LRFs.”³⁴²

“Frequent change of methodology is a big issue. LRF work is less about managing risk than about managing the process. Simple example: risk numbering keeps changing which means LRFs have to renumber everything every time, which isn’t adding any value.”³⁴³

Resilience Partnerships also commented on how each area interpreted and applied the methodology in a slightly different way:

“Way in which risk assessment methodology is applied across the South West is different in each LRF. All share the same risks but all approach the assessment slightly differently. Risks don’t respect boundaries so should all be assessing, eg. flooding the same way. A future Inquiry would question why the assessments are different. Need greater consistency in the application of the methodology. Not helped by repeated changes to the NSRA methodology. Know the top risks now: don’t need an extensive methodology change to reassess them.”³⁴⁴

“Process could be much better. Spend months creating new ways of assessing risk every time there is a change in methodology. Each LRF deals with risk differently. How can they be properly compared, or aggregated?”³⁴⁵

Interviewees noted that the position was worsened in the development of the 2019 NSRA by the lack of sufficient engagement by the Civil Contingencies Secretariat with Resilience Partnerships to explain – or ideally, co-design – the changes, which meant that they were not well understood enough to allow Partnerships to change their local processes³⁴⁶:

“CCS did not consult sufficiently in the last methodology review. 2019 process was rushed, haphazard, no leadership from CCS.”³⁴⁷

“More complex when underpinning methodology changes, especially because CCS engagement and briefing on the changes and the reasons for them is limited … Transition to new NSRA has taken a year and has been very time and resource consuming. Lots of process, not enlightening.”³⁴⁸

“…need to consult properly with LRFs on the process changes: don’t present a fait accompli that has been stitched up within central government beforehand. Need to listen to the views of LRFs as to what will work and be meaningful on the ground.”³⁴⁹

Resilience Partnerships also highlighted the need for a feedback loop so they could flag new or changing risks to government, or make suggestions on changes to the methodology:

“Where there are local risks that are common across many LRFs or of a significant scale and these are not reflected nationally, need a mechanism to feed risks and risk assessment back up to CCS.”³⁵⁰

“Current risk scoring methodology misses the social care impacts (eg. community / NHS / vulnerable people provision). [Our LRF] has adapted the national methodology to cover that as social care is often the most impacted service. Have fed back to CCS risk team on social care scoring and waiting for it to get incorporated.”³⁵¹

And Resilience Partnerships confirmed the need for all bodies – at local and national level –

to follow the same methodology:

“Got experience that government departments don’t use the same risk methodology … Department for Transport (DfT) categorised a risk as a ‘Level 6’ risk which means nothing to the LRF. All risk assessments should be based on the NSRA methodology to enable effective communication across all the resilience community.”³⁵²

Assess National Risks at National Level

At present, Resilience Partnerships are required to make their own assessments of the likelihood and impact of each risk in the NSRA. For local risks, this is clearly sensible. But

there is a wide range of ‘national’ risks, such as infectious disease epidemics, space weather and volcanic ash clouds, where Partnerships clearly do not have access to the necessary deep technical expertise, much of which is best accessed at national level. This leads to different approaches to the assessment of national risks being applied by different areas.

The risks of inconsistency are high (although Resilience Partnerships have found their own informal work-arounds to try to achieve some consistency). So is the time spent in activity of limited value:

“No value in each LRF doing its own assessment of the impact of national-level risks (eg. of Critical National Infrastructure being affected). National subject matter experts should do the assessment once and share with all LRFs rather than everyone doing the assessment locally.”³⁵³

“Could be a lot more national (or regional) assessment of risk where the expertise is held nationally, with risk assessments passed to LRFs to take in subject to any necessary local adaptation.”³⁵⁴

“…national risks (eg. volcanic ash) should be assessed by the national subject matter expert, and the results passed to LRFs. They can take straight in or adapt if there are local factors which need to be taken into account. No point LRFs spending time on assessment of risks where they have no expertise. More useful to focus on local risks.”³⁵⁵

“Assessment of national risks should be done nationally and then shared, though need to be clear where accountability sits when risks are assessed nationally. Are LRFs accountable for assessments of particular risks if done nationally and then used in the LRF risk register? Should be a stronger sense of risk ownership at national level, with Risk Owners taking a more holistic look at risk – its assessment through to its mitigation. Risk Owners should analyse the ‘So What’ questions arising from the NSRA at national level, to enable interoperability and consistency of approach when the assessment goes to LRFs.”³⁵⁶

It would make more sense for relevant national risks to be assessed once, nationally, and for the results to be passed to Resilience Partnerships to take into their local risk assessments, adapted if necessary to reflect local variations in likelihood or impact. Clarity on accountability for the nationally-produced assessments should be provided.

Provide Common Tools and Templates

The Civil Contingencies Secretariat does not provide Resilience Partnerships with a set of tools and templates which they can adapt and use in taking the national methodology into local risk assessments. At present, each Partnership therefore has to develop its own set of tools and templates. And it needs to rework those tools and templates every time the methodology changes. Here, too, there are risks of inconsistency in risk assessment inadvertently being introduced by Partnerships in the tools and templates they develop. And the time wasted is significant:

“CCS needs to do the hard work so that the risk assessment process is simple and easy to use. Ideally have one national database or template managed by HMG to input the data at LRF level.”³⁵⁷

“Obvious scope for process improvement: can’t cut and paste content; not easily understandable. Should move to doing once, doing regionally where that is more sensible, make it simpler, have standard, consistent, editable tools and templates.”³⁵⁸

“A review of NSRA methodology is underway. [Our] LRF has fed in that they want CCS to give them a system, tools, etc. to do risk assessment work more efficiently and effectively.”³⁵⁹

“…very much agree on the need for standard tools and templates. A real battle to create and then use them all – non-value-added activity. Nationally LRFs are pushing the need for consistency. A central template makes it easier to complete and compare, especially for national and regional partners.”³⁶⁰

Digitise

The NSRA is published partially online and part in paper form. But even the online document provides no ability for data interrogation, extraction or manipulation, which means that Resilience Partnerships have to spent time reloading and re-keying data:

“National risk assessment should be loaded onto a single portal, to which LRFs can add their local risks. ResilienceDirect is not sufficiently agile to allow effective information management and exchange.”³⁶¹

“Should have a standard approach, standard templates, and make more digital using ResilienceDirect (RD) as a portal. National risks should be assessed nationally and loaded onto RD, to which LRFs can add their local risks.”³⁶²

There is no obvious reason why, once misplaced security considerations are addressed (see the Improving Access and Engagement section below), a large part of the NSRA could not be made available in genuinely digital form to Resilience Partnerships.

The House of Lords Select Committee has recommended that:

“Wherever possible, to prevent duplication of effort, information should be produced once at a national level and cascaded down to a local level. The Government should produce a single risk assessment template for use by LRFs to limit the duplication of effort and should ensure that information on risks should be directly copied from the NSRA into the local risk assessment.”³⁶³

It has also recommended the creation of a forum for the sharing of information between the UK Government and LRFs, to meet at least twice yearly, and to discuss inter alia the development of the NSRA.

We would go further. We believe that the risk assessment process is capable of radical redesign, to reduce unnecessary process overhead and free up time which can be invested in the improved methodology we recommend above and subsequently in resilience-building activities on the basis of the assessment.

Recommendation 38: The UK Government should radically re-imagine and simplify the risk assessment process. Changes to risk assessment methodology should be introduced only after discussion with Resilience Partnerships and the Devolved Administrations and where they make a material difference to the placing of risks in the risk matrix, and hence to the prioritisation of actions taken to address them. When the methodology changes, the Government should provide full support to Resilience Partnerships to ensure that they understand the reasons for the changes, can effectively apply the new methodology and that the assessment of risks is consistent. Relevant national risks which draw on expertise best accessed at national level should be assessed once, at national level, with the results passed to Resilience Partnerships for taking into their local risk assessments, adapted if necessary to reflect local variations in likelihood or impact.

Recommendation 39: Except where there are compelling national security reasons for not doing so, the main components of the National Security Risk Assessment should be provided to Resilience Partnerships via a digital platform which allows the ability for local data interrogation and extraction. The UK Government should provide via the digital platform standard tools and templates, including those needed to explore the impact of concurrency, which Resilience Partnerships can adapt and use in taking the national methodology into local risk assessments.

Improving Access and Engagement

The Designation of Co-operating Bodies – Category 2 Responders section identifies the need for Category 2 responders to be full participants in the risk assessment work of Resilience Partnerships and recommends that the Risk Assessment Duty should be placed on them, to mirror the duty on Category 1 responders.

To facilitate their engagement, and the engagement of others who can actively support the risk assessment process, it is vital that they have access to a shared evidence base.

The assessment of risk will always include the discussion of topics that are sensitive, or highlight potential vulnerabilities or shortfalls in capability, which will potentially be attractive information for those who may wish to cause the UK harm and therefore require protection. Some elements of risk assessments will therefore need to be appropriately classified and securely handled by those who need to use the material to support national and local emergency planning.

But our research and interviews have shown that this understandable need to protect genuinely sensitive information has been allowed to mushroom so that it has become an unnecessary barrier to effective multi-agency resilience-building activity between partners.

We heard many striking examples of the NSRA – or even particular non-sensitive passages in the NSRA – as well as other nationally-issued risk assessment materials not being shared with or within Resilience Partnerships. In some cases, this was through risk aversion – an abundance of caution by the receiving organisation, exacerbated in many cases by the lack of knowledge of document handlers of government guidance on the level of security clearance (if any) required by staff of partner bodies to access and use the materials. In other cases, issues over access were clearly rooted in difficulties in the relationship between individuals, or between organisations:

“Need to cut through power and egos in classification of information which could be shared. Example is previous iterations of the NRA which were secret documents as led by the security side of the house which stopped it or any of its content being shared in partnerships. Much of content was not really secret level: most could be found on the internet. But CCS didn’t do enough to provide useable material which could be shared.”³⁶⁴

“Bureaucracy surrounding access to the NSRA, and information sharing on what is in the NSRA, gets in the way of collaborative working. Sets up a single point of failure with a limited number of people who are allowed to access the NSRA, but then can’t share.”³⁶⁵

The House of Lords Select Committee, having seen the version of the NSRA classified as

‘Official Sensitive’, has observed that the risk assessment process has “developed a culture of secrecy” preventing information sharing with key partners, and in particular that:

“… the secrecy surrounding the document is unwarranted and … much of this information does not need to be secret and should be in the public domain.” ³⁶⁶

Reform also urged greater transparency of the NSRA to encourage external scrutiny:

“The Government should move from a presumption of ‘Need to Know’, to ‘Need to Share’. To improve engagement with the National Risk Assessment, make it easier to consult as a risk assessment tool, and encourage external scrutiny, the government should pursue a policy of increased transparency. It should publish all parts of the Assessment that are not pertinent to national security in line with updates to the Assessment.”³⁶⁷

Similar problems have also been seen in the sharing of other risk products. For example, the Institute for Government has cited issues where:

“The government’s pandemic risk assessment had not consistently filtered out from the centre of government to properly influence policy decisions that line departments made.”³⁶⁸

We understand that improved transparency is a key focus of work in the development of the 2022 NSRA and hope that a significant volume of information, especially on hazards, will be ‘declassified’ accordingly. We suggest that information-sharing would also be helped by:

369. Rather than having a single uniform classification for the NSRA, identifying which specific passages are security-sensitive³⁶⁹.
370. Addressing the lack of understanding, and hence risk aversion, of document handlers about the level of security clearance (if any) needed to access risk assessment materials. The quickest way of doing this might be through embedding advice in the NSRA itself.

Recommendation 40: To enable the better sharing of the National Security Risk Assessment (NSRA), the UK Government should consider the identification in the document of the specific passages which are classified rather than having a single uniform classification for the document as a whole. The NSRA should include clear and unequivocal guidance for document handlers on the level of security clearance (if any) needed for those who wish to access and use the information it contains.

The Emergency Planning Duty

What Does the Act Require?

The Act requires local bodies to:

“… maintain plans for the purpose of ensuring that if an emergency occurs or is likely to occur the person or body is able to perform his or its functions so far as necessary or desirable for the purpose of:

• preventing the emergency;
• reducing, controlling or mitigating its effects; or
• taking other action in connection with”³⁷⁰

The need for a duty on emergency planning is self-evident. We received no comment on the duty itself in our interviews.

Recommendation 41: The emergency planning duty in the Act or successor legislation should remain at the core of resilience-building activity in the UK.

Are Changes Needed to Arrangements for the Execution of the Duty?

As noted in the Putting People First – Moving to Needs-Based Planning section, we did however receive considerable commentary on the rather antiseptic tone and language, and process-based approach, to emergency planning currently set out in the Act, associated Regulations³⁷¹ and guidance³⁷², which means that what ought to be the primary focus – of addressing the needs of those affected by an emergency – can become lost. The Renewed Approach section sets out our recommendations on how the approach to emergency planning should be revised to put people and their needs first, and the consequential changes this would require to Regulations and statutory guidance. This is covered in Recommendation 7.

The Business Continuity Management Duty

What Does the Act Require?

The Act requires designated local bodies to:

“… maintain plans for the purpose of ensuring, so far as is reasonably practicable, that if an emergency occurs the person or body is able to continue to perform his or its functions.”³⁷³

Supporting Regulations to the Act make clear that such business continuity plans must be linked to the local risk assessment:

“In performing its duty … to maintain business continuity plans … a general Category 1 responder must have regard to any relevant assessment which it has carried out …”374

Statutory guidance³⁷⁵ (and the National Resilience Standard on Business Continuity Management³⁷⁶) provides substantial material for local bodies. It makes clear that, although the Act requires local bodies to maintain plans to ensure that they can both continue to exercise their civil protection functions and continue to perform their ordinary functions, local bodies should focus on ensuring that they can deliver their critical functions.

Importantly, the guidance notes that business continuity management:

“… is a more operationally-focused activity to ensure that service disruptions are managed, potentially cascading effects are mitigated and services are maintained.”³⁷⁷

The guidance promotes, and is heavily based on, the British Standard for Business Continuity Management (BS 25999)³⁷⁸, subsequently superseded by BS ISO 22301³⁷⁹.

Front-line organisations we interviewed uniformly confirmed the continuing requirement for this duty. Many noted that the COVID-19 pandemic had brought home the importance of business continuity and hence of compliance with the duty, an area they regarded as rarely attracting the attention of senior managers.

Are Changes Needed to Arrangements for the Execution of the Duty?

But two areas of improvement were consistently flagged.

Move to Organisational Resilience

First, there was widespread recognition that the impacts of the COVID-19 pandemic had fundamentally changed the way in which many organisations approached the analysis of the potential impact of an emergency on the operation of their organisation:

“COVID has completely changed business impact analysis. Businesses were previously looking at critical people and finding a Disaster Recovery location where they could work. Now [people] can work from home means a move away from DR sites: connectivity of external systems to home is critical … Resilience of a company is now about how critical their systems are and how they can connect to them remotely.”³⁸⁰

Good practice on business continuity management (BCM) is that strategies and plans should be updated following an incident and, clearly, organisations will be updating their BCM arrangements following the COVID-19 pandemic to reflect how their operating model has changed. For work that is more mobile, this may include allowing for more home working.

But there was a widely-held view, across all sectors, that the large-scale, systemic impacts of the COVID-19 pandemic had shown the need for organisations to go beyond operational- level business continuity management to the broader and more strategic concept of Organisational Resilience³⁸¹:

“[Our] previous focus [was] on BCM but, for the last five or so years, [the] big move [has been] to organisational resilience. [Taking a] more holistic view, at Board level, asking ‘Where are we as a business?’ BCM teams, etc. are in the plumbing.”³⁸²

Organisations who had taken this path wanted to understand their critical functions across all aspects of an organisation’s activities, and to bring together analysis of the impacts of disruption on those functions at a strategic – Board – rather than operational level.

Interviewees recognised that, if BCM was done properly, there should already be strategic level engagement in decisions. But they were clear that BCM has, in the past, been pushed too far down the organisational hierarchy.

We share that view. A move to organisational resilience, bringing business continuity management alongside the management and control of other risks, would be consistent with the need for organisations with resilience responsibilities to be capable of continuing to deliver critical services even when faced with the strategic challenges of what is likely to be an increasing likelihood of future national and wide-scale emergencies. And it would help in attracting the attention of senior leaders of organisations onto the ability of their organisations to continue delivering critical services even when faced with large-scale, enduring and systemic impacts alongside short-term operational shocks and disruptions.

Recommendation 42: The business continuity management duty in the Act or successor legislation should be amended to move to the concept of organisational resilience.

Compliance

It is clear that recent emergencies have exposed weaknesses in some organisations’ business continuity planning and capabilities, to the extent that some local bodies have been required to support partners facing deficiencies which have threatened their ability to continue providing critical services:

“Need more emphasis on partners putting their own BCM arrangements in place. Clear from recent experience with COVID and fuel disruption that some organisations either hadn’t done that or hadn’t done it effectively. So they tended to look to the local authority / LRF to fix their problems.”³⁸³

National Resilience Standards already cover business continuity management³⁸⁴. These need to be updated to reflect the move to organisational resilience, and the resulting Standards taken into the radically improved validation and assurance mechanisms we recommend in the Validation and Assurance chapter.

Recommendation 43: Resilience Standards should be updated to reflect the move to organisational resilience. The effectiveness and coverage of organisational resilience planning should be included in validation and assurance arrangements.

The Business Continuity Promotion Duty

What Does the Act Require?

The Act places a duty on local authorities (alone amongst designated local bodies) to:

“…provide advice and assistance to the public in connection with the making of arrangements for the continuance of commercial activities by the public, or the continuance of the activities of bodies other than the public or local authorities whose activities are not carried on for profit, in the event of an emergency.”³⁸⁵

Supporting Regulations to the Act make clear that such business continuity advice should take account of the community risk register developed and published by the Resilience Partnership³⁸⁶. Local authorities need provide advice only to businesses which carry on commercial activities in their area³⁸⁷ or, recognising the range and diversity of the voluntary sector, to those voluntary organisations which it considers appropriate³⁸⁸.

Statutory guidance³⁸⁹ provides substantial material to support local authorities in their work, especially in setting out the anticipated scope:

“Local authority officials can undertake this type of work themselves if they have the experience and competence to do so … Alternatively, the local authority may give advice and assistance to individual organisations to facilitate the engagement of a business continuity consultant, who may be better placed to provide the support required.”³⁹⁰

The National Resilience Standards also contain a specific Standard on Business Continuity Promotion³⁹¹, which has a desired outcome that:

“Businesses and voluntary organisations are enabled by their local resilience partnership to develop their own business continuity arrangements against locally foreseeable risks, in a way that encourages learning and continuous improvement.”³⁹²

The Standard also makes clear that, whilst the duty to promote business continuity applies only to local authorities:

“…the LRF may have a role in co-ordinating such activity, by Local Authorities and others, in the interests of efficiency and effectiveness. For this reason, this standard is slightly different to others in that it highlights how Local Authorities and LRFs may work towards good practice.”³⁹³

Are Changes Needed to Arrangements for the Execution of the Duty?

This duty received the most criticism, as being out-of-date and in urgent need of updating to reflect developments over the past 20 years. Criticisms fell into four broad areas.

Business Continuity is the Wrong Thing to Promote with the Wrong Audiences

As noted above, senior business leaders have moved on over the past decade to focus on organisational resilience rather than business continuity management, usually the domain of more junior, operational staff. Interviewees were therefore concerned that messaging and materials on business continuity from local authorities were not targeted at the right level, were not sufficiently selling the benefits, and were thus not having the desired impact:

“[Need for a] more strategic, dynamic, mature discussion at board / just below board level. Shouldn’t go too far down in an organisation with engagement or else you lose cohesion. Getting … agreement with the board / just below is important.”³⁹⁴

“Government and public bodies need to provide clear messaging across the organisational resilience piece, not just business continuity. And organisational resilience is at Board level, so messages should be targeted at Board level.”³⁹⁵

“Would be potentially very useful to have a focus on business owners and Non- Executive Directors (NEDs) and building their organisational resilience skills. When promoted to being Chief Executive, people are suddenly expected to know lots of things and be expert at everything. They need support. All senior leaders and NEDs behave and learn differently. Business listens to business, so peer learning and sharing knowledge in informal networks works particularly well.”³⁹⁶

Local Authority Resources are Limited

It is clear that local authorities do not, in the main, have the resources or specialist expertise to deliver the duty effectively or to meet the needs of their target audience. Some local authorities continue to make a significant investment in this area, and most recognise their involvement in supporting business as part of sustaining the economic wellbeing of their areas. But for most the duty is being observed in only a nominal way:

“Duty is broken. Most local authorities just tick the box. Not adding value.”³⁹⁷

“Local authority does very little on business continuity promotion as not enough resources. If businesses contact them, they will help, but not much proactive work beyond taking part in business continuity week and publishing materials on website.”³⁹⁸

Other Organisations are Better Placed

Other organisations at national and local level have been identified as having greater contact with businesses and being better placed to promote business continuity or, preferably, organisational resilience. Suggestions included Local Enterprise Partnerships, Growth Hubs, Chambers of Commerce, Business Improvement Districts, the British Library Business and IP Centre Network, HM Revenue and Customs, Companies House and the Information Commissioner, as well as business representative organisations:

“Businesses don’t instinctively look to the local authority. Other organisations locally do a great job and are more trusted than the local authority as they are specialists.”³⁹⁹

Do It Once, Consistently

Beyond statutory guidance, the UK Government provides no further support to local authorities in undertaking this duty. Each, therefore, is faced with creating its own arrangements and materials. Although there is clearly some informal co-ordination between local authority officers working in this area, taken overall this is not only highly inefficient but also risks significant inconsistency in the scope and nature of the advice provided to business and voluntary organisations. Many of those we interviewed pointed out that this need could be more effectively and efficiently met through the provision of nationally- produced materials which could then be adapted as necessary and distributed locally.

It is clear that the business continuity promotion duty in the Act is of a past age and now out-of-date. The objective of seeking to improve the resilience of businesses and voluntary organisations remains worthwhile. But the best means of doing so needs to be rethought from first principles. And it is clear from the business sector representatives we spoke to that there is a real opportunity to build on experience and learning from the response to the COVID-19 pandemic to promote operational resilience, targeted at Board level:

“Real opportunity at the moment as resilience is on the agenda for every Board. Boards don’t want to be caught out with the next emergency. Door is wide open for that engagement to begin.”⁴⁰⁰

Recommendation 44: The duty in the Act on local authorities to provide advice and assistance on business continuity management to business and voluntary sector organisations in their area should be abolished. The UK Government should build on the opportunity and learning from the response to the COVID-19 pandemic to rethink from first principles the Standard to be promoted, the audiences that are best placed to receive and act on advice, the wide range of channels (including government bodies) for reaching those audiences, and the most efficient and consistent way of providing advice which supports the objective of improving the resilience of businesses and voluntary organisations.

The Public Awareness Duty and The Warning and Informing Duty

What Does the Act Require?

The successful management of the response to almost any emergency will be more effective if it has the support and co-operation of a wider network than simply the bodies with duties under the Act – of businesses, voluntary and community groups, communities, and individuals and families. If people are aware of the potential consequences of an emergency, and of the actions they can take before, during and afterwards, the impacts can be reduced and interventions by emergency responders can be focussed on those with the most serious needs. And, as work over decades in the engagement of communities on flood prevention and some other risks has shown, the provision of fuller information on risks and their potential consequences will enable people not only to prepare but also to take action to prevent emergencies arising in the first place:

“All about changing the behaviour of the public. Need information for:

• People that are worried about risk and want to try to prevent an occurrence
• People who want to find out when a risk is realised – what is happening, what they need to do, etc
  
• People who are worried about recovery and want to know how to ”⁴⁰¹

This fundamental principle – of providing information to people to allow them to take steps to secure their own safety and wellbeing and that of others – is inherent in the Act, which has two separate duties in this area.

The first is the duty to put information into the public domain for the purpose of raising public awareness, which requires that designated local bodies:

“… arrange for the publication of all or part of [risk] assessments made and [emergency] plans maintained … in so far as publication is necessary or desirable for the purpose of:

• preventing an emergency,
• reducing, controlling or mitigating the effects of an emergency, or
• enabling other action to be taken in connection with an”⁴⁰²

The second duty covers the obligation on designated local bodies to:

“… maintain arrangements to warn the public, and to provide information and advice to the public, if an emergency is likely to occur or has occurred.”⁴⁰³

This duty is further amplified in the Regulations associated with the Act:

“In performing its duty … [to warn and inform the public] … a general Category 1 responder –

• may maintain arrangements which relate to a particular emergency or an emergency of a particular kind;
• may maintain arrangements which relate to more than one emergency or more than one kind of emergency.”404

These two duties are a vital underpinning to resilience activity in the UK. We received no evidence that they need to be changed.

Recommendation 45: The two public information duties in the Act – to raise the awareness of the public on risks and plans, and to warn and inform the public in the event of an emergency – remain fit for purpose.

Are Changes Needed to Arrangements for the Execution of the Duties?

But there are serious issues in the way in which statutory guidance covers the execution of these two duties.

First, although the Act and its associated Regulations make a clear distinction between the two duties, they are then largely conflated in statutory guidance to “Communicating with the Public”⁴⁰⁵. Thus, the relevant section of statutory guidance starts:

“There are two aspects of the duty in relation to communicating with the public.”⁴⁰⁶

(Our emphasis)

This is unhelpful. The purpose of the work required by the two duties, the audiences to be reached, the information to be communicated and the channels which might be used are significantly different. Although statutory guidance makes clear⁴⁰⁷ the obvious linkage between the two in its analysis of the three recognised stages in communicating with the public:

• Public Awareness before an incident, covering risk communication and education
• Public warning/alerting at the onset of an incident
• Informing and advising the public, during and long-term post emergency

the main focus of the guidance is on the latter two stages. As a result, it is clear from our interviews that local bodies have historically focused more on those stages than on more general communication of risks and plans.

Second, whilst statutory guidance rightly notes that:

“The more information the public has access to, and the better educated they therefore become before an event, the more open they are likely to be to the warnings and advice they are given at the time of an emergency. A well informed public is better able to respond to an emergency and this will minimise the impact of an emergency on the community.”⁴⁰⁸

it then drastically narrows the scope of the information to be published by restricting it only to one product – the Community Risk Register – with no obligation to publish material on plans, notwithstanding the requirement set out in the Act:

“Category 1 responders meet these requirements by publishing a Community Risk Register (CRR), which provides an agreed assessment of the risks affecting a local area and an agreed position on the planning and resourcing priorities required to prepare for those risks.”⁴⁰⁹ (Our emphasis)

Third, the absence of legal duties on the UK Government means that there is no obligation on departments to publish the information they hold on risks and plans, which will be the most valuable source of information for many organisations. We heard some limited praise for the updated National Risk Register⁴¹⁰, but the majority of organisations we interviewed were not familiar with it. Even those who used it found that it – and Community Risk Registers – were of limited value to their internal planning, especially because of the absence of sufficient, detailed information on the nature and scale of potential consequences and of the likely shape of the government response, information which is vital to the effectiveness of their own planning. And it was widely seen as being difficult to access and navigate.

The Operational Need

We heard consistently – and strongly – expressed views across all sectors that Government and statutory bodies need to publish much more information on the risks facing the UK and localities, on their potential consequences and on the broad shape of the likely government response to allow them to plan effectively. Interviewees noted the poor contrast between practice in the UK and the much fuller information provided to their publics by a wide range of other countries. And, whilst all interviewees were conscious of the need to protect genuinely security-sensitive information, they were clear that there was a considerable volume of non-sensitive information which could readily be published.

A genuine whole of society approach to resilience will require much more information to be put into the public domain at national and local level to allow users in all areas of society – businesses; voluntary groups; and individuals and communities – to take action. As the House of Lords Select Committee noted:

“The Government must recognise that informing the public about the risks they face is both morally justified and benefits societal resilience … There needs to be a new culture within Government which recognises that … providing information on risks, will lead to a more cohesive risk response.”⁴¹¹ (Our emphasis)

This view was echoed more widely, by interviewees across all sectors:

“Communities and individuals need to understand risks, their consequences in ways which are relevant and meaningful to them. That will help them to understand and work out locally what to do when those risks happen.”⁴¹²

“Communications engagement with the public has moved on over the last 15 years … Just putting a PDF of a CRR on a website is not sufficient any more.”⁴¹³

The Better Involvement of Business section sets out the way in which the businesses we interviewed uniformly sought substantially more information to support their own organisational resilience planning. But many went wider, to note that the absence of adequate information meant that they:

1. Were not able to discuss with UK Government or with local statutory bodies the potential impact not only of risks and their consequences but also the impact on their operations (and on their supply chains) of the measures that might be implemented in the emergency response (eg. lock-down, evacuation, closing airspace) and the mitigations which might be put in place to reduce the impact on their businesses.
2. Were not enabled to identify areas where they could make a material contribution to the response, especially in meeting the needs of those affected by the emergency.

VCS organisations found the National Risk Register, even where they knew of it, of limited utility. They were more concerned to understand the potential consequences, as the basis for developing a better understanding of the needs of those affected by an emergency to form the basis of their own planning. They also wanted to know more about the likely shape of the response, into which their activity might be integrated:

“Partners say understanding the risks and, especially, the consequences and how they would affect the vulnerable and marginalised groups, would be really useful.”⁴¹⁴

“National Risk Register – used it for planning models, exercises, etc. using the priorities it provided. NRR could be improved to provide more information, especially on priorities, and to improve useability through making it a digital product with layers of information.”⁴¹⁵

“Need fuller information on risks and impacts, presented in a way which is meaningful.”⁴¹⁶

Similarly, those promoting community resilience were keen that individuals and communities should have access to more information on risks, their consequences and, especially for local risks, what individuals and communities could do to prevent or to prepare for them, taking into account the likely actions of designated responders.

A New Culture

There is thus a compelling need to make fundamental changes to the way in which the two duties are executed, and to capture the “new culture” proposed by the House of Lords Select Committee to enable the genuine ‘whole of society’ engagement in all aspects of work to build the resilience of the UK.

First, the clear separation between the two duties in law needs to be reflected in a similarly clear separation in statutory guidance and supporting arrangements, so that each has a sound platform for the public information actions undertaken at national and local level.

Recommendation 46: The UK Government should amend Regulations associated with the Act or successor legislation and supporting statutory guidance to ensure that there is a clear separation between the public awareness duty (information shared in advance of an emergency) and the warning and informing duty (information shared when an emergency occurs or is imminent). Statutory guidance should contain a chapter on each duty.

Second, publishing information on risks alone will not be sufficient to meet the scope of the Public Awareness Duty which requires the publication of information on risks (including consequences) and plans. People need actionable information, including details on how risks might arise, the potential consequences of those risks – what the emergency might look and feel like – and of the broad shape of the likely response – what would and should be done:

“There is a need for greater transparency on scenarios and planning and how things would be handled in the response phase to build knowledge and awareness amongst all responders. That information – on all major risks – needs to come from central government. All involved need one consistent view of what they should be working to. So, whilst the National Risk Register is good as far as it goes, it could usefully contain more information to help with planning – on risks, on their impacts and scenarios, and on the major components of the emergency response plan.”⁴¹⁷

“Need to make the National Risk Register / Community Risk Registers resonate with [business] people and talk to them about the impacts. Key is the quality of the explanation, to aid their comprehension so that they can see the relevance. So focus on practical relevant things which they can understand – impacts on power supply, transport, IT systems, etc. and what they might do to deal with them.”⁴¹⁸

“[We] align our work with the National Risk Register (NRR); but the NRR looks and feels like a box-ticking exercise. Needs much more specific information on risks, consequences, scenarios. And should not just stop at publication like it does at present: should be the basis for more discussion, collaboration and partnership- working on risk and planning with government and with other Cat 2s … Should lead to fuller understanding what the implications might be….”⁴¹⁹

“…need much better understanding of the types and – especially – the consequences of events we are talking about, especially the consequences that cascade across organisations … Need to be clear about whether events would be nationwide / global / local in their impacts … Loss of electricity, infectious diseases, cyber attack on critical national infrastructure, global supply chain disruption, climate change – all potentially significant risks for the future that government should be telling businesses about and discussing with them.”⁴²⁰

“Guidance covering requirement to publish all or part of CRRs needs to change. At present, everyone just loads the CRR on their website. But it means nothing to the public in its raw form. LRFs need to communicate the outcome of their risk assessments in ways which allow people to do something with it, backed up with wider communications and messaging.”⁴²¹

Publicly-available information thus needs to include much more detail on consequences and on local and national preparedness and response plans to inform and enable the plans and actions of businesses, VCS bodies, communities and individuals.

Public awareness materials should also explain the role of Resilience Partnerships:

“Needs also to promote what resilience is, nationally and locally, including the role of the LRF and what it does to keep people safe. If you asked the general population or even our own agency workforces what an LRF or the [Civil Contingencies Act] was, nobody would be able to tell you. Need to correct that: explain how we keep people safe.”⁴²²

“LRF engagement project under way to promote the work of the LRF in peacetime and emergencies. Much needed: public don’t know what LRFs are or what they do.”⁴²³

The UK Government and Resilience Partnerships should also use the opportunity of activity under the Public Awareness Duty to foster trust with communities which will then stand them in good stead during an emergency⁴²⁴, including being transparent about the limitations of their knowledge and the level of support that they will be able to provide.

Recommendation 47: The UK Government and designated local bodies (co-ordinated through Resilience Partnerships) should publish significantly more detail on risk scenarios, their potential consequences and the broad nature of emergency plans, at both national and local level. Statutory guidance should amplify the main categories of information which should be made available under the Public Awareness Duty.

Third, we found that there was a widespread perception of the cultural reluctance of the UK Government to share information widely, even on hazards where there are few, if any, national security sensitivities. As many interviewees brought out, this culture is in sharp contrast to the way in which the provision of public information has been tackled in other areas of national security, such as the sharing of cyber threat information by the National Cyber Security Centre (NCSC) on their CiSP platform⁴²⁵, or the work of the National Counter Terrorism Security Office (NaCTSO) in providing advice to businesses and the public on the impacts of terrorist attacks⁴²⁶:

“National Cyber Security Centre leads the way on showing what can be done … Very good bridge between open and secret [information]: shows what can be done … Resilience well behind. Should readily be able to share information on risks (hazards and threats), likelihood and consequences on a multi-year basis. And should be able to provide early warning about any risk assessed as likely to materialise in next few weeks. Would be much better prepared if that was done. Can put mitigation in place to support customers better.”⁴²⁷

It is clear that a major issue underlying the cultural reluctance to share more information is anxiety that doing so would provoke difficult questions about levels of preparedness, at national and local levels and within individual organisations. It is further exacerbated by the requirement for responders not to “alarm the public unnecessarily”⁴²⁸ when communicating about risk. This is both patronising and counter-productive. As the House of Lords Select Committee has noted:

“… there is no evidence that providing the public with risk and resilience information leads to panic amongst the population.”⁴²⁹

If the UK is to pursue a ‘whole of society’ approach to building resilience, there will need to be a more open and transparent approach to the proactive sharing of all but the most sensitive information about risks, their consequences and the plans put in place to tackle them at all levels. This may require Government and responders to be prepared to have challenging conversations with the public and in Parliament, including about the readiness of the UK to manage certain risks. But, even if difficult, a well-informed debate is healthier than continuing ignorance and poor planning – and the harm they can lead to.

Recommendation 48: There should be a presumption of publication of material on risks and their consequences, including that in the National Security Risk Assessment, and on national and local planning unless there are clear and justifiable national security or commercial reasons not to do so. Where there is a question about the release of information on security or other grounds, sensitivities should be balanced against the public interest in releasing material if doing so would make a material contribution to the safety and wellbeing of those likely to be affected by an emergency.

Recommendation 49: The UK Government should abolish Regulations 27 and 30 warning against causing undue alarm when communicating with the public.

Finally, we received considerable evidence of the way in which businesses and VCS organisations felt hampered in their work during the response to the COVID-19 pandemic by the absence of information from the UK Government, or by the Government issuing requirements that were very prescriptive, rather than outcome-focused, hindering their

ability to respond flexibly to best meet people’s needs:

“Communication – frequency and timeliness of comms could have been improved during COVID. Recognise things changed quickly, but comms often struggled to keep up. Timely communications of incidents could be improved.”⁴³⁰

“Communications very haphazard. Information during COVID came from lots of different sources. Caused uncertainty. Can the process be improved?”⁴³¹

“During COVID [there were] amazing efforts all round but at times it felt harder than it needed to be. For example, when shops were closing to customers but Click and Collect could stay open, the requirements were very specific, meaning very few shops could meet the requirements. If the Government had detailed the outcomes they were trying to achieve, then they could probably have found more ways to keep all stores open for Click and Collect safely for customers.”⁴³²

There are clearly lessons to be learned in this area, which we assume will be pursued in greater depth by the COVID-19 Inquiry.

Improving Accessibility

The act of publishing more information about risk is only one part of the equation. The presentation of the information provided is crucial to allow interpretation and interrogation by all who wish to use it. In practice, this means that publication is not enough. Significant effort will be required to present the material in a way which is useful, to promote the material and to interpret it for users to encourage and enable them to act:

“Get out as much information as possible. 30days30waysUK campaign in September is providing really useful information. People still think “it won’t happen to me” – need to change hearts and minds.”⁴³³

“National Risk Register is not as useable as it could be and not publicised, so that the public and communities don’t understand the risks they face. Government needs to put the effort in to:

• Develop the document (or alternative documents) much further so its content is relevant to individuals, communities, businesses
• Keep the language simple – current material is written by resilience geeks who can’t write plain English

• Make it useful at both national and local levels
• And then promote it much more, including bringing the media on board ...

…That work at national level should be complemented by local messaging about local risks. Could include local dissemination (by LRFs) of, for example, a national flood plan leaflet. There should be a library of nationally produced material available to help local responders with public education and awareness raising. Good example of messaging is the ‘Run, Hide, Tell’ campaign. Government needs to keep messages high level and simple.”⁴³⁴

“Small and medium-sized enterprises don’t have that resource or expertise, so engagement will be more difficult. More general guidance for companies of that size is more useful for them. Principles of information and guidance should be:

• Keep it simple – no geek-speak
• Make it easy for people to do something – for companies to adopt and for Directors to go through in Board meetings.”⁴³⁵

“English speaking media do not get to non-English speaking communities – they have their own media channels in their own language (often via cable, online, etc). Need to recognise in planning and training and exercising.”⁴³⁶

For Resilience Partnerships, this may mean actively engaging with different parts of the communities they serve (as suggested in the relevant National Resilience Standard⁴³⁷) to discuss risks, their consequences and the work of the Partnership, as a basis for dialogue with businesses, voluntary groups and communities. We cover in the Resourcing of Local Bodies and Resilience Partnerships section the resources we believe that Partnerships need to fulfil this risk communication role.

In support of Resilience Partnerships’ local engagement activity, we were pleased to hear that the BBC were exploring further how they could assist, particularly through use of their local radio networks:

“… public service broadcasters have an important role to play in supporting the emergency responder community in discharging their duty to communicate relevant risk information to the public – both with targeted vital messages to … audiences at a locality specific level as well as on a national basis. BBC Local radio contribution to local awareness weeks facilitated through existing Local Resilience Forum relationships continues to add value to community resilience and further work in this area which can serve the public interest is currently being explored as good practice.”⁴³⁸

But a large part of the task will – and should – fall on the UK Government. It has substantial experience – and more than many Resilience Partnerships – of communicating with the public in other areas of public policy, including in recent years using behavioural change techniques as a means of encouraging public action. It can draw on that experience to help Resilience Partnerships in their work.

And, as well as publishing the material it holds, there is a strong case for the UK Government publishing information which is common across all localities rather than each Resilience Partnership being required to devote resources to re-inventing the wheel. Although local tailoring of information is important, especially where different risk profiles may require different advice or action within the locality, the impact of many risks will be felt in the same way across the UK. In those circumstances, one single, central source of information will avoid inconsistencies in the provision of core information to people who may well live, work, study or socialise across a range of Partnership areas. It will also avoid obvious inefficiencies and allow Partnerships to focus on issues which are unique to their own area:

“One of the big things I found an issue from my time in local authority / LRF working was that there are many organisations approaching communities with preparedness / plan templates. We found communities were overwhelmed and therefore didn’t pick up any of the plans. Think a national steer on community resilience would be brilliant and include factors like grab bags, key risks (eg. total loss of power), flood advice, utilities priority services, key numbers (eg. not all are familiar with 111, 101, 105 etc). A one stop shop of sorts would be ideal.”⁴³⁹

Many interviewees proposed that the most effective and efficient way of achieving the desired goal would be to develop a single site, with a single brand, providing information to the public through a shared web presence, as seen in the USA’s Ready.gov⁴⁴⁰ website or Canada’s Get Prepared⁴⁴¹ website, both of which are part of national public service campaigns:

“…resilience is crying out for a national website for public communication. Most information doesn’t need to be localised. Would get more public attention. Better value-for-money.”⁴⁴²

“Would be best to have one website centrally to contain risk information. Local advice and guidance could be provided there so everything was in one place.”⁴⁴³

“US has a single resource on risk (Ready.gov) that really works nationally. UK does it 38 times; not efficient or practical. Should be one national website for shared common material, with 38 separate areas for LRF-specific content.”⁴⁴⁴

We agree. A single platform, properly curated, would provide the consistency which is important in the information and advice provided to businesses and communities. Inclusion of national and local content on the same platform would reduce the resource burden on Resilience Partnerships and become a simple ‘one stop shop’ for the public. It would support the ability of Partnerships to run local media campaigns, as many do now. And it would enable the development and use of a trusted brand⁴⁴⁵, which, if done well and used consistently across all promotional materials, could help build the trust which is a vital underpinning to whole of society involvement in building UK resilience.

The House of Lords Select Committee has recommended that:

“The [National Risk Register] should … be presented via a dynamic, data driven web- portal which is easily navigated, evolves in response to identified threats and which provides practical, targeted advice to individuals. Its profile must be increased through an active and continuing media campaign, including via social media. This campaign should heighten whenever substantive changes are made to the risk register. It should focus on informing society of the content of the NRR and how they could use the NRR to bolster their personal preparedness.”⁴⁴⁶

We would go further, to recommend that the platform should not rest on the NRR alone. As other countries’ equivalent platforms demonstrate, there is a wealth of potential content, covering both nationally- and locally-generated material, and material generated by each sector. That material needs to be presented in a form which is easy to navigate and interrogate, and to extract. That places an emphasis on ease of access, simplicity of design and language, and the provision of information in digestible packages (including, for example, in short video clips as well as written material) – all hallmarks of the GOV.UK website, which we believe would be the most obvious, high-quality, trusted and efficient platform to host public information material.

Recommendation 50: Government and designated local bodies (co-ordinated through Resilience Partnerships) should ensure that the information they publish about risks, consequences and plans is designed, presented and actively promoted in a way which supports the public, businesses and voluntary and community organisations in their own planning. This should include the ability to support sustained local and national media campaigns.

Recommendation 51: The UK Government should draw on its experience of communicating with the public in other areas of public policy to identify the most effective ways of presenting information about risks to different audiences and share this with Resilience Partnerships.

Recommendation 52: The UK Government should identify with Resilience Partnerships those areas where the development of information once, at national level, would mean that the information provided to the public was consistent and reduce the duplication of effort at local level, allowing Resilience Partnerships to focus on the development of material tailored to local circumstances.

Recommendation 53: Information should be provided in a form which is easy to digest, navigate and interrogate, and to extract. The UK Government should discuss with Resilience Partnerships the development of a shared web presence to hold both national and local content, including hosting it on the GOV.UK platform.

Recommendation 54: The UK Government should work with Resilience Partnerships to develop, and then consistently use, a single ‘brand’ for resilience information in the UK.

The Information Sharing Duty

Information sharing between designated bodies at the local level is clearly critical, both in enabling them to successfully complete their duties in the planning phase, and also during an emergency:

“Information sharing is necessary so that Category 1 and 2 responders are able to make the right judgements. If Category 1 and 2 responders have access to all the information they need, they can make the right decisions about how to plan and what to plan for. If they do not have access to all the information, their planning will be weakened.”⁴⁴⁷

What Does the Act Require?

The 2005 Regulations therefore encouraged informal information sharing as part of broader co-operation, but also provided a mechanism whereby a designated body could formally request information from another designated body as long as it was for the purposes of enabling them to fulfil their responsibilities under the Act or to perform another function related to an emergency. The Regulations were amended in 2012 as part of the Civil Contingencies Act Enhancement Programme⁴⁴⁸ in response to findings from the Pitt Review and the Buncefield Review, which prompted calls to clarify the duty and to add flexibility as to how it could be fulfilled. There was:

“…a worry that the information sharing duty was being hindered by responders being unsure of what they were allowed to share resulting in a high number of time- consuming formal information sharing requests.”⁴⁴⁹

The changes were therefore aimed at:

“…[reducing] the burden on both Category 1 and 2 responders by clarifying the intention of the Act to encourage informal information sharing. The amendments go on to specify that a formal information request is a last resort and should only be used where the information cannot be supplied with an informal request.”⁴⁵⁰

The 2017 Post-Implementation Review of the Regulations looked at whether fewer formal information requests were being made as a result of the changes but were unable to reach a conclusion as “no relevant data [was] available”⁴⁵¹.

Are Changes Needed to Arrangements for the Execution of the Duty?

Our analysis of the evidence we received on information sharing highlighted that there were three areas where changes were needed to arrangements for the execution of the duty:

• Some concerns were raised by designated local bodies on the sharing of information between themselves during the planning phase
• Significant concerns were raised by local bodies on the sharing of information by UK Government departments during the planning phase and during emergencies
• Significant concerns were raised across all sectors on the sharing of personal data during an emergency

These are covered in turn below.

Sharing of Information Between Designated Local Bodies During the Planning Phase

We received no evidence that suggested a need for amendment to the existing duty.

Some concerns were raised, however, on arrangements for its execution. These included problems with information sharing between health bodies and other Resilience Partnership members during the COVID-19 pandemic, which we assume will be pursued by the COVID-19 Inquiry. Issues were also raised about the sharing of commercially sensitive information:

“Commercial sensitivity acting as a barrier to information sharing. Was particularly damaging when the LRF was tackling EU Exit and ports issues. Did try some workarounds but those have risks. Unclear how to get necessary information sharing to take place, especially in the planning phase.”⁴⁵²

Statutory guidance⁴⁵³ has not been updated since March 2012 and therefore does not align with the latest Government Security Classifications guidance⁴⁵⁴. The next update should include the latest requirements for the secure handling of information, including commercially sensitive information. Resilience Partnerships can then consistently use this updated guidance to ensure they have the necessary security-cleared and trained personnel, and information security arrangements, in place to effectively support multi-agency working.

ResilienceDirect was cited by interviewees as a key tool to support information sharing but concerns were expressed about its user-friendliness:

“Need better information flows and information sharing. ResilienceDirect is key tool to do this. But from a national Cat 1 point of view, it is difficult to access and is clunky. It needs investment and improvement: to be quicker, more intuitive, with better search functionality, more interactive.”⁴⁵⁵

“Don’t like ResilienceDirect. Have more incidents … than other local authorities in the LRF so used more than most. Very clunky. Log doesn’t work as quickly as it needs to. Some functions good but needs an officer who is looking at it all the time: not got the resources for that. Hard to keep up to date and keep people trained in its use.”⁴⁵⁶

“…lack of digital innovation is apparent. ResilienceDirect is clunky and hard to use. Not resilient! We are good at using it but this needs investment too.”⁴⁵⁷

These comments echo a recommendation made by the C19 National Foresight Group in their First Interim Operational Review Report on the response to the COVID-19 pandemic:

“Resilience Direct should be re-structured to improve horizontal visibility across LRFs, to improve situational awareness and share good practice. Greater use of standard naming conventions and templates for reporting is encouraged.”⁴⁵⁸

Recommendation 55: The information sharing duty in the Act remains fit for purpose for supporting the sharing of information between designated bodies at local level.

Recommendation 56: In refreshing statutory guidance on the information sharing duty, the UK Government should ensure that it aligns with the latest Government Security Classification scheme.

Recommendation 57: Resilience Partnerships should use the updated guidance on the information sharing duty to ensure that they have the necessary security-cleared and trained personnel, and information security arrangements, in place to effectively support multi-agency sharing of information.

Recommendation 58: The UK Government should review the role, use and user- friendliness of ResilienceDirect with designated local responders and make the necessary improvements.

Sharing of Information Between Designated Local Bodies and the UK Government During the Planning Phase and During Emergencies

We describe in the Improving Access and Engagement section the difficulties encountered by Resilience Partnerships in trying to access the National Security Risk Assessment. We also heard evidence of other difficulties experienced by Resilience Partnerships in receiving information from the UK Government:

“Historically, too many restrictions on information sharing to do a robust local risk assessment. Seen again in COVID where risk information was all one-way to government, not two-way information sharing. Affected decision making. When dashboards were set up, all [our LRF] saw was what they had inputted. No shared situational awareness. Risk assessment process is for all partners …”⁴⁵⁹

“All Cat 1 responders need to understand the planning assumptions to be able to do their planning properly … Six key scenarios on winter pressures developed by government for this year. Government confirmed they weren’t going to put them on paper for LRFs even though they had been verbally told them on the LRF Chairs call.”⁴⁶⁰

“LRF shares as much as it can, particularly in response. Issue is what comes from centre … LRF got its information from Sky for COVID … During EU Exit, LRFs given the reasonable worst case scenarios were allowed to share them with only three named people. Huge lack of trust with CEOs of major public sector bodies. Arguably, those with the information were breaching their legal duties under Act. That attitude must change … Central government needs to think hard about information-sharing in a different way, with accountability, so that local responders can take sensible decisions. Need to get the trust back into the relationship between central government and local responders.”⁴⁶¹

“Information sharing was difficult at the start of COVID. Example provided of a specific instruction within an organisation that information couldn’t be shared with a senior key responder from another agency. Can’t have national structures stopping LRF members working together effectively as they do normally.”⁴⁶²

Similar concerns were flagged by the C19 National Foresight Group in their First Interim Operational Review Report on the response to the COVID-19 pandemic. They recommended that:

“… Central Government [should] seek to share their assumptions, strategy, decisions, data and modelling with local level decision makers to support effective decision- making to improve the efficacy of the response, recovery and other phases going forward.”⁴⁶³

and that:

“The communication forums between local LRFs and the national level need to be further improved to ensure they are effective, timely and bi-directional and discussions, requests, actions and decisions are logged and shared with participants.”⁴⁶⁴

A similar recommendation in the C19 Foresight Group’s Third Interim Operational Review Report is indicative of continuing problems. It repeated the need for improved, timely information sharing:

“The Communications Strategy/Plan should incorporate the processes and platforms (such as LRF Chairs Calls/ Resilience Direct) to ensure local decision makers are made aware of key strategic decisions and changes to policy ahead of them being announced. These need to be accompanied by the evidence underpinning them; how they support the national strategic objectives and also appropriate guidance to enable the necessary planning for implementation at the local level and to enable clear communication with the public.”⁴⁶⁵

It is apparent that information sharing between the UK Government and designated local bodies has not been working effectively. We assume that some of the issues identified will be pursued by the COVID-19 Inquiry. But, more broadly and more immediately, if the full suite of duties are placed on the UK Government as we recommend in the Duties to be Placed on the UK Government section, consideration will need to be given to the requirement for additional Regulations, with supporting statutory guidance, which specify the information sharing mechanisms to be used between designated bodies at national level and between designated local and national bodies.

Recommendation 59: The UK Government should consider the need for additional Regulations, with supporting statutory guidance, covering the information sharing mechanisms to be used between designated bodies at national level, and between designated local and national bodies.

The Sharing of Personal Data During an Emergency

One of the most significant issues raised in our interviews with front-line organisations was the sharing of personal data. We received compelling – and in some cases harrowing – evidence from public, private and voluntary sector organisations of the way in which actual or perceived restrictions on the ability of organisations to share personal data meant that those affected by emergencies, especially the COVID-19 pandemic, had not received support which was as effective or as timely as it should have been:

“Gap on information sharing about vulnerable people. Don’t think Data Protection Act is helping. For example, for those severely vulnerable people who were self- isolating during COVID, it would have been useful to know who they were in advance in case of a fault arising so that UK Power Networks (UKPN) could put in place additional protection measures to help them, including sourcing food and heating in case of electricity outage. Information was gathered on vulnerable people by other responders, but they wouldn’t share it with UKPN, who were told that an event (eg. an electricity outage in this case) needed to have happened before information could be released. Failure to share in advance means that UKPN can’t be proactive: if it takes 4-5 hours to receive and process information once the incident happens, UKPN staff lose the golden hours for triage and action. People hide behind [the] DPA. Need the government to intervene and clarify nationally what can be done though guidance and legal interpretation.”⁴⁶⁶

“Resilience partners do share information but usually only at the height of the incident and not before. They do have some data sharing agreements in place and are looking to get more, however lots of nervousness due to DPA / GDPR, etc. about sharing information in advance. Obvious benefit of sharing information in advance means that utility companies and others can make plans to support vulnerable customers. Not getting data until the incident happens means that supplies and support to vulnerable people are delayed. And made worse by the way in which each LRF collects data on vulnerable people in different ways. And defines vulnerable in different ways – eg. older people v economically vulnerable, etc. Need an agreed common, shared set of data attributes.”⁴⁶⁷

“…need to sort the NHS data issue. Can’t have people standing on GDPR in future and getting in the way of providing financial support through charitable gifts to people in need.”⁴⁶⁸

A recent paper from the National Preparedness Commission (NPC) sets out the challenge:

“In any crisis or emergency, getting help and assistance to the most vulnerable is a priority … However, the knowledge of who is vulnerable and the nature of their needs are usually dispersed … The challenge is how to make sure that this dispersed knowledge is brought together before times of crisis.”⁴⁶⁹

This is not a new issue. It arose, for example, in the immediate aftermath of the 2005 London bombings when:

“Limitations on the initial collection and subsequent sharing of data between the police and humanitarian support agencies hampered the connection of survivors to support services like the Assistance Centre. The concern at the time was that the Data Protection Act might prevent the sharing of personal data without the explicit consent of those concerned. As a result, there were delays in information reaching survivors about the support services available.”⁴⁷⁰

To address this learning, the UK Government published guidance⁴⁷¹ with the support of the then Information Commissioner in 2007 on data-sharing in emergencies which:

“… makes clear that data protection legislation is not a barrier to appropriate information sharing …”⁴⁷²

and set out a number of key principles to guide emergency planners and responders in their decision-making:

Key Principles

• Data protection legislation does not prohibit the collection and sharing of personal data – it provides a framework where personal data can be used with confidence that individuals’ privacy rights are respected
• Emergency responders’ starting point should be to consider the risks and the potential harm that may arise if they do not share information
• Emergency responders should balance the potential harm to the individual (and where appropriate the public interest of keeping the information confidential) against the public interest in sharing the information
• In emergencies, the public interest consideration will generally be more significant than during day-to-day business
• Always check whether the objective can still be achieved by passing less personal data
• Category 1 and 2 responders should be robust in asserting their power to share personal data lawfully in emergency planning, response and recovery situations
• The consent of the data subject is not always a necessary pre-condition to lawful data sharing
• You should seek advice where you are in doubt – though prepare on the basis that you will need to make a decision without formal advice during an emergency

However, few of the organisations we interviewed who played a major role in the response to the COVID-19 pandemic were aware of this guidance. Some were aware of guidance issued by the Information Commissioner’s Office (ICO) on the principles to be used in decisions on data-sharing in emergencies. The statutory Data Sharing Code of Practice⁴⁷³, published by the ICO in December 2020, has a specific section dealing with the sharing of data in emergencies. But, as the NPC paper records, “… there is a belief that these do not go far enough”⁴⁷⁴.

Indeed, the organisations we interviewed put the issue more strongly. In their view, legal restrictions in primary law on the sharing of personal data trumped guidance with non- statutory force. This was especially the case in circumstances where decisions on the sharing of personal data were being made by relatively junior staff in highly-pressured circumstances. Many argued that the absence of a defined exemption in law⁴⁷⁵ for the sharing of data in such circumstances in itself reinforced the presumption against sharing.

The argument was often made that, had the UK Government wanted data to be shared, it would have created an exemption in law alongside the other exemptions:

“Our legislation and policy in the UK under data protection laws and through the management of police information, in some areas of policing, has created environments where officers and partners are nervous about sharing too much information, which can inhibit our ability to manage risk safely and make good decisions. Need to find a way to create those environments then train people on the duty to share. Need a proper structure to do this and solid backing in law.”⁴⁷⁶

This view was widely held, not only in those organisations such as the NHS which routinely place a high premium on protecting personal data, but also a wide range of VCS organisations and businesses providing what the response to the COVID-19 pandemic has shown are essential services to people in need (eg. food retailers). Their uniform view was that the sharing of data in an emergency should be covered by a specific exemption in the 2018 Data Protection Act which could be cited by those taking decisions to share personal data in an emergency, subject to their reasons for doing so being formally recorded:

“Real issue. Discussions took place previously with Home Office Victims of Terrorism Unit to discuss how personal data of those affected during a terrorism incident, could be passed to relevant agencies who are in a position to support those affected, bearing in mind the Data Protection Act. Initial suggestions were considered that a senior police officer may declare a period in the immediate aftermath of a terrorism incident, whereby personal details could be passed to support agencies, where it was believed that support was required. Not aware if this was ever progressed.”⁴⁷⁷

“The ability to share and exchange information is also vital. People in communities need to know who is vulnerable and may need help. Central government needs to deal with restrictions on sharing personal data: longstanding issue, not gripped.

Health organisations in particular are bureaucratic and risk averse, stick to the letter of the law and don’t share. ICO gave an exemption on data exchange of personal information for crime and disorder under the Crime and Disorder Act: information can be shared to enhance public safety, etc. Should have something similar for resilience. VCS in particular get really frustrated as they can’t get the information they need to work effectively.”⁴⁷⁸

We have tested alternative routes to addressing the need.

The first would be to cover the issue in guidance and training for those staff in the organisations most likely to face decisions on sharing personal data, especially as part of the common core training we recommend in the Rebooting the Training Ecosystem section. Such training is clearly necessary and valuable. But we do not believe that it would provide sufficient certainty of reaching all of those likely to have to make decisions on data-sharing, across the public, private and voluntary sectors nor would it overcome what are clearly deep-seated views on the dominance of provisions in primary law on the protection of personal data even where the humanitarian need to share appears compelling.

The second, well covered in the NPC paper, would be through the use of Priority Service Registers developed by some of the regulated utilities and encouraged by their Regulators:

“SE Water led to get the water companies working together to share their [Priority Service Registers]. We need one list we can work to rather than lots.”⁴⁷⁹

The proposals in the paper are attractive, and we hope that they are taken forward. But clearly they cannot cover personal data held by other organisations, especially the substantial amounts of important data held by local statutory bodies.

The third would be to rest on existing provisions in the Civil Contingencies Act⁴⁸⁰ and its supporting Regulations⁴⁸¹, as amplified in statutory guidance⁴⁸². The NPC paper commends this route⁴⁸³. We disagree, on three grounds:

484. The provisions in the Act cover only those bodies – mainly local statutory bodies and the regulated utilities – designated by the Act⁴⁸⁴. They do not cover VCS organisations or private sector businesses who, as the response to the COVID-19 pandemic has shown, have a vital role in providing support to those affected by an emergency.
485. Regulations make clear⁴⁸⁵ that organisations should not comply with requests for information which is deemed to be “sensitive”⁴⁸⁶ including “information which is personal data within the meaning of” the Data Protection Act.
486. Coverage in statutory guidance⁴⁸⁷ of the sharing of personal data is both brief and restrictive rather than permissive, reinforcing the requirement for organisations to refuse requests to share information of grounds of Reference to the 2007 Guidance agreed with the Information Commissioner is given less prominence – and in any case that guidance is non-statutory. It is particularly disappointing that the 2007 guidance developed with the Information Commissioner was not embedded into the 2012 revision of the relevant chapter of Emergency Preparedness and thereby given statutory force.

There is thus potential for better guidance and training in this area, and for the development and use of Priority Service Registers – including in the telecommunications sector which does not currently operate such a service:

“Power sector does have a … Priority Services Register … Telecoms companies hold their own information about vulnerable consumers. Maybe there is an opportunity to use the existing power sector Priority Service Register to target comms related help to vulnerable people via LRFs, etc?”⁴⁸⁸

But for the reasons set out above, these do not fully address the legal – and therefore the humanitarian – need. What are clearly believed by emergency responders across the public, private and voluntary sectors to be powerful restrictions in primary law on the sharing of personal information need a clearly expressed exemption with the same legal status, capable of being used quickly and with confidence by operational staff facing the urgent

demands of meeting people’s needs in the response to major emergencies.

We therefore believe that the most effective means of addressing the need would be to create a further exemption in the Data Protection Act which allows for the sharing of personal data in cases of ‘urgent humanitarian necessity’. This formulation is intended to provide a legal ‘triple lock’ against misuse of the exemption: those citing the exemption in the formal recording of their decision to share personal data in the response to an emergency would be required to demonstrate that the need to do so was:

• Urgent – as would be the case in an emergency
• Intended to meet identified humanitarian need, most likely by reference to the identified or anticipated consequences of the emergency for the physical or mental wellbeing of those affected
• Necessary, to enable the provision of support which would not otherwise be provided, or of support where the actions of two or more agencies working together would result in a material difference to the quality of the support provided.

An ideal opportunity exists to pursue this change as part of reforms to the UK’s data

protection regime on which the UK Government has recently consulted⁴⁸⁹.

Recommendation 60: The UK Government should pursue with the Information Commissioner the creation of an exemption in the Data Protection Act 2018 or successor legislation explicitly to allow for the sharing of personal data during emergencies in cases of urgent humanitarian necessity.

Recommendation 61: Legal provisions and principles on the sharing of personal data, including guidance provided by or agreed with the Information Commissioner and any new exemption in Data Protection legislation, should be captured in updated guidance and training for staff in those organisations most likely to face decisions on sharing personal data during the response to a major emergency.

The Co-Operation Duty

Delivery of all of the duties described above cannot be done in organisational silos. Even the ‘internal’ Business Continuity Management duty requires organisations to engage with their supply chains, and to explore arrangements for mutual aid, in order to ensure that they are truly resilient.

What Does the Act Require?

The most critical relationships are those between designated bodies at the local level and government departments and other relevant bodies at the national level. At present, the duty of co-operation set out in Regulations focuses solely on the former – co-operation between Category 1 and 2 responders at the local level – and requires that:

“(1) Relevant general Category 1 responders must co-operate—

• with each other in connection with the performance of their duties … and
• with relevant general Category 2 responders in so far as such co-operation relates to or facilitates the performance of the relevant general Category 1 responder’s duties …

Relevant general Category 2 responders must co-operate with each relevant general Category 1 responder in connection with the performance by that relevant general Category 1 responder of its duties …

• Relevant general Category 2 responders must co-operate with each other in so far as such co-operation is necessary to enable each such relevant Category 2 responder to perform its duties …”⁴⁹⁰

The Regulations go on to state that the mechanisms used for that co-operation must include:

“… a forum of all relevant general Category 1 and Category 2 responders (referred to in these Regulations as the “local resilience forum”).”⁴⁹¹

and that there must be:

“…a meeting of the local resilience forum, to which the chief officer of each relevant general Category 1 responder and each relevant general Category 2 responder is invited, at least once every six months (“the Chief Officers Group”).”⁴⁹²

We cover in the next Chapter on Structures our analysis and recommendations for improvements to Resilience Partnerships, including the resulting legislative changes that would be required.

The Duties to be Placed on the UK Government section covers the application of the full suite of duties to the UK Government. This change to the Act or successor legislation would need to be supported by additional associated Regulations, with supporting statutory guidance which set out the co-operation mechanisms to be used between designated bodies at national level, and between designated local and national bodies.

Recommendation 62: Additional Regulations, with supporting statutory guidance, should specify the co-operation mechanisms to be used between designated bodies at national level, and between designated local and national bodies.

Previous Chapters have covered:

• What we should be seeking to achieve in building UK resilience – setting a higher ambition on risk reduction and prevention, and on ‘building resilience in’
• Who might be involved – building stronger arrangements to give operational meaning to the aspiration of involving the whole of society in building UK resilience
• Whether there is a need to change the list of designated bodies which have specific legal duties placed upon them under the Act – sustaining continuity at local level, but with new duties placed on the UK Government
• Whether the duties themselves need to change, or arrangements for their execution

In this Chapter, we bring together the conclusions of those Chapters into an analysis of whether current governance and collaboration structures which bring together organisations in partnership remain a sound platform for building and sustaining UK resilience over the next 20 years, or whether there is a need for change. The analysis below covers:

• Local structures
• The role of Metro Mayors
• Regional structures
• National structures
• The doctrine and guidance which builds a consistent approach to maximise the effectiveness and efficiency of the combined efforts of everyone involved

set against the requirements of the Act, associated Regulations and supporting guidance.

What Does The Act Require?

Resilience Partnerships

The Act places duties on designated local bodies but does not itself mandate the form of governance and collaboration structures which should be adopted by local bodies in the execution of those duties. These are set out in:

1. In England and Wales, Regulations made in 2005 and amended in 2012 which require that co-operation:
   

   “… shall take such form as may be agreed between the relevant responders, but must include … a forum of all relevant general Category 1 and Category 2 responders (referred to in these Regulations as the ”local resilience forum”).”⁴⁹³

2. In Scotland, Regulations made in 2005 and amended in 2013 which require that co- operation:
   

   “… must take the form of all Scottish Category 1 responders which have functions which are exercisable in that co-ordination area co-operating together in a single group with all general Category 1 responders which have functions which are exercisable in that co-ordination area.”⁴⁹⁴

   and that:

   “The form of co-operation … is referred to in these Regulations as the “Regional Resilience Partnership”.”⁴⁹⁵

Regulations do not provide for equivalent governance and collaboration structures in Northern Ireland. These have been set out recently by The Executive Office⁴⁹⁶ which also notes that:

“The [Civil Contingencies Act] will be reviewed in the next year and it is hoped to clarify the Northern Ireland legislation at that point, including secondary legislation if required and appropriate.”⁴⁹⁷

For England and Wales, the 2012 Regulations also require that:

“Relevant general Category 1 responders may hold meetings of the local resilience forum … at such times as they may agree and must hold a meeting of the local resilience forum, to which the chief officer of each relevant general Category 1 responder and each relevant general Category 2 responder is invited, at least once every six months (“the Chief Officers Group”).”⁴⁹⁸ (Our emphasis)

For Scotland, the 2005 Scotland Regulations set that same expectation⁴⁹⁹.

Geographical Areas

The 2005 Regulations provide for the “local resilience areas” in England and Wales covered by designated local bodies, and hence Local Resilience Forums (LRFs), to be based on police force areas⁵⁰⁰. The 2013 Scotland Regulations define three geographical “co-ordination areas” in the north, west and east of Scotland⁵⁰¹ to be covered by Regional Resilience Partnerships (RRPs). Within each RRP area are a number of Local Resilience Partnerships (LRPs) – amounting to 12 in total – organised across varying geographical and authority boundaries which provide the mechanisms to allow local planning, exercising and emergency response.

Legal Status

Neither the Act nor any of the supporting Regulations provide for these structures to have legal form. Resilience Partnerships therefore do not have legal duties, which remain the sole preserve of individual designated local bodies. Statutory guidance⁵⁰² makes clear that an LRF:

“… has no separate legal personality and does not have powers to direct its members. As a forum for responder organisations, it is not a local responder itself and has no specific duties under the Act.”⁵⁰³ (Our emphasis)

It also sets the purpose of the LRF to:

• “provide a local forum for local issues;
• help co-ordinate risk assessment through production of the Community Risk Register;
• facilitate Category 1 and 2 responders in the delivery of their … duties;
• help deliver government policy by co-ordinating responses to government initiatives; and
• help determine a procedure for the formation of a Strategic Co-ordinating Group (SCG) by the relevant local responders at the time of an emergency.”⁵⁰⁴

Local Governance and Collaboration Structures – Continuity and Change

The recommendation in the Legislative Implications section in the What is Resilience and a Truly Resilient Nation? chapter that resilience-building activities in the UK should in future cover the full range of risk and emergency management, addressing risk reduction and prevention as much as emergency preparedness, response and recovery, would in itself represent a substantial broadening of the role and workload of local bodies and Resilience Partnerships. But we believe that future governance and collaboration structures need also to reflect three further significant shifts.

First, a future risk picture, summarised in the Future Risk Picture section, which is markedly worse than in 2004 when the structures in use today were established. The most significant challenges, which were envisaged 20 years ago as being predominantly local in nature, are becoming more complex, with consequences on a wider scale and more likely to be national in scope. Local bodies and Resilience Partnerships will need to plan for a higher likelihood of emergencies on a national scale, as well as those with significant cascading and compounding consequences for people’s wellbeing and way of life.

Secondly, societal expectations, summarised in the Societal and Public Expectations section, especially the readiness of people to pursue their own resilience and to reach out to neighbours and their communities, but to do so within a properly defined and developed framework. This must in large part be provided at local level. The arrangements for moving from the current rhetoric to an effective ‘whole of society’ architecture for building resilience in the UK on the lines we propose in the Involving the Whole of Society chapter will need good, local leadership by public bodies working collectively.

Third, the expectations of the UK Government, which has over the last five years significantly shifted its expectations and use of English LRFs. One part of the shift has seen the greater engagement of LRFs in risk reduction and prevention activities – a role which we believe should be formalised and continue. The second part has been that the UK Government is increasingly looking to LRFs to act as a single collective, to receive and undertake tasks set by the UK Government and to report back as an entity:

“LRFs have changed. An entirely different world now from 2004. But there is incomplete buy-in to that across the LRF. Not all partners understand that the Government expects LRFs to act collectively, and to provide a single collective response to its requests.”⁵⁰⁵

These changes mean that local governance and collaboration structures are clearly in a fundamentally different position to that envisaged in 2004 and set out in Regulations and guidance. We have therefore discussed with staff of local bodies and Resilience Partnerships – and with businesses and voluntary organisations – whether current structures remain the most appropriate vehicle for achieving the ambition of the UK being a “the most Resilient Nation”.

It is notable that the almost unanimous view of those we interviewed was that LRF and RRP/LRP structures would be fit for that future purpose, and that continuity – of securing and then building on what has been achieved over the past 20 years – was important. We share that view.

Equally, however, changes are needed. If local bodies and the governance structures within which they operate are to be capable of fulfilling this wider and more challenging role, they need clarity about their future role and the expectations of them. And they need the tools to do a bigger job. The analysis below covers:

1. Whether the geographical basis of the ‘local resilience areas’ (police force areas) in England and Wales and of the geographical ‘co-ordination areas’ in Scotland, are right for the future.
2. The legal status of LRFs and RRPs/LRPs, including whether they need legal powers and duties to deliver their future role.
3. The provision of clarity around their future role and expectations of
4. Their leadership.
5. Their resourcing.

Given its importance, we cover accountability separately in the Accountability chapter.

Geographical Basis

There is a wide range of geographical and legal models for resilience structures in other countries. But these reflect what in many cases are different constitutional settlements to those of the UK, especially in:

1. Countries such as the US, Australia and Germany with strong, separate political leadership and powers at sub-national These are mirrored in the devolution of responsibilities for resilience to the Devolved Administrations in the UK, but not to sub-national areas in England.
2. Countries such as Italy where civil protection structures reach to markedly lower levels than in the UK.

Our research and interviews led to a clear conclusion that LRFs in England and Wales on their current geographical basis continue to offer the best fit against current political settlements⁵⁰⁶. There are no practicable alternatives which would merit the operational disruption of abolishing current Partnerships and moving to a different geographical model.

Although there are practical issues, mainly in England, associated with different bodies working on different geographical boundaries, these are, mostly, being addressed – although we have identified some amendments to ways of working which would add value, especially greater regional collaboration, covered in the Regional Resilience Structures in England section. Unless significant changes are made to political leadership and governance arrangements as a result of the implementation of any of the proposals in the ‘Levelling Up’ White Paper⁵⁰⁷, the current geographical basis for co-operation should be sustained.

In Scotland, experience in recent years in building emergency preparedness and in the response to major emergencies has brought out that the primary focus of resilience-building activity is at local level. LRPs have increasingly become the fundamental building block, with RRPs providing important mechanisms for building capacity and preparedness on a multi-LRP basis:

“One discreet issue for Scotland is Regional Resilience Partnerships (RRPs) and their legal powers and duties. Needs to be looked at in a refresh of the Act. Primary focus is local – on Local Resilience Partnerships (LRPs) / local tier. So consideration of the role and purpose of RRP’s would be useful – who is round the table and at which tier?”⁵⁰⁸

In light of experience gained, we suggest that there would be value in the Scottish Government reviewing roles and responsibilities of Partnerships at local, regional and national levels, drawing on learning across the four UK Nations.

Recommendation 63: The current geographical basis for Local Resilience Forums in England and Wales should be sustained. There would be value in the Scottish Government reviewing roles and responsibilities of Partnerships in Scotland at local, regional and national levels, drawing on learning across the four UK Nations.

Legal Status

We have examined, especially with Chairs of Resilience Partnerships, whether LRFs, and RRPs in Scotland, should be given legal status, with their own legal personality, power and duties in addition to those placed on local bodies under the Act.

We have done so against the recommendation of the House of Lords Select Committee that

the Government “should place [LRFs] on a statutory footing.”⁵⁰⁹

The main argument given to us in favour of giving Resilience Partnerships legal status is based on the challenge – which many Partnerships have told us they do indeed face – of gaining the consistent commitment of partner organisations around the table. Weaknesses in the performance of one partner can limit the collective performance of the Partnership.

At present, the Chair of a Resilience Partnership has no authority in law to require improvement in the performance of a partner organisation and can only act through the convening power and moral authority of his or her status as Chair, speaking on behalf of all partners. Under those circumstances, the ability of the Chair to draw on legal powers to require an under-performing body to improve its performance looks tempting.

A second argument in favour is that legal status would provide Chairs, and those who act on behalf of the Partnership, with a legal basis for the decisions they make and the actions they undertake. This legal footing would, it is argued, provide a platform for examination by regulatory and legal processes, such as public Inquiries.

Opinion was divided. Although we heard contrary views:

“[LRF] needs to be a recognised body with a structure and staff that can respond to the requirements of central government. That means legal status; legal structure; its own staff. If a body is tasked, it needs to operate under a statutory duty to do what it is tasked to do by central government ...”⁵¹⁰

we have concluded that the arguments against giving Resilience Partnerships legal status are stronger. This was also the view of the majority of Partnerships:

“Legislation to create one entity seems like it might offer efficiencies and simplify lines of accountability. But all the duties under the Act are on a range of organisations.

They have the depth of management capacity and capability to focus on dealing with the risks: the LRF wouldn’t. If duties were taken away from responders and given to the LRF, position would be worse: an LRF which has duties but doesn’t have the capacity to deliver them, especially in an emergency.”⁵¹¹

“[LRFs] need clarity on responsibilities more than legal status.”⁵¹²

The biggest concern is that giving Resilience Partnerships legal status would create confusion between the powers, duties and accountabilities of the Partnership and those of designated local bodies in an area where clarity is vital⁵¹³. There is clarity in the way in which the Act places duties on individual bodies, who are accountable in law for their performance, including in the response to emergencies. Indeed, we believe that that accountability should be reinforced rather than risk its being diluted, and make proposals for doing so in the Accountability chapter.

Second, legal status for Resilience Partnerships would risk cutting across and damaging the culture and ethos of partnership which has been embedded locally since 2004. Our interviews showed this to be highly-prized by front-line organisations, especially those who had parallel experience of other areas of the delivery of public services where partnership was weak or lacking.

Third, there would be the obvious additional cost and bureaucracy of creating some 40 new legal entities.

Giving legal status to Resilience Partnerships would thus in our view be counter-productive. Unless the UK Government wishes to make a fundamental change to resilience structures – for example, by changing the nature of Resilience Partnerships to be the delivery arm of the UK Government – we believe that they should continue on their current, partnership basis.

Escalation and Intervention

We did, however, pursue further whether there was a need for changes to support the Chairs of Resilience Partnerships in tackling under-performing organisations in circumstances where they were clearly not fulfilling their responsibilities, including duties in law:

“LRF Chairs do not have powers. Need to be much clearer on what that means for accountability, whether in partnership or in law … Needs to be addressed in work to codify the role of LRFs in future, including clarity on roles.”⁵¹⁴

“Agree that giving LRFs legal status would have a negative impact. If you made it a legal entity, who would want to run it? But do need better arrangements for escalation and intervention where partners are not performing. Being a Chair with no rights to ensure things get done properly can sometimes be difficult. But partnership model is right: when it works, it has real strengths.”⁵¹⁵

The majority of Chairs we interviewed were clear that issues with under-performing partners were capable of local resolution in the majority of cases. But there was a clear appetite for

giving Chairs ‘teeth’ including through:

1. Greater clarity on expectations, coupled with much stronger arrangements for the validation of performance – the Validation and Assurance chapter contains our proposals in this area.
2. Sharpened accountability – including personal accountability – for performance, which we address in the Accountability
3. Much clearer arrangements for escalation for resolution or, if necessary, intervention by the UK Government, with the government being more observably ready to support Chairs in tackling under-performing partners.

On the last, it was disappointing to hear that, in those rare circumstances where local persuasion had not worked, the Chairs of the Partnerships involved had rarely felt able to escalate issues with under-performance to the relevant national authorities for their intervention in resolution or, ultimately, enforcement action and that, where they had done so, the relevant UK Government department had conspicuously taken no action.

The Act and its supporting arrangement do not help here. Although the Act provides the ability for a Minister or a designated local body to “… bring proceedings in the High Court or Court of Session in respect of a failure by a person or body … to comply”⁵¹⁶ with their duties under the Act, this is clearly a large sledgehammer and is unlikely to be a credible route for struggling Partnerships, especially if they wish to sustain the spirit of partnership between members.

But it is notable that coverage in statutory guidance of escalation mechanisms short of legal action focuses only on escalation action within the Partnership⁵¹⁷. The readiness of the UK Government to support Partnerships in the management of the performance of under- performing organisations does not feature either in the description of the support available⁵¹⁸ from the Resilience and Recovery Directorate of (now) the Department for Levelling-up, Housing and Communities or of the role of the Civil Contingencies Secretariat⁵¹⁹. Nor are any mechanisms outlined for raising concerns via relevant inspection bodies or regulators where these bodies exist. Closing this gap, so that there is a clear route for administrative escalation and intervention as necessary, is an important underpinning to sustaining the effectiveness of local governance and collaboration structures.

Recommendation 64: LRFs in England and Wales, and RRPs in Scotland, should continue as a partnership of organisations, including those with duties in law.

Recommendation 65: The UK Government should establish stronger arrangements for administrative escalation to, and timely intervention and enforcement action by, the sponsoring central government department in the case of sustained under-performance by a designated local body. This function, and the processes to be followed, should be clearly set out in Regulations and statutory guidance.

Future Role and Expectations

As noted above, Resilience Partnerships are already operating – and are being asked by the UK Government to operate – outside the scope of current law and guidance. The Government’s expectations of their future role are unclear, with Partnerships clearly starting to be drawn into addressing a range of broader public service delivery problems (eg. the delayed transfer of care) which are well outside their remit:

“Helpful to be clear on boundaries of future role of LRF; cannot solve everyone’s problems.”⁵²⁰

This cannot continue. It is damaging to the effective operational delivery of the roles which Resilience Partnerships are required to fulfil. And it is unfair to those involved at local level, especially for those who might expect to be held to account for their performance by local political oversight and scrutiny mechanisms or, ultimately, in public Inquiries.

The House of Lords Select Committee recommended that “… the Government should clarify the purpose and duties of the LRFs …”⁵²¹. There is a clear need for the UK Government as an early priority to:

1. Discuss and agree with the Devolved Administrations and English LRFs a formal document setting out:

1. 1. Their future role, including their future wider role covering the full range of risk reduction and emergency management activity and in supporting the building of Resilient Places as proposed in the Resilient Places
   2. The Government’s expectations on the way in which they will discharge that role, including in their ways of working.

2. Reflect the key points of that document in subsequent revisions to the Act or future legislation, associated Regulations and supporting guidance⁵²².

Recommendation 66: The UK Government should as an early priority discuss and agree with Devolved Administrations and English LRFs a formal document which sets out the future role of local bodies and of Resilience Partnerships, and expectations on the way in which they will discharge that role. It should subsequently reflect the revised framework in changes to the Act or successor legislation, associated Regulations and supporting statutory and non-statutory guidance.

The Leadership of Resilience Partnerships

LRF Chairs in England have since 2004 been drawn from the senior leadership of the police force, fire and rescue service or local authority in the locality, as the principal designated local bodies in the Partnership. They undertake that role in addition to discharging the responsibilities of the organisation they lead.

This arrangement was practicable and cost-effective when the load on LRF Chairs was expected to be relatively light – indicated by the requirement in Regulations to hold a minimum of two LRF meetings per year. But their workload has grown considerably over the period since 2004, especially in the last five years with planning for exit from the European Union and during the response to the COVID-19 pandemic, and increasingly with the move by UK Government departments routinely to work with LRFs on a regular basis to anticipate and manage disruptive events, a role we have recommended should continue. We have therefore examined whether the current arrangement should continue in future, or whether the loading of the role would merit the introduction of alternative arrangements, in particular:

1. The appointment of a dedicated Chair, on a part-time basis, as with some other areas of public service.
2. The adoption of the Co-Chair model, as currently used by some English

Dedicated Chair

We have concluded that appointing part-time, independent Chairs of Resilience Partnerships would be counter-productive. The real value of the current model is that Chairs, because they are drawn from the senior leadership of the emergency services or local authorities, are highly connected on a day-to-day basis to other local leaders and have an intimate knowledge of local geography, demography and infrastructure. For almost all English LRFs we spoke to, this provided an essential platform for the building of the strong personal relationships which are vital in an emergency, together with an intimate, day-to-day understanding of local risks, vulnerabilities and potential consequences. This model therefore provides a vital capping stone to the successful partnership model developed since 2004 in creating a strong culture of belonging and togetherness – of working to ‘make friends before you need them’.

There is a significant risk that a part-time Chair, especially if not appointed from local public bodies, would not have that knowledge or be able to build such strong personal relationships:

“[Independent Chair] would result in lower levels of engagement than having the role embedded in one of the Category 1 organisations.”⁵²³

And it would also risk undermining the leadership of the local response during an emergency. At present, the Chairs of Resilience Partnerships usually transition in an emergency into leadership roles in the Strategic Co-ordinating Group (SCG) overseeing the local response, thereby bringing into the management of the emergency the knowledge, skills and networks they have built as Chairs of the Partnership. It is unlikely that part-time Chairs could make that commitment, either of immediately emptying their forward diaries to allow them to commit to the leadership of the response or to their sustained involvement in long duration emergencies.

Recommendation 67: The Chairs of Resilience Partnerships should continue to be appointed from the senior leadership of local bodies designated under the Act or successor legislation.

Co-Chairs

We have, however, been attracted by the Co-Chair model used by some English LRFs. Those who have adopted this model have pointed to two key advantages:

1. The ability to tailor leadership on a particular issue to the nature of the issue itself. Experience has shown, for example, that there are some issues where the local authority Co-Chair is better placed to lead activity, and others where leadership more naturally falls to the police or fire and rescue service.
2. Added personal resilience, especially in the response to long duration, major emergencies, when the Co-Chairs of the LRF have been able to form a leadership cadre in chairing Strategic Co-ordinating Groups. Having a cadre of capable, experienced and knowledgeable leaders drawn from across the Partnership adds real depth to leadership capability in sustaining the response to an emergency and also in ensuring that the right person is in place for the particular type of emergency that

West Yorkshire Local Resilience Forum Co-Chair Model

The West Yorkshire LRF co-chair model has served the group well for many years. Comprising a Local Authority Chief Executive, an Assistant Chief Constable, and a Deputy Chief Fire Officer, there are a range of skill sets and perspectives which are used to lead the LRF, and to make the most effective decisions.

The Chair of the LRF is rotated for quarterly business meetings and the group agrees the most appropriate Chair for SCG type incidents as they arise. Being a Co-Chair doesn’t mean that only one of the three will attend the meetings, it is about who controls and leads the discussions. By ensuring that strategic discussions are kept at an appropriate level, and that attendance at meetings is by those with the right competences and appropriate levels of delegated authority from their respective organisations, the role is one of leadership and facilitation rather than being the single source of expert knowledge.

Whilst the model existed long before the pandemic, one of the unforeseen benefits has been the resilience afforded by the ability for any one of the co-chairs to pick up the role of SCG Chair, seamlessly and with minimal handover, and often at short notice given the challenges presented by being senior members of their own organisations in a time of crisis.

This, of course, doesn’t happen by accident and the team put conscious effort into sharing thinking, and contemplating next steps when they are afforded the luxury of time to think – nothing elaborate here, a shared WhatsApp group and mutual understanding is all that it takes!

As an LRF where the response to wide area flooding is regularly tested, particular benefit from the co-chair model has been seen in the development and scrutiny of flood response plans for the LRF. Whilst always working to be as joined up as possible in all areas of mitigating the impact of flooding, the perspective of a Local Authority Chief Executive will naturally be focussed on flood prevention and recovery measures, when a blue light responder senior officer will focus on incident response. The West Yorkshire LRF has consciously used these differing perspectives to ensure that they are as well prepared as possible for the next flood event.

Recommendation 68: Decisions on who should chair Resilience Partnerships are properly a decision for the partners involved. But the Co-Chair model appears to have significant advantages which the UK Government should discuss further with the Devolved Administrations and English LRFs. Depending on the outcome, the Co-Chair model could be included in a subsequent revision of statutory guidance.

Resourcing of Local Bodies and Resilience Partnerships

Structures do not work without the resources to deliver the purpose for which they were established. The UK Government provided new funding to local authorities in 2004 to recognise the assessed cost of the new duties which local bodies were being required to undertake under the Act. In line with government policy at the time, and at the request of the Local Government Association, the funding provided was not ring-fenced.

That funding has eroded over the period since 2004 with reductions in the budgets of local bodies, especially over the past decade, and as local authorities have diverted funding to other service delivery areas. The Chartered Institute of Public Finance and Accounting and Institute for Government found, for example, that:

“Substantial cuts to the funding provided by central government to local authorities weakened councils’ ability to plan for emergencies … during austerity, emergency planning functions were politically easier to cut than front-line services. As a result, local authority emergency planning expenditure in 2018/19 was 35% lower in real terms than in 2009/10.”⁵²⁴

Our research and interviews found that local bodies and LRFs in England are at levels of resourcing for their resilience-building activities which are unsustainable, with significant impacts on staffing, skills development, and training and exercising which are causing real damage to their operational effectiveness. Current resourcing levels are insufficient to deliver existing policy let alone the additional tasks that come with the ambition of the UK being “the most Resilient Nation”.

We have been told that the UK Government has expressed an intention of putting English LRFs onto a sustainable, long-term funding basis. This is very welcome:

“Current instability around finance – created by central government time-limited funding and local negotiations – creates real issue in the quality of the LRF’s work, in planning, capability-building, training and exercising.”⁵²⁵

“The key issue is permanency of funding and hence long-term sustainability of work, rather than short-term funding LRFs receive from DLUHC. Short-term funding affects calibre of people who are used on the LRF’s work, as well as the scale and ambition of that work.”⁵²⁶

After discussion with English LRFs, we believe that the key resource deficiencies which need to be addressed are at the heart of the work of the Partnership itself. We have in discussion identified five posts which are central to enabling an LRF to fulfil its current roles, addressing the systemic weaknesses we identify in this report and taking on those new tasks we recommend:

1. An ‘LRF Manager’⁵²⁷ in each LRF, who acts in direct support of the LRF Chair in driving and co-ordinating the activities of the LRF. LRFs with an effective LRF Manager reported better progress and outcomes than those where this role was absent, or less effective. This person should have sufficient seniority and the knowledge, skills, attributes and experience to command the respect of the senior leaders of all designated local bodies.
2. A post dedicated to risk assessment, the analysis of vulnerabilities, and the significant improvements in risk assessment we recommend in the Risk Assessment Duty section.
3. A post dedicated to learning and improvement, through skills development, training, exercising and the identification and embedding of lessons identified from the response to emergencies and from exercises, to take forward the improvements we recommend in the Pursuit of Excellence chapter.
4. A post to take forward work on building the ‘whole of society’ engagement in the work of the LRF, especially in the local communication of risk on the lines set out in the Public Awareness Duty section, and outreach to VCS organisations, businesses and communities on the lines we recommend in the Involving the Whole of Society chapter.
5. An LRF Support Officer.

We support the proposal frequently made to us that there should be standard job descriptions and job titles for these posts to aid consistency across LRFs and to support cross-LRF working⁵²⁸.

But having the people is not enough. Clearly, they need to be trained, competent and confident in their roles. Much of this will lie with individual organisations. But there is one area – multi-agency exercising – where collective funding is needed, where the training is vital to operational effectiveness but where – as we describe in the Provision of Training section – the impact of budget reductions over the past decade means that insufficient training has been undertaken.

We therefore judge that the sustainable long-term funding package provided by the UK Government to English LRFs⁵²⁹ should cover as a minimum the costs of the five core posts identified above plus one major multi-agency exercise per year in each LRF.

Ideally, as the House of Lords Select Committee has recommended⁵³⁰, this money should be ring-fenced. If that is not possible, it is important that the sums provided to the LRF should be clearly identifiable by all partners around the LRF table, most obviously by means of specific grant to one of the partner bodies, rather than being contained within an individual organisation’s formula-based budget settlement where it will not be separately identifiable.

Recommendation 69: A sustainable long-term funding package for LRFs in England would cover as a minimum the costs of a core team of five posts and one major multi-agency exercise each year in each LRF. This should be provided by the UK Government as either ring-fenced funding or specific grant, so that the sums available are visible to all partners. The UK Government should also fund the consequential increases to settlements for the Devolved Administrations.

We do not have the evidence base to comment here on the funding required by individual designated bodies (eg. police forces, fire and rescue services, local authorities) to allow them to deliver their duties under the Act. But we would emphasise that the additional resources for LRFs set out above should not be regarded as being sufficient to fill shortfalls in the resources available to individual designated bodies to fulfil their responsibilities.

Even with the UK Government funding package for Resilience Partnerships outlined above, local bodies will still wish to provide their own top-up contributions, as now, to fund the work of the LRF. We heard from a large number of English LRFs about the time wasted – sometimes in bureaucratic politics – arguing over very small sums. And we were disappointed to hear that some bodies designated as Category 1 responders under the Act, and who therefore should have felt the responsibilities of full partnership, operated as ‘free riders’ in refusing to make a contribution or making only a token contribution. There was widespread support for the definition by the UK Government and use of a standard funding formula based on a single cost key (eg. population; budget), for adoption by all English LRFs in determining the contribution⁵³¹ to be made by each organisation:

“Should be standard funding formula, written down, with duty that all LRF members have to contribute to costs. Shared enterprise equals shared funding.”⁵³²

“Funding formula important: sense of a shared stake is vital underpinning to partnership working.”⁵³³

Moving in this direction would mean that time and energy is spent on strategic issues – what is to be achieved, and at what cost – rather than on who pays what.

Recommendation 70: The UK Government should, working with English LRFs, develop and publish a standard funding formula for the top-up contributions made by those bodies designated as Category 1 responders under the Act or successor legislation. It should be based on the partnership principle that all Category 1 responders contribute their fair share calculated under the funding formula.

The Role of Metro Mayors

The Act, its Regulations and supporting guidance are silent on the role of Metro Mayors of combined authorities in local resilience-building activity. That is unsurprising, given the relative newness of devolution settlements. But Metro Mayors are here to stay, and it is clear from our research and interviews that they have a valuable role which needs to be recognised. Mayors provide a clearly visible point of local leadership, with significant local agency and authority. Thinking only in the narrow terms of local resilience activity, and indeed in the narrow terms of emergency preparedness, response and recovery, is unhelpful. They provide or oversee:

1. Ownership or stewardship of a range of local public services, and the ability to marshal and direct those services in an emergency.
2. Valuable sources of data and information.
3. Political convening power, even in areas where they have no legal authority.
4. A major source of democratic accountability.

And, as noted in the Resilient Places section, they have an important role in work on ‘Place Based Resilience’.

Every devolution settlement, and hence the powers and responsibilities of each Metro Mayor, is different. It is therefore unlikely that there is one solution to how best to recognise them in legislation. But it is important that that is done.

We note the intention in the ‘Levelling Up’ White Paper to explore a ‘new framework for devolution’⁵³⁴ which could see over time an increase in the numbers of areas:

“… with a directly-elected leader covering a well-defined economic geography with a clear and direct mandate, strong accountability and the convening power to make things happen.”⁵³⁵

This could include directly-elected Mayors of combined authorities having a “Clear defined role in local resilience”⁵³⁶. Although the proposals in the White Paper overall will clearly take many years to be agreed, developed and implemented, we hope that it will be possible to make progress in this area an early priority given that the leaders and institutions are already in place.

Recommendation 71: The valuable role of Metro Mayors should be recognised in an amended Act or future legislation, associated Regulations and supporting statutory guidance.

Regional Resilience Structures In England

For the period immediately following the introduction of the Act, the work of LRFs in England was enabled by Regional Resilience Teams (RRTs), small teams of around 5-6 civil servants based in the then nine Government Offices for the Regions, who acted as the secretariat to Regional Resilience Forums (RRFs) and their sub-groups. This architecture:

1. Acted as an important interface between the UK Government and local bodies and LRFs in the development of national policy, and then in overseeing its local delivery, including providing advice and guidance on, as well as light-touch monitoring, validation and assurance of, local activity.
2. Enabled the development of cross-boundary, regional risk assessments, recognising that risks and their consequences do not stop at LRF boundaries, and that infrastructure, and people’s work and home lives, cross boundaries.
3. Provided an important forum for the engagement of organisations, especially Category 2 responders such as the regulated utilities and transport providers, and also VCS organisations, whose footprint is regional or national, enabling them to engage efficiently on issues common to all LRFs in the area especially risk assessment, emergency planning and infrastructure resilience.
4. Led on the development of region-wide capabilities and In some cases, such as training and exercising, these recognised the efficiencies of doing so. Regional activity also recognised that in some capability areas (eg. temporary mortuaries) it was operationally more sensible to develop and hold capabilities at regional level.
5. Supported the sharing of best practice, and the brokering of mutual assistance on a ‘buddy’ basis between LRFs.

Unlike LRFs – and indeed Regional Resilience Partnerships in Scotland – Regional Resilience Forums were not covered by Regulations associated with the Act.

The RRTs, and with them the regional machinery they supported, were abolished by the then Secretary of State for Communities and Local Government after the 2010 General Election as part of a wider package of regional and local government changes, with the role being absorbed into the Resilience and Emergencies Directorate (RED) in the then Department of Communities and Local Government (now the Resilience and Recovery Directorate in the Department for Levelling up, Housing and Communities (DLUHC)) operating through a

network of ‘Regional Resilience Advisers’.

It is clear that, over the past decade, cross-LRF, regional collaboration has progressively eroded. The abolition of the RRTs is widely seen as a retrograde step which has resulted in the loss of considerable expertise and with it operational and efficiency benefits. Despite good support from individual Regional Resilience Advisers, which LRFs were keen to praise, the systemic support provided to regional collaboration by DLUHC is seen as weak:

“Was a lot better when there were Regional Resilience Teams (RRTs).”⁵³⁷

“Used to have great RRT officers who were specialists, experienced, trained together, provided advice and guidance to LRFs, buddied up LRFs to provide support. All RRT staff now gone: big loss of expertise and knowledge.”⁵³⁸

“RRTs worked well. Had much better connection via RRTs with government departments.”⁵³⁹

There are effective regional collaboration arrangements in some parts of England (eg. the South West and North East), but not all. It is notable that, where they are working well, they cover most or all of the activities covered by the former RRTs and RRFs and their sub-groups:

“Would like regional layer back. Stops duplication across LRFs. They are a conduit for sharing information across LRFs. Everyone does it differently. LRFs not good at working regionally. North East still holding on to regional collaboration – do mutual aid and mutual assistance. But down to people making it happen.”⁵⁴⁰

“Regional collaboration is very valuable. During Op. Yellowhammer it forged common working with Kent and Hampshire in particular. Some risks need LRFs to think regionally. Use regional working to deal with regional systemic risks (eg. mortuary capacity). Greater regional collaboration on risk would be welcome.”⁵⁴¹

There are clear operational and efficiency benefits to putting regional collaboration arrangements onto a consistent, secure footing.

Recommendation 72: The value of regional collaboration between LRFs in England should be recognised, reinforced and put onto a consistent, secure footing. LRFs should decide their chosen forms of regional collaboration. The need for regional collaboration forums, and the potential scope of their activity, should be captured in Regulations associated with the Act, and in supporting statutory guidance. Support should be provided by the government department with lead responsibility for the stewardship of local resilience activity, and by the core team in each LRF.

Regional Structures in Emergencies

Experience of the response to the COVID-19 pandemic has shown the need for clarity on the arrangements to be used for collaboration between national and local levels in a major, wide-scale emergency.

Existing UK Government guidance is clear that:

“Whilst most emergencies are dealt with by local responders at a local level through Strategic Co-ordinating Groups, a Multi-SCG Response Co-ordinating Group (ResCG) may be convened where the local response has been or may be overwhelmed and wider support is required, or where an emergency affects a number of neighbouring Strategic Co-ordinating Groups and would benefit from co-ordination (eg. to obtain a consistent, structured approach) or enhanced support.

In such circumstances, DCLG [now DLUHC] may, on its own initiative or at the request of local responders or the Lead Government Department in consultation with the Cabinet Office, convene a ResCG in order to bring together appropriate representatives from local Strategic Co-ordinating Groups … where activated.”⁵⁴²

We heard from a wide range of English LRFs that they sought to set up ResCGs to enable multi-SCG collaboration during the response to the COVID-19 pandemic, including on the distribution of personal protective equipment and the administration of testing, but that, in many cases, such moves were not supported by the UK Government. We also heard criticism of the alternative arrangement of national virtual meetings between DLUHC and all LRFs, judged to be much less effective than a properly-enabled system of regional co-ordinating groups as envisaged for a national emergency.

It will be for the COVID-19 Inquiry to investigate this area further and make recommendations on the future management of national emergencies. But experience over the past four years with both planning for exit from the European Union and in the management of the response to the COVID-19 pandemic shows that, unless and until superseded by revised arrangements, ResCGs have a potentially vital role to play, especially in circumstances where the cross-boundary effects are significant.

Recommendation 73: Multi-SCG Response Co-ordinating Groups enabling cross-boundary collaboration between Strategic Co-ordinating Groups at local level continue to have a vital role in the emergency response framework for national emergencies. Their value in such emergencies should be recognised, and the government department with lead responsibility for the stewardship of local resilience activity should support local areas in their activation and use.

Structures At National Level

Structures at national level are marked by distributed leadership, in:

1. The substantial devolution of responsibility for resilience-building activity to the Devolved Administrations.
2. Risk-based responsibilities, where leadership in risk assessment, in emergency planning and preparation, and in emergency response and recovery is in most cases taken by a ‘Lead Government Department’ (LGD)⁵⁴³.
3. Sector-based responsibilities, again allocated to a Lead Government Department for each of the UK’s 13 critical sectors, and seen in Sector Security and Resilience Plans (SSRPs) which cover physical, personnel and cyber security as well as resilience to hazards⁵⁴⁴.
4. Stewardship of local resilience activities, which currently rests with the Resilience and Recovery Directorate (RED) in DLUHC.
5. Stewardship of the contribution of the Voluntary and Community Sector (VCS) to emergency preparedness and response, which rests with the Civil Society and Youth Directorate in the Department for Digital, Culture, Media and Sport (DCMS).
6. “Cross-cutting oversight and co-ordination of resilience activity at the national level”⁵⁴⁵ which rests with the Civil Contingencies Secretariat.

It is clear from our research and interviews that the designation of Lead Government Departments is valuable and should continue – and indeed be reinforced with legal duties (as described in Duties to be Placed on the UK Government section) and stronger arrangements for validation and assurance of performance, and sharpened accountabilities, as described in the Validation and Assurance and Accountability chapters. It is equally clear, however, that the distribution of responsibilities between the Cabinet Office, DLUHC and DCMS is not.

Stewardship of the VCS Contribution to Building UK Resilience

The majority of the VCS organisations we interviewed, especially those who had had the greatest contact with DCMS, were critical of the way in which DCMS had fulfilled their stewardship role in the development of UK resilience before the pandemic. Organisations praised the visible involvement and contribution of the then Minister during the response to the pandemic. And they were at pains to point out that criticisms were not directed at particular officials. But they were clear that DCMS did not act as an effective bridge between the UK Government and the VCS on resilience issues. Officials had clearly not received sufficient training on emergency response structures and practices to be able to fulfil their roles effectively. DCMS were perceived not to have the ability within the UK Government to pursue the issues concerning the VCS to resolution – a weakness of particular significance given the substantial contribution of the VCS to meeting people’s needs.

Nor did the majority of VCS organisations who regularly interacted with the UK Government believe that DCMS should continue their stewardship role. Several pointed out that DCMS officials were recruited and trained for a different set of attributes and skills:

“DCMS is not the right focal point in government for VCS emergency preparedness and response activity. The skills needed for its major role are not those needed for emergency response, so it should be no surprise that DCMS officials struggle.”⁵⁴⁶

Most significantly, however, VCS organisations believed that having an intermediary layer between the Cabinet Office and responder organisations, in whatever sector, would always impede operational clarity and effectiveness at the time it was most needed, in an emergency. Opinion was divided on whether stewardship of the involvement of the VCS in building UK resilience should rest with DLUHC or the Civil Contingencies Secretariat:

“… no reason for [DCMS] to have a role in emergency response VCS activities which should really sit with CCS or [DLUHC].”⁵⁴⁷

“… VCS was better served when responsibility for its sponsorship was based in the Cabinet Office, as a department that had more clout in terms of co-ordination.”⁵⁴⁸

“Think VCS role in emergencies should sit in either [DLUHC] as got links to communities or in Cabinet Office. Arrangements with VCS work better in Scotland and Wales – in the right department and Minister advocates for the sector effectively.

Sector needs ‘active stewardship’ to a department:

• With influence and convening power
• Who can joint up with other government colleagues
• With continuity of staffing/good corporate ”⁵⁴⁹

As well as the advantages in the execution of routine business, the compelling need for operational clarity in the response to an emergency meant that the majority of interviewees in the VCS and in Resilience Partnerships concluded that stewardship of the involvement of the VCS in building UK resilience should rest with the Civil Contingencies Secretariat.

Recommendation 74: UK Government stewardship of the involvement of the VCS in building UK resilience should rest with the Civil Contingencies Secretariat or any successor organisation.

Stewardship of English LRFs

The Local Governance and Collaboration Structures section above describes the increased expectation of the UK Government that English LRFs should act as a collective, receiving and undertaking tasks set by the UK Government and reporting back as an entity, joining up the work of local bodies in the Partnership. That expectation should work both ways. Effective resilience arrangements need at the other pole an ‘expert centre’ in the UK Government fulfilling the stewardship role, with officials who:

1. Have the knowledge, skills and experience to enable them to interface effectively with what are knowledgeable, skilled and experienced people at local level. Their competence would be demonstrated in the clarity of, and knowledge and understanding shown in, the taskings sent to LRFs in normal It would also be vividly demonstrated when the officials act as ‘Government Liaison Officers’ (GLOs) to local Strategic Co-ordinating Groups (SCGs) in an emergency.
2. Have the convening power to join up Whitehall, bringing together, and rationalising if necessary, commissions from several government departments rather than each sending its own request separately to LRFs.
3. Where necessary, have the authority (and courage, built on competence and experience) to intervene with local bodies or Partnerships who are under- performing. This would include receiving and acting on issues escalated by LRF Chairs, as covered above.

The widespread view of those we interviewed was that the RED Team in DLUHC did not have the necessary skills, experience and attributes, or supporting management structures, to act effectively in the stewardship role. Here, too, interviewees were at pains to point out that criticisms were not directed at particular officials, several of whom will have moved from other roles to reinforce the RED Team during the response to the COVID-19 pandemic and whose individual actions gained considerable praise. But we heard widespread criticism of the degree to which those individuals had been provided with the necessary training and other support, exposed most significantly in their inability to make their contribution as a Government Liaison Officer (GLO) to the work of an SCG during the response to the COVID- 19 pandemic or to act as an effective interface on urgent operational issues:

“COVID experience with MHCLG/DLUHC RED team wasn’t great … During COVID, RED team were not good: no knowledge; no convening power; no ability to get information and remove barriers.”⁵⁵⁰

“Think RED team advisers are fantastic. Do the best they can in extreme circumstances, despite what they have above them.”⁵⁵¹

The frequent churn of GLOs, led the C19 National Foresight Group to recommend that:

“Each LRF should continue to have access to a named and consistent Government Liaison Officer (GLO), who ideally is familiar with the locality, for the duration of the response.”⁵⁵²

And, although the criticisms we heard in our interviews focused on the lack of knowledge of emergency response arrangements, a recent report by the Institute for Government suggests that the lack of knowledge goes wider:

“Politicians and civil servants from both sides of the relationship felt that the handling of the pandemic exposed a basic lack of understanding of the makeup and functions of local government within Whitehall departments, even including senior ranks of the Ministry of Housing, Communities and Local Government (MHCLG).”⁵⁵³

We also heard a wide range of examples of multiple, conflicting commissions from separate UK Government departments:

“[Had] multiple taskings, often from 4-5 departments simultaneously, and attitude that LRFs are standing organisations able to operate 24/7, which they are clearly not. If that’s what government wants, needs to address how LRFs service a 24/7 culture … In some [emails] it’s not clear what the Centre wants. LRFs need clarity and streamlining from government, not scattergun.”⁵⁵⁴

The C19 National Foresight Group in their Third Interim Operational Review Report on the COVID-19 pandemic recommended that the UK Government needed:

“To empower current representatives that connect the local to national government (GLOs, MHCLG representatives) to enhance their reach into government beyond MHCLG so that they are able to provide a bi-directional flow of information and enhance communication between local and national levels recognising they can be key advocates of the local context.”⁵⁵⁵

There is clearly an urgent need to improve levels of knowledge and skills in UK Government departments. We cover this area, and skills development work now under way, in the Training of Ministers and Civil Servants section. Beyond that, some interviewees saw advantages in keeping the RED Team within DLUHC given their local government stewardship responsibilities. But others pointed out that local multi-agency Partnerships went well beyond local government alone, and that other policy priorities would always command greater attention within the department. And here, too, there was a strongly-held view that having an intermediary layer between the Cabinet Office and responders would always impede operational clarity and effectiveness in the response to a major emergency:

“Why are CCS and RED separate? Never made sense. Should all be in CCS, where they would have teeth.”⁵⁵⁶

“Could see value of merging RED team into CCS. During COVID, DLUHC were an intermediary, so central government ended up doing similar things via two routes instead of one.”⁵⁵⁷

“Current structure creates an instant divide as responsibility and interaction are separated. Bring together in the Cabinet Office. Why outsource engagement? Added complexity.”⁵⁵⁸

“[Need] a single centre of expertise at the heart of Whitehall. Needs much stronger convening power across Whitehall. So very clearly stewardship role should sit with Cabinet Office. Government needs to follow its own doctrine – having two separate departments managing differing aspects of a crisis is confusing and risks duplication of effort, application ‘fratricide’ and increases tension.”⁵⁵⁹

We believe that, on the basis of our research and interviews, stewardship of local resilience activity should be moved from DLUHC to the Civil Contingencies Secretariat.

Recommendation 75: UK Government stewardship of local resilience activity should rest with the Civil Contingencies Secretariat or any successor organisation.

One Team, One Purpose

The transfer of stewardship roles would go some way to reducing the perceived fuzziness of responsibility and leadership in the UK Government. But it is clear from our research and interviews that there is further to go. A wide range of interviewees, from across all sectors, contrasted the clear vision, visible leadership and drive provided in other areas of national safety and security, especially in cyber security and counter-terrorism, with the more opaque arrangements for the leadership of resilience-building work at UK Government level – although interviewees did comment favourably on arrangements in Scotland.

Unfavourable contrasts were also drawn with arrangements in other leading countries, especially the United States, a range of EU members and countries in the Asia-Pacific region.

This is not a new issue. In 2003, the Joint Committee on the Draft Civil Contingencies Bill⁵⁶⁰ debated the creation of a single government body to lead on UK resilience. They heard from the Minister in charge of the Bill who:

“… firmly rejected the concept of an “Emergencies” super Ministry, along the lines of the Department for Homeland Security in the United States …”⁵⁶¹

The Committee accepted and supported his arguments, but were:

“… not convinced that preparedness for events of such potentially catastrophic consequence can be effectively overseen by anything less than an organisation established for that specific purpose …”⁵⁶²

They proposed the:

“… formation of a relatively small permanent national Civil Contingencies Agency (CCA), not a department, staffed by people with expertise in the management of crises and their consequences …[that] in addition to fulfilling a management and audit function … would also be responsible for setting national response standards for Category 1 and 2 Responders …”⁵⁶³

Their view was that the Agency:

“… could include individuals seconded from appropriate fields of emergency expertise (for example, military, logistics, police …. etc) for 2/3 year periods …”⁵⁶⁴

They also proposed that its objectives could include:

“To measure capacity, set training objectives and operational standards and ensure compliance across all contributing departments, organisations and agencies, including those of central government, to ensure consistency in planning and response capability …”

and that:

“ … The Agency would report to Parliament annually … and its reports should be published …”⁵⁶⁵

They also noted that:

“Because of the importance of ensuring public confidence in the system, we recommend that the Cabinet Office examines the feasibility of a dedicated inspectorate to oversee performance management of civil protection activity, to ensure operational effectiveness and financial efficiency. Such a dedicated inspectorate might be based within a Civil Contingencies Agency.”⁵⁶⁶

Their final recommendation was thus:

“… that the Government gives careful consideration to the establishment of a Civil Contingencies Agency which, like other Agencies, would have both advisory and supervisory responsibilities.”⁵⁶⁷

The Government did not proceed with the Joint Committee’s recommendation.

More recently, the House of Lords Select Committee has recommended that:

“The Government should change the name of the Civil Contingencies Secretariat in acknowledgement that the secretariat no longer manages civil emergencies alone. A name should be chosen which reflects its broad portfolio of threats and hazards. The Committee recommend the use of the ‘Resilience and Contingencies Secretariat.’”⁵⁶⁸

We, and many we interviewed, would go further, to the creation of a single government body on the lines of that recommended by the original Bill Committee which provides:

• A single, visible point of focus for resilience in the UK
• Clear, credible leadership, visible to those working on resilience in all sectors and to the public, both in normal circumstances and in the leadership of a national emergency
• A clear mandate, with the authority, drive and resources to build UK resilience across all areas of risk and emergency management

The precise form of such a body need not follow the form of the National Cyber Security Centre, or of Emergency Management Agencies in other countries, although those have been praised and used as benchmarks by those we have interviewed. But its desirable attributes would be likely to mean that it was a self-standing body rather than a secretariat of the Cabinet Office, with:

1. Staff drawn not only from the Civil Service but also, and vitally, from all sectors – local bodies, the VCS and business – who are knowledgeable, experienced and credible with their stakeholders:
   

   “The … essential key to translate vision into results are people of the right experience, skills and passion who really understand what is likely to happen on the ground when central levers are pulled, and who can make it happen.”⁵⁶⁹

2. The authority, credibility, leadership skills and convening power to join up work across UK Government departments, including if necessary the “… power to compel departments to work together or to compel preparation on specific risk ”⁵⁷⁰. We recognise the Institute for Government’s analysis that in the Cabinet Office:
   

   “Its secretariats broker policy but can fail to set a clear direction, and the mechanisms for holding departments to account are too weak. The government needs to set out its policy agenda clearly, identify which high priority cross-cutting issues need central Cabinet Office direction and create strong units to work with departments to make changes happen.”⁵⁷¹
   

   In order to set a clear direction:

   “The central capability for strategic thinking and risk management will need strengthening. Not to centralise executive responsibilities, or to set up new capabilities where they already exist, but to produce a centrally directed common story, language and processes. Strategic thinking takes place in all government departments and assessment bodies but is not always brought together effectively. The centre does not fully benefit from the intellectual firepower of departments and analytical bodies, and there is a lot of duplication.”⁵⁷²

3. Corporate Governance mechanisms which allow for the full and effective engagement of the Devolved Administrations⁵⁷³ and of representatives of all sectors:
   

   “Government arrangements for working with devolved administrations and local and regional government are too weak. The UK has not developed a framework where politicians with different mandates and responsibilities can disagree but effectively co-ordinate activity on behalf of citizens.”⁵⁷⁴

4. The provision of support and challenge via independent Non-Executives with substantial experience in risk and emergency management.
5. A culture which captures and reflects the operational imperatives of risk and, especially, emergency management: agile, flexible, data driven, and delivery- and outcome-focused, avoiding the “groupthink and a massive aversion to risk, which in turn held back innovation and the pace of execution”⁵⁷⁵ of the Civil Service seen by Dame Kate Bingham.
6. A demonstrable passion for the pursuit of learning, improvement and excellence: in the development of knowledge, skills and capabilities; in products and publications; and in arrangements for validation and assurance.

We would also hope that the new body could build two important cultural underpinnings to its work.

First, a demonstrable desire to reach out to gather and share wisdom and experience, going much wider than the UK Resilience Forum⁵⁷⁶. This is about more than creating ‘talking shops’: it will be important that the voice and contribution of front-line responders, VCS organisations, businesses and those affected by past emergencies is embedded in the development of policy and operational practice, so that they are grounded in reality and people’s needs. As the Institute for Government has noted:

“The UK’s management of Brexit and the Covid-19 pandemic has reinforced the need for good policy to have broad, meaningful input from people across central, devolved and local government, the wider public sector, civil society, academia and businesses.”⁵⁷⁷

and that:

“Incorporating the right expertise into policy-making will always be easier if civil servants and politicians actively choose to do so. The over-reliance on individuals and the lack of a systematic approach is a weakness of policy-making in the UK. Ministers and senior officials need to recognise and address this gap, refusing to sign off policy proposals that have not been tested with those they affect, and insist on a process of more open decision-making.”⁵⁷⁸

Counter Terrorism Policing has shown what can be done, in a highly-sensitive area, to reach out not only to statutory bodies but also to VCS organisations, businesses, academics and, importantly, people who have been personally affected by terrorist incidents, to give them a voice and enable them to make a contribution in the solving of problems, and in the shaping of policy and operational practice. We have been impressed with the philosophy and approach behind the Counter Terrorism Advisory Network. If this can be done for counter- terrorism, we are certain that it can be done for the less sensitive field of UK resilience.

The Counter Terrorism Advisory Network

The Counter Terrorism Advisory Network (CTAN) is made up of around 200 people organised through regional and thematic groups, with the Chairs of those groups forming the National Advisory Group. As well as building transparency and trust on counter- terrorism issues, it helps to develop the emotional connection between civil servants and officers of statutory bodies and those they serve, motivating all those involved to tackle difficult and sensitive issues and ensuring that new policies and practices will be operationally deliverable and human-centred in addressing people’s needs.

The impact of CTAN is evident through the voices of victims and survivors of terrorism, who make up a significant proportion of the membership. Victims and survivors are regularly consulted on a range of issues in a ‘critical friend’ capacity to help ensure that CT Policing is able to function as effectively as possible. In recent years, victims and survivors have shaped the strategy for the deployment of family liaison officers, and have influenced the nature of information that is provided to victims in the aftermath of terrorist attacks. The CTAN amplifies voices of those directly affected by acts of terrorism and creates a meaningful platform to test new approaches to CT Policing and to influence government policy.

In recent years, CT Policing has co-ordinated annual events to pay tribute to victims and survivors of terrorism. These events enable partner departments in government, such as the Victims of Terrorism Unit, and charity organisations, including Victim Support, to cascade information and update communities on the work taking place to better support those affected by terrorism. In 2021, the victim and survivor event was attended and supported by HRH The Countess of Wessex. Victims and survivors within the CTAN play an instrumental role in shaping events such as these.

The insights and contributions provided by the CTAN have also enabled improvements to national training, such as improving interactions at UK borders, and shaping of Prevent counter-radicalisation campaigns, including a national Hollyoaks storyline and the development of the ActEarly.uk website.

Second, the body, and especially its leaders, should seek to rebuild and sustain with stakeholders the spirit of partnership in a shared enterprise. We heard too many times for comfort that that spirit had been seriously damaged in recent years:

“Need a much simpler, more nimble architecture which has command, control, communication but also collaboration which is often lost in current system. Single team approach is needed: people need to cut each other some slack nationally and locally … built on feeling of partnership and shared enterprise.”⁵⁷⁹

“There is sometimes a feeling that HMG and LRFs are not of the same standing, and that there is not a mutual basis of respect and trust in the relationship …”⁵⁸⁰

We hope that it can be rebuilt.

Recommendation 76: UK Government stewardship of all UK resilience-building activity should be led by a single government body which provides:

• A single, visible point of focus for resilience in the UK
• Clear, credible leadership, visible to those working on resilience in all sectors and to the public, both in normal circumstances and in the leadership of a national emergency
• A clear mandate, with the authority, drive and resources to build UK resilience across all areas of risk and emergency management

The new body should have:

1. Staff drawn not only from the Civil Service but also – and vitally – from all sectors who are knowledgeable, experienced and credible with their stakeholders.
2. The authority, credibility and convening power to join up work across government
3. Corporate Governance mechanisms which allow for the full and effective engagement of the Devolved Administrations and of representatives of all sectors; and for the provision of support and challenge via independent Non-Executives with substantial experience in risk and emergency management.
4. A culture which captures and reflects the operational imperatives of risk and, especially, emergency management: agile, flexible, data driven, and delivery- and outcome-focused.
5. A demonstrable passion for the pursuit of learning, improvement and excellence: in the development of knowledge, skills and capabilities; in products and publications; and in arrangements for validation and assurance.

The new body should build two important cultural underpinnings to its work:

• A demonstrable desire to reach out to gather and share wisdom and It should ensure that the voice and contribution of front-line responders, VCS organisations, businesses and those affected by past emergencies is embedded in the development of policy and operational practice, so that they are grounded in reality and people’s needs
• It should seek to rebuild and sustain with stakeholders the spirit of partnership in a shared enterprise

Doctrine and Guidance

Effective partnership working between organisations at national, regional and local levels rests heavily on a good understanding by everyone involved of what is to be achieved, and how that should best be done. If organisations at all levels and across several sectors are to operate together coherently and make best use of the resources available to them – in risk assessment, risk reduction and preparedness activities and, especially, in the response to an emergency – then achieving a consistent approach and maximising the effectiveness and efficiency of the combined efforts of everyone involved is fundamental.

A major contributor to achieving this is having doctrine and guidance that:

• Is up-to-date
• Incorporates good practice – from the UK and overseas
• All organisations are aware of
• All organisations have easy access to and can navigate easily

This need is self-evident. So it is gravely disappointing that so much of the key resilience doctrine and guidance has not been updated for a decade, especially the two major pieces of statutory and non-statutory guidance accompanying the Act: Emergency Preparedness⁵⁸¹ and Emergency Response and Recovery⁵⁸². Similarly, Responding to Emergencies: The UK Central Government Response. Concept of Operations⁵⁸³, a critical document which sets out UK arrangements for responding to and recovering from emergencies requiring co-ordinated central government action, has not been updated since April 2013.

It is not credible that no new information of operational significance has arisen in that period – in new operational practices, especially from work on the Joint Emergency Services Interoperability Principles⁵⁸⁴ (JESIP); from Inquiries held; and from Lessons Identified reports – which should have been captured in guidance and published for use by emergency planners and responders:

“Key documents are well out-of-date. Need alignment to JESIP as part of updating … [also] EPRR guidance from NHS England and guidance from government doesn’t always align and needs to. Means duplication. And means people have competing priorities.”⁵⁸⁵

Even documents which have been produced in the last decade have not been updated since publication to reflect machinery of government and important legislative changes, and learning identified from emergencies. For example, the List of Lead Government

Departments’ Responsibilities for Planning, Response and Recovery from Emergencies⁵⁸⁶ has not been updated since at least 2011, with some departments listed having gone through a number of iterations and name changes since that time. It is ironic as well as deeply frustrating that this document sits on a webpage that starts with the text “It is important for all levels of government to be clear, in advance, which department will lead on main potential challenges”.

Similarly, both Emergency Preparedness⁵⁸⁷ and Human Aspects in Emergency Management⁵⁸⁸ contains references to the Data Protection Act 1998, rather than the current Data Protection Act 2018 with its important and revised obligations, including on the sharing of personal data. In light of the issues raised with us on personal data sharing, it is particularly critical that those documents are updated to contain references to the latest legislation and supporting guidance from the Information Commissioner’s Office⁵⁸⁹.

As another example, Human Aspects in Emergency Management⁵⁹⁰ contains helpful references to JESIP and links to its underpinning Joint Doctrine: The Interoperability Framework. But, of the two links provided in the document, one⁵⁹¹ goes to Edition 2⁵⁹² of the Joint Doctrine (July 2016) and the other⁵⁹³ to Edition 3⁵⁹⁴ (October 2021). It is a credit to the JESIP Team that they have updated their Joint Doctrine three times since its original publication to ensure that it reflects learning from incidents, but this is of no use if responders cannot be confident that they are being sent to the latest version. And this lack of accurate and up-to-date cross-referencing is even more problematic if a document is required quickly in the heat of the response to an emergency when there may not be time to double-check that it is indeed the latest version.

Interviewees also noted routinely that terminology – including that which covers important principles and operational practices – varies across the wide range of single- and multi- agency doctrine and guidance. Since 2007, the Civil Contingencies Secretariat has helpfully led on production of a Lexicon of Civil Protection Terminology⁵⁹⁵ in association with a wide range of partners. But this has not been updated since 2013, is not being used consistently and, being a spreadsheet of over 750 rows, could be seen as having become unmanageable and not user-friendly.

Recommendation 77: Single- and multi-agency doctrine and guidance which act as the spine of coherent resilience-building activity across the resilience community need urgent – and then regular future – updating to ensure that they reflect developments in policy and operational practice and learning over the last decade. Cross-referencing of, and links to, other documents should also be checked to ensure they are – and continue to be – up- to-date.

Recommendation 78: The Lexicon of Civil Protection Terminology should be refreshed and made a more accessible, user-friendly, reference document. It should then be used consistently to inform the writing of all single- and multi-agency doctrine and guidance.

The Need for Better Mapping

The volume of statutory and non-statutory guidance available to local bodies and Resilience Partnerships has grown significantly in the last decade. We heard strong evidence that the absence of a central directory of all the guidance now published by the UK Government and other key bodies means that planners struggle to keep track and, as a result, are not confident that they know of all the guidance available, its legal status, how to navigate it and how it all links together:

“Been working on this agenda for 17 years and would still struggle to name all the guidance and how it all fits together. Need a structure chart of the guidance, covering it all, starting from the CCA and showing the place of each piece in the [Integrated Emergency Management] cycle … Good to understand the national expectation on execution of each piece of guidance – obligatory or recommended? … Know each document was developed for good reasons, but a spider’s web to navigate.

Emergency Preparedness and Emergency Response and Recovery well known, but other guidance documents are less well known. People often don’t even know they exist.”⁵⁹⁶

This impediment to the work of local bodies and Resilience Partnerships could readily be addressed by the development and publication of a simple map of the guidance available. This should be presented digitally to aid search and navigation and should cover the full suite of single- and multi-agency documents.

Whilst it does not currently meet the needs of all users and would benefit from being more interactive, one model to build on might be the NHS England, Summary of Published Key Strategic Guidance for Health Emergency Preparedness, Resilience and Response (EPRR)⁵⁹⁷ (extract shown in Figure 5 below). This shows documents published by the Cabinet Office, the Department of Health and Social Care, NHS England, (the then) Public Health England, the National Ambulance Resilience Unit (NARU) and some other bodies. It also shows the documents which are in development and those that are being updated. The documents are grouped into themes and links are provided to published documents.

Recommendation 79: The UK Government should develop and publish digitally for use by local bodies, Resilience Partnerships and government departments a simple map of current doctrine and guidance.

Statutory Underpinning

Our research and interviews suggest that legal and other developments over the last decade may mean that some areas of non-statutory guidance should now be made statutory. It is clearly important that the way in which services are delivered to meet people’s needs are compliant with current law and meet professional standards in the way in which they are delivered.

One example of this is in developments in safeguarding legislation over the last decade. Another may be in the coverage in current non-statutory guidance of the provision of specialist humanitarian assistance to those affected by emergencies⁵⁹⁸ (eg. those providing psychosocial and mental healthcare), which clearly should be provided by appropriately trained health practitioners and specialists⁵⁹⁹. But the major issue raised in interviews was whether, drawing on experience since 2004, including the recommendations of successive Inquiries, the emergency co-ordination structures set out in current non-statutory guidance⁶⁰⁰ should be made statutory:

“What guidance should be statutory now and what non-statutory? … SCGs and TCGs are not mentioned in the CCA or statutory guidance. So is there a responsibility to set them up in an emergency? Can an LRF be held to account if it doesn’t set them up? … should responders be following Emergency Response and Recovery during the response to an emergency or is it non-statutory and only a guide? Have expectations of politicians, public, the courts (through inquiries) moved on?”⁶⁰¹

The conclusions and recommendations of the Grenfell and Manchester Arena Inquiries, and in due course the COVID-19 Inquiry, will be highly influential in reaching conclusions on the best way forward. Our judgement is that there is a strong case for substantial changes to the status of doctrine and guidance in each of these areas.

Recommendation 80: As part of updating doctrine and guidance, the UK Government should examine whether legal and other developments, including the recommendations of public Inquiries, mean that some areas of current non-statutory guidance, especially on safeguarding, humanitarian assistance and emergency co-ordination structures, should now be made statutory.

Recommendation 79: The UK Government should develop and publish digitally for use by local bodies, Resilience Partnerships and government departments a simple map of current doctrine and guidance.

Statutory Underpinning

Our research and interviews suggest that legal and other developments over the last decade may mean that some areas of non-statutory guidance should now be made statutory. It is clearly important that the way in which services are delivered to meet people’s needs are compliant with current law and meet professional standards in the way in which they are delivered.

One example of this is in developments in safeguarding legislation over the last decade. Another may be in the coverage in current non-statutory guidance of the provision of specialist humanitarian assistance to those affected by emergencies598 (eg. those providing psychosocial and mental healthcare), which clearly should be provided by appropriately 598 HM Government (2013b). Emergency Response and Recovery. Chapter 7: Meeting the needs of those affected by an emergency AN INDEPENDENT REVIEW OF THE CIVIL CONTINGENCIES ACT 2004 AND ITS SUPPORTING ARRANGEMENTS 208 trained health practitioners and specialists599 . But the major issue raised in interviews was whether, drawing on experience since 2004, including the recommendations of successive Inquiries, the emergency co-ordination structures set out in current non-statutory guidance600 should be made statutory:

“What guidance should be statutory now and what non-statutory? … SCGs and TCGs are not mentioned in the CCA or statutory guidance. So is there a responsibility to set them up in an emergency? Can an LRF be held to account if it doesn’t set them up? … should responders be following Emergency Response and Recovery during the response to an emergency or is it non-statutory and only a guide? Have expectations of politicians, public, the courts (through inquiries) moved on?”601

The conclusions and recommendations of the Grenfell and Manchester Arena Inquiries, and in due course the COVID-19 Inquiry, will be highly influential in reaching conclusions on the best way forward. Our judgement is that there is a strong case for substantial changes to the status of doctrine and guidance in each of these areas.

Recommendation 80: As part of updating doctrine and guidance, the UK Government should examine whether legal and other developments, including the recommendations of public Inquiries, mean that some areas of current non-statutory guidance, especially on safeguarding, humanitarian assistance and emergency co-ordination structures, should now be made statutory.

Previous Chapters have covered what we should be seeking to achieve in building UK resilience; who might be involved; which of those organisations should have legal duties, and the need for changes to those duties or the way in which they are executed; and the structures which bring everyone together in partnership in pursuit of a shared purpose.

But, although machinery and process are important, people are everything. In the next three Chapters, we therefore cover:

• The pursuit of excellence – in knowledge, skills, training, exercising, learning and improvement – by everyone with a role in building UK resilience
• Radically improved arrangements for ensuring that quality is sustained, even in the ‘quiet years’ when attention inevitably drifts away

• The injection of greater clarity on personal accountability for quality and performance

Skills and Training

Skilled, competent and confident people are the foundation of effective risk and emergency management. Without them, no organisation can discharge its responsibilities effectively.

With them, organisations will build a better foundation for the response to emergencies and, with agility, flexibility and imagination, will be better able to tackle the unexpected challenges that inevitably arise.

To say that is so commonplace that it has become a cliché. And yet successive Inquiries and formal lessons identified reviews draw out time and time again the way in which the lack of understanding, skills and experience of those involved was a major factor behind weaknesses in the response. The Pollock Review brought out that recurring failures in the response to major emergencies going back nearly 30 years were often linked to the fact that:

“Too many people have not been given the necessary skills to ensure effective and competent response … However, there is a reluctance by some to commit the necessary resources/time/cost to ensure response capacity and capability.”⁶⁰²

And our interviews flagged how:

“Many people fall into emergency planning. No-one ever asks if you have the skills, competences, experience.”⁶⁰³

“Professionalising resilience should be at the heart of debate from the National Security Council to LRFs. Too much focus on prescribing doctrine … not enough on education and experience. But good people matter more.”⁶⁰⁴

The public rightly expects those managing risks and responding to emergencies to be competent in their role. It is unsurprising that this area has been an important topic for the Grenfell and Manchester Arena Inquiries, and many others before them. But it is clear from our research and interviews that current arrangements for the definition of the competences⁶⁰⁵ required of individuals and teams engaged in resilience-building activities are inconsistent and, in several areas, fall well short of what is required. And, although it is clear that resilience in the UK is blessed with a wide range of skilled and experienced people working to protect the public, we also heard disturbing evidence from front-line responders in all sectors of the demonstrable lack of core knowledge, understanding and skills of those with significant responsibilities in the management of the response to the COVID-19 pandemic, especially in government departments and some public sector bodies.

That is not a position that can continue. The UK Government’s commitment in the Integrated Review that one of its “priority actions” will be:

“To develop more capabilities – people, skills and equipment – that can be used across a range of scenarios.”⁶⁰⁶

is therefore very welcome. In our view, it is the development of human capabilities which will make the greatest contribution to improving UK resilience. The analysis below covers four major stages on that journey, set against current obligations in the Act, Its associated Regulations and statutory guidance:

1. The development of a Competence Strategy, covering everyone with a substantial role in building UK resilience, aligned with parallel skills strategies in other functional areas (eg. the NHS).
2. The definition of an associated Competence Framework, both for individuals and for teams acting collectively.
3. The provision of sufficient, high-quality training for individuals and teams to enable their professional development against the Competence Framework.
4. Arrangements for the demonstration and validation of competence on a regular basis.

What Does the Act Require?

Regulations associated with the Act require that:

“Every plan⁶⁰⁷ maintained by a general Category 1 responder … must include

provision for:

• the carrying out of exercises for the purposes of ensuring that the plan is effective;

• the provision of training of:
  • an appropriate number of suitable staff of the general Category 1 responder; and
  • such other persons as that general Category 1 responder considers appropriate

for the purpose of ensuring that the plan is effective.”⁶⁰⁸

The Regulations contain similar provisions for the training of staff managing arrangements for warning and informing the public if an emergency occurs or is likely to occur⁶⁰⁹.

This very narrow scope of training is replicated in supporting statutory guidance⁶¹⁰, which focuses on “plan specific” training, requiring Category 1 organisations to define a schedule for training responders as an annex to each plan. There is no requirement that those working across the resilience field generally should have the necessary competences, or that those involved should have training in areas which are not “plan specific”, or that they should be able to demonstrate them against defined professional standards. This is in sharp contrast to practice in some sectors, including the police and fire and rescue services, where core competences are well defined and competence is validated through Her Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS), and the health sector, validated through the Care Quality Commission (CQC). Similarly, the Control of Major Accident Hazards (COMAH) regime requires site operators to have a safety management system which addresses inter alia:

“… the identification of the training needs of … personnel and the provision of the training.”⁶¹¹

Welcome as these regimes are, they address only part of the overall resilience picture. And, because each applies only to its own particular sector, there is no consistency so that it is difficult to read across from one area to another.

What Should we be Seeking to Achieve?

What we judge to be the desirable end goal was well-expressed in the Kerslake Report on the Manchester Arena attack, which, drawing on practice developed by the Greater Manchester Resilience Forum, recommended that:

“The Concept of Suitably Qualified, Experienced and Empowered Personnel should be integrated into the doctrine, language and training regimes of all Local Resilience Fora.”⁶¹²

We would go further, to extend the concept to UK Government departments and agencies, and to underpin the concept in law.

In this area, as in others, other national security sectors are showing the way. In the cyber- security field, for example, the UK Government has over six years progressively built the classic skills pathway and governance architecture seen in many other professional areas. It has thus:

1. In the 2016 National Cyber Security Strategy, set out as an explicit goal the strengthening of cyber security skills, including through the development and implementation of a “self-standing skills strategy.”⁶¹³
2. Consulted in 2018 on proposals for developing the cyber security profession:
   

   “… helping those already in [the profession] to have their skills and expertise recognised more easily and in a clear and consistent way [and] employers … to be more confident in the professionalism, capability and integrity of those they employ …”⁶¹⁴

3. Funded the creation of the UK Cyber Security Council, which launched in March 2021, as:
   

   “… the authority on the cyber profession, bringing together the existing work of professional and certification organisations in this space, to meaningfully communicate and ensure consistency across standards and pathways”⁶¹⁵ (Our emphasis)

4. Consulted on:
   

   “… proposals around the role of legislation to underpin the role and reach of the UK Cyber Security Council [which] will allow for the Council to develop a common taxonomy that recognises expertise across the range of specialisms in the field, and formally recognise its role as standard-setter.”⁶¹⁶

5. Consulted on⁶¹⁷:
   1. Embedding standards across the cyber security
   2. Giving the UK Cyber Security Council the ability to define and recognise cyber security job titles and link them to existing qualifications and certifications. People would have to meet competency standards set by the Council before they could utilise a specific job title across the range of specialisms in cyber security.
   3. The creation of a Register of Practitioners setting out the practitioners who are recognised as “ethical, suitably-qualified or senior”.

We recognise that the objective and reach of this activity is intended to go wider – to building the UK skills base – than would be needed in the resilience field. But we believe that both the key principles – of quality, consistency and recognition – and the steps on this journey are equally applicable:

“As a profession, we are relatively unknown. People don’t want to know us until it is too late. Had a really high-profile for the last 18 months but not when things are quiet. Need to become [a] better known, respected profession.”⁶¹⁸

A Competence Strategy

There is no overall Competence Strategy covering everyone with a substantial role in building UK resilience, aligned with parallel skills strategies in other functional areas. That is clearly the first gap to address. We believe that the task falls logically to the Cabinet Office until such time as existing professional bodies conclude that they wish to create a governance and regulatory body for UK resilience (see further below).

Recommendation 81: The UK Government, working with stakeholders from all sectors, should develop a Competence Strategy covering everyone with a substantial role in building UK resilience.

A Competence Framework

Competence frameworks for the police and fire and rescue services, and in the NHS, are demonstrably being used systematically for training and assessment, continuous professional development (CPD), and in recruitment, promotion and role allocation processes. And the Joint Emergency Services Interoperability Principles (JESIP) programme, developed to improve joint working, has a defined Learning Outcomes Framework⁶¹⁹, which forms the basis of training for a number of organisations.

More broadly, the National Occupational Standards (NOS) for Civil Contingencies⁶²⁰ were developed and published in 2008 and updated in 2013 and 2015. They are intended as quality standards for expected skills and are recommended for use in recruitment, training and personal development. But, as those we have interviewed have observed, in contrast to competence frameworks in other fields, they have no teeth. There is no requirement to use them in CPD, or to inform recruitment and promotion processes. So it is no surprise that it is clear from our interviews that they are not being used by many local bodies, or Resilience Partnerships, in their training activities. Where they are used, interviewees told us that they find them to be out-of-date, not fully aligned with JESIP, and difficult to use, with numerous and overlapping criteria. And the Standards are not well aligned to those used in the police and fire and rescue services, and the NHS:

“How can there not be standards for resilience professionals? How can we be this far on and not have standards? NOS need a refresh and could be better used. Should distinguish between common skill sets and focused skill sets (eg. LRF Chair).”⁶²¹

“NOS are a great place to start but need updating and then consistently applying.”⁶²² “National Occupational Standards are there but not embedded.”⁶²³

“Outside emergency services, there is no real set of standards. We need to set, achieve, and maintain them to be a Resilient Nation. NOS structure helps but need to be updated with professional sponsorship. Define what good looks like and how you get there. Should be used to drive capability with the group of people principally engaged in emergency management. Standards should also cover how people in organisations work collaboratively together in emergency management. And standards should be used by regulatory bodies as a tool to check and test against.”⁶²⁴

“Single- and multi-agency skills are poorly defined; NOS do not cover the requirement. And there is a distinction between the skills needed for full-time roles and those required where emergency preparedness and response are only part of the role.”⁶²⁵

We also heard of the value of research skills, and critical thinking and analysis skills, to be part of the competence set for resilience practitioners:

“Resilience is currently a young subject – need innovative research and practice. Need practitioners that can engage with that innovation and not just fall for the next big idea. Need good research ability and critical analysis skills.” ⁶²⁶

This lack of coherence, and piecemeal usage, of the Standards falls well short of what is needed. We believe that there is a need for a consistent set of defined competences for individuals, for use as a common spine across all organisations with resilience responsibilities. They should be in a form which can be readily used by individuals in their personal development and be capable of being used if wished by organisations in recruitment and promotion processes, depending on the personal attributes of the candidate being sought and allowing flexibility for some on-the-job training to encourage a wide diversity of candidates:

“Standards need to be consistent across all LRF/ SCG partners. People should be trained to the same standard, operate at the same skill level, use the same language.”⁶²⁷

“NOS should be used for recruitment and professional development – gives a direction of travel.”⁶²⁸

“Use of NOS in recruitment might alienate some people for entry level posts. Need to allow for a degree of training on the job to bring people in from other areas.”⁶²⁹

“Should not erect barriers to entry to the profession so have to be careful in applying any new requirements in recruitment. Need a mixed workforce that recognises experience too.”⁶³⁰

“…shouldn’t go overboard and have over-insistence on qualifications where demonstrable competence is what is needed. Concerned that it would be possible to blunder into a qualifications approach which ruled out people with good, developed experience over time.”⁶³¹

“Profession needs good people who can learn and bring in other skills, then be trained in resilience. At present, resilience can attract retired people from other professions with limited appetite to learn. Result is big gaps in skills. Need good generalists too.

Need skills standards because individuals can be unconsciously incompetent.”⁶³²

They should underpin the development, over time, of a resilience profession.

There is a need in the same way to define the expected collective competence of at least the core members of the command teams who have leadership responsibilities in the management of the response to major emergencies, at both strategic (Strategic Co- ordinating Group) and tactical (Tactical Co-ordinating Group) levels:

“SCG members are already running large organisations, so the question would be ‘What additional skills do they need?’. Identify and train specifically in those key areas such as interoperability, collaboration and the delivery of integrated multi-agency outcomes.”⁶³³

And we also heard about the need to define the competences required of LRF Chairs to reflect their critical role in multi-agency working:

“LRF Chairs should undergo a level of training around chairing an LRF. Level of commitment of LRF Chairs can strongly influence how well LRFs progress. Chairs should undergo training and have a set of expectations of an LRF Chair.”⁶³⁴

We judge that, although they have not achieved their original potential, the National Occupational Standards offer the best platform for bringing greater consistency and quality into the development of competences across resilience in the UK. But they clearly need to be reviewed and updated on the basis of a needs analysis that is explicitly informed by practice and research on the complex demands of operating in the current and future risk landscape; to be aligned to other competence frameworks; and to be made more useable in front-line organisations. That process should engage not only stakeholders from all sectors, but also professional bodies, employers and the higher and further education sectors, to inform the development of their future programmes. And, once developed, the resulting Resilience Competence Framework should be subject to regular review, again engaging stakeholders, to ensure that experience of their operation, lessons identified from emergency debriefs and the recommendations of formal Inquiries are captured.

Who Should Own the Competence Framework?

“Continuity of focus and attention [on professional standards / competences] is key. This agenda started with EPC but is now marginalised. Who owns it? Regional University? Centre of Excellence?”⁶³⁵

The UK has several Societies and Institutes in the resilience field, none of which have a regulatory or governance function. In the time available to the Review, we were unable to pursue with them whether they felt that, in time, they would be able collectively to define and implement the policies, structures and processes that would enable them to govern and regulate a resilience profession. Even if the aspiration was there, however, it is clear that, as in the cyber security field, the UK Government will need to provide initial leadership in the development of the Resilience Competence Framework, working closely with existing professional bodies and other stakeholders.

We do, however, believe that resilience in the UK would benefit from its own professional oversight body, with governance and regulatory functions:

“Also add in a link to a professional body. Should establish national standards aligned to approved bodies and professionalise the sector.”⁶³⁶

We recognise that this could only be a medium-term goal. But, provided that a Competence Strategy and associated Resilience Competence Framework was put in place and used in validation and assurance regimes, the need is less pressing than in, say, the cyber security field. So we suggest that the UK Government should pursue with existing professional bodies whether they would, collectively, wish over time and with Government support to create a governance and regulatory body for UK resilience professionals.

Recommendation 82: The UK Government should develop with stakeholders from all sectors, professional bodies, employers and the higher and further education sectors, an integrated Resilience Competence Framework. The Framework should cover both individual and team competences. It should identify the core knowledge, skills, attitudes and experience that are common across organisations as well as those for particular functional and technical specialisms. The resulting Framework should be aligned with those already in place in other sectors and regulatory regimes. Once developed, the Framework should be subject to regular review.

Recommendation 83: In the short term, the UK Government should provide leadership of the development and promotion of the Resilience Competence Framework. But it should pursue with existing professional bodies whether they would, collectively, wish over time and with Government support to create a governance and regulatory body for UK resilience.

The Provision of Training

What Should we be Seeking to Achieve?

Training in the organisations with significant resilience roles falls into two broad areas, each with its own demands and characteristics:

1. Functional – training in specific areas for resilience practitioners who carry out, for example, risk assessment and emergency and business continuity planning so that they are able to support their organisations in fulfilling their duties under the Act.
2. Emergency response and recovery – training for those who will carry out response and recovery functions when an emergency occurs.

Both are underpinned by basic knowledge and awareness, for example on the Act and its obligations, structures and duties, and should be supplemented by personal skills (and personal resilience) training where necessary.

Against the goal of building a cadre of “Suitably Qualified, Experienced and Empowered Personnel”, we believe that the training they undertake should:

• Be conducted by “Suitably Qualified, Experienced” trainers
• Include content that is compliant with legislation and approved doctrine where relevant
• Include content which is up-to-date, and captures lessons identified from emergencies and exercises
• Ensure that participants are given the support they need in obtaining the required Competences, as set out in the Resilience Competence Framework
• Set out any further requirement for continuous professional development

and participants should be able to refresh their training at regular intervals so that they keep abreast of new or updated legislation and guidance and the latest thinking on good practice:

“… goes back to [need for] skills / competence standards – really difficult to design training programmes when there is no standard to design them against. Customers see courses as giving them most, but not all, of what they want and so they are only ‘best fitting’ as there is no standard and no skills pathway … want to grow individual and team training in resilience but difficult to do this without skills definition and thus competency and accreditation…”⁶³⁷

“There needs to be a training framework covering the whole resilience community, and covering everything from … academic qualifications down to short introductory training. The skills framework and the training framework could then be used as the basis for a system of professional qualifications, and accreditation of individuals.

Need a recognised qualification that all providers can use to get core competences and benchmark them.”⁶³⁸

For emergency response and recovery training, the same principles apply. But the training should clearly be provided not only for staff of individual organisations but also on a multi- agency basis, covering not only core command teams from the statutory bodies but also representatives of any other organisation (including from businesses and voluntary and community groups) who are identified as potential contributors in the relevant plan and who might thus be involved in the response.

And emergency response and recovery training should also go beyond the mechanics of processes and systems to cover more human-centred issues which those involved will face at a very personal level:

• Awareness and recognition of the potential consequences with which they might have to deal, and their potential emotional impact
• Building individuals’ confidence in plans and procedures and their ability to carry them out successfully
• Supporting individuals in the development of their personal resilience

Training in this area also needs to recognise the importance of building relationships between people who may need to work together under difficult circumstances in an emergency. Properly structured joint training is critical for realising the full potential of all of the organisations involved: emergencies demand levels of joint working that are exceptional and extend roles beyond their normal limits. So it is especially important that senior personnel in the relevant organisations attend multi-agency training so that they are able to lead their organisations and the multi-agency response effectively in the event of an emergency.

Finally, a rolling training programme will be needed to account for staff turnover, and also to ensure that all staff are regularly refreshed and practised in emergency response.

What is Current Practice?

There is a culture of well-structured training and continuous professional development in the emergency services and in the health sector, often based on common skills, a defined curriculum, recognised accredited providers and, in many cases, formal recognition of the training, including via qualifications. But this is not seen in all designated local bodies. And often this training is, for understandable reasons, focused on the needs of a particular sector, with limited focus on multi-agency working:

“College of Policing set minimum standards on skill sets required and where that training needs to be sourced from. Local authority position is the opposite of that: no standards for training, no providers. Local authorities are key to a multi-agency response and recovery so they need to be trained to the same standards as others around the SCG table.”⁶³⁹

“Police and fire services do training well. Local authorities are rubbish at it. Should be a matter of course that local authority leaders are trained, both in-house and external, and informal and more formal training.”⁶⁴⁰

As well as formal training, opportunities for mentoring and coaching, and secondments in other sectors, especially secondments between designated local bodies and government departments, were also cited as being beneficial for professional development:

“Living it through a secondment makes people understand how the cogs turn and pre-empt predictable government needs.”⁶⁴¹

“Needs a certain type of person to chair an SCG. Would be good to see more coaching, mentoring, secondments, cross-observation, buddying, especially for LRF Chairs when they are starting in role.”⁶⁴²

But several interviewees noted that a lack of structured ‘pairing’ arrangements for either mentoring or secondments meant they happened very rarely.

There was also a recognition that more needed to be done on succession planning, especially for senior roles:

“Senior colleagues in the NHS are all due to be retiring soon, around the same time. Need to mentor and grow their successors.”⁶⁴³

It is clear that the vast bulk of resilience training at local level is now being delivered by Resilience Partnerships in their local area. We were impressed by what they are seeking to achieve, and the range of training they provide, including in some cases building linkages to the National Occupational Standards. It is clear all are striving to offer good training, despite having very limited resources:

“LRF has taken up a lot of strategic and tactical training using pilot funding. When COVID came, LRF partners had confidence that they could deal with it as they had all had tactical/strategic training and knew what to do.”⁶⁴⁴

We identified many strengths to this approach, including:

1. The advantages of providing training that is locally contextualised and fits local structures, plans, risks and local geography, demography and other ch
2. The team-working advantages of bringing together participants from across the Resilience Partnership.
3. The greater cost-effectiveness achieved through the provision of training to many participants simultaneously.
4. The creation of capacity to support those organisations who do not have or could not afford their own in-house resilience training capability, so enabling them to meet their training need.
5. Enabling the provision of training to participants whose work or home commitments would otherwise make it difficult for them to attend training courses at remote
6. The ability to build trusted and effective long-term working relationships with training providers, especially through a growing practice of partnership and co- development of training courses and materials with higher education

But, despite these efforts, it is clear from the evidence we received that there are insufficient training and development opportunities available to equip everyone with a significant resilience role with the competences they need. We repeatedly heard evidence from local bodies and Resilience Partnerships on the barriers to training uptake, including:

1. The availability of suitable training: most Resilience Partnerships are seeking, where they can, to develop and deliver at least some training using their own in-house Where staff with the necessary skills and experience are not available, Resilience Partnerships conduct their own market research on the providers of suitable training, with varying success:

“Training market is very small – no real choice or ability to move between suppliers.”⁶⁴⁵

“Getting access to good training, mentoring, etc. is too hard to do.”⁶⁴⁶

1. Resourcing: if training is mainly being delivered in-house, it will be limited by the resources which an individual Resilience Partnership can provide which, at present levels of resilience funding, is limited:

“Delivered some sessions locally via Hydra suite as an “SCG Refresher Day”,

including SCG-level members from all agencies. Ran for four days: well

received and built confidence. But took a lot of the team’s time and impacted on delivery of the day job. Couldn’t repeat in future years as no time. So there are resource capacity limits on what can be done in this space. Delivery of command team training needs a team of people to do it.”⁶⁴⁷

1. Competing priorities, at work and at home: the time which people have, or are willing to devote to, training and development relative to other demands (and the more immediate consequences of not meeting those other demands):

“Biggest issue is capacity to deliver and space in diaries of those to be trained. Each LRF trying to do everything itself. And everything costs to do it properly.

Held together by sticking plaster.”⁶⁴⁸

“Need to be clear it’s a requirement. Unless organisations are regulated and held to account, too much comes down to personalities and people’s willingness to attend. They need to understand that, even if they are not in charge of the response, they may well be held to account for their individual role.”⁶⁴⁹

“Need a carrot and stick to get training take-up. Tried the carrot – selling the benefits of the training – but people move around so often, especially in local authorities, that it is almost impossible to keep up.”⁶⁵⁰

“People complain about time and cost of training. But sent two directors on

MAGIC course recently who said it was the best course they had ever done.

Can use the skill set every day in the day job.”⁶⁵¹

1. The perceived accessibility of training provided by external providers who require participants to attend courses at their The location of Government Colleges was often cited by interviewees as an impediment to the take-up of training.
2. The perceived quality of some externally provided training, including especially its currency and its compliance with legislation and current doctrine. Concerns were particularly raised by interviewees about the Emergency Planning College, with some of its training cited as being too generic as it tried to meet the needs of a multitude of organisations, and some of the training and trainers cited as having been sub- standard, casting a shadow over their willingness to use the College for other training:

“EPC: too far away; content out-of-date – sometimes have to correct the trainers; … currency of trainers decreases over time especially as EPC tend to use retired people.”⁶⁵²

“The UK has the Fire Service College, College of Policing and EPC. Should be the de-facto organisations to get current, high quality training. Don’t see EPC as such: they are missing a trick.”⁶⁵³

“For individual training, send people to EPC as it is local. But quality is variable depending on who leads the course which means that some courses can fail and be a waste of money.”⁶⁵⁴

“EPC less relevant once people have been in the job for 3-4 years. So there is a hole in mid-career training … Some EPC tutors are well out-of-date because they are no longer active in resilience; frustrating to students when they have to correct the trainer.”⁶⁵⁵

“EPC not addressing the training need any longer – national and local authorities need to be able to identify their training and education demand and provide a regular statement of training requirement (SOTR) for the EPC to fulfil. Is there an executive or advisory board to guide EPC deliverables and to hold the EPC to account? If not, can this be considered?”⁶⁵⁶

“If Cabinet Office want a structured approach to skill development, they need to publish a syllabus and run courses that give LRFs what they need to know in a progressive way. Courses need a syllabus, learning outcomes directed by national doctrine and Occupational Standards in order to build confidence in the product. For many, EPC is in the wrong place; is too expensive; and the training doesn’t work because the doctrine is not connected to the commercial offer. It would be helpful for the Cabinet Office guidance to state explicitly what individuals need to know and what good looks like in order for the College to train to it.”⁶⁵⁷

“College of Policing training has real added value by way in which they bring in people on secondment with fresh operational experience, and who are up to date with latest guidance. High quality delivery as a result. Don’t always get that with EPC ...”⁶⁵⁸

1. Cost, especially of externally provided training (and in particular training provided by the Government Colleges of most relevance in the resilience field⁶⁵⁹), and with it concerns about value-for-money and affordability, especially for the voluntary sector:
   

   “[Fees for] MAGIC-Lite, delivered by the College of Policing … have just increased massively, so LRF is exploring options for the internal development of MAGIC-Lite course for the South West, or commissioning the development of a programme that they then look to accredit through a local university.”⁶⁶⁰
   “EPC … cost prohibitive in an age of austerity…” ⁶⁶¹

1. The absence of formal recognition of the training And the current system has significant weaknesses, especially:
2. In essence, each Resilience Partnership is creating its own training materials, reinventing the wheel time and time again. This is an obvious waste of
3. The training materials developed, and hence the training delivered across all Resilience Partnerships, will unavoidably be inconsistent.
4. Some local bodies and Resilience Partnerships noted that in-house training can sometimes be provided by staff who are enthusiastic and have relevant knowledge and experience, but who are not natural trainers and have received no training in that role.
5. There is no ability to check that the training provided is compliant with legislation and doctrine, and up-to-date. There is in particular no independent quality check on any external trainers (or subject matter experts) used, and whether they are delivering training which is compliant and up-to-date. Interviewees noted that a high proportion of external resilience trainers were recent retirees from public service, who could bring valuable experience but whose knowledge might quickly become out-of-date. Similarly, consultants from a uniformed services background brought a wealth of experience of their own service’s approach to the response to emergencies but could often have a narrowness in their training. Conversely, large consultancy companies might have greater capacity to respond to government tenders and to be on government procurement frameworks but might have less expertise and real-life experience in multi-agency emergency management.

Rebooting the Training Ecosystem

Resilience Partnerships are thus caught between two areas of UK Government neglect. Despite their best efforts, they cannot on their own and at current levels of resourcing equip everyone with a significant resilience role with the competences they need. But the Government has failed properly to recognise and to support the significant shift to in-house resilience training. The result is a training ecosystem which falls a long way short of what is needed. The need for a fundamental ‘reboot’ to meet the aims and address the weaknesses identified above is thus compelling and urgent. That has to be led by the UK Government.

Our interviews brought out six areas for early action, in many cases drawing on what is successfully being done in the cyber security and counter-terrorism policing fields:

1. A move to more ‘bite-sized’ training modules, especially on the fundamentals of resilience, which would better suit both the topics to be trained and allow busy people to fit their take-up of training to the demands of work and home:
   

   “Training that people can do in their own time works well as they can pace the training to suit their circumstances.”⁶⁶²

2. For the same reasons, and to reduce overall cost, a big increase in digital delivery, including the use of e-learning modules especially for education and training on the basics of resilience – the Act, duties, structures and the fundamentals of emergency response – and virtual courses using video-conferencing and similar tools. But use of digital delivery should be carefully balanced as part of a hybrid training solution which also includes face-to-face training elements for more advanced or critical areas of training, especially command team training which needs to be face-to-face. Concerns were particularly raised that most JESIP training is only provided digitally which was viewed as insufficient, especially for first responders on the ground:
   

   “Support digital learning, especially for those with home commitments; gives them more options. But need also to recognise value of meeting people at training events and networking. So future training system should be hybrid, with delivery tailored to content and training audience.”⁶⁶³
   “Using the pilot money [from government] to develop new learning (e- learning by default) to train more people, more easily, to be in place for 2022.”⁶⁶⁴
   “Doing digital training locally, in bite-sized chunks. Able to push this training into wider pool of people in agencies rather than solely those who attend the LRF on behalf of their agency. Seems to be working, though need to recognise that it is focused on people acquiring knowledge not deep skills.”⁶⁶⁵

3. To ensure that the training provided is up-to-date and compliant, and to eliminate the current requirement for each Resilience Partnership to develop its own training materials, there should be central provision of accredited core training materials which Resilience Partnerships can adapt and use locally. These should be developed in conjunction with Resilience Partnerships and be kept up-to-date with the latest legislation and guidance, good practice (from operational experience and research in the UK and overseas) and lessons identified from emergencies and And this training material needs to be delivered by suitably trained trainers:
   

   “Centralised core training library of material would be brilliant. Would reduce costs. Could more readily be kept up-to-date with best and latest learning. And would help achieve greater consistency between LRFs.”⁶⁶⁶
   “[nationally produced core training materials] would help greatly. JESIP provide lots of templates and information online that they recommend to all LRF agencies … But still need the appropriately skilled and qualified person to deliver the training.”⁶⁶⁷

4. The greater mobility of trainers and training. There are significant benefits for some topics in bringing together, at courses provided by Government Colleges or higher education institutions, participants from a range of geographical areas and specialisms to learn from each other. But maximising the attendance of members of Resilience Partnerships – especially those with demanding jobs, or caring responsibilities – will require more training to be delivered locally:
   

   “Benefits in doing training with people from other areas in that members learn good practice from others. But also need to have a localisation element so people understand how things are done in their own area.”⁶⁶⁸
   “LRF is looking at creating a central training hub locally. Like the idea of trainers coming to LRFs to support that activity.”⁶⁶⁹

5. The provision of ‘train the trainer’ training to staff in Resilience Partnerships who wish to develop their training delivery skills:
   

   “People sitting on Training and Exercising groups should be accredited trainers. So need ‘train the trainers’ courses. And need to ensure people remain available and don’t get swallowed up by the organisation for other purposes.”⁶⁷⁰

6. The provision of sufficient central resourcing of the Resilience Partnership to provide the capacity to organise and deliver the training required. We cover this in our recommendations on sustainable resourcing in the Resourcing of Local Bodies and Resilience Partnerships section:
   

   “Recruited a trainer using government grant … that should be a permanent role with government funding given importance of good training.”⁶⁷¹
   “Good to have a dedicated person in each LRF to lead on training and exercising. In [our LRF], would also need input from seconded people from partners to work with the dedicated person as part of a Training and Exercising team.”⁶⁷²

A further area for medium-term action should be the introduction of tighter quality assurance arrangements for those firms and individuals who provide relevant resilience training, to ensure that what is delivered is compliant and up-to-date:

“Training and exercising needs to be run by suitably qualified people. It is a full time job.”⁶⁷³

The formal accreditation of training providers on the lines of that proposed in the cyber security field would not be feasible in the short term. But we do believe it feasible for the UK Government, working with local bodies and Resilience Partnerships, to develop and make available to Resilience Partnerships a register of those training providers who are recognised for the quality, compliance and currency of their training. Similarly, this could also cover subject matter experts:

“Should have a national database for national experts / accredited people who can be called on if needed.”⁶⁷⁴

Recommendation 84: The UK Government should lead a fundamental ‘reboot’ of the current resilience training ecosystem, set against the goal of providing the necessary training and development opportunities to allow everyone with a significant resilience role to develop the competences and confidence they need. This should include:

• Developing, in conjunction with training providers as appropriate, a wide range of training options, including modular courses, digital delivery and on-site training provision to make it easier for individuals and teams to undertake training and development
• Producing and maintaining accredited core training materials on subjects agreed with Resilience Partnerships which they can adapt and use These materials should be kept up-to-date with the latest legislation and guidance, good practice (from operational experience and research in the UK and overseas), and lessons identified from emergencies and exercises
• Providing ‘train the trainer’ training to those in Resilience Partnerships responsible for developing capacity and capability to provide them with the skills and confidence needed to train others locally
• Developing and making available to Resilience Partnerships a national register of recognised trainers and subject matter Registration requirements should include ensuring compliance with legislation and doctrine, demonstrating that training materials are up-to-date, that trainers and subject matter experts have relevant recent experience and that training is perceived as high quality. Registration should be refreshed every three years. Technical specialisms should be delivered by those formally assessed and registered as competent expert providers

The Training and Exercising section covers the training requirements of VCS organisations, and especially how these should be integrated into the training undertaken by local bodies and Resilience Partnerships where relevant.

Multi-Agency Emergency Response Training

We note above that skilled, competent and confident people are the foundation of effective resilience. For senior leaders, those attributes need to be seen not only in the quality of the work they do as individuals but also in their competence when working together as a team in the multi-agency leadership of the response to a major emergency. The response to major emergencies places demands on a wide range of organisations, often with different cultures, possibly over a protracted period of time. The unique nature of each emergency means that not all of those in leadership positions in the emergency response are likely to have worked together sufficiently in day-to-day business to be able to transition smoothly into being an effective team. So it is important that the core members of Strategic and Tactical Co- ordinating Groups are well-trained in working together, and practiced through exercises:

“Need to strengthen command team training. Individuals may be trained in leading in a crisis, but collective response may not have been trained. Seen in COVID response that there were managers and staff who weren’t used to working collectively. Had to overcome all the barriers, find different ways of working, which took time.”⁶⁷⁵

“Need to push hard on multi-agency leadership team training. Has the biggest impact on the outcomes of a response and hence on the safety and wellbeing of people and communities.”⁶⁷⁶

Resilience Partnerships recognise this need. They have increasingly moved to providing multi-agency command team training in recent years, especially following the introduction of the JESIP programme, so that it is now a key focus of many Partnerships’ training activities:

“LRF has a three year ‘ticket to ride’ approach. If individuals are not trained or have not demonstrated competence in live responses, they are prompted to refresh or retrain. That does not prevent their involvement in response, but those individuals are chased to refresh their training via Staffordshire LRFs training/ exercising pathway and are provided with a package to do this. Applies to strategic, tactical, operational and specialist roles in a multi-agency framework. LRF designed this approach for itself and is now working with expert help to redesign the pathway, standards, NOS by March 2022 so that people know what is required in a multi-agency environment.

Also looking at how to accredit that learning.”⁶⁷⁷

But it is clear from our interviews that not all Partnerships have the resources or capacity to undertake the multi-agency command team training they would wish. And, because many Partnerships are generating their own learning objectives and training materials, the training provided will inevitably be inconsistent and may not be up-to-date.

Furthermore, there is no requirement in some sectors for those likely to fill senior leadership positions in the management of an emergency to undertake the necessary training (and some interviewees noted that some potential senior leaders had seemed deliberately to avoid training, and suffered from observable deficiencies in their effectiveness in the management of the response to the COVID-19 pandemic).

Here, too, the public will rightly expect the team managing the response to emergencies to be individually and collectively competent in fulfilling its role. In our view, the National Police Chiefs’ Council has set the benchmark, under which all police forces must have the capability and capacity to deploy trained and approved strategic commanders for civil emergencies.

Under this model, major incident commanders are mandated to attend the (‘MAGIC’)

strategic training course⁶⁷⁸ every three years and undertake annual CPD⁶⁷⁹ to be ‘approved’⁶⁸⁰ as strategic commanders for civil emergencies. Their approval status and CPD are recorded on the police national training system. Where any areas of weakness are identified, the College of Policing contacts the relevant police force to make them aware of the area for development and of the need to seek a mentor within the force to assist personal development. Fire and rescue service and ambulance service commanders also have to meet nationally-set requirements.

We recognise the concerns expressed in some interviews that organisations involved in emergency response and recovery may have a large cadre of personnel who will be on 24/7 rotas⁶⁸¹. But we believe that it cannot be left to ‘best efforts’ and chance that at least the core members of Strategic Co-ordinating Groups are individually and collectively competent to fulfil their leadership role in the management of major emergencies; and that there should thus be a requirement that core (Category 1) members of Strategic Co-ordinating Groups should:

1. Undertake individual emergency management training every three years^{682, 683}, and suitable CPD each intervening year.
2. Undertake at least one formal command team exercise per year⁶⁸⁴.

with details of those who have received the necessary training and undertaken the necessary CPD being recorded by Resilience Partnerships and used as the basis for drawing up rotas⁶⁸⁵.

We recognise that this will generate a significant increase in the requirement for the necessary training and exercising, both in-house and externally-provided, and have therefore tested with local bodies, Resilience Partnerships and others how best this need might be met.

As with individual training, the central provision of accredited core materials which Resilience Partnerships can adapt and use locally will ensure that the training provided in- house is up-to-date and compliant and reduce the need for Partnerships to develop their own training materials.

For externally-provided training, Resilience Partnerships have progressively moved to using training (‘MAGIC’ or ‘MAGIC-Lite’) provided by the College of Policing, or in a few cases similar courses run by private sector companies and the Emergency Planning College. This is a very welcome development. We were impressed by the work undertaken by the College of Policing over the past two years to broaden the training previously focused on the needs of the police service to seek to fill the broader need of Resilience Partnerships, including:

1. A very substantial ramp-up in training capacity, from 15 MAGIC courses in 2020 to 40 courses being planned for 2022, with plans to increase the capacity further in subsequent years.
2. The deliberate broadening of the intake of participants on each course, to cover the full range of designated local bodies.
3. The progressive development of their courses and materials (including exercise scenarios) to be genuinely multi-agency, recognising the commentary from Partnerships that they had previously tended to be too ‘blue light’ focused. We would encourage the continued development of a wider range of multi-agency (both sudden and slow onset) emergency scenarios to reflect the full content of the National Security Risk Assessment and Community Risk Registers:
   

   “Done a few MAGIC-Lite one day exercises … MAGIC goes deeper and is more interactive, and hence better … MAGIC course should have more LRF Chairs sharing experiences of running an SCG: injecting practical experience.” ⁶⁸⁶
   “…would be helpful to explore in command team training the difference, and the pressures, of running a long duration emergency like COVID.” ⁶⁸⁷

4. Getting on the road – running training in local areas rather than expecting participants from designated local bodies to travel to a remote venue. This facility is especially important for those, especially senior leaders, with demanding roles, as well as those with caring Out of 30 MAGIC courses run by the College of Policing in 2021, 12 were hosted at the Fire Service College and 18 held in LRF areas.

But it would be wrong to rest on a monopoly – not least because we also heard repeatedly from Resilience Partnerships that the cost of MAGIC courses has increased markedly in the past six months, and risks becoming prohibitive:

“… it is a single provider monopoly, at too high a price. Need to move to a position where there is a set of standards for multi-agency command team training which a range of different providers can contribute towards, after accreditation. Could be organised on a regional basis.”⁶⁸⁸

“MAGIC is good. But cost is getting prohibitive and capacity is limited. Need a wider range of accredited providers.”⁶⁸⁹

And whilst interviewees expressed strong appreciation at the way in which the College of Policing had stepped up to provide multi-agency training, they still raised some concerns about whether the College was best placed to lead multi-agency training on their own:

“MAGIC is police-run and works for the emergency services. But it needs to work to multi-agency doctrine; needs CCS/EPC doctrine linked to all Colleges, including JESIP. Needs a proper governance board of multi-agency partners to agree the syllabus.”⁶⁹⁰

“…why aren’t the three Colleges [the Fire Service College, College of Policing and Emergency Planning College] joined up on resilience?”⁶⁹¹

There could clearly be a significant market for the provision of suitable training, and development of the range of accredited training providers would provide more capacity on which Resilience Partnerships could draw, as well as injecting an element of competition into pricing. But, as with individual training, it would be important that the training provided by new providers was validated initially and then reassessed at least every three years as being compliant with legislation and doctrine, especially JESIP; up-to-date; and delivered by trainers with relevant experience.

The Demonstration and Validation of Competence

We were conscious that, in other public safety fields, command teams are subject to rigorous external assessment and validation regimes, a discipline which should logically have equal applicability for those managing the response to major emergencies which could cause at least as much, if not more, disruption and harm. We therefore tested with interviewees across a wide range of local bodies whether command teams should be formally ‘accredited’ for their demonstrated competence in the management of the response to major emergencies.

Opinion was split. Around two-thirds of the Chairs and members of Resilience Partnerships believed that a truly professional approach to emergency management required some means by which the collective competence of command teams was demonstrated and validated, and that that was what the public (and public Inquiries) should reasonably expect. Those who were opposed to such a move voiced concerns about the administrative challenges, especially given the size of the cohort of people on 24/7 rotas and the frequency of their turnover. They were also concerned about the acceptability of ‘assessment’ and its impact on the readiness of some senior leaders to agree to take on an emergency leadership role:

“MAGIC should be mandated. Individuals and Command Teams can’t lead or take part in SCGs, etc. unless they have been through it. MAGIC training should be tied into CPD and accreditation programmes.”⁶⁹²

“Think mandation / accreditation across all organisations would be broadly welcomed. Last few years have shown the need but will only happen if it is a requirement.”⁶⁹³

“Have own local accreditation arrangements. If people go on relevant training, they are approved to sit on SCGs / TCGs for three years. But because of staff turnover, there is a significant continuing job to keep the list of people who have been through training up to date.”⁶⁹⁴

“Good to aspire to accreditation of core command team. Why would we not want that? Should push for it. Making that an obligation would get people to take command team training seriously. But recognise may need to get there progressively over a period: scale of catch-up is very significant … 120 people on an exercise [outside London] last week, only three of whom had been MAGIC trained.”⁶⁹⁵

“Comfortable with the idea [of accreditation of command teams]: standard practice in the police and fire services. But know not many Chief Executives would be comfortable. Their current level of command team training and demonstrated competence would not stand up to scrutiny, for example, at an Inquiry. But needs addressing. Clear that some people around the SCG table don’t understand their roles and responsibilities even though they are making life and death decisions. Not unreasonable for the public or a future Inquiry to expect accreditation.”⁶⁹⁶

“Have sometimes seen people at the SCG who do not understand even the basics of how it works and yet put into a lead decision-making role. Everyone at the SCG should be trained (eg. via MAGIC) and held to account for their competence. Need that level of skill and knowledge, not learning as you go along in the middle of an emergency … And needs accreditation of the core command team. In a crisis, you need people who can do the job, at both strategic and tactical level.”⁶⁹⁷

“…accreditation is a step too far: set the requirement, make it easier to take up training and make sure that people know they may be held to account. If there is a requirement that people can’t be part of an SCG unless they have done individual and collective training, then how many people will use that as an excuse not to do the training so they don’t have to take part?”⁶⁹⁸

“Don’t favour accreditation: need to recognise cultural differences. And passing / failing an individual probably too contentious and difficult.”⁶⁹⁹

On balance, we share the majority view that there is a need for arrangements by which the collective competence of command teams is demonstrated and assessed but suggest that the journey to formal accreditation should be taken as a number of steps. In the near term, the weight of evidence, and what we believe to be reasonable public expectations, point to the introduction of arrangements which stop short of formal accreditation but which do provide for external assessment of the collective performance of command teams in an annual exercise against the relevant standard set out in the Resilience Competence Framework. To ensure consistency, the assessment role should always be carried out by a central team in the Civil Contingencies Secretariat. Resilience Partnerships should be required to put in place an improvement plan and to evidence improvement (eg. through a repeated exercise) if collective performance is assessed as being seriously weak in any area. Compliance would be included as part of the proposed validation and assurance arrangements described in the Validation and Assurance chapter.

Recommendation 85: Team competences set out in the Resilience Competence Framework should be used as the reference standard when designing multi-agency training and exercising.

Recommendation 86: The suite of accredited core training materials developed by the UK Government should include those for multi-agency command team training and exercises.

Recommendation 87: The national register of recognised trainers and subject matter experts should include the accredited providers of multi-agency strategic emergency management training.

Recommendation 88: All Category 1 responders must have the capability and capacity to deploy trained and approved strategic leaders for civil emergencies. Senior leaders from Category 1 responder bodies who are expected to be core members of Strategic Co- ordinating Groups in the response to a major emergency should be mandated in an amended Act or future legislation and supporting statutory guidance to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD, in order to be assessed as ‘approved’ to fulfil that role. A record of those who have received the necessary training and CPD should be maintained by Category 1 responder bodies and Resilience Partnerships and used as the basis for drawing up rotas. This requirement should be phased in over a three-year period, drawing on the increase in accredited training capacity being put in place by the College of Policing and, we hope, by other accredited providers, with new SCG members being prioritised for training. In recognition of the mutuality of benefits gained, the UK Government should provide specific, time-limited co-funding of the cost of meeting this requirement.

Recommendation 89: An amended Act or future legislation and supporting statutory guidance should mandate that core members of Strategic Co-ordinating Groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, Resilience Partnerships should be required to put in place an improvement plan and to evidence improvement in the areas that fell short of the expected standard within a given timeframe.

The Training of Ministers and Civil Servants

We note in the Structures at National Level section the need for civil servants in government departments performing resilience roles to have the knowledge, skills, attitudes and experience – including in emergency management – to perform their roles and to enable them to interface effectively with knowledgeable, skilled and experienced people at local level. The need would be increased if the UK Government were, as we recommend in the Duties to be Placed on the UK Government section, to be subject to the full suite of duties under the Act. And it is given urgency by the substantial evidence we received of serious weaknesses in the competence of staff of the UK Government departments engaged in the response to the COVID-19 pandemic, especially their lack of basic understanding of resilience structures, the role and status of Strategic and Tactical Co-ordinating Groups, and the basic principles of emergency management:

“…urgent need for basic training in government departments about emergency response arrangements … Most don’t know what a Government Liaison Officer (GLO) is or an LRF or an SCG. Civil servants, especially senior civil servants, in key departments don’t know how things should work.”⁷⁰⁰

“… big training and education task in government departments: level of knowledge of resilience arrangements at present is weak.”⁷⁰¹

“…need for much greater training of Whitehall departments, not only on resilience

processes and architecture but also key principles like subsidiarity.”⁷⁰²

“Government needs to develop a concept of operations that works. Current CONOPs were thrown away in COVID … Gross misunderstanding in central government of LRFs and emergency response arrangements. Has to be tackled.”⁷⁰³

As noted in the Stewardship of English LRFs section, concerns were particularly raised about those staff from the Resilience and Recovery Directorate (RED) of the Department for Levelling Up, Housing and Communities (DLUHC) who act as the key intermediaries with Local Resilience Forums / Strategic Co-ordinating Groups in England:

“People in central government who carry out this role should be deep subject matter experts in the Act and its wider implications, which would allow them to be advisers to the LRF Chair: source of advice, sharing good practice, sounding board.”⁷⁰⁴

“Lower levels of experience of DLUHC RED officers have become obvious. Not inspired LRF confidence as they always need to go back and check with colleagues in the department before they can make decisions, give advice, etc.”⁷⁰⁵

“Agree urgent need for [government] upskilling. RED team in particular need better knowledge, skills, experience.”⁷⁰⁶

The House of Lords Select Committee also emphasised that:

“No matter how sophisticated the assessment of risks, it is of little value if it is not matched by practical measures to ensure preparedness and resilience. The Government must not only anticipate risks but prepare for and respond to them effectively. Much of the Government’s time and resources are focused on responding to crises and emergencies, from flooding to terrorist attacks … We must place a premium on possessing the competence, capacity and skills to manage these crises…”⁷⁰⁷

It is therefore welcome that the gap has been identified and is being addressed as part of the work of the recently-created Government Skills and Curriculum Unit in the Cabinet Office⁷⁰⁸. The new Executive Director of the Unit, Pamela Dow, has acknowledged that:

“2020 was a watershed for the Civil Service … BREXIT and COVID uncovered weaknesses in the resilience and responsiveness and effectiveness of our institution … and it all comes down to capabilities. We realised collectively we needed to place a greater emphasis, and be more prescriptive about, the skills, knowledge, networks of our people …”⁷⁰⁹

We are also aware of excellent work in the Department for Business, Energy and Industrial Strategy (BEIS), supported by the Emergency Planning College, to build the capacity and capability of their staff, a model “designed to set the standard for emergency response training and exercising across government”.

BEIS Emergency Response Academy (BERA)

The BEIS Emergency Response Academy (BERA) is an ambitious training and exercising programme with the twin goals of building and assuring the department’s capability to respond to a wide range of emergency incidents in its purview.

For BEIS to be able to resource, lead and operationally maintain a successful response to an incident or emergency, it is vital that there are enough people with the necessary skills, knowledge and experience to lead an emergency response (or multiple concurrent responses).

The aims of the programme are to set the standard for emergency response training and exercising across HM Government, further professionalising crisis management and

securing BEIS’ place as a leader in resilience and crisis capability. BERA also aims to build, maintain and validate a standard doctrine of emergency response practise across BEIS to ensure consistency in approach and to provide ongoing assurance of BEIS’ trained strength.

The programme offers a dynamic multi-dimensional learning experience, consisting of a comprehensive e-learning package, workshops and live play exercises across three levels of attainment: Foundation, Practitioner and Expert.

The programme is open to all BEIS members of staff and the Training and Exercising Pathway provides participants with the skills, theoretical and practical knowledge and experience necessary to competently and effectively take part in a BEIS emergency response. Transferable skills which are taught include delivering at pace and under pressure, personal resilience and adaptability, effective communication and stakeholder engagement.

Additionally, the programme equips learners with an understanding of the current risks BEIS hold responsibility for as the Lead Government Department, and relevant legislation, policies, procedures and guidelines relating to emergency response across government and within BEIS. The programme also trains BERA members how to effectively use available BEIS resources and facilities to assist in the performance of emergency response roles.

On top of the learning outcome, BERA has also established a learning community and facilitates a network of resilience practitioners across BEIS who can support each other through collective development, experience sharing and ongoing mentoring.

More recently, the UK Government has announced the creation of a Leadership College for Government⁷¹⁰ which will take over the programmes currently delivered by the Civil Service Leadership Academy and the National Leadership Centre.

The ingredients for the provision of the necessary training for civil servants thus appear to be in place, together with recognition of the need. But here too, it cannot be left to ‘best efforts’ and chance that at least the core members of departments’ emergency management groups, and those who are expected to participate in cross-government emergency management groups, are individually and collectively competent to fulfil their leadership role in the management of major emergencies. The same disciplines on building and demonstrating individual and collective competence should apply as much to civil servants as they do to staff of local bodies, including:

1. All Lead Government Departments must have the capability and capacity to deploy trained and approved civil servants for emergencies requiring a single department or cross-government response:
   

   “The government cannot employ thousands of surplus civil and public servants, waiting to be deployed to the latest crisis. But it is important that the capacity to respond to shock events is considered and protected in the budget process and in ministers’ plans for their departments.”⁷¹¹
   

   This includes the provision of sufficient trained and approved Government Liaison Officers to be deployed to work with Resilience Partnerships where required, including in UK-wide, long-running emergencies.

2. The definition of the competences required of civil servants with resilience roles, and their inclusion in the Resilience Competences Framework.
3. Undertaking individual emergency management training every three years, with suitable CPD each year, set against the defined competences.
4. Each Lead Government Department undertaking at least one formal command team exercise per year, observed by independent external assessors against the requirements set out in the Resilience Competence Framework⁷¹².
5. At least one formal cross-government command team exercise to be undertaken per year, observed by independent external assessors against the requirements set out in the Resilience Competence Framework.

The critical role played by Government Ministers and Special Advisers in the response to emergencies means that it is vital that they too have a basic understanding of resilience structures at national level and the role and status of Strategic Co-ordinating Groups at local level, along with the basic principles of emergency management:

“Ministers and civil servants rarely understand LRF functions or what they really are.

Have a vision of an LRF but no understanding of what it is and can do.”⁷¹³

There would be merit in capturing the necessary competences in the Resilience Competences Framework, and ensuring that suitable training is available, particularly when Ministers and Special Advisers are new in post, to support their personal development. This need was also reflected in the report by the House of Lords Select Committee:

“There must be more ministerial engagement in risk preparedness. The Government should provide guidance and implement training for ministers on planning and crisis response.”⁷¹⁴

And we strongly believe that Ministers would benefit from undertaking a cross-government command team exercise at least once a year. Again, this requirement was also reflected by the House of Lords Select Committee:

“Exercising … should be at the heart of UK preparedness as they are crucial to ensure plans are tested and those responsible for executing them are well-trained. Exercises must be regular, short and involve the most senior figures responsible for the plans, including ministers.”⁷¹⁵

and supported by the then Paymaster General in her evidence to the Lords Committee:

“… need to invest more in induction, training, flexion and exercising with ministers. Ministers are the most transient part of the team, but they are an incredibly important link and, ultimately, they are the ones at the table, so we need to ensure that they know what they should be doing and are equipped to do that job well.”⁷¹⁶

To boost its capacity and capability, government should also look at opportunities for mentoring, coaching and secondments. As highlighted in the Provision of Training section, secondments between designated local bodies and government departments can be beneficial for the professional development of those concerned, as well as bringing people with more operational experience into government and enabling more civil servants to get hands-on experience of front-line operations⁷¹⁷. Similar benefits could be obtained with secondments to and from relevant private and voluntary sector organisations. Consideration should be given to the establishment of a structured secondment programme that can be used not only during the planning phase but also the response and recovery phases of emergencies – particularly to get senior practitioners into government to help advise on the practical implications of delivering policy options on the ground:

“During COVID, government needed LRFs to deliver things like PPE. Should have got more senior practitioners into government to help advise on delivery and how best to use LRFs. Could have helped in getting a better response more quickly.”⁷¹⁸

Recommendation 90: The Resilience Competence Framework should set out the competences required of civil servants with resilience roles, with training to allow individuals to achieve those competences incorporated into the training provision of the Government Skills and Curriculum Unit and the new Leadership College for Government. The Framework and Curriculum should also include the competences needed by civil servants who are expected to act as a Government Liaison Officer within Strategic Co- ordinating Groups.

Recommendation 91: All Lead Government Departments must have the capability and capacity to deploy trained and approved civil servants for emergencies requiring a single department or cross-government response. This includes the provision of sufficient trained and approved Government Liaison Officers to be deployed to work with Resilience Partnerships where required. Senior leaders of Lead Government Departments who are expected to be core members of their emergency management groups in the response to a major emergency should be mandated in an amended Act or future legislation and supporting statutory guidance to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD, in order to be assessed as ‘approved’ to fulfil that role. A record of those who have received the necessary training and CPD should be maintained by each department and used as the basis for drawing up rotas.

Recommendation 92: An amended Act or future legislation and supporting statutory guidance should mandate that core members of departmental emergency management groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, an improvement plan should be put in place with improvement evidenced in the areas that fell short of the expected standard within a given timeframe.

Recommendation 93: An amended Act or future legislation and supporting statutory guidance should mandate that core members of cross-government emergency management groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, an improvement plan should be put in place with improvement evidenced in the areas that fell short of the expected standard within a given timeframe.

Recommendation 94: The UK Government should consider how best to support Ministers in the development of the competences they need to lead a single department or participate in a cross-government response to a major emergency. Ideally, Ministers should undertake at least one cross-government command team exercise per year.

Recommendation 95: Government should consider the establishment of a structured programme that can be used both during the planning phase and also during the response and recovery phases of emergencies to facilitate secondments (with public, private and VCS organisations) into and out of departments.

Links With Academic Institutions

National Links

Higher education institutions (HEIs) have an important role to play, not only in the education of people who work, or wish to work, in the resilience field but also in the contribution they can make from their research to the development of policy and operational practice. We therefore interviewed a number of HEIs on the courses they taught, the research they conducted, and especially on the level of their engagement with the UK Government and Resilience Partnerships, to establish whether there was an effective two-way flow of information and learning.

Whilst a small number of the HEIs we interviewed ran under-graduate courses, most focused on post-graduate teaching, particularly aimed at serving practitioners, usually from Category 1 bodies. Course attendees at undergraduate and postgraduate level were primarily from the UK, although a small but increasing number came from overseas.

Course content was a balance of theory and practice, and was increasingly being delivered virtually, driven in part by the measures that had to be put in place during the COVID-19 pandemic but also reflecting the need to make participation as easy as possible for students with demanding work or home lives. Some courses involved student placements but not all, which was often a reflection of the fact that post-graduate students attending courses were typically already working in a resilience role. The need for under-graduate students to expand their academic knowledge with practical experience was highlighted as important to recruiters. But, where HEIs did offer placements, these were not always taken up:

“Placements offered with local authority EPOs, NHS EPRR, etc. Following COVID … think students want to get out and start work quickly and lots of jobs on offer at present.”⁷¹⁹

In line with our recommendation in the Business Continuity Management Duty section, most HEIs who covered business continuity in their courses confirmed that the relevant modules were being refocused onto organisational resilience.

Many HEIs, especially those with courses aimed at students intending to work outside the UK or undertaking research into resilience policies and frameworks, expressed an intention to inject more content on societal resilience and the Sendai Framework⁷²⁰ into courses aimed at UK students – and thereby to seek to attract the attention of government and Resilience Partnerships to these wider agendas rather than what they perceived as the current narrow focus of UK resilience chosen by the UK Government.

“In a recent review to ensure we keep up-to-date, we will be including a module on Societal Resilience, to support the changing world and wider thinking around resilience.”⁷²¹

Increasingly HEIs were looking to make parts of their courses available as discrete modules, including for use in CPD. Many were exploring micro-credentialling. Some were working with sector bodies to explore a potential role in accrediting individuals against sector-specific competences or standards.

HEIs consistently identified two areas of concern.

First, the lack of a national Resilience Competence Framework for use in the development of courses and materials was seen as a barrier to ensuring that students were equipped with the right skills and knowledge to meet the needs of their future employers.

The more significant gap was the absence of meaningful engagement by the UK Government with HEIs; and the inability of HEIs to find a point of contact in the UK Government with whom they could discuss current resilience policies and practices and the findings from relevant recent research – although HEIs did recognise they needed to be good partners:

“[Lack of good links] may not be a criticism of government. Government is receptive to relevant academic research and findings that are supported with a strong evidence base – but sometimes those messages are best positioned in a way, and at a point in time, that mean that some academics aren’t always best placed to share those messages in a way that lands well with policy makers.”⁷²²

Where they did exist, the most significant contacts between HEIs and the UK Government were built on personal relationships. This meant that:

1. HEIs were not always sure, and felt unable readily to check, that their materials were up-to-date with government policy thinking or operational good practice:
   

   “Don’t get protectively marked information which makes keeping up to date with policy materials from government hard. Have battled on that for many years. Got ReslienceDirect Lite account but doesn’t provide anything useful … No links to CCS and EPC on keeping up with good practice. Have called for it several times over the last 10 years but got nowhere. Told they are not emergency planners and are not in the field.”⁷²³
   “Would welcome greater understanding about [the reasons] why changes are made to policy and practice … do consult widely every 4-5 years as part of the course review process, but would welcome a stronger, more regular, input and engagement with government.”⁷²⁴

2. The UK Government was not exploiting the contribution which HEIs could make through their research to the development of policy and operational practice:
   

   “[How does your research get into government thinking, policy-making and operational development?] Some institutions have achieved this, but this is not through systematic approaches, this generally occurs through expertise or project work on specific projects or issues with small groups of academics … COVID-19 has created more discussion around research, but it has been narrow in focus.”⁷²⁵
   “Role of HEIs to gain best practice and case studies from around the world and to disseminate those.”⁷²⁶

HEI research leads also confirmed that there was no one government department collating research gaps and questions that government and local responders wanted answering, and then working with research funding bodies to commission this research:

“Resilience and civil contingencies research requests from the government and its agencies are hard to catch and complex to see where they will be advertised … Each department has a different driver with no clear central collation or co-ordination … Resilience comes in to focus and fades again in people’s priorities so up-to-date knowledge is not prioritised or research requests are time-lagged: there is no forethought.”⁷²⁷

They also repeatedly drew out the irony that, whilst the UK Government funded significant levels of research for the benefit of other countries on disaster management and humanitarian assistance (usually through the Foreign, Commonwealth and Development Office), there was very little funding available for research focused on improving resilience in the UK:

“University is involved in policy engagement and impact assessment in the same way as other HEIs. But no funding for UK focused research – although there is a lot of money for international research on disaster management.”⁷²⁸

It is clear that strengthening the relationship between HEIs and the UK Government would have benefits in the development of UK resilience. We make recommendations below to address the identified weaknesses and to achieve the potential benefits in this area.

Local Links

The evidence from our interviews suggests that contacts between HEIs and Resilience Partnerships are much stronger, with an observable recent development in linkages between Partnerships and HEIs in the same local area. Topics covered included:

1. HEIs delivering specific education and training to meet the needs of individual Resilience Partnerships or particular sectors (eg. the ambulance service).
2. Two-way knowledge exchange, bridging the gap between academic and practical experience, especially for courses with a significant experiential learning component:
   

   “Also work on knowledge exchange. Working with West Mercia LRF to bridge the gap between academic and practical experience.”⁷²⁹
   “Nottingham Trent University has the ‘Nottingham Civic Exchange’ which connects and facilitates policy influencing and engagement into and out of local and national government building support for civil contingencies and resilience amongst other work themes.”⁷³⁰

3. Staff of local bodies feeding into HEI taught courses:
   

   “Had … links with Portsmouth University on risks, but more about helping their students with local context than the LRF members benefitting from them.”⁷³¹

4. Staff of local bodies contributing to HEI research projects, which often required practitioner This made it more likely that the findings would be able to be embedded more quickly in operational practice.
5. HEIs providing specialist input into projects being taken forward by Resilience Partnerships. This was particularly seen where Partnerships were pursuing projects requiring a high degree of data manipulation and analysis (eg. for projects on building Resilient Places, drawing on local demographic and socio-economic data to provide analysis and advice on intersectional issues to help Partnerships to better understand the needs and vulnerabilities of their communities). HEIs often cited that the evidence base that they held would be of value in informing fuller risk assessment and emergency planning work done in Resilience Partnerships:
   

   “There currently does not appear to be a coherent way of transferring learning from academia into LRFs. Research could be disseminated in a similar way to the sharing of good practice and lessons from incidents. The LRF has recently worked with the University of Nottingham and Nottingham Trent University to develop a ‘Nottingham Universities Expert Advisory Group’, with the aim to “provide actionable evidence and insight from the latest research to inform time sensitive and critical decisions by local leaders”… must promote more involvement locally with higher tier universities.”⁷³²

6. LRFs and HEIs working together on joint The National Consortium for Societal Resilience [UK+] is a good example of this.

Despite this thickening of local networks, there was a general acceptance that there was considerable scope for doing more:

“…why not use local HEIs to help LRFs regionally to do [risk assessment] work and develop systematic, sustainable relationships with them. Risk and consequence assessment needs more strength: why do we leave it to LRFs alone?”⁷³³
“To [understand the vulnerabilities in communities better], EPOs need to know their areas; set up relationships with other parts of the governance system; combine data sources, etc. Softer social science is a key part of the planning: needs to be embedded from the start … some of this happens already but there could be so much more. In the COVID pandemic … the idea seemed to come from nowhere that there was an increased rate of domestic violence, but it was totally predictable from the research evidence over decades. You can plan for it if you know something about it.”⁷³⁴
“Would be good to have a role linking to universities to aid collective research work and access to funding pots / research pieces / best practice. Research is key: universities are all doing the work and have people there with skills and knowledge, but LRFs do not have the capacity to access this.”⁷³⁵
“Another role for HEIs is as a hub of knowledge and community, providing co- operation and cohesion in their local community where public, private, VCS sectors can find a home. HEIs don’t forget – they are places where lessons and research are stored and can be pulled out and looked at.”⁷³⁶

Recommendation 96: The Resilience Competence Framework, once produced, should be made available to HEIs to inform their course design and teaching.

Recommendation 97: The Civil Contingencies Secretariat or any successor body should establish and promote a formal engagement mechanism for those HEIs seeking advice on current resilience policy and operational practice, or who wish to pursue or promote research of benefit to UK resilience.

Recommendation 98: Resilience Partnerships should be encouraged to engage with their local HEIs, including in areas where they can offer analytical expertise in the development of risk assessments and emergency plans to more fully reflect local demographic, socio- economic and other data and information.

Recommendation 99: The Civil Contingencies Secretariat or any successor body should collate from across government departments and Resilience Partnerships a list of those UK resilience issues which would benefit from further research, and pursue this with HEIs and research funding bodies.

A Centre of Resilience Excellence

One clear, overarching conclusion drawn out in interviews – across a number of sectors – is that, in the resilience field, the UK Government has focused heavily over the past decade on processes and products at the expense of people. It has not sufficiently invested in the knowledge base, occupational competence instruments, quality mechanisms and – above all – the visible signalling which encourages the pursuit of excellence in UK resilience. We have therefore tested in interviews the value of adopting in the resilience field the mechanism classically used in other fields, including other areas of national security, which wish to pursue and embed professionalism and quality – the creation of a Centre of Excellence.

We have found widespread support for the concept of a Centre of Resilience Excellence (CORE):

“Fully support concept of CORE … government spends lots of public money through the Foreign, Commonwealth and Development Office telling other countries how to write national plans, to have a national resilience centre, etc, but then doesn’t do it itself in the UK.”⁷³⁷

The functions of the CORE could cover many of the areas described above:

1. Leadership within government of the development of the Resilience Competence Framework, working in partnership with resilience stakeholders from all sectors, professional bodies, employers and the higher and further education sectors.

2. Leading the fundamental transformation of the resilience training ecosystem, including:

1. • Developing, in conjunction with other training providers as appropriate, learning pathways setting out guidance on how to train individuals to meet Resilience Competence Framework requirements.
   • Developing, in conjunction with other training providers as appropriate, a wide range of training options, including modular courses, digital delivery and on-site training provision.
   • Producing and maintaining core training materials (including toolkits, aides memoire, etc.) for adaptation and use by government departments, Resilience Partnerships and voluntary and community organisations.

3. Providing specific training courses and command team exercising in some areas; but more broadly overseeing the availability of training courses and command team training across all providers in the UK to ensure that there is sufficient, high-quality and compliant training available to allow everyone with a significant resilience role, and command teams in UK Government departments and Resilience Partnerships, with the ability to develop the competences they need. This function would include developing and making available to Resilience Partnerships a national register of recognised trainers, subject matter experts and providers of multi-agency emergency management training:

“Centre of Resilience Excellence should be able to point people to areas of good practice to do the teaching, training and exercising.”⁷³⁸

4. Overseeing or brokering the mechanisms to create, advertise and recruit to apprenticeships, student placements and secondments; and to facilitate mentoring and coaching

5.  Acting as a point of engagement for, and maintaining regular dialogue with, HEIs seeking advice on current resilience policy and operational practice, or who wish to pursue or promote research of benefit to UK resilience:

“Need from government a national emergency planning college that is not constrained by a public-private partnership and has an understanding about what resilience research looks like, brings in best practice and disseminates best practice, including embedding it in exercise scenarios, etc.”⁷³⁹

6. Where needed, connecting Resilience Partnerships with HEIs who have specialist skills and knowledge.

7. Collating from across UK Government departments and Resilience Partnerships a list of those ‘Areas of Research Interest’ (ARIs)^{740, 741} in the resilience field which would benefit from further research and pursuing this with HEIs and research funding bodies:

“Where are the research questions generated with Areas of Research Interest (ARI) produced that would outline current and future research requirements? Each department has a different driver with no clear central collation or co- ordination … Resilience comes into focus and fades again in people’s priorities so up-to-date knowledge is not prioritised or research requests are time- lagged: there is no forethought … Historically resilience does not appear to be high enough in priority. Cannot see anything high on civil servants’ priority list to pursue with their Ministers in terms of resilience. The Cabinet Office have done some work, but resilience research is never high on their priority list.

Government structures should help focus attention on this area but do not currently do this. One of the causes could be dispersed leadership of resilience.”⁷⁴²

“People’s awareness of consequences and needs has been raised to some extent through the pandemic. Had a much wider impact than other hazards responders normally deal with. Gives a personal, human flavour to what we mean by academic and theoretical concepts like vulnerability: can see many examples of it during the pandemic. If thinking about research to come out of the pandemic, it would be good for someone to collate a range of stories and scenarios that show how the pandemic has affected different groups in different ways and where this intersects with EPOs’ work and interests …

Needs a mindset change that people are complex beings so can’t give them one label. How do you get a handle on that and make it work practically? A lot of people are struggling with that. So address that with the priority research on case studies / cameos of the different impacts that occurred in COVID that people can see and feel. And would be worth studying the counter-factual: what would have happened if we had recognised all that at the start of COVID? Would it have played out differently? How much did it cost us not to recognise something that was hidden in plain sight? This is not the add on, luxury item that comes after you’ve done the important stuff. This is the important stuff! But it is not given that recognition.”⁷⁴³

and more broadly:

8. Leading on arrangements for capturing lessons identified from the response to major emergencies, and their dissemination and embedding into doctrine, guidance, competences and training:

“[Centre of Resilience Excellence] should have a training package with latest learning from recent incidents which people regularly have to do. Need to be more proactive on CPD.”⁷⁴⁴

9. Analysing, synthesising and disseminating the findings of relevant UK and international research, including its inclusion in doctrine, guidance, competences and training.

10. With the Devolved Administrations and others, creating and maintaining doctrine and guidance, embedding lessons and the findings of relevant research, and maintaining an up-to-date mapping of available doctrine and guidance and its status for use across all sectors.

11. The provision of thought leadership on resilience in the UK, including creating spaces where diverse groups of people from government, Resilience Partnerships, the voluntary and community sector, academia and elsewhere can debate issues and develop new ideas to inform policy development and operational practice:

“[CORE] could act as a beacon or lightening rod for academics and practitioners to bring them together with the aim of getting better questions and answers. [CORE] could overcome the current issue that getting information into government frequently relies on personal networks, which is sub-optimal. Could be of real value, in normal circumstances and in an emergency. Could be very effective in combining multi-disciplinary material into aggregated, layered outputs, enabling the development which resilience badly needs.”⁷⁴⁵

“Good to expose responders to wider debates and open them to views beyond the current narrow focus on doctrine … Need to create places that allow diverse groups of people to come together with a blank piece of paper and come up with ideas, but facilitated so that ideas are captured by policy makers. Needs to be beyond just having a good debate: need to come out with things that can be used in policy development and taken forward as concrete proposals … BEIS ran some sessions to do research around a topic – had that kind of mix. Led by the government department but had an academic chair and a broader panel of academics and practitioners to feed in. Worked quite well.”⁷⁴⁶

12. Running, or sponsoring others with specialist skills to run (eg. through a HEI), a Knowledge Hub to collate and maintain an accessible online library of essential UK reference materials, and documentation from the UK and overseas that illustrates a wide range of good practice.

Our interviews also covered the key question of whether the current Emergency Planning College could transition to becoming the UK Centre of Resilience Excellence. It is with regret that we conclude that there was no appetite for this in Resilience Partnerships or elsewhere:

“[CORE is an] interesting concept. EPC could have been there, but people view EPC as not being as focussed in that space anymore.”⁷⁴⁷

For most Resilience Partnerships, the College barely featured in their thinking about training, beyond the provision of some introductory or specialist courses. Some interviewees had a lingering affection for what the College had been and the services it had provided in the past. But, for most, the training provided by other Colleges, or in some cases by HEIs, was much more significant in their thinking. And, as noted above, a number of Resilience Partnerships had concerns about the accessibility, cost and, in particular, the quality of some trainers and courses provided by the College.

The Emergency Planning College would thus also need a fundamental transformation, including a different funding model, alongside the transformation of the training ecosystem, if it were to form part of the CORE. But we believe that focusing on the College alone would be too narrow and would build a silo where the CORE should go wider, to embrace the benefits of co-working with:

1. The wide range of government training institutions, including not only the College of Policing and the Fire Service College but also, for example, the Defence Academy, including the Development, Concepts and Doctrine Centre (DCDC), and the Diplomatic There is clear value in cross-fertilisation of training between the different institutions and cultures, especially between the ‘civilian’ and ‘military’ fields, and between ‘home’ and ‘overseas’ experience and practice. And there are obvious benefits in terms of accessibility in having multiple geographies for on-site training, drawing on the geographical locations of the other institutions:
   

   “Centre of Resilience Excellence (CORE) should … not be outsourced with a contract that can’t keep up with necessary changes. Best people should be released into CORE on secondment to produce and deliver training materials, etc. Culture change needed.”⁷⁴⁸

2. Other HEIs, including the ability of the CORE to draw on academic teaching and research disciplines (including academic accreditation arrangements), to share skills and capabilities, and possibly to share overheads:
   

   “Agree with shared enterprise. Consider as a tripod – academics, government, practitioners … [and] even if it is a joint enterprise, then needs to be an open model to bring in other people and organisations too.”⁷⁴⁹

The model we are recommending means that it is unlikely that such a Centre could become self-financing. But, whilst it would need a small ‘head office’ as well as its digital presence, its ability to draw on geographically-distributed hubs – both government sites and possibly those of HEIs – would sharply reduce costs whilst radically increasing engagement.
Even so, the CORE may well not be attractive to private sector partners as a full joint venture on the lines of the current arrangements for the Emergency Planning College (which expire in the next 2-3 years). Our preference, for the reasons set out above, is that the CORE should become part of the proposed College of National Security, for the reasons first set out in the 2015 National Security Strategy. This noted the then Government’s intention to take:

“… a more strategic shared approach across government, including by ensuring our education and training establishments work closely together. These include the Diplomatic Academy, the Defence Academy, the Emergency Planning College and the College of Policing. We will establish a virtual National Security Academy which will act as a hub for these organisations to share, develop and maintain critical knowledge and skills across the national security community, leading to greater coherence and common professional standards.”⁷⁵⁰ (Original emphasis)

Although this proposal did not proceed, the 2021 Integrated Review noted the current UK Government’s intention at least to:

“… review the case for a dedicated College for National Security as part of the new Curriculum and Campus for Government Skills.”⁷⁵¹

A subsequent paper by Sir Ian Andrews on behalf of the National Preparedness Commission⁷⁵² suggests that the College “… might explicitly be extended to embrace ‘Resilience’…”. Sir Ian goes on to note that:

“From the perspective of national preparedness, a dedicated College for National Security represents an invaluable, and perhaps overdue, investment in delivering the ambition for greater resilience at home and overseas …” (Our emphasis)

and that:

“… the right level of visible, committed, and pro-active engagement and support from senior leaders … is vital to the effective delivery of genuinely transformational outcomes. By signalling the importance that they attach to the resilience agenda … they would ensure that the College is able to realise its potential to transform the capability of citizens and communities …”

For the reasons set out earlier in this Chapter, we agree with Sir Ian that a transformation is needed in the resilience training ecosystem – and indeed that it is overdue. We believe that the creation of a Centre of Resilience Excellence would not only signal the importance of the resilience agenda, as he describes, but go further to address the need we set out above to provide the visible signalling which encourages the pursuit of excellence in delivering that agenda. The creation of the CORE as part of the newly-created UK College for National Security⁷⁵³ would be highly beneficial, allowing it to embrace the co-working benefits described above, provided that:

1. It was genuinely open to and able to meet the needs of all sectors – public, private, voluntary and community – and not just the UK Government as the current proposal
2. It was able to build strong linkages to, and possibly joint ventures with, HEIs not only on teaching but also – and especially – on research and learning.

Recommendation 100: The UK Government should pursue the creation of a Centre of Resilience Excellence. This should represent and meet the needs of all sectors engaged in building UK resilience, including by drawing in the expertise it needs from across the sectors. The Centre could lead on the development of the Resilience Competence Framework and the fundamental transformation of the resilience training ecosystem, act as the point of engagement for higher and further education institutions on teaching and research, collate a schedule of Areas of Research Interest, and lead on learning and improvement, including disseminating and embedding lessons identified and the findings of relevant UK and international research. It should embrace the benefits of co-working with other Government Colleges, and with HEIs active in the resilience field. There would be considerable benefits from the Centre being part of the proposed College for National Security.

Building a Learning and Continuous Improvement Culture

In its Integrated Review, the UK Government repeatedly stressed the importance of “learning the lessons of COVID-19”. However, as Lord Toby Harris, Chair of the National Preparedness Commission, said at the launch of the Learning That Can Save Lives report⁷⁵⁴ in September 2021:

“Too often, after any disaster or crisis we hear the promise ‘Lessons will be learned’.

However, that is sometimes as far as it goes.”⁷⁵⁵

This echoed the conclusion of the earlier Pollock Review in 2013:

“The consistency with which the same or similar issues have been raised by each of the inquiries is a cause for concern. It suggests that lessons identified from the events are not being learned to the extent that there is sufficient change in both policy and practice to prevent their repetition.”⁷⁵⁶

We heard from interviewees that there is limited evidence at a national or local level of a learning and continuous improvement culture. This was sometimes portrayed as being due to a lack of time and resources – a view which we have sympathy for, but only up to a point. More worryingly, this was also sometimes attributed to a fundamental lack of desire to disturb the status quo, or to a perception that there was nothing to learn from others, including from international experience:

“Was a sense of “we have a complete system” so became hard to challenge. “LRFs are working so don’t touch them”. LRFs sometimes feel precarious and fragile. People really need to be invested in them to keep them working. Worried that if you look to make changes, then may fall apart altogether … Give people the space to breath. It is a good system – was ground-breaking in its time. Reality is that people are fighting to keep it alive every day on the ground. As a result, they haven’t got the bandwidth or boldness to change. It all sits in a precarious place.”⁷⁵⁷

“UK policy making tends to be boxed in and narrowly focused, with less openness to what has been learnt globally, not only from the US, Australia and Europe but also from less economically developed countries who have had to be very creative as they often haven’t had the centrally funded capacity available in the UK and elsewhere.

Developing countries have had to work out how to make things work from the ground up with few resources. In the UK, there doesn’t seem to be a perception that the UK could learn from others’ experience in less economically developed settings.”⁷⁵⁸

An effective learning and continuous improvement culture would also involve a systematic process to make sure that debriefs take place following exercises and emergencies, that lessons identified are shared widely, and then adopted and embedded in all relevant organisations. For long-running emergencies, debriefs should take place at regular intervals during the response and recovery phases: the need for this was particularly highlighted during the COVID-19 pandemic by the C19 National Foresight Group:

“The UK Government should rapidly establish a common debrief methodology and shared learning mechanism to ensure learning and good practice is captured, shared and acted upon in real time, to both mitigate harm now, and influence the future response, to Covid-19. Reviews and local debriefs should aim to identify the enabling factors of the successful longer term response and recovery partnerships in this unique situation.”⁷⁵⁹

Interviewees expressed their frustration that this is still not happening consistently, and that producing a debrief report was no guarantee that lessons were actually being adopted and embedded into all operational practices:

“Need also to look at learning, not just training. Not seen an LRF that is a real learning organisation. Some do debriefs, and review debriefs from elsewhere, and say the issues have been addressed, but then an incident happens and it is clear that lessons weren’t really embedded. Risk that many debriefs are a process that is required as opposed to reaching their potential.”⁷⁶⁰

There was widespread recognition and welcome from interviewees for Joint Organisational Learning (JOL) Online, which aims to collate and highlight lessons, but concerns were raised about its user-friendliness and that lessons, once identified, are not being followed through:

“It would be really beneficial if the format of JOL could be looked at to enable it to be filtered to find specific lessons to a risk set, as it can be quite difficult to navigate.”⁷⁶¹

“JOL is not doing the job as well as it should. Could a central validation organisation  use it much better?”⁷⁶²

Interviewees were also concerned that lessons identified were not being incorporated into policy and guidance with any sense of urgency. We note in the Doctrine and Guidance section that key pieces of doctrine and guidance have not been updated in the last decade.

The development of a culture of continuous, systematic learning and improvement is well- trodden ground in other fields, with substantial experience which can be drawn into UK resilience. We suggest that the first two steps should be to signal the value placed on continuous learning and improvement, and to start to put in place arrangements for taking that ethos forward, through:

1. The need for, and encouragement of, such a culture being signalled within the resilience community from the centre of Government, by Ministers and senior civil servants. The imminent appointment of a Knowledge Co-ordinator at the Emergency Planning College, jointly funded with the Civil Contingencies Secretariat, is a welcome move in this area.
2. Demonstrating that commitment through the development of systematic arrangements to gather learning and ideas for improvement and to oversee their embedding in changes in operational practice, a mission which we suggest should be given to the Centre of Resilience Excellence.

Recommendation 101: The Cabinet Office should signal the need for, and encouragement of, a learning and continuous improvement culture; and demonstrate that commitment by putting in place systematic arrangements for its promotion and pursuit, led by the Centre of Resilience Excellence.

The Need

The need, in an area of such significance for people’s safety and wellbeing, for effective validation and assurance arrangements encompassing both the definition of performance standards and rigorous arrangements to validate whether they are being met has been widely accepted over the past 20 years. There is established practice in some risk areas, as for example in the assurance arrangements embedded in the major industrial hazards⁷⁶³ and nuclear radiation⁷⁶⁴ fields. The NHS in England has performance management arrangements in place through its definition of Core standards for emergency preparedness, resilience and response⁷⁶⁵, validated by the Care Quality Commission (CQC). Her Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) covers resilience as part of its inspections of police forces and fire and rescue services. And the Maritime and Coastguard Agency ensure compliance against the marine safety code⁷⁶⁶ and oil pollution Regulations⁷⁶⁷.

But those arrangements do not cover all local bodies, all risks, or Resilience Partnerships as a whole. Our interviews with front-line organisations, especially the Chairs of English LRFs and Scottish interviewees, have brought out very clearly that they would welcome arrangements through which it was possible to assess performance and identify areas of improvement more broadly.

And, broader still, there is widespread agreement on the need for the results of those assessments to be brought together by the UK Government into an overall assessment of:

• The quality of resilience in the UK
• Areas of best practice on which Resilience Partnerships can draw
• Areas for improvement
• And, especially, of how ready the UK is to tackle risks and respond effectively to emergencies

It is clear from our research and interviews that current validation and assurance arrangements are wholly inadequate against those broader goals. Performance standards have progressively developed over the period since 2010 but, critically, have no teeth.

Current standards are not used consistently between sectors. There are no current systematic, routine arrangements to monitor the performance of all organisations with legal duties and other defined responsibilities, and of the way in which those organisations act in partnership. As far as we have been able to establish, at no stage has the UK Government taken formal intervention action with an individual designated body or with a Partnership overall on performance grounds. And there are no systematic arrangements in place to generate an assessment in the centre of government of the quality of resilience in the UK, for use by UK Government Ministers and the UK Parliament.

The analysis below sets out the current weaknesses, and our recommendations for radical improvements in two broad areas to address these weaknesses:

• The definition of standards – ‘what good looks like’
• Performance monitoring arrangements

Addressing Current Weaknesses – Standards

The UK Government has in the period since 2010 progressively defined standards and indicators of good practice for use in performance assessment. The first set of standards was published in 2010 and updated in 2013⁷⁶⁸. These aimed to provide:

“… a consistent framework for self-assessment, peer review and more formal assessments.”

For each duty under the Act, the document highlighted⁷⁶⁹:

1. “What is involved .. outlining any mandatory requirements …”
2. “What you should consider … optional elements of the [Act] regime”
3. “Examples of good practice … to provide a picture of what performance over and above compliance with … statutory obligations might look like.”

The Government also published a ‘Reference Document’⁷⁷⁰:

“… intended to clarify the role of English and Welsh Local Resilience Forums.”

and to highlight:

“… some of the key aspects that demonstrate robust compliance with the duties under the CCA and Regulations …”

The document was targeted on:

“… use individually and collectively by organisations that constitute an LRF or contribute to its work [and] Assurance agencies … in guiding their assessments of engagement among local agencies in their collective LRF responsibilities and in supporting the agencies’ efforts to manage and develop their individual and collective effectiveness.”⁷⁷¹

In line with a commitment in the 2015 National Security Strategy⁷⁷², the ‘Expectations Set’ was superseded in 2020 by the National Resilience Standards⁷⁷³. As with the ‘Expectations Set’, they:

“… set out expectations of good and leading practice for Local Resilience Forums …”

and:

“… are intended to establish a consistent and progressive means for LRFs and their constituent local responder organisations to self-assure their capabilities and overall level of readiness …”⁷⁷⁴ (Our emphasis)

As with the ‘Expectations Set’, they define expectations at three levels:

1. “Mandatory, legal requirements (expressed in terms of ‘must’).”
2. “Good practice (expressed in terms of ‘should’).”
3. “Leading practice (expressed as ‘could/may’).”⁷⁷⁵

The new Standards have been broadly welcomed by most front-line organisations, especially as they were developed with representatives of local bodies as well as government departments and agencies. And it is clear that they are being used in self-assessment by Resilience Partnerships and individual local bodies. Our interviews have, however, identified two areas where the Standards could be improved.

The first is in their format and useability. The Standards are crisper and sharper than the previous ‘Expectations Set’: a simple metric is that they now cover some 30 pages rather than more than 60. And the use of a “Desired Outcome” statement at the start of each Standard to guide interpretation is widely welcomed. But there is a widespread view amongst local bodies that they could be crisper still:

“Resilience Standards are too wordy, lots of repetition. Need to make them more efficient and easier to implement, and then LRFs will try to achieve them.”⁷⁷⁶

“Welcome greater clarity on standards, especially making them more useable: hard to self-assess against them at present.”⁷⁷⁷

In several cases, for example, the material on mandatory requirements points to a range of publications rather than providing simply-expressed requirements. This means that there is a need for a separate analysis by Resilience Partnerships to infer potential requirements from other documents, with the associated risk of inconsistency in interpretation.

The second concerns the legal force of the word ‘should’ in the definition of good practice which some interviewees regarded as unclear, especially in the perspective of officers of local bodies who might be accountable for their actions and those of their organisations to a future Inquiry:

“Standards need to be crystal clear on expectations. For example, Resilience Standards use the word ‘should’: does that mean that LRFs should do it, or not? What would a future Inquiry think?”⁷⁷⁸

The Treasury’s Orange Book⁷⁷⁹ on risk management is careful to set out at the outset the exact meaning of the key words used, especially the distinction between mandatory and advisory actions. It would be helpful if future editions of the Resilience Standards could do the same.

It should also be made clear that the Standards will be used in single- and multi-agency validation and assurance regimes (see further below). To support the former, it would clearly be helpful for HMICFRS and CQC to be involved in the development of the revised Standards, to ensure alignment with their inspection regimes and also to benefit from their experience:

“… development of inspection and validation regime will need care to ensure that it integrates properly with existing regimes, including by embedding resilience requirements into existing regimes were possible.”⁷⁸⁰

Recommendation 102: Current Resilience Standards provide a sound basis for assessing the performance of local bodies with duties under the Act and of Resilience Partnerships collectively. But they should be revised to include either a crisper definition of requirements or an associated summary checklist. The legal force of each of the three sub- sets of expectations (“must/should/could”) within each Standard should be set out more distinctly. HMICFRS and CQC should be involved in the development of the revised Standards. And it should be made clear that they will be used in single- and multi-agency validation and assurance regimes.

The fundamental gap which needs to be addressed, therefore, is that, in the same way as government departments do not have resilience duties in law, so there are effectively no standards governing their performance. Our understanding is that the extant document which offers departments guidance on ‘what good looks like’ dates from before the Civil Contingencies Act passed into law⁷⁸¹. It appears not to have been updated since. Guidance on the validation of performance⁷⁸² is brief, certainly by reference to the Resilience Standards. And, in several areas, the suggested measures of performance are now out-of- date.

This weakness matters and needs to be addressed, especially given the widespread criticisms we received about the competence of staff of UK Government departments in the management of the response to the COVID-19 pandemic. We have recommended in the Duties to be Placed on the UK Government section that Lead Government Departments should be subject to the same set of duties as local bodies, recognising that they are equal partners in the shared endeavour of building UK resilience. We can see no valid reason why their performance against those duties should not similarly be assessed against defined standards. These could draw on the Resilience Standards. But they should also recognise:

1. The vital leadership role of Lead Government Departments in many areas of risk and emergency management, including in their leadership of national prevention programmes, in their stewardship of national emergency plans and capabilities, and in emergency response and recovery.
2. The need, in discharging that leadership role, to engage constructively with organisations in the public, private and voluntary sectors to support them in their own risk and emergency management That will be particularly important in areas where the risk management projects being taken forward by local bodies fall within a national framework led by an individual government department.
3. The need for government departments and agencies to recognise the need to support local bodies in their engagement with local democratic oversight and scrutiny arrangements.
4. The particular role of relevant departments in leading activity with public and private sector organisations to build and sustain the resilience of the essential service sectors (eg. water, electricity) they sponsor.

Recommendation 103: The UK Government should develop and publish additional Resilience Standards for the performance of designated Lead Government Departments. These should cover the quality of the departments’ own work across all aspects of risk and emergency management as well as the quality of their engagement with designated local bodies, including supporting them in their engagement with local democratic

accountability arrangements. And they should cover the quality of departments’ activities within the essential services sectors they sponsor to build and sustain the resilience of the sector.

Addressing Current Weaknesses – Performance Monitoring

Concerns over the adequacy of performance management arrangements in the resilience field are long-standing. Effective performance assessment was a key area of scrutiny in 2003 by the Parliamentary Joint Committee on the draft Civil Contingencies Bill⁷⁸³ which noted that:

“The Government believes that the certainty offered by the new local contingency framework will provide the basis for robust performance management of civil protection activity to ensure operational effectiveness and financial efficiency. It has considered establishing a new mechanism for performance management, possibly through an inspectorate, but believes that the use of existing mechanisms will achieve its aims of ensuring consistency of performance … The new framework will feed into established processes through bodies such as the Audit Commission, the emergency services inspectorates, and the utility regulators.”⁷⁸⁴

and that this meant that:

“… the Government believes the means are already in place to allow the Minister to monitor performance and take effective action in the event of poor performance or non-compliance.”⁷⁸⁵

The Bill Committee disagreed with this view. They were attracted by:

“… the concept of a separate, dedicated civil contingencies inspectorate [which] would be able to ensure that civil contingency inspection had a high profile and that specialised expertise was developed to examine civil contingencies and the joint working arrangements which will be needed to underpin it.”⁷⁸⁶

They recommended that:

“… the Cabinet Office examines the feasibility of a dedicated inspectorate to oversee performance management of civil protection activity, to ensure operational effectiveness and financial efficiency. Such a dedicated inspectorate might be based within a Civil Contingencies Agency …”⁷⁸⁷

In the event, the Bill Committee’s recommendation was not pursued by the Government. The Act and its supporting arrangements have provision both for the monitoring of performance and for enforcement, but they are limited in their scope – and, as far as we have been able to establish, have never been used. The Act thus provides for Ministers to “require a person or body” with duties under the Act to:

“… provide information about action taken by the person or body for the purpose of

complying with a duty …”

and:

“… to explain why the person or body has not taken action for the purpose of complying with a duty …”⁷⁸⁸

Statutory guidance supporting the Act makes clear, however, the expectation that this power would be narrowly and infrequently used:

“The Government would be most likely to use its monitoring powers to probe perceived systemic failures in the operation of the Act. For example, if a particular class of Category 2 responder is not sharing information …”⁷⁸⁹

Clearly, the legal provision and its amplification in statutory guidance does not envisage the routine, systematic monitoring of performance by the UK Government. Instead, guidance is clear that “The Government relies on”⁷⁹⁰:

1. Internal processes to each organisation, including internal audit and quality assurance systems⁷⁹¹.
2. “established audit and regulatory bodies across the Category 1 and 2 organisations …”⁷⁹². However, the closure of the Audit Commission limits external audit and assurance activity for public sector bodies to the emergency services and wider NHS. And our interviews have not identified any examples of the utility regulators monitoring or taking enforcement action with companies designated as Category 2 responders in respect of their compliance with their duties under the Act.
3. Locally-driven self-assessment and peer review⁷⁹³, including those undertaken for the National Capabilities Survey, covered further below.

The Resilience Standards do provide a solid basis for use in the single-agency inspections carried out by HMICFRS and by CQC, although several interviewees noted that the performance benchmarks in the resilience field used by HMICFRS in their inspections differed between their inspections of police forces and of fire and rescue services, raising the risk of inconsistency in performance assessment.

Recommendation 104: The Resilience Standards should be adopted consistently by HMICFRS and CQC for their assessment of the performance of relevant bodies who have duties under the Act or successor legislation.

The Resilience Standards could also be used to meet the Government’s original expectation that performance assessment could be carried out by the utility regulators⁷⁹⁴. The value of their doing so would be greatly increased if, as recommended in the Designation of Co- operating Bodies – Category 2 Responders section, the businesses concerned were to have placed upon them the same duties as local bodies currently designated as Category 1 responders.

Recommendation 105: The Resilience Standards should ideally be adopted by relevant regulators in their assessment of the performance of those regulated utilities who have duties under the Act or successor legislation.

The Resilience Standards can also be used in self-assessment and peer review. It is disappointing that the nationwide performance assessment initiative which used the former ‘Expectations Set’ in self-assessment by LRFs under the ‘National Capabilities Survey’ programme⁷⁹⁵ to provide useful evidence on the quality of resilience in the UK appears to have lapsed. But we were encouraged to hear from several English LRFs that they are using the Resilience Standards in their own self-assessment and in informal peer reviews.

Although useful, however, these assessment tools are simply not sufficient. As many front- line organisations have pointed out to us, there is a risk of organisations ‘marking their own homework’ in internal reviews and self-assessments, especially given the perceived lack of clarity in some current Resilience Standards:

“Organisations are currently self-regulated so [validation and assurance] would help drive improvement across organisations. LRFs need a critical friend … DLUHC often ask LRFs to declare their preparedness but there is no challenge back on those declarations.”⁷⁹⁶

And single-agency inspection regimes, although valuable, do not provide an assessment of the performance of all designated bodies acting in partnership. Ultimately, and as pointed out by the Bill Committee, a genuinely rigorous performance monitoring regime requires external, independent review, drawing on people with expertise and experience, looking across the entire LRF partnership, against well-defined standards. This was also the view of the House of Lords Select Committee on Risk Assessment and Risk Planning which called for:

“… an Office of Preparedness and Resilience as a non-departmental body [which] would be responsible for producing independent analysis of UK preparedness and monitoring Government preparedness. It would produce assessments of UK resilience, set resilience standards, and conduct audits of UK preparedness.”⁷⁹⁷

Multi-agency validation would best be undertaken by a new team, which need not be large, staffed by experienced, knowledgeable practitioners who will carry credibility with those they deal with:

“… no self-assessment is rigorous so external validation would be welcome as long as it is conducted by experienced, competent people.”⁷⁹⁸

“… needs to be done by people who are experienced, know what they are talking about, respected. Needs to be people who can see beyond a shiny plan to see if it would really work in practice.”⁷⁹⁹

“Practitioner-led team (secondees for a year from Category 1 and 2 organisations?) …

must be expert, experienced and respected, not consultants.”⁸⁰⁰

The focus of validation reviews should be on learning and improvement, with reviews conducted in a spirit of collaboration with the Resilience Partnership so that recommendations are more readily accepted and acted upon. Validation reviews would thus ideally be conducted at the request of and in support of the Chair (for example, on his or her appointment, or as a foundation for a self-generated improvement programme), subject to each Partnership being the subject of validation at least every three years:

“Validation is a gap that needs addressing. LRF Chair needs assurance that they are doing the right things in the right way.”⁸⁰¹

Of the various performance management regimes currently in use in the public sector, we believe that the Sector-Led Improvement model⁸⁰² led by the Local Government Association and its associated peer support offer⁸⁰³ most closely mirror the spirit of the supportive validation regime, focused on improvement, we recommend:

“Have a moral obligation to help make improvements, not just criticise …”⁸⁰⁴

In the same spirit, the reports of validation reviews should be provided in narrative form.

“Need a regime which supports, not antagonistic. A friend that can help LRFs improve. That would mean a narrative commentary on how the LRF is performing. LRF should be able to provide their own commentary on the analysis and the areas prioritised for action.”⁸⁰⁵

And the multi-agency team should not walk away after their reviews but should instead be capable of providing support to the Resilience Partnership in its improvement programmes, especially in signposting sources of best practice or expertise in particular functional areas:

“LRFs rarely excel in all aspects of planning. But if you knew which LRF was good on what, then you could go to them and ask for help. Would save resources if good signposting was available.”⁸⁰⁶

We recommend in the Duties to be Placed on the UK Government section that UK Government should have the same duties as local bodies. By extension, validation would cover fully the activities of Lead Government Departments and their Arm’s Length Bodies as well as Resilience Partnerships⁸⁰⁷. Validation reviews would be undertaken at the request of and in support of the Accounting Officer.

Finally, it is worth reverting to the overall intention behind the Bill Committee’s original recommendation, and a point which has been stressed repeatedly by interviewees – that performance monitoring arrangements need teeth to be effective and respected:

“Validation will help bring home to agencies, including their senior leaders, their responsibilities.”⁸⁰⁸

“Standards and validation would get the attention of strategic leaders, which is vitally needed.”⁸⁰⁹

If the Standards and their associated validation and assurance arrangements are to provide a sound basis for assessing performance against legal duties and for driving improvement, and especially if they are to provide a stronger underpinning to the current weak provisions for monitoring and enforcement in Sections 9 and 10 of the current Act, they will need to be given status in law.

Recommendation 106: The UK Government should establish arrangements for the assessment against defined Resilience Standards of the performance of English LRFs and of Lead Government Departments. Validation reviews should be undertaken by a small new team of experienced, knowledgeable practitioners, hosted in the Civil Contingencies Secretariat or successor body.

Recommendation 107: Validation reviews should be conducted at the request of the Chair of each Resilience Partnership or the Accounting Officer of each Lead Government Department, subject to each Partnership or Department being the subject of validation at least every three years. The focus of the reviews should be on learning and improvement, with reports provided in narrative form. The review team should be able to provide continuing support to Resilience Partnerships or Departments in their improvement programmes, especially in advising on sources of best practice or expertise in particular functional areas.

Recommendation 108: An amended Act or future legislation should, in its provisions for monitoring and enforcement, provide legislative backing to Resilience Standards and the associated validation and assurance regime.

Democratic Deficit

The Future Role and Expectations section sets out the need for greater clarity on the future roles and responsibilities of designated local bodies and Resilience Partnerships. In a field of such significance to people’s safety and wellbeing, we believe that there is an equally compelling need for greater clarity on accountability, not only to political oversight and scrutiny mechanisms at local and national levels but also to the British people and to future Inquiries.

It is clear from our research and interviews that there is a substantial ‘democratic deficit’ in the resilience field. This can be seen in the very limited recognition in the Act and its associated Regulations and guidance of the place and value of democratic and public scrutiny. It can also be seen in the limited degree to which the quality of resilience arrangements in the UK have since 2004 been the subject of scrutiny by political oversight mechanisms at local and national levels.

Arrangements for and support to political oversight and scrutiny mechanisms at local level are simply not addressed in the Act itself, which provides only for Government Ministers to have monitoring powers⁸¹⁰.

Supporting statutory guidance has the same substantial gap. A section on “Local arrangements for assurance and accountability” ⁸¹¹ does not cover local political oversight and scrutiny mechanisms at all⁸¹². And there is only one glancing reference in the guidance to the use of “local authority scrutiny powers”⁸¹³ as one of the external validation processes which might be used to provide assurance.

There is a similar gap in political accountability to the UK Parliament. Unsurprisingly, given a scope which is limited to “Local Arrangements for Civil Protection”, the Act and its associated Regulations and supporting guidance are silent on the role of the UK Parliament. Our research suggests that Parliamentary scrutiny since 2004 has mainly been confined to reviews of the response to particular emergencies after the emergencies have occurred and inevitably with a scope confined narrowly to the particular risk event. Although there have been valuable reviews with a wider scope carried out by Committees of the House of Lords, especially that by the Select Committee on Risk Assessment and Risk Planning⁸¹⁴, there appear to be no arrangements which provide for the systematic, forward-looking review by the UK Parliament of the quality of resilience arrangements in the UK overall, across all identified risks and covering all aspects of resilience. As the Lords Select Committee noted:

“… Parliament has been too passive in its responsibility to scrutinise risk plans and

should assist the audit of Government preparedness.”⁸¹⁵

Our strongly-held belief, reinforced by the clear view of those we interviewed, is that the quality of resilience in the UK would be greatly reinforced by stronger political oversight and scrutiny at all levels, and by enabling people and communities to scrutinise and challenge what public bodies are doing in their name. We believe this function to be so important that democratic accountability arrangements, and the provision of support to enable effective monitoring and scrutiny, should be captured much more fully in legislation and supporting statutory guidance. New provisions should cover:

1. Executive accountability: who is accountable for the performance of their organisations against the duties and other responsibilities defined in law and against defined standards, and should therefore be held to account by the public, by political oversight and scrutiny mechanisms, and by future Inquiries.
2. Clearly defined obligations on designated bodies to support democratic accountability arrangements at local and national levels, especially through the publication of information and analysis for public review and challenge, and to enable political oversight and scrutiny mechanisms to fulfil their role

We cover these in turn below.

Executive Accountability

The best form of clarity on executive accountability is that seen in a range of other fields – the designation of Accountable Officers. This discipline is already well embedded for some risks covered by local and national risk assessments, for example in the major industrial hazards⁸¹⁶ and nuclear radiation⁸¹⁷ fields. It is widely used in other fields where the safety and wellbeing of people is a key consideration, such as the health sector which requires organisations to:

“… have an appointed Accountable Emergency Officer (AEO) who is a board level director and responsible for [emergency preparedness, resilience and response] in their organisation. This person should be supported by a non-executive board member.”⁸¹⁸

And it is a fundamental underpinning to responsibility and accountability in central government, through the designation of heads of organisations as Accounting Officers, who with their Ministers are responsible and accountable to Parliament for the performance of their core departments and associated Arm’s Length Bodies.

Local Bodies

But there is no such clarity of the personal accountability of the heads of most bodies with duties under the Act for the way in which their organisations fulfil their responsibilities, across all of the work of the Resilience Partnership. Nor, as our interviews showed, is it judged by the Chairs of Resilience Partnerships and others that the weight of that responsibility and accountability is felt and respected in all cases, and seen in the actions of senior leaders:

“… system needs personal accountabilities to be defined and captured in the Act.”⁸¹⁹

“Need greater clarity on personal accountabilities, which would help to secure consistency of attention in senior leaders. Have seen senior leaders ready to take that responsibility, but also a complete absence of acceptance of that level of responsibility, with those involved only showing interest at the onset of an incident.”⁸²⁰

“… greater clarity on accountability would help support the continuing commitment of senior leaders of organisations to the fulfilment by their organisations of their duties.”⁸²¹

We believe that that gap needs to be addressed especially, as described in the Escalation and Intervention section, as a means of giving the Chairs of Resilience Partnerships ‘teeth’ in their dealings with those bodies who are clearly not fulfilling their responsibilities. In this area, the personal accountability of the heads of the relevant bodies should be set out in law.

Recommendation 109: An amended Act or future legislation, and associated Regulations, should not only designate those bodies with legal duties but also make clear that the heads of those bodies have personal accountability for the performance of their organisations against those duties and associated standards.

UK Government Departments

We have recommended in the Duties to be Placed on the UK Government section that UK Government departments should have the same legal duties as local bodies, and that the quality of their resilience-building activity should be subject to an equivalent standards regime. Equally, we believe they should be subject to the same disciplines of accountability for their performance, to the UK Parliament:

“Need to get ministers to take ownership of … the resilience agenda. Where does disaster management sit in the UK? Where does the role of risk reduction currently sit? Who can be held accountable, with other ministries in support?”⁸²²

 The accountability architecture would sensibly mirror the accountability arrangements which are well developed and understood in other fields.

Under these arrangements, Accounting Officers and Ministers of government departments – in this case, of designated Lead Government Departments – should be responsible and accountable to Parliament. This would pick up in the resilience field the intention in the Declaration on Government Reform that:

“We will bring greater clarity to the roles, responsibilities and accountability of Ministers and senior officials when taking decisions.”⁸²³

In addition, responsibility and accountability for cross-government activity should rest with a designated Cabinet Officer Minister and, at senior official level, the National Security Adviser or, more logically, the Deputy National Security Adviser for Intelligence, Security and Resilience. Considerations of workload might point to the appointment of a Deputy National Security Adviser with responsibilities for resilience alone.

The goal should be that, following practice in other countries, there is a single, identifiable senior official who cares and is seen to care about the quality of resilience in the UK, a point reinforced in our interviews with front-line organisations. This approach is deliberately intended to mirror that adopted by the Resilient Cities network⁸²⁴ which commends such a role to act as the city’s point person for resilience building, leading the development and execution of the city’s resilience strategy, and working to improve cross-organisational communication and support for resilience-building initiatives⁸²⁵. On the same basis, we believe that the individual should be designated as the ‘UK Government Chief Resilience Officer’⁸²⁶.

The postholder would have responsibility not only for the quality and effectiveness of the activity undertaken across UK Government departments but also (subject to respecting the scope of devolved powers) for that of work by organisations outside central government, and especially by local bodies and Resilience Partnerships. On that basis, we believe that the new multi-agency validation team should be hosted by the Civil Contingencies Secretariat in the Cabinet Office or any successor body, and be accountable directly to the UK Government Chief Resilience Officer:

“… Cabinet Office not only need to gather and synthesise the results, but also to feed the synthesised analysis back out to LRFs collectively.”⁸²⁷

Recommendation 110: An amended Act or future legislation and associated Regulations should make it clear that Ministers and Accounting Officers of designated Lead Government Departments have personal accountability for the performance of their departments against the duties placed on their departments and associated Standards.

Recommendation 111: The National Security Adviser or a nominated Deputy should be appointed UK Government Chief Resilience Officer. The postholder should have responsibility for the quality and effectiveness of the resilience-building activity across the UK, including that undertaken in central government departments and (subject to respecting the scope of devolved powers) by designated local bodies and Resilience Partnerships. He or she would be directly responsibility for the new multi-agency validation team. The postholder should bring substantial operational experience of working in a front-line role in the resilience field and have credibility across all sectors. The accountability of the postholder and of a designated Cabinet Office Minister for the quality of resilience in the UK should be set out in an amended Act or future legislation.

The Obligation to Support Local Political Accountability

There is already a range of local political oversight and scrutiny mechanisms, often involving members of the public. Thus, it is not unusual for local authority scrutiny committees to co- opt independent members to get a service user voice. Health and Wellbeing Boards have the ability to appoint additional co-opted members. Police and Crime Panels include independent or ‘lay’ members. And, to the degree that they are covered by devolution settlements, oversight structures are maintained by Mayors and combined authorities:

“… community challenge is really important … Cannot just be about local authority

scrutiny committees and elected members. Need to enable people to talk about “This is how it feels to me living here at present”. People need to be able to hold professional responders to account …”⁸²⁸

“Very hard for Councillors, even Parish Councillors, to speak on behalf of their communities – better to have communities speaking for themselves.”⁸²⁹

“LRFs want the public in the area to be able to see they are doing a good job and that the public can hold them to account for areas where they are not doing well.”⁸³⁰

These mechanisms cover most of the local bodies with duties under the Act, so that there is no obvious immediate need to create new political oversight structures. In any case, further changes may result from implementation of the devolution proposals in the Levelling Up White Paper, which notes that:

“It is important that devolution is accompanied by sharper and clearer accountability.”⁸³¹

We would simply note that in the resilience field the ideal form of oversight and scrutiny would be that Mayors, Elected Members, Police and Crime Commissioners and other elected or co-opted individuals come together to undertake multi-agency scrutiny of the multi- agency work of a Resilience Partnership.

The main need is thus to ensure that the absence of recognition of the role and value of local political oversight and scrutiny mechanisms in current legislation and guidance is corrected, and that it sets out the obligation on local bodies to provide such information and analysis as is necessary to enable those mechanisms to fulfil their role effectively. The Validation and Assurance chapter covers arrangements for the multi-agency validation of the work of Resilience Partnerships. The reports of those reviews, and of the Action Plan agreed by the Partnership to address their findings, will contain material which is valuable to local public and political scrutiny and accountability. As with the reports of inspection and validation in other fields, they should clearly be published.

Recommendation 112: The valuable role of local democratic engagement, oversight and scrutiny arrangements, and the obligation on bodies designated with duties under the Act or successor legislation to support those arrangements, should be set out clearly in an amended Act or future legislation, Regulations and supporting guidance.

Recommendation 113: The reports of multi-agency validation reviews of the work of Resilience Partnerships, together with the Action Plan agreed by the Partnership, should be published locally, for the information of the public and for use in local political oversight and scrutiny mechanisms. The obligation on Resilience Partnerships to publish the reports should be captured in an amended Act or future legislation.

The Obligation To Support Accountability to the UK

As noted above, the Act is silent on accountability arrangements to the UK Parliament. Here, too, the need is therefore to ensure that the role and value of Parliamentary oversight and scrutiny is recognised, and that legislation sets out the obligation on the UK Government to provide such information and analysis as is necessary to enable Parliament and its Committees to fulfil their role effectively.

The House of Lords Select Committee has recommended⁸³²:

1. A yearly debate on the National Security Risk Assessment (NSRA), to be held by both Houses of Parliament.
2. The creation of a new Joint Select Committee – the Joint Resilience and Contingencies Committee – to scrutinise and democratise the UK’s risk planning approach and the work of the Cabinet Office Civil Contingencies Secretariat, which should have access to all relevant information, including the NSRA.

We understand that the recommendation to create a new Joint Committee rather than use the existing Joint Committee on the National Security Strategy, which would enable resilience to be brought together with other risk management activity including in the counter-terrorism and cyber security fields, was made on grounds of the heavy workload of the existing Joint Committee. Our recommendations below are intended to support whichever route is preferred, as well as enabling scrutiny by existing Select Committees, especially the Public Accounts Committee.

Sector Resilience

The Validation and Assurance chapter identifies the value of building and validating the quality of resilience in those sectors which are vital to people’s safety and wellbeing, identified in Section 1 of the Act – the supply of money, food, water, energy, fuel and the continuous provision of communication, transport and health services. It also sets out a recommendation that Lead Government Departments’ responsibilities should continue to include the pursuit of sector-wide resilience in the sectors they sponsor.

The UK Government has helpfully published a summary⁸³³ of the resulting Sector Security and Resilience Plans. This, and the more detailed Plans for each sector which lie behind it, provide a valuable potential source of information and analysis for the work of departmental Select Committees. We believe that departments should have an obligation in law to provide relevant Plans and summary reports to the Select Committee which has oversight of their work. Departments should also have a similar obligation to provide Select Committees with the reports of validation reviews of their resilience-building work, and resulting Action Plans, carried out in accordance with Recommendation 106.

UK Resilience

The House of Lords Select Committee in its report also recommended that annual reports on the standards of preparation and required capabilities be signed off by Ministers and laid before Parliament for debate⁸³⁴. We would go further.

First, the UK Government Chief Resilience Officer should provide a regular assessment to the National Security Council on the current state of UK resilience, the gaps and weaknesses and plans to address them:

“To address gaps in central Government’s capabilities to respond to the risks identified in the National Risk Assessment, the Civil Contingencies Secretariat should produce an assessment for the National Security Council of where such gaps exist, and the time and resources required to address them. The Deputy National Security Advisor should then be responsible for co-ordinating action plans to address these gaps, driving this agenda through the Council.”⁸³⁵

 Second, an obligation should be captured in law that the UK Government should provide an annual ‘Resilience Report’ to the UK Parliament, prepared by the UK Government Chief Resilience Officer and submitted by the Cabinet Office Minister, which brings together:

1. A summary assessment of the findings of validation reviews of Resilience Partnerships conducted in the year.
2. The findings of validation reviews of Lead Government Departments conducted in the year, together with the agreed departmental Action Plans.
3. A report on the findings of any lessons identified reviews carried out during the year after major emergencies; and progress in the implementation and embedding of lessons of all past reviews.
4. A description of progress on the main risk reduction and emergency preparedness programmes, including the major programmes within individual sectors, and the development of associated strategies, policies, plans and capabilities.
5. A summary analysis of the current state of UK resilience

Recommendation 114: The important oversight and scrutiny role of the UK Parliament, and the obligation on the UK Government to support Parliament and its Select Committees in their work, should be set out clearly in an amended Act or future legislation, Regulations and supporting guidance.

Recommendation 115: Lead Government Departments should provide to the relevant Parliamentary Select Committee the Sector Security and Resilience Plans for the sectors which they sponsor, and the reports of validation reviews, together with the Action Plans agreed by the department.

Recommendation 116: The UK Government should provide an annual Resilience Report to the UK Parliament bringing together the findings of validation and assurance activity carried out during the year at local and national levels, and of any lessons identified reviews carried out in the year; a description of progress on the main risk reduction and emergency preparedness programmes, including the major programmes within individual sectors, and the development of associated strategies, policies, plans and capabilities.; and a summary analysis of the current state of UK resilience. The obligation to provide the Resilience Report should be captured in an amended Act or future legislation, and associated Regulations.

The Role of the National Audit Office

The House of Lords Select Committee in its report also noted that:

“… the National Audit Office has the power to investigate the Government’s risk preparedness … the NAO should continue its valuable role scrutinising risk management in Government.”⁸³⁶

The NAO has widely drawn powers under the National Audit Act 1983 to examine the economy, efficiency and effectiveness with which UK Government bodies have used their resources and to report the results of this work to the UK Parliament. Against a backdrop of an increasing focus on risk and resilience, we have discussed with the NAO the application of its powers to the scrutiny of the UK Government’s work on building resilience in the UK.

The NAO already covers resilience as appropriate in its routine scrutiny of departments. We believe that the fuller definition we recommend in the Executive Accountability: UK Government Departments section of the responsibilities of Accounting Officers of Lead Government Departments for the work of their core departments and of their Arm’s Length Bodies, together with the definition of standards by which that work can be measured, will support both the NAO’s routine scrutiny and any focused examinations of the UK

Government’s resilience measures that the independent Comptroller and Auditor General may decide to undertake.

Recommendation 117: We invite the Comptroller and Auditor General to take account of departmental Sector Security and Resilience Plans, together with the UK Government’s annual Resilience Report to the UK Parliament, to inform decisions about future examinations by the National Audit Office and its scrutiny of resilience-building work in the UK.

The recommendations from our report are reproduced below. Recommendations that may require new or amended primary legislation are shown with*.

Chapter 3: What is Resilience and a Truly Resilient Nation?

*Recommendation 1: An amended Act or future legislation, and associated Regulations, should set risk reduction and prevention activities onto the same legal and operational basis as emergency preparedness, enabling the full range of risk management action at national and local levels.

*Recommendation 2: An amended Act or future legislation should include a new duty on risk reduction and prevention placed on all Category 1 responders.

Recommendation 3: The execution of the new duty on risk reduction and prevention should be addressed in new statutory and non-statutory guidance, aligned to the Sendai Framework, Sustainable Development Goals and the Paris Agreement.

Recommendation 4: The UK Government should put in place mechanisms to gather metrics, at UK and locality level, to allow progress in building UK resilience to be tracked, and to provide data into the UN Disaster Risk Reduction programme.

Recommendation 5: The role of Resilience Partnerships should be expanded to cover risk reduction and prevention as well as emergency preparedness, response and recovery.

Recommendation 6: The UK Government should encourage and support localities in the development of Local Resilience Strategies which seek to build deeper societal resilience, drawing on the work of the London, Greater Manchester and Hampshire and Isle of Wight Resilience Partnerships. Statutory guidance should reflect the role of Resilience Partnerships in leading or providing significant support to the development of Local Resilience Strategies.

Chapter 4: Involving the Whole of Society

Recommendation 7: Statutory guidance on the execution of the Emergency Planning duty should be fundamentally revised to put people first, through a move to needs-based planning. It should be re-developed around a main theme of identifying the consequences for people of major emergencies and their potential physical, social, psychological and economic needs; and then using that analysis as the basis for determining which organisations are best placed to meet those needs, from whichever sector, subject to the necessary safeguards. It should embed existing good practice developed in some Resilience Partnerships on the identification and recording of potential contributions through the use of a Capability Matrix and other similar tools, and then ensuring that contributors are trained and plans are tested in exercises involving the organisations concerned. Relevant Regulations on the execution of the duty should be revised to adopt a human-centred rather than process-based approach.

Recommendation 8: The formula in Regulations by which designated local bodies are required to ‘have regard to’ the capabilities of the VCS in carrying out their duty on emergency planning should be abolished. Regulations associated with an amended Act or future legislation should provide for VCS organisations to have partnership status in the resilience-building activities of local bodies, Resilience Partnerships and central government departments. Engagement of the VCS in resilience-building at local level should be captured in a new Resilience Standard.

Recommendation 9: Statutory guidance to the Act or successor legislation should promote the development and use by Resilience Partnerships of a Capability Matrix to capture the skills and capabilities potentially available from local VCS organisations, for use in emergency planning and response.

Recommendation 10: Statutory guidance to the Act or successor legislation should include much fuller information on the broader range of VCS organisations, and their skills and capabilities, which experience has shown to have an important contribution to make in the response to a major emergency.

Recommendation 11: The VCSEP should be invited to work with Resilience Partnerships and VCS partners iteratively to test and develop the concept of a National Capability Matrix of the VCS organisations, and their skills and capabilities, which operate on a national or regional basis, able to be used by Resilience Partnerships and VCS organisations as a shared online resource.

Recommendation 12: We welcome the intention of the VCSEP to provide a ‘brokering’ facility by which local bodies and Resilience Partnerships can identify VCS organisations, and which VCS organisations locally can use to more easily signpost and navigate partners to offer support, in the response to a major emergency.

Recommendation 13: The UK Government should work with the VCSEP to identify specific functional areas where joint, common and consistent training between local bodies and VCS organisations would have operational and efficiency benefits.

Recommendation 14 (linked to Recommendation 84): The core training materials provided to local bodies, Resilience Partnerships and government departments for adaptation and use in their own in-house training should be made equally available to VCS organisations for their own use should they wish.

Recommendation 15: Statutory guidance to the Act or successor legislation should continue to encourage local bodies and Resilience Partnerships to involve VCS organisations in relevant in-house training and exercising.

Recommendation 16: Statutory guidance to the Act or successor legislation should include a model for the engagement of the VCS (and other) organisations based on the principle of ‘Putting People First’ by focusing on the outcome to be achieved – of providing effective support to those affected by the emergency.

Recommendation 17: Statutory guidance to the Act or successor legislation should make clear that it is for VCS organisations themselves to select the Chairs of any sub-groups led by the VCS or their representatives on other committees set up by Resilience Partnerships.

Recommendation 18: The UK Government should recognise the potential mutual benefits provided by the VCSEP by co-resourcing its annual operating costs.

Recommendation 19: The UK Government should develop with business a formal Business Sector Resilience Partnership focusing on resilience matters. This should supplement existing business engagement arrangements managed by Lead Government Departments within their sectors and focus on wide-scale national risks and common and cross-cutting issues. Participation should go widely, to cover business representative bodies and a wide spread of businesses and business resilience-focused consultancies. Its work should be operationally-focused, and cover the assessment of risks and their consequences, risk reduction, the mitigations which might be put in place to address the impacts of emergencies on businesses, and the contribution which businesses might make in the response to major emergencies.

Recommendation 20: The Business Sector Resilience Partnership should be supported by a Business Resilience Team in the Civil Contingencies Secretariat, responsible for leading cross-government work with business on resilience matters. Its work should include ensuring that each Lead Government Department in its resilience-building activity has an established programme of engagement with businesses in the sectors it sponsors, and that cross-cutting issues raised by individual sectors are acted on where necessary. It should also support the Devolved Administrations and Resilience Partnerships in their engagement with businesses in their areas.

Recommendation 21: There should be a new chapter in statutory guidance dedicated to business involvement in building the resilience of the UK. Engagement of the business sector in resilience-building should be captured in a new Resilience Standard.

Recommendation 22: The Business Sector Resilience Partnership should, as a first early priority, co-develop and disseminate information and advice on risks, their consequences and response plans targeted on meeting the needs of businesses, for their use in organisational resilience and business continuity planning.

Recommendation 23: A second early priority for the Business Sector Resilience Partnership should be the development of a National Capability Matrix of the skills, assets and capabilities offered by businesses which operate on a national and regional basis for use in the response to major emergencies.

Recommendation 24: The UK Government should explore, including with the National Consortium for Societal Resilience [UK+], how Resilience Partnerships can be provided with the practical hands-on peer support and advice they need to enable them to promote community resilience development in their areas.

Recommendation 25: The UK Government should include advice in statutory guidance on community participation in formal training and exercising activities organised at Resilience Partnership level, including advice on the appropriate legal and safeguarding issues.

Recommendation 26 (linked to Recommendation 69): The UK Government should encourage the Community Resilience Co-ordinators in each Resilience Partnership to form a network to enable the provision of peer support as well as the effective and timely sharing of information and best practice.

*Recommendation 27: A new duty should be added to an amended Act or future legislation requiring designated local and national bodies to promote and support community resilience, with delivery of the duty at local level being co-ordinated through Resilience Partnerships, and nationally through the Civil Contingencies Secretariat. Key elements of the successful execution of the duty should be clearly articulated in Regulations associated with the Act and developed further in a dedicated Chapter in statutory guidance. The National Resilience Standard for Community Resilience Development should be updated accordingly, to provide a clear roadmap for Resilience Partnerships to fulfil the requirements of the duty and build their own capabilities to support local activity.

Chapter 5: Who Should Have Duties?

*Recommendation 28: All existing Category 1 organisations should remain designated in Schedule 1 of the Act or successor legislation, except that the designation of NHS bodies should be reviewed once the Health and Care Bill has received Royal Assent. There are strong arguments for Integrated Care Boards to be designated as Category 1 responders; and for mental health Trusts to be placed on the same footing as acute Trusts.

*Recommendation 29: The full suite of Category 1 responder duties should be placed on the organisations currently designated under the Act as Co-operating Bodies (Category 2 responders). The UK Government should pursue and capture in statutory guidance ways in which the additional burdens of fulfilling the new duties might be reduced, for example by activity undertaken at multi-LRF / regional level.

*Recommendation 30: The full suite of Category 1 responder duties should be placed on the UK Government. Associated Regulations and statutory guidance should set out the roles, responsibilities and accountabilities of relevant departments and agencies in the implementation of those duties, differentiating clearly between the Cabinet Office, Lead Government Departments and other departments and agencies who act in support.

*Recommendation 31: The UK Government should consider with the organisations concerned whether the Animal and Plant Health Agency, the Food Standards Agency, the Meteorological Office, Inland Drainage Boards, operators of COMAH and REPPIR sites, the UK Oil Pipeline System, the Oil and Pipelines Agency, The Crown Estate, and St John Ambulance and other charitable ambulance services should be considered for addition to the Schedule of designated bodies with legal duties under the Act or successor legislation.

Recommendation 32: The status of the British Red Cross as an auxiliary to the UK Government, and its particular and valuable capabilities in planning, needs assessment and humanitarian assistance for emergencies, especially those which occur overseas, should be recognised in statutory guidance.

Recommendation 33: There remains no case for the designation of the Armed Forces with duties under the Act or successor legislation. But the UK Government should review the contribution which should be made by the Armed Forces, alongside all other parts of society, to the response to future national, wide-scale catastrophic emergencies and, if appropriate, take the conclusions into future legislation and statutory guidance.

Chapter 6: Duties Under the Current Civil Contingencies Act

Recommendation 34: The risk assessment duty in the Act remains fit for purpose and should remain at the core of resilience activity in the UK.

Recommendation 35: The current two-year timeline for the National Security Risk Assessment does not provide a sound platform for effective resilience-building activity at national and local levels. It does not sufficiently inform planning and capability-building for emerging societal hazards, especially those with complex cascading and compounding effects across multiple sectors, and including chronic risks which might worsen over an extended period of time. Nor is it an adequate basis for long-term policy-making or investment decisions for risk reduction and prevention projects which will be

implemented over several years. Risk assessment should be returned to the previous practice of having separate assessments that look ahead for five years and twenty years respectively, to enable longer-term prevention and preparedness activity.

Recommendation 36: Risk assessment at national and local levels should identify and analyse areas where risks are likely to arise concurrently, either because of the cascading and compounding consequences of a major emergency or because likelihood assessment identifies a significant potential for simultaneous emergencies.

Recommendation 37: The UK Government should use the new Situation Centre as the hub of a network providing relevant, rapid and dynamic analysis of emerging and changing risks to Resilience Partnerships and the Devolved Administrations as well as central government departments.

Recommendation 38: The UK Government should radically re-imagine and simplify the risk assessment process. Changes to risk assessment methodology should be introduced only after discussion with Resilience Partnerships and the Devolved Administrations and where they make a material difference to the placing of risks in the risk matrix, and hence to the prioritisation of actions taken to address them. When the methodology changes, the Government should provide full support to Resilience Partnerships to ensure that they understand the reasons for the changes, can effectively apply the new methodology and that the assessment of risks is consistent. Relevant national risks which draw on expertise best accessed at national level should be assessed once, at national level, with the results passed to Resilience Partnerships for taking into their local risk assessments, adapted if necessary to reflect local variations in likelihood or impact.

Recommendation 39: Except where there are compelling national security reasons for not doing so, the main components of the National Security Risk Assessment should be provided to Resilience Partnerships via a digital platform which allows the ability for local data interrogation and extraction. The UK Government should provide via the digital platform standard tools and templates, including those needed to explore the impact of concurrency, which Resilience Partnerships can adapt and use in taking the national methodology into local risk assessments.

Recommendation 40: To enable the better sharing of the National Security Risk Assessment (NSRA), the UK Government should consider the identification in the document of the specific passages which are classified rather than having a single uniform classification for the document as a whole. The NSRA should include clear and unequivocal guidance for document handlers on the level of security clearance (if any) needed for those who wish to access and use the information it contains.

Recommendation 41: The emergency planning duty in the Act or successor legislation should remain at the core of resilience-building activity in the UK.

Recommendation 42: The business continuity management duty in the Act or successor legislation should be amended to move to the concept of organisational resilience.

Recommendation 43: Resilience Standards should be updated to reflect the move to organisational resilience. The effectiveness and coverage of organisational resilience planning should be included in validation and assurance arrangements.

*Recommendation 44: The duty in the Act on local authorities to provide advice and assistance on business continuity management to business and voluntary sector organisations in their area should be abolished. The UK Government should build on the opportunity and learning from the response to the COVID-19 pandemic to rethink from first principles the Standard to be promoted, the audiences that are best placed to receive and act on advice, the wide range of channels (including government bodies) for reaching those audiences, and the most efficient and consistent way of providing advice which supports the objective of improving the resilience of businesses and voluntary organisations.

Recommendation 45: The two public information duties in the Act – to raise the awareness of the public on risks and plans, and to warn and inform the public in the event of an emergency – remain fit for purpose.

Recommendation 46: The UK Government should amend Regulations associated with the Act or successor legislation and supporting statutory guidance to ensure that there is a clear separation between the public awareness duty (information shared in advance of an emergency) and the warning and informing duty (information shared when an emergency occurs or is imminent). Statutory guidance should contain a chapter on each duty.

Recommendation 47: The UK Government and designated local bodies (co-ordinated through Resilience Partnerships) should publish significantly more detail on risk scenarios, their potential consequences and the broad nature of emergency plans, at both national and local level. Statutory guidance should amplify the main categories of information which should be made available under the Public Awareness Duty.

Recommendation 48: There should be a presumption of publication of material on risks and their consequences, including that in the National Security Risk Assessment, and on national and local planning unless there are clear and justifiable national security or commercial reasons not to do so. Where there is a question about the release of information on security or other grounds, sensitivities should be balanced against the public interest in releasing material if doing so would make a material contribution to the safety and wellbeing of those likely to be affected by an emergency.

Recommendation 49: The UK Government should abolish Regulations 27 and 30 warning against causing undue alarm when communicating with the public.

Recommendation 50: Government and designated local bodies (co-ordinated through Resilience Partnerships) should ensure that the information they publish about risks, consequences and plans is designed, presented and actively promoted in a way which supports the public, businesses and voluntary and community organisations in their own planning. This should include the ability to support sustained local and national media campaigns.

Recommendation 51: The UK Government should draw on its experience of communicating with the public in other areas of public policy to identify the most effective ways of presenting information about risks to different audiences and share this with Resilience Partnerships.

Recommendation 52: The UK Government should identify with Resilience Partnerships those areas where the development of information once, at national level, would mean that the information provided to the public was consistent and reduce the duplication of effort at local level, allowing Resilience Partnerships to focus on the development of material tailored to local circumstances.

Recommendation 53: Information should be provided in a form which is easy to digest, navigate and interrogate, and to extract. The UK Government should discuss with Resilience Partnerships the development of a shared web presence to hold both national and local content, including hosting it on the GOV.UK platform.

Recommendation 54: The UK Government should work with Resilience Partnerships to

develop, and then consistently use, a single ‘brand’ for resilience information in the UK.

Recommendation 55: The information sharing duty in the Act remains fit for purpose for supporting the sharing of information between designated bodies at local level.

Recommendation 56: In refreshing statutory guidance on the information sharing duty, the UK Government should ensure that it aligns with the latest Government Security Classification scheme.

Recommendation 57: Resilience Partnerships should use the updated guidance on the information sharing duty to ensure that they have the necessary security-cleared and trained personnel, and information security arrangements, in place to effectively support multi-agency sharing of information.

Recommendation 58: The UK Government should review the role, use and user- friendliness of ResilienceDirect with designated local responders and make the necessary improvements.

Recommendation 59: The UK Government should consider the need for additional Regulations, with supporting statutory guidance, covering the information sharing mechanisms to be used between designated bodies at national level, and between designated local and national bodies.

*Recommendation 60: The UK Government should pursue with the Information Commissioner the creation of an exemption in the Data Protection Act 2018 or successor legislation explicitly to allow for the sharing of personal data during emergencies in cases of urgent humanitarian necessity.

Recommendation 61: Legal provisions and principles on the sharing of personal data, including guidance provided by or agreed with the Information Commissioner and any new exemption in Data Protection legislation, should be captured in updated guidance and training for staff in those organisations most likely to face decisions on sharing personal data during the response to a major emergency.

Recommendation 62: Additional Regulations, with supporting statutory guidance, should specify the co-operation mechanisms to be used between designated bodies at national level, and between designated local and national bodies.

Chapter 7: Structures

Recommendation 63: The current geographical basis for Local Resilience Forums in England and Wales should be sustained. There would be value in the Scottish Government reviewing roles and responsibilities of Partnerships in Scotland at local, regional and national levels, drawing on learning across the four UK Nations.

Recommendation 64: LRFs in England and Wales, and RRPs in Scotland, should continue as a partnership of organisations, including those with duties in law.

Recommendation 65: The UK Government should establish stronger arrangements for administrative escalation to, and timely intervention and enforcement action by, the sponsoring central government department in the case of sustained under-performance by a designated local body. This function, and the processes to be followed, should be clearly set out in Regulations and statutory guidance.

Recommendation 66: The UK Government should as an early priority discuss and agree with Devolved Administrations and English LRFs a formal document which sets out the future role of local bodies and of Resilience Partnerships, and expectations on the way in which they will discharge that role. It should subsequently reflect the revised framework in changes to the Act or successor legislation, associated Regulations and supporting statutory and non-statutory guidance.

Recommendation 67: The Chairs of Resilience Partnerships should continue to be appointed from the senior leadership of local bodies designated under the Act or successor legislation.

Recommendation 68: Decisions on who should chair Resilience Partnerships are properly a decision for the partners involved. But the Co-Chair model appears to have significant advantages which the UK Government should discuss further with the Devolved Administrations and English LRFs. Depending on the outcome, the Co-Chair model could be included in a subsequent revision of statutory guidance.

Recommendation 69: A sustainable long-term funding package for LRFs in England would cover as a minimum the costs of a core team of five posts and one major multi-agency exercise each year in each LRF. This should be provided by the UK Government as either ring-fenced funding or specific grant, so that the sums available are visible to all partners. The UK Government should also fund the consequential increases to settlements for the Devolved Administrations.

Recommendation 70: The UK Government should, working with English LRFs, develop and publish a standard funding formula for the top-up contributions made by those bodies designated as Category 1 responders under the Act or successor legislation. It should be based on the partnership principle that all Category 1 responders contribute their fair share calculated under the funding formula.

*Recommendation 71: The valuable role of Metro Mayors should be recognised in an amended Act or future legislation, associated Regulations and supporting statutory guidance.

Recommendation 72: The value of regional collaboration between LRFs in England should be recognised, reinforced and put onto a consistent, secure footing. LRFs should decide their chosen forms of regional collaboration. The need for regional collaboration forums, and the potential scope of their activity, should be captured in Regulations associated with the Act, and in supporting statutory guidance. Support should be provided by the government department with lead responsibility for the stewardship of local resilience activity, and by the core team in each LRF.

Recommendation 73: Multi-SCG Response Co-ordinating Groups enabling cross-boundary collaboration between Strategic Co-ordinating Groups at local level continue to have a vital role in the emergency response framework for national emergencies. Their value in such emergencies should be recognised, and the government department with lead responsibility for the stewardship of local resilience activity should support local areas in their activation and use.

Recommendation 74 (linked to Recommendation 76): UK Government stewardship of the involvement of the VCS in building UK resilience should rest with the Civil Contingencies Secretariat or any successor organisation.

Recommendation 75 (linked to Recommendation 76): UK Government stewardship of local resilience activity should rest with the Civil Contingencies Secretariat or any successor organisation.

Recommendation 76: UK Government stewardship of all UK resilience-building activity should be led by a single government body which provides:

• A single, visible point of focus for resilience in the UK
• Clear, credible leadership, visible to those working on resilience in all sectors and to the public, both in normal circumstances and in the leadership of a national emergency
• A clear mandate, with the authority, drive and resources to build UK resilience across all areas of risk and emergency management.

The new body should have:

1. Staff drawn not only from the Civil Service but also – and vitally – from all sectors who are knowledgeable, experienced and credible with their stakeholders.
2. The authority, credibility and convening power to join up work across government
3. Corporate Governance mechanisms which allow for the full and effective engagement of the Devolved Administrations and of representatives of all sectors; and for the provision of support and challenge via independent Non-Executives with substantial experience in risk and emergency management.
4. A culture which captures and reflects the operational imperatives of risk and, especially, emergency management: agile, flexible, data driven, and delivery- and outcome-focused.
5. A demonstrable passion for the pursuit of learning, improvement and excellence: in the development of knowledge, skills and capabilities; in products and publications; and in arrangements for validation and assurance.

The new body should build two important cultural underpinnings to its work:

• A demonstrable desire to reach out to gather and share wisdom and It should ensure that the voice and contribution of front-line responders, VCS organisations, businesses and those affected by past emergencies is embedded in the development of policy and operational practice, so that they are grounded in reality and people’s needs
• It should seek to rebuild and sustain with stakeholders the spirit of partnership in a shared enterprise

Recommendation 77: Single- and multi-agency doctrine and guidance which act as the spine of coherent resilience-building activity across the resilience community need urgent – and then regular future – updating to ensure that they reflect developments in policy and operational practice and learning over the last decade. Cross-referencing of, and links to, other documents should also be checked to ensure they are – and continue to be – up- to-date.

Recommendation 78: The Lexicon of Civil Protection Terminology should be refreshed and made a more accessible, user-friendly, reference document. It should then be used consistently to inform the writing of all single- and multi-agency doctrine and guidance.

Recommendation 79: The UK Government should develop and publish digitally for use by local bodies, Resilience Partnerships and government departments a simple map of current doctrine and guidance.

Recommendation 80: As part of updating doctrine and guidance, the UK Government should examine whether legal and other developments, including the recommendations of public Inquiries, mean that some areas of current non-statutory guidance, especially on safeguarding, humanitarian assistance and emergency co-ordination structures, should now be made statutory.

Chapter 8: The Pursuit of Excellence

Recommendation 81: The UK Government, working with stakeholders from all sectors, should develop a Competence Strategy covering everyone with a substantial role in building UK resilience.

Recommendation 82: The UK Government should develop with stakeholders from all sectors, professional bodies, employers and the higher and further education sectors, an integrated Resilience Competence Framework. The Framework should cover both individual and team competences. It should identify the core knowledge, skills, attitudes and experience that are common across organisations as well as those for particular functional and technical specialisms. The resulting Framework should be aligned with those already in place in other sectors and regulatory regimes. Once developed, the Framework should be subject to regular review.

Recommendation 83: In the short term, the UK Government should provide leadership of the development and promotion of the Resilience Competence Framework. But it should pursue with existing professional bodies whether they would, collectively, wish over time and with Government support to create a governance and regulatory body for UK resilience.

Recommendation 84: The UK Government should lead a fundamental ‘reboot’ of the current resilience training ecosystem, set against the goal of providing the necessary training and development opportunities to allow everyone with a significant resilience role to develop the competences and confidence they need. This should include:

• Developing, in conjunction with training providers as appropriate, a wide range of training options, including modular courses, digital delivery and on-site training provision to make it easier for individuals and teams to undertake training and development

• Producing and maintaining accredited core training materials on subjects agreed with Resilience Partnerships which they can adapt and use These materials should be kept up-to-date with the latest legislation and guidance, good practice (from operational experience and research in the UK and overseas), and lessons identified from emergencies and exercises
• Providing ‘train the trainer’ training to those in Resilience Partnerships responsible for developing capacity and capability to provide them with the skills and confidence needed to train others locally
• Developing and making available to Resilience Partnerships a national register of recognised trainers and subject matter Registration requirements should include ensuring compliance with legislation and doctrine, demonstrating that training materials are up-to-date, that trainers and subject matter experts have relevant recent experience and that training is perceived as high quality. Registration should be refreshed every three years. Technical specialisms should be delivered by those formally assessed and registered as competent expert providers

Recommendation 85: Team competences set out in the Resilience Competence Framework should be used as the reference standard when designing multi-agency training and exercising.

Recommendation 86: The suite of accredited core training materials developed by the UK Government should include those for multi-agency command team training and exercises.

Recommendation 87: The national register of recognised trainers and subject matter experts should include the accredited providers of multi-agency strategic emergency management training.

*Recommendation 88: All Category 1 responders must have the capability and capacity to deploy trained and approved strategic leaders for civil emergencies. Senior leaders from Category 1 responder bodies who are expected to be core members of Strategic Co- ordinating Groups in the response to a major emergency should be mandated in an amended Act or future legislation and supporting statutory guidance to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD, in order to be assessed as ‘approved’ to fulfil that role. A record of those who have received the necessary training and CPD should be maintained by Category 1 responder bodies and Resilience Partnerships and used as the basis for drawing up rotas. This requirement should be phased in over a three-year period, drawing on the increase in accredited training capacity being put in place by the College of Policing and, we hope, by other accredited providers, with new SCG members being prioritised for training. In recognition of the mutuality of benefits gained, the UK Government should provide specific, time-limited co-funding of the cost of meeting this requirement.

*Recommendation 89: An amended Act or future legislation and supporting statutory guidance should mandate that core members of Strategic Co-ordinating Groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, Resilience Partnerships should be required to put in place an improvement plan and to evidence improvement in the areas that fell short of the expected standard within a given timeframe.

Recommendation 90: The Resilience Competence Framework should set out the competences required of civil servants with resilience roles, with training to allow individuals to achieve those competences incorporated into the training provision of the Government Skills and Curriculum Unit and the new Leadership College for Government. The Framework and Curriculum should also include the competences needed by civil servants who are expected to act as a Government Liaison Officer within Strategic Co- ordinating Groups.

*Recommendation 91: All Lead Government Departments must have the capability and capacity to deploy trained and approved civil servants for emergencies requiring a single department or cross-government response. This includes the provision of sufficient trained and approved Government Liaison Officers to be deployed to work with Resilience Partnerships where required. Senior leaders of Lead Government Departments who are expected to be core members of their emergency management groups in the response to a major emergency should be mandated in an amended Act or future legislation and supporting statutory guidance to attend a strategic emergency management training course every three years, and subsequently undertake annual CPD, in order to be assessed as ‘approved’ to fulfil that role. A record of those who have received the necessary training and CPD should be maintained by each department and used as the basis for drawing up rotas.

*Recommendation 92: An amended Act or future legislation and supporting statutory guidance should mandate that core members of departmental emergency management groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, an improvement plan should be put in place with improvement evidenced in the areas that fell short of the expected standard within a given timeframe.

*Recommendation 93: An amended Act or future legislation and supporting statutory guidance should mandate that core members of cross-government emergency management groups should undertake at least one command team exercise per year, externally observed and assessed by independent external assessors against the requirements set out in the Resilience Competence Framework. If collective performance is assessed as being seriously weak in any areas, an improvement plan should be put in place with improvement evidenced in the areas that fell short of the expected standard within a given timeframe.

Recommendation 94: The UK Government should consider how best to support Ministers in the development of the competences they need to lead a single department or participate in a cross-government response to a major emergency. Ideally, Ministers should undertake at least one cross-government command team exercise per year.

Recommendation 95: Government should consider the establishment of a structured programme that can be used both during the planning phase and also during the response and recovery phases of emergencies to facilitate secondments (with public, private and VCS organisations) into and out of departments.

Recommendation 96: The Resilience Competence Framework, once produced, should be made available to HEIs to inform their course design and teaching.

Recommendation 97: The Civil Contingencies Secretariat or any successor body should establish and promote a formal engagement mechanism for those HEIs seeking advice on current resilience policy and operational practice, or who wish to pursue or promote research of benefit to UK resilience.

Recommendation 98: Resilience Partnerships should be encouraged to engage with their local HEIs, including in areas where they can offer analytical expertise in the development of risk assessments and emergency plans to more fully reflect local demographic, socio- economic and other data and information.

Recommendation 99: The Civil Contingencies Secretariat or any successor body should collate from across government departments and Resilience Partnerships a list of those UK resilience issues which would benefit from further research, and pursue this with HEIs and research funding bodies.

Recommendation 100: The UK Government should pursue the creation of a Centre of Resilience Excellence. This should represent and meet the needs of all sectors engaged in building UK resilience, including by drawing in the expertise it needs from across the sectors. The Centre could lead on the development of the Resilience Competence Framework and the fundamental transformation of the resilience training ecosystem, act as the point of engagement for higher and further education institutions on teaching and research, collate a schedule of Areas of Research Interest, and lead on learning and improvement, including disseminating and embedding lessons identified and the findings of relevant UK and international research. It should embrace the benefits of co-working with other Government Colleges, and with HEIs active in the resilience field. There would be considerable benefits from the Centre being part of the proposed College for National Security.

Recommendation 101: The Cabinet Office should signal the need for, and encouragement of, a learning and continuous improvement culture; and demonstrate that commitment by putting in place systematic arrangements for its promotion and pursuit, led by the Centre of Resilience Excellence.

Chapter 9: Validation and Assurance

Recommendation 102: Current Resilience Standards provide a sound basis for assessing the performance of local bodies with duties under the Act and of Resilience Partnerships collectively. But they should be revised to include either a crisper definition of requirements or an associated summary checklist. The legal force of each of the three sub- sets of expectations (“must/should/could”) within each Standard should be set out more distinctly. HMICFRS and CQC should be involved in the development of the revised Standards. And it should be made clear that they will be used in single- and multi-agency validation and assurance regimes.

Recommendation 103: The UK Government should develop and publish additional Resilience Standards for the performance of designated Lead Government Departments. These should cover the quality of the departments’ own work across all aspects of risk and emergency management as well as the quality of their engagement with designated local bodies, including supporting them in their engagement with local democratic accountability arrangements. And they should cover the quality of departments’ activities within the essential services sectors they sponsor to build and sustain the resilience of the sector.

Recommendation 104: The Resilience Standards should be adopted consistently by HMICFRS and CQC for their assessment of the performance of relevant bodies who have duties under the Act or successor legislation.

Recommendation 105: The Resilience Standards should ideally be adopted by relevant regulators in their assessment of the performance of those regulated utilities who have duties under the Act or successor legislation.

Recommendation 106: The UK Government should establish arrangements for the assessment against defined Resilience Standards of the performance of English LRFs and of Lead Government Departments. Validation reviews should be undertaken by a small new team of experienced, knowledgeable practitioners, hosted in the Civil Contingencies Secretariat or successor body.

Recommendation 107: Validation reviews should be conducted at the request of the Chair of each Resilience Partnership or the Accounting Officer of each Lead Government Department, subject to each Partnership or Department being the subject of validation at least every three years. The focus of the reviews should be on learning and improvement, with reports provided in narrative form. The review team should be able to provide continuing support to Resilience Partnerships or Departments in their improvement programmes, especially in advising on sources of best practice or expertise in particular functional areas.

*Recommendation 108: An amended Act or future legislation should, in its provisions for monitoring and enforcement, provide legislative backing to Resilience Standards and the associated validation and assurance regime.

Chapter 10: Accountability

Recommendation 109: An amended Act or future legislation, and associated Regulations, should not only designate those bodies with legal duties but also make clear that the heads of those bodies have personal accountability for the performance of their organisations against those duties and associated standards.

*Recommendation 110: An amended Act or future legislation and associated Regulations should make it clear that Ministers and Accounting Officers of designated Lead Government Departments have personal accountability for the performance of their departments against the duties placed on their departments and associated Standards.

Recommendation 111: The National Security Adviser or a nominated Deputy should be appointed UK Government Chief Resilience Officer. The postholder should have responsibility for the quality and effectiveness of the resilience-building activity across the UK, including that undertaken in central government departments and (subject to respecting the scope of devolved powers) by designated local bodies and Resilience Partnerships. He or she would be directly responsibility for the new multi-agency validation team. The postholder should bring substantial operational experience of working in a front-line role in the resilience field and have credibility across all sectors. The accountability of the postholder and of a designated Cabinet Office Minister for the quality of resilience in the UK should be set out in an amended Act or future legislation.

*Recommendation 112: The valuable role of local democratic engagement, oversight and scrutiny arrangements, and the obligation on bodies designated with duties under the Act or successor legislation to support those arrangements, should be set out clearly in an amended Act or future legislation, Regulations and supporting guidance.

*Recommendation 113: The reports of multi-agency validation reviews of the work of Resilience Partnerships, together with the Action Plan agreed by the Partnership, should be published locally, for the information of the public and for use in local political oversight and scrutiny mechanisms. The obligation on Resilience Partnerships to publish the reports should be captured in an amended Act or future legislation.

*Recommendation 114: The important oversight and scrutiny role of the UK Parliament, and the obligation on the UK Government to support Parliament and its Select Committees in their work, should be set out clearly in an amended Act or future legislation, Regulations and supporting guidance.

Recommendation 115: Lead Government Departments should provide to the relevant Parliamentary Select Committee the Sector Security and Resilience Plans for the sectors which they sponsor, and the reports of validation reviews, together with the Action Plans agreed by the department.

*Recommendation 116: The UK Government should provide an annual Resilience Report to the UK Parliament bringing together the findings of validation and assurance activity carried out during the year at local and national levels, and of any lessons identified reviews carried out in the year; a description of progress on the main risk reduction and emergency preparedness programmes; and a summary analysis of the current state of UK resilience. The obligation to provide the Resilience Report should be captured in an amended Act or future legislation, and associated Regulations.

Recommendation 117: We invite the Comptroller and Auditor General to take account of departmental Sector Security and Resilience Plans, together with the UK Government’s annual Resilience Report to the UK Parliament, to inform decisions about future examinations by the National Audit Office and its scrutiny of resilience-building work in the UK.

Annex A: Independent Review of The Civil Contingencies Act 2004: Terms of Reference

Aim

1. The Aim of the Review of the Civil Contingencies Act 2004 (“the Act”) is:

“To review the implementation and operation of the Civil Contingencies Act 2004, of the civil protection structures it introduced and its associated Regulations, guidance and key supporting enablers; and to make recommendations for improvements.”

Objective

2. The Review intends to draw conclusions in particular on:
   1. Whether the Act, its supporting Regulations, associated Guidance and key supporting arrangements, taken overall, have achieved the original strategic purpose and intent set by the UK Parliament; and, where that is not the case, what further improvements need to be made.
   2. In particular, the effectiveness of collaboration and governance arrangements:
      • In the Local Resilience Forums (LRFs) created as a result of the Act, including whether experience has shown that they should now be placed on a formal legal footing
      • At levels below LRFs
      • At sub-national level in England
      • At national levels in the four UK Nations
   3. How best in future to engage the business sector in all aspects of risk and emergency management, especially planning, exercising, and emergency response and recovery.
   4. Whether, taking account of the future risk picture facing the UK and of experience gained since 2004, there is a need to go beyond the original strategic purpose and intent of the Act and to put in place enhanced arrangements for civil protection in the UK to meet the requirements of the next 15 years, including:
      • New or revised Duties
      • New or adapted collaboration and governance structures
      • New or developed Statutory or non-Statutory Guidance
      • Reinforced arrangements for monitoring, oversight and enforcement
      • Enhanced expectations for relevant skills and training
      • Increased resourcing

Scope

3. The Review will cover:
   1. Part 1 (Local Arrangements for Civil Protection) of the Act
   2. Part 2 (Emergency Powers) of the Act
   3. The supporting Regulations (The Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005, and subsequent amendments)
   4. The associated Statutory Guidance – Emergency Preparedness
   5. The associated non-Statutory Guidance – Emergency Response and Recovery
   6. As relevant, other associated doctrine and guidance used in risk assessment, prevention and preparedness planning, and emergency response and recovery
4. The Review will cover the whole of the It will seek to cover especially:
   1. The different implementation of the provisions of the Act in each of the four UK Nations, focusing in particular on issues that are common across all four Nations, and on areas of good practice in particular Devolved Administrations which might be applied more widely.
   2. Experience in the operation of the provisions set out in supporting Regulations for consultation with the Devolved Administrations
   3. The effectiveness of cross-border co-operation and collaboration in emergency planning and response
5. The Review will cover each of the major components and provisions of the Act and its supporting Regulations and Guidance:
   
   Part 1

• The definition of ‘Emergency’
• The designation of ‘Category 1’ and ‘Category 2’ responders
• The Duties placed on designated responders covering:
  1. Risk Assessment
  2. Emergency Planning
  3. Business Continuity Management
  4. Business Continuity Promotion
  5. Public Awareness
  6. Warning and Informing
  7. Information Sharing
  8. Co-operation
• The formal structures and governance arrangements created by the Act and its supporting Regulations
• Arrangements for performance assessment and development
• Arrangements for monitoring and oversight
• Arrangements for enforcement
  
  Part 2
• Emergency Powers
• Parliamentary Scrutiny
• Parliamentary Approval

6. The Review will cover key enablers to the effective implementation of the Act and of its provisions, including:
   1. The coverage and clarity of roles and responsibilities, as set out in law or otherwise: whether these are comprehensive and effective; and especially whether in light of experience since 2004 there is a need for change.
   2. The definition of relevant skills, competences and occupational standards, and the provision of suitable training, for those in relevant roles and carrying relevant
   3. Resourcing, including arrangements for Parliamentary
7. The Review will, as relevant, cover the efficiency and effectiveness of the interface between the provisions of the Act and those set out in other relevant legislation.
8. The Review will have particular regard to:
   a. The conclusions of past formal Reviews of the Act conducted in 2008-12 and in
   b. Relevant recommendations included in the published Reports of formal Inquiries, and of published formal Lessons Identified reports.
   c. Reports issued by Parliamentary Committees
9. The Review will cover the role of regulatory bodies; and of UK Government departments in the oversight, monitoring and enforcement of the Act and of its provisions.
10. The Review will consider the role of Parliament in the oversight, monitoring and scrutiny of the implementation of the Act; and more broadly the effectiveness of arrangements for risk assessment, prevention and preparedness planning, and emergency response and recovery, including implementation of the recommendations of formal Inquiries and Lessons Identified reports.
11. The Review will consider whether significant policy initiatives that have been developed and implemented in the period since the passage of the Act should be codified in the Act or its supporting Regulations or Statutory Guidance, including:
    1. Activities focused on reducing the likelihood of risk events occurring, drawing on the conclusions of the Pitt Report
    2. Corporate resilience
    3. Community resilience
    4. Arrangements for the care of, and support to, people affected by an emergency
12. The Review will, where relevant, analyse good practice in other countries which might usefully be taken into UK arrangements.

Approach

13. The Review will follow two of the guiding principles of the development of the original Civil Contingencies Bill: it will be demonstrably consultative in its approach, and, as far as possible, consensual in its conclusions.
14. In support of those principles, the Review will be rigorous in assembling, analysing and publishing its evidence base, subject to respecting contributions given on the basis of
15. The Review will be respectful and neutral in its analysis and conclusions, whilst being ambitious for the quality of the civil protection arrangements put in place to protect citizens, the economy, environment and reputation of the UK.
16. The Review recognises that most emergencies are local, and that effective local multi- agency arrangements for risk assessment, preparedness, response and recovery are the foundation of civil protection arrangements in the UK. Gaining the experience, analysis and conclusions of designated ‘Category 1’ and ‘Category 2’ responders in the implementation and operation of the Act and of its provisions is, therefore, a fundamental part of the evidence-base for the Review.
17. Input from the Devolved Administrations, and from UK Government departments, charged with leadership and oversight of civil protection arrangements will also be
18. The Review equally recognises that building effective resilience requires a ‘Whole of Society’ approach. The Review will therefore also seek inputs from a wide range of other organisations, including the business sector; the voluntary and charitable sector; community organisations; academic institutions; and, where relevant, from ‘Think Tanks’ and other organisations which have conducted their own reviews.

Limitations and Constraints

19. The Review is in no way intended to be a COVID-19 lessons identified Inquiry. The Review will consider well-evidenced experience of general applicability drawn from the response to COVID-19 where relevant; but a full lessons identified process must wait for the formal COVID-19 Inquiry announced by the Prime Minister.
20. The Review recognises that other relevant formal Inquiries are being conducted in parallel, including into the Manchester Arena bombing and the fire at Grenfell In those areas, it will draw only on any published Interim Reports from those Inquiries.
21. The Review will in its work inevitably be constrained by any limitations placed by the UK Government or by the Governments of the Devolved Administrations on access to those who might provide oral contributions.

Governance and Execution

22. The Review will be overseen by a Reference Group on behalf of the National Preparedness Commission, whose members will be:

• Stephen Baker, Chief Executive, East Suffolk Council
• John Barradell, Town Clerk and Chief Executive, City of London; Deputy Chair, London Resilience Forum
• Alan Brown, Group Security Director, Tesco
• Ellie Greenwood, Local Government Association
• Simon Lewis, Head of Crisis Response, British Red Cross
• Deputy Chief Constable Paul Netherton, formerly NPCC Lead for Civil Contingencies
• Kathryn Oldham, Chief Resilience Officer, Greater Manchester Combined Authority
• Susan Scholefield, former Director, Civil Contingencies Secretariat, Cabinet Office
• Fiona Twycross, Deputy Mayor of London for Fire and Resilience; Chair London Resilience Forum

Timeframe and Outputs

23. The Review intends to produce one or more Reports in late 2021 (subject to the volume of evidence submitted). If warranted by the scale and volume of the subject matter and evidence base, these may take the form of an interim report followed by one or more final The Commission hopes that these will be used by the UK Government in its future planned reviews of the Act.
24. The Review will take care in the assembly and archiving of its evidence base, against the potential for this to be made available to another organisation for ongoing curation after the Review has concluded.

Annex B: Review Team Members

Bruce Mann, Leader of the Independent Review

Bruce’s early career in the UK civil service covered a wide range of national security policy and operational roles in the Ministry of Defence and Cabinet Office, including as Head of the Nuclear Accident Response Organisation and in the Cabinet Office Secretariat dealing with terrorism and major emergencies. He was appointed in 2004 to be Director of the Civil Contingencies Secretariat in the Cabinet Office, leading work across the public and private sectors to improve the UK’s readiness to respond to major emergencies. In that role, he led the UK Government response to a wide range of domestic emergencies, including animal disease outbreaks, severe flooding and weather events, major industrial accidents, severe disruption to the provision of basic services to citizens and the swine flu pandemic of 2009. After retiring from the Civil Service, Bruce has provided support to a number of countries seeking to develop their risk and emergency management capabilities.

Declaration of Relevant Interests: Senior Associate of the UK Emergency Planning College. Director of Lodestone 1452 Limited, including clients in the UK and overseas seeking advice and support on risk assessment and mitigation; emergency preparedness and response; and national resilience strategies, supporting policy and investment prioritisation frameworks, and resilience metrics and dashboards.

Kathy Settle, Deputy Leader of the Independent Review

Kathy’s career in the UK civil service began as a Chartered Civil Engineer in the Highways Agency and progressed to include Director-level roles in the Cabinet Office, Department for Digital, Culture, Media and Sport and Department for International Trade. She was the Regional Resilience Director for the North West of England from 2004, chairing the NW Regional Resilience Forum and supporting local and regional partners with the implementation of the Civil Contingencies Act. She also facilitated multi-agency exercising and led the regional response to a number of emergencies. She moved to the Civil Contingencies Secretariat in the Cabinet Office in 2008, building stronger capabilities and preparedness across 1,200+ local and regional emergency response bodies. She led the first Quinquennial Review of the Act and the development of National Recovery Guidance and the first Community Resilience Framework. As Response Director (or Deputy) in COBR, she responded to a wide range of emergencies including the 2009 swine flu pandemic, flooding, terrorism, animal diseases and severe weather events. After leaving the Civil Service, Kathy has provided support to a Middle Eastern country in the development of its risk and emergency management capabilities.

Declaration of Relevant Interests: Senior Associate of the UK Emergency Planning College. International Advisor for The Resilience Advisors Network. Director of Aquadulce Ltd.

Andy Towler, Deputy Leader of the Independent Review

Andy has had a 30 year career in policing in both Greater Manchester Police and Cumbria Constabulary rising to the rank of Chief Superintendent. He spent the majority of his career in Uniform Operations and held strategic roles as a Firearms, Public Order, CBRNe and

Hostage Negotiation Commander. He has wide experience in dealing with major incidents and emergencies leading responses in both forces. In 2015 he led the multi-agency response to the Storm Desmond floods in Cumbria and has subsequently advocated for major changes to UK national resilience to deal with complex national emergencies. In 2020 he worked both as a strategic advisor to UK Policing and the UK Government in response to the COVID-19 pandemic. He retired from policing and continues to advocate for change in how the UK manages national security and resilience risks and threats.

Declaration of Relevant Interests: Founder and Managing Director of The Resilience Group Ltd which provides consultancy and support to business and NGO’s both in the UK and globally.

Rob Doran, Independent Review Team Member

Rob has worked in a number of resilience and crisis management related roles in his career. Working in the Civil Contingencies Secretariat in the Cabinet Office, Rob was a founding member of the team that developed the UK’s first policy on community resilience. He led readiness and assurance programmes for the London 2012 Olympic and Paralympic Games as well as developing new strategies to manage high impact hazard risks. Rob went on to work in the Home Office, where he was responsible for Public Order and Civil Contingencies policy. He also developed and delivered assurance programmes for state occasions and major events including NATO and G7 summits and the 2015 Rugby World Cup. Throughout his time in government service, Rob supported a number of UK Government responses to crises including the swine flu pandemic in 2009, the London riots in 2011, the Ebola outbreak in 2014, several flooding incidents, responses to industrial action, terrorist incidents and state occasions.

Since leaving the civil service in 2015, Rob has delivered a wide range of risk and crisis management programmes for clients in the UK Government and public sector organisations, national governments around the world and private sector companies in a range of sectors.

Declaration of Relevant Interests: Associate of the UK Emergency Planning College. Director of Black Dog Crisis Management Ltd – working in the UK and overseas on crisis and emergency management programmes to build confidence and competence of people and organisations to manage emergencies. International Advisor for The Resilience Advisors Network.

Eleanor Parker, Independent Review Team Member

After completing her PhD in climate change science, El taught engineering geology and natural hazards whilst researching and working in international disaster risk reduction, community resilience and post disaster reconstruction. With the arrival of a young family, she travelled less, and alongside being course director for emergency and disaster management programmes at Coventry University she was actively involved in emergency management practice here in the UK. She applied what she had learned internationally to the emerging community resilience agenda here and took an opportunity to support the development of new UK Government guidance for practitioners on community resilience. After a period as Associate Head of Department for Quality Assurance, she took on the challenge of designing and writing the first fully online suite of postgraduate course in Emergency Management and Resilience in the UK. She also designed a NOS compliant Strategic Incident Management training programme for the Environment Agency. El left academia to pursue sector relevant projects including defining the disaster risk financing system for the START Network, the resilience curriculum for Staffordshire’s Civil Contingencies Unit, and most recently as project manager for the Emergency Planning, Response and Resilience Degree Apprenticeship Trailblazer Group.

Declaration of Relevant Interests: Director of El Parker Consulting Limited including public and third sector clients in the UK seeking training and development support and consultancy on risk assessment, preparedness, recovery and resilience. She is also a Resilience Officer for Leicester, Leicestershire and Rutland LRF team.

Andy Holdsworth, Independent Review Team Member

Andy was a civil servant from 2003 to 2011, working in numerous roles. He spent over 2 years in the Cabinet Office’s Civil Contingencies Secretariat preparing for and responding to domestic challenges to the UK. He was part of the UK Government response to a variety of domestic issues and crises, including Swine Flu, Severe Weather and Icelandic Volcano Eyjafjallajokull, as well as being part of numerous UK Government exercises that tested response mechanisms and plans.

Leaving the Civil Service in 2011, Andy went on to work for consultancy and public relations firms, focussing on crisis management, crisis communications and capacity building. He has assisted a wide range of varied clients in the UK and internationally, having worked for clients in the Middle East, Europe, Africa and America in both the preparation for, and response to, emerging issues and crises. Clients have included sovereign wealth funds, retail, entertainment, food, oil & gas, aviation, education, and many others. In 2018, he

founded Holdsworth Consultancy Ltd which provides tailored advice to a wide range of clients on crisis and reputation management, resilience, capacity building, communications and public relations. In addition, he has recently supported the development of a country’s national risk department, leading a team of expats and nationals in the development of the country’s first Seasonal and National Risk Assessments.

Declaration of Relevant Interests: Founder and Director of Holdsworth Consultancy Ltd. Associate of Cratus Communications Limited.

Stephanie Buller, Independent Review Team Member

Steph has a strong academic background. She graduated from Coventry University with a 1st Class with honours in BSc Geography and Natural Hazards in 2014 where her primary areas of research were the impacts of climate change and resilience. Steph then graduated top of her class at University College London and was awarded the IRDR Masters Prize 2016. Here, she undertook her Masters in Disaster Risk Reduction. Her thesis on Neighbourhood Planning as a Tool for Building Community Resilience achieved distinction. She has developed a transdisciplinary research background in community resilience, disaster risk reduction, and emergency planning. Following university, she worked with Aylesbury Vale District Council as Neighbourhood Planning Officer, supporting local communities to develop community led-planning policies. Here she was responsible for co-ordinating and managing all Neighbourhood Planning related duties. She also became involved across the Council as Connected Knowledge Champion, Learning Enabler, Lead Health and Safety Champion and Emergency Planning support. Currently she is working full time with the Thames Valley Local Resilience Forum.

Declaration of Relevant Interests: Stakeholder Engagement and Communications Officer at Thames Valley Local Resilience Forum. Director of Unit Administration Limited, a private business interest in the software and property management sector.

Mike Price, Independent Review Team Member

Mike is a specialist consultant in organisational resilience with over 20 years’ experience supporting local and national entities in the management of risks and emergencies. In his early roles in the UK public sector, including as Head of Resilience at a local government organisation, Mike oversaw the implementation of statutory duties under the Civil Contingencies Act and co-ordinated tactical responses to major incidents, including industrial fires, severe weather and flooding and the Swine Flu Pandemic of 2009. As an independent consultant, Mike has provided strategic advice to numerous high-profile public and private sector clients, including UK Government departments and overseas national government bodies. He has also co-authored national level business continuity management guidance for critical infrastructure operators, a national strategy for strategic stockpiling of critical commodities and a national strategy for disaster risk reduction.

Declaration of Relevant Interests: Managing Director of Resilius Consulting Ltd., supporting clients in the UK and oversees in areas including organisational resilience, operational resilience, business continuity management, corporate security, IT disaster recovery, information security and national risk and emergency management. Former Associate of the Emergency Planning College.

Annex D: Abbreviations and Commonly Used Terms

Abbreviations and commonly used terms in the Report include:

Annex E: References and Resources

References

1 See Annex A for the full Terms of Reference for the Review

2 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence. Page 7

3 We use the term ‘Resilience Partnerships’ to cover the Local Resilience Forums (LRFs) in England and Wales, Regional Resilience Partnerships (RRPs) and Local Resilience Partnerships (LRPs) in Scotland, and Emergency Preparedness Groups (EPGs) in Northern Ireland

4 National Audit Office (2021b). Initial Learning from the government’s response to the COVID-19 pandemic: Cross-government. Report by the Comptroller and Auditor General. Paragraph 46

5 The full set of recommendations is shown in the Summary of Recommendations

6 Of which the major elements would be: sustainable funding for Resilience Partnerships (£12m); improved training and exercising (£7m); Centre of Resilience Excellence (£3m); Cabinet Office, including validation and assurance team (£2m). See the main report for full details

7 UNISDR (2005). Hyogo Framework for Action 2005–2015: Building the Resilience of Nations and Communities to Disasters and United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015-2030. The Sendai Framework sets four ‘Priorities for Action’: understanding disaster risk; strengthening disaster risk governance to manage disaster risk; investing in disaster risk reduction for resilience; and enhancing disaster preparedness for effective response and to “Build Back Better” in recovery, rehabilitation and reconstruction

8 Including taking in the recommendations set out in House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society

9 House of Lords and House of Commons (2003). Draft Civil Contingencies Bill. Joint Committee on the Draft Civil Contingencies Bill.

10 These are listed in the Resourcing of Local Bodies and Resilience Partnerships section

11 There would be consequential increases to the funding provided for resilience-building work to the Devolved Administrations

12 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom

13 The Department for Levelling Up, Housing and Communities (DLUHC)

14 The Department for Digital, Culture, Media and Sport (DCMS)

15 See https://www.gov.uk/government/publications/meeting-notes-for-uk-resilience-forum/uk-resilience- forum-inaugural-meeting-14-july

16 Cabinet Office (2011-12). Revision to Emergency Preparedness [different chapters have different publication dates – see Annex E for full details]

17 HM Government (2013b). Emergency Response and Recovery

18 Cabinet Office (2013c). Responding to Emergencies: The UK Central Government Response. Concept of Operations

19 Including HM Government (2013b). Emergency Response and Recovery and JESIP (2021). Joint Doctrine: The Interoperability Framework. Edition 3

20 Cabinet Office (2013b). Emergency Responder Interoperability: Lexicon of UK civil protection terminology.

Version 2.1.1

21 In using the word ‘competences’, we are referring to knowledge, skills, attitudes and experience

22 Continuous Professional Development

23 Cabinet Office (2022a). New National Security College founded to boost UK and Australian National Security

(press release)

24 Her Majesty’s Inspectorate of Constabulary and Fire and Rescue Services

25 Care Quality Commission

26 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 267

27 Annex B provides details of the members of the Review Team and their experience

28 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence. Page 7

29 A list of References and Resources is at Annex E

30 A list of abbreviations and commonly used terms is at Annex D

31 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence.

32 Ibid.

33 In Scotland, the roles of the Local Resilience Forums (LRFs) in England and Wales are undertaken by Regional Resilience Partnerships (RRPs) and Local Resilience Partnerships (LRPs). The equivalents in Northern Ireland are the Emergency Preparedness Groups (EPGs)

34 See for example https://www.gov.uk/government/news/free-cyber-skills-training-for-thousands-of-school- pupils for what is done for cyber security learning

35  UNDRR (2015n). Sendai Declaration

36  United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015-2030

37  United Nations (2015b). Transforming our world: the 2030 Agenda for Sustainable Development

38  United Nations (2015c). Paris Agreement

39 Cabinet Office (2021a). Global Britain in a competitive age – The Integrated Review of Security, Defence, Development and Foreign Policy

40 HM Government (2022). UK Climate Change Risk Assessment 2022

41 World Economic Forum (2022). The Global Risk Report 2022. 17th edition

42 Ministry of Defence (2018). Global Strategic Trends – The Future Starts Today. Sixth Edition

43 Cabinet Office (2021a). Global Britain in a competitive age – The Integrated Review of Security, Defence, Development and Foreign Policy. Page 31

44 Harris, Lord T. (2021). Strengthening the UK’s National Resilience: The Tasks Ahead. RUSI Commentary (webpage)

45 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Page 4

46 OECD (2011). Future Global Shocks: Improving Risk Governance. Page 21

47 Cabinet Office (2021a). Global Britain in a competitive age – The Integrated Review of Security, Defence, Development and Foreign Policy. Paragraph 5

48 There is in our view a strong case for greater research in this area, given its importance to the effective management of future national risks and emergencies

49 Reform (2020). Building a resilient state: A collection of essays. Page 18

50 Ibid. Page 20

51 Bollyky, T., Hulland, E. et al (2022). Pandemic preparedness and COVID-19: an exploratory analysis of infection and fatality rates, and contextual factors associated with preparedness in 177 countries, from Jan 1, 2020, to Sept 30, 2021

52 Mackenzie, P., with Demos (2021). Build Back Stronger – The Final Report of Renew Normal: The People’s Commission on Life after COVID-19. Page 14

53 Ibid. Pages 20-21

54 Ibid. Page 22

55 Ibid. Page 21

56 Ibid. Page 22

57 Cabinet Office (2021a). Global Britain in a competitive age – The Integrated Review of Security, Defence, Development and Foreign Policy. Page 6

58 Cabinet Office (2021b). The National Resilience Strategy – A Call for Evidence. Page 7

59 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 49

60 “The use of the recovery, rehabilitation and reconstruction phases after a disaster to increase the resilience of nations and communities through integrating disaster risk reduction measures into the restoration of physical infrastructure and societal systems, and into the revitalization of livelihoods, economies and the environment.” United Nations (2016). Report of the open-ended intergovernmental expert working group on indicators and terminology relating to disaster risk reduction

61 Cabinet Office (2011g). Keeping the Country Running: Natural Hazards and Infrastructure. A Guide to improving the resilience of critical infrastructure and essential services. Paragraph 2.11

62 Ibid. Footnote 10

63 Scottish Government (2016). Preparing Scotland: Scottish Guidance on Resilience. Page 3

64 UNDRR (2022). Definition of Resilience (webpage)

65 Cabinet Office (2021b). The National Resilience Strategy – A Call for Evidence. Page 12

66 Ibid.

67 IDNDR (1994). Yokohama Strategy and Plan of Action for a Safer World: Guidelines for Natural Disaster Prevention, Preparedness and Mitigation

68 UNISDR (2005). Hyogo Framework for Action 2005–2015: Building the Resilience of Nations and Communities to Disasters

69 Summarised from Hyogo Framework, Priorities for Action

70 Briceño, S. (2015). Looking Back and Beyond Sendai: 25 Years of International Policy Experience on Disaster Risk Reduction

71 UNDRR (2015). Sendai Declaration

72 United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015–2030

73 Ibid. Summarised from Part III, Guiding Principles

74 Ibid. Part IV, Priorities for Action

75 United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015-2030. Part II: Expected Outcome and Goal. Global targets (a)–(d)

76 Ibid. Part II: Expected Outcome and Goal. Global target (e)

77 Cabinet Office (2018b). Preparation and planning for emergencies: the National Resilience Capabilities Programme

78 Cabinet Office (2012c). Revision to Emergency Preparedness. Chapter 1 : Introduction. Paragraph 1.62

80 Ibid. Extracted from Page 11

81 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(d)

82 Cabinet Office (2012c). Revision to Emergency Preparedness: Chapter 1: Introduction. Paragraph 1.59

83 UK Parliament (2015). The Control of Major Accident Hazards Regulations 2015

84 HM Government (2022). UK Climate Change Risk Assessment 2022. Page 15

85 Given the wide range of risk reduction measures which can be employed, values vary significantly. A World Bank estimate often quoted in reports is that disaster risk reduction saves $4-7 for every $1 invested, although as no calculations or methods were associated with these values the World Bank no longer promotes these numbers. However, the US Geological Survey used credible methods to estimate that $40 billion invested in disaster risk reduction would have reduced disaster losses during the 1990s by $280 billion

86 UNISDR, OECD, European Commission (2013). United Kingdom Peer Review Report 2013 – Building Resilience to Disasters. Implementation of the Hyogo Framework for Action (2005-2015). Page 12

87 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 87

88 This might best be taken forward as a research and data analytics project in collaboration with one or more higher education institutions

89 Including against benchmark countries

90 United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015-2030. Part II: Expected Outcome and Goal. Global targets (a)-(d)

91 INT 109 – Kent LRF members

92 INT 124 – Gordon, R., Bournemouth University

93 INT 096 – London LRF members

94 INT 116 – Ayton-Hill, S., Warwickshire LRF

95 INT 073 – Odin, N., Hampshire and Isle of Wight LRF

96 INT 114 – Haynes, D., Dorset LRF

97 INT 096 – London LRF members

98 INT 106 – Towers, F. and Glot, G., West Yorkshire LRF

99 INT 096 – London LRF members

100 OECD (2011). Future Global Shocks – Improving Risk Governance. Page 14

101 World Economic Forum (2012). Global Risks 2013. Eighth Edition. Pages 36-39

102 Ibid. Figure 23. Page 38

103 World Economic Forum (2022). The Global Risk Report 2022. 17th edition. Chapter 6. Pages 9-11

104 Greater London Authority (2020). London City Resilience Strategy 2020

105 Greater Manchester Resilience Forum (2021). Greater Manchester Resilience Strategy 2020-2030

106 The concept of a ‘Resilient Place’ could in our view be extended to cover the three Devolved Administrations should their Governments wish to undertake that work

107 In line with Target E in the Sendai Framework, in particular its advocacy that “having in place subnational and Local Disaster Risk Reduction strategies or plans that complement the national policy framework has been increasingly recognized over the past two decades as an important requirement of a functioning risk governance system”. UNDRR (2019). Global Assessment Report on Disaster Risk Reduction. Page 318

108 For example, at the 2016 NATO Summit in Warsaw, Heads of State agreed seven baseline requirements for national resilience against which member states can measure their level of preparedness, including: assured continuity of government and critical government services; resilient energy supplies; resilient food and water resources; resilient civil communications systems; and resilient transport systems. North Atlantic Treaty Organization (NATO) (2021). Resilience and Article 3 (webpage)

109 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence. Page 12

110 Department for Environment, Food and Rural Affairs (2018). The National Adaptation Programme and the Third Strategy for Climate Change Adaptation Reporting – Making the country resilient to a changing climate

111 Including infrastructure

112 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom

113 Cabinet Office (2021b). The National Resilience Strategy – A Call for Evidence. Page 12

117 Edwards, C. (2009). Resilient Nation. Demos

118 HM Government (2015). National Security Strategy and Strategic Defence and Security Review 2015: A Secure and Prosperous United Kingdom. Page 43

119 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 88

120 Cabinet Office (2021b). The National Resilience Strategy – A Call for Evidence. Page 14

121 INT 053 – Shepherd, H., National Flood Forum

122 INT 027 – Almeida, R., Victim Support

123 British Red Cross, with Demos (2021). Ready for the Future: Meeting People’s Needs in an Emergency. Page 23; and British Red Cross (2019). People Power in Emergencies. An assessment of voluntary and community sector engagement and human-centred approaches to emergency planning. Pages 2-3

124 See for example British Red Cross (2018). Ready for anything. Putting people at the heart of emergency response

125 “People often won’t leave their house if they can’t take their pet with them. Or if they are separated, leads to a lot of stress – mental health wellbeing issue that is never considered enough. RSPCA ask that everyone thinks about the animal and the animal owner’s welfare – holistic response.”. INT 122 – Minty, T., RSPCA

126 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence

127 Covering assets as well as capabilities

128 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence

129 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(d)

130 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 4,

Regulations 19-26

131 Cabinet Office (2011h). Revision to Emergency Preparedness. Chapter 5: Emergency Planning. Pages 39-41

132 Ibid. Paragraphs 5.3–5.6

133 House of Lords and House of Commons (2003). Draft Civil Contingencies Bill. Joint Committee on the Draft Civil Contingencies Bill. Paragraph 120

134 Ibid.

135 Ibid. Paragraph 125

136 Ibid. Paragraph 126

137 Ibid. Paragraph 129

138 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulation 23

139 Cabinet Office (2011l). Revision to Emergency Preparedness. Chapter 14: The Role of the Voluntary Sector

140 INT 007 – Dunmore, S., Royal Voluntary Service

141 INT 014 – Itani, F., Muslim Charities Forum

142 INT 018 – Reddish, P., Volunteering Matters

143 INT 007 – Dunmore, S., Royal Voluntary Service

144 INT 013 – Langford, A., Cruse Bereavement Care

145 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 159

146 INT 009 – Lampard, B., REACT Disaster Response

147 INT 014 – Itani, F. Muslim Charities Forum

148 Cabinet Office (2011l). Revision to Emergency Preparedness. Chapter 14: The Role of the Voluntary Sector.
Paragraph 14.6

149 Ibid. Paragraphs 14.16 and Annex 14A

150 Figure provided by the VCS Emergencies Partnership (VCSEP)

151 National Emergencies Trust (2022). Annual Report and Accounts 2020-2021. Page 7

152 Ibid.

153 Kruger, D. MP. (2020). Levelling up our communities: proposals for a new social covenant. Page 35

154 Cabinet Office (2011l). Revision to Emergency Preparedness. Chapter 14: The Role of the Voluntary Sector. Paragraph 14.25

155 There would be similar advantages in VCS organisations sharing their relevant training materials with local bodies and Resilience Partnerships

156 Cabinet Office (2011l). Revision to Emergency Preparedness. Chapter 14: The Role of the Voluntary Sector. Paragraphs 14.9-14.15

157 That is, those not designated as Category 2 responders under the Act

158 INT 023 – Robertson, N., Unilever

159 Deloitte and Reform (2021). The State of the State 2021-22 – Towards a new public sector normal. Research evidence – senior civil servant

160 INT 023 – Robertson, N., Unilever

161 Ibid. Page 25

162 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Page 5

163 INT 052 – Crask, J. and Sawers, B.

164 UK Parliament (2004). Civil Contingencies Act 2004. Section 4

165 Cabinet Office (2011l). Revision to Emergency Preparedness. Chapter 14: The Role of the Voluntary Sector

166 Cabinet Office (2011m). Revision to Emergency Preparedness. Chapter 15: Other Sectors that should be involved in Emergency Planning. Paragraph 15.3

167 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 231

168 Deloitte and Reform (2021). The State of the State 2021-22 – Towards a new public sector normal. Page 26

169 Cabinet Office (2019a). Sector Security and Resilience Plans 2018: Summary

170 INT 038 – Aitken, T. and Jones, P.

171 INT 052 – Crask, J. and Sawers, B.

172 Deloitte and Reform (2021). The State of the State 2021-22 – Towards a new public sector normal. Private evidence – business leader

173 INT 004 – Needham-Bennett, Dr C., Needhams 1834 Ltd

174 INT 037 – Freeburn, M. and McEvoy, A., British Telecom (BT)

175 INT 113 – Lee, J., John Lewis & Partners

176 INT 059 – Barker, Dr R., Institute of Directors

177 Ibid.

178 Cabinet Office (2015b). National Business Resilience Planning Assumptions

179 Environmental, Social, Governance (ESG)

180 INT 113 – Lee, J., John Lewis & Partners

181 INT 097 – Hobson, C., East Midlands Chamber of Commerce and Simon, P., Suffolk Chamber of Commerce

182 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 88

183 Cabinet Office (2021b). The National Resilience Strategy: A Call for Evidence. Paragraph 68

184 INT 087 A1 – Nottingham and Nottinghamshire LRF members

185 Cabinet Office (2008b). The National Security Strategy of the United Kingdom – Security in an interdependent world. Paragraph 4.59

186 Pitt, Sir M. (2008). Learning lessons from the 2007 floods: An Independent review by Sir Michael Pitt. Page 355

187 Edwards, C. (2009). Resilient Nation. Demos. Page 10

188 Ibid.

189 Ibid. Page 11

190 Crismart, The Swedish Defence University; Multinational Resilience Policy Group; Bach, R. (2015). Strategies for Supporting Community Resilience: Multinational Experiences. Page 6

191 Cabinet Office (2011f). Strategic National Framework on Community Resilience

192 See for example Department of Homeland Security (2015). National Preparedness Goal. Second Edition. Page 12; and Council of Australian Governments (2011). National Strategy for Disaster Resilience – Building the resilience of our nation to disasters. Page 10

193 National Institute of Science and Technology, USA (2022). Community Resilience Program (webpage)

194 Bundesanstalt Technisches Hilfswerk, Germany (2022). Overview of Bundesanstalt Technisches Hilfswerk

(THW) (webpage)

195 National Emergency Management Agency, New Zealand Government (2022). Get Ready campaign

(webpage)

196 HM Government (2015). National Security Strategy and Strategic Defence and Security Review 2015: A Secure and Prosperous United Kingdom. Paragraph 4.128

197 Ibid. Paragraph 4.132

198 Cabinet Office (2016a). Community resilience: resources and tools

199 HM Government (2018). National Security Capability Review: Including the second annual report on implementation of the National Security Strategy and Strategic Defence and Security Review 2015. National Resilience. Paragraph 2

200 Cabinet Office (2019b). Community Resilience Development Framework

201 Department for Digital, Culture, Media and Sport (2018b). Civil Society Strategy: building a future that works for everyone

202 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society.. Page 5

203 INT 024 – Ahmed, B.

204 INT 053 – Shepherd, H., National Flood Forum

205 INT 048 – Roberts, P., LGBT+ Consortium

206 INT 020 – Beeforth, A., Cumbria Community Foundation

207 Cabinet Office (2011h). Revision to Emergency Preparedness. Chapter 5: Emergency Planning

208 Ibid. Paragraph 5.51

209 Cabinet Office (2012h). Revision to Emergency Preparedness. Chapter 7. Communicating with the Public.
Paragraph 7.7

210 Cabinet Office (2019b). Community Resilience Development Framework. Paragraph 2.2

211 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 87, Paragraph 4

212 National Consortium for Societal Resilience [UK+] (2022). The National Consortium for Societal Resilience [UK+] (webpage)

213 INT 104 – Merseyside LRF members

214 INT 055a – Essex LRF members

215 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs): Version 3.0. Standard #5: Community Resilience Development

216 Department for Digital, Culture, Media and Sport and Wilson, R. (2017). Enabling social action: guidance

217 INT 083 – Camborne, M., Merseyside LRF

218 An example might be New Zealand, which has commonly-agreed and branded materials for local use. National Emergency Management Agency, New Zealand Government (2022). Get Ready campaign (webpage)

219 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

220 INT 102a and b – Norfolk LRF members

221 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

222 Department for Digital, Culture, Media and Sport and Wilson, R. (2017). Enabling social action: guidance. Section C: Leadership and Culture Change. Page 16

223 INT 093 – Ferrier, A., Hampshire and Isle of Wight LRF

224 INT 055a – Essex LRF members

225 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs): Version 3.0. Standard #5: Community Resilience Development

226 Ibid. Desired Outcome Statement

227 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

228 INT 086 – Gladstone, M., South Yorkshire LRF

229 UK Parliament (2004). Civil Contingencies Act 2004. Schedule 1, Parts 1 and 2

230 Ibid. Parts 3, 4 and 5

231 The Office for Nuclear Regulation was added as a Category 2 responder via the Energy Act 2013

232 UK Parliament (2022). Parliamentary Bills. Health and Care Bill: Government Bill (webpage)

233 INT 062a – Suffolk LRF members

234 UK Parliament (2005). The Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulation 4 (7)

235 Ibid. Regulation 4 (6)(a)

236 Cabinet Office (2009c). Civil Contingencies Act Enhancement Programme (CCAEP) Briefing Pack

237 Cabinet Office (2013a). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012: impact assessment. Page 6

238 UK Parliament (2012). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012

239 Cabinet Office (2013a). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012: impact assessment. Page 6

240 Ibid. Page 7

241 Cabinet Office (2017a). Report Of The Post Implementation Review Of The Civil Contingencies Act (2004) (Contingency Planning) Regulations 2005

242 Ibid. Extracted from Table 3. Page 10

243 INT 117 – Police Scotland

244 INT 055a – Essex LRF members

245 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

246 INT 008 – D’Albertanson, B. and Barden, C., UK Power Networks

247 INT 095 – Reed, I., Lincolnshire LRF

248 INT 077 – Gloucestershire LRF members

249 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

250 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

251 INT 062a – Suffolk LRF members

252 INT 081 – Blacksell, C., Humber LRF

253 INT 095 – Reed, I. Lincolnshire LRF

254 INT 121 – OFCOM

255 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

256 INT 047a – North Yorkshire LRF members

257 INT 101 – Bedfordshire LRF members

258 Department for Business, Energy and Industrial Strategy (2021a). Government review into Storm Arwen response launched (press release)

259 Department for Business, Energy and Industrial Strategy (2021b). Independent report: Storm Arwen electricity distribution disruption review. Terms of reference

260 National Infrastructure Commission (2020). Anticipate, React, Recover. Resilient infrastructure systems

261 INT 034 – Moss, R., Thames Water

262 INT 037 – Freeburn, M. and McEvoy, A., British Telecom (BT)

263 INT 047a – North Yorkshire LRF members

264 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

265 INT 115 – Cambridgeshire and Peterborough LRF members

266 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

267 INT 116 – Ayton-Hill, S., Warwickshire LRF

268 INT 105 – Northumbria LRF members

269 INT 110 – Cumbria LRF members

270 INT 105 – Northumbria LRF members

271 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 154

272 INT 115 – Cambridgeshire and Peterborough LRF members

273 INT 034 – Moss, R., Thames Water

274 INT 037 – Freeburn, M. and McEvoy, A., British Telecom (BT)

275 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

276 INT 037 – Freeburn, M. and McEvoy, A., British Telecom (BT)

277 INT 115 – Cambridgeshire and Peterborough LRF members

278 House of Lords and House of Commons (2003). Draft Civil Contingencies Bill. Joint Committee on the Draft Civil Contingencies Bill

279 Ibid. Paragraph 94

280 Ibid. Paragraph 95

281 Ibid. Paragraph 98

282 Ibid. Paragraph 99

283 Ibid. Paragraph 101

284 Ibid. Paragraph 102

285 Cabinet Office (2011a). List of lead government departments’ responsibilities for planning, response, and recovery from emergencies

286 INT 114 – Haynes, D., Dorset LRF

287 INT 109 – Kent LRF members

288 Cabinet Office (2004a). The Lead Government Department and its role – Guidance and Best Practice

289 Animal and Plant Health Agency (2022). Animal and Plant Health Agency. About us (webpage)

290 Food Standards Agency (2022). About the Food Standards Agency and our mission (webpage)

291 Met Office (2022). Met Office. Who we are (webpage)

292 Association of Drainage Authorities (2022). Internal Drainage Boards (webpage)

293 INT 101 – Bedfordshire LRF members

294 Critical National Infrastructure as defined by the Centre for the Protection of National Infrastructure. See https://www.cpni.gov.uk/critical-national-infrastructure-0

295 Schedule 1 of the COMAH Regulations lists the dangerous substances or the categories of dangerous substances which cause the duties to apply and the quantities which set the two thresholds for application – at ‘lower tier’ and ‘upper tier’. Operators of sites holding larger quantities of dangerous substances and notifying as upper tier sites are subject to more requirements than lower tier sites

296 UK Parliament (2015). The Control of Major Accident Hazards Regulations 2015

297 House of Lords and House of Commons (2003). Draft Civil Contingencies Bill. Joint Committee on the Draft Civil Contingencies Bill. Paragraph 131

298 UK Parliament (2019b). The Radiation (Emergency Preparedness and Public Information) Regulations 2019

299 Essar Oil (UK) Limited (2022). UK Oil Pipeline (UKOP) System (webpage)

300 Oil and Pipelines Agency, The (2022). What The Oil and Pipelines Agency does (webpage)

301 Crown Estate, The (2022a). The role of The Crown Estate around the coast (webpage)

302 Crown Estate, The (2022b). The role of The Crown Estate on the seabed and coast (webpage)

303 NHS England and NHS Improvement (2019b). NHS Core Standards for Emergency Preparedness, Resilience and Response

304 For the same reasons, other charitable ambulance services might usefully be considered for designation, especially air ambulance organisations

305 It does not, for example, feature in the report of the Joint Scrutiny Committee on the Bill: House of Lords and House of Commons (2003). Joint Committee on the Draft Civil Contingencies Bill

306 Ministry of Defence (2021). Joint Doctrine Publication 02. UK Operations: The Defence Contribution to Resilience. Fourth Edition. Foreword

307 Ibid. Foreword

308 Ibid. Paragraph 2.2

309 Ibid. Paragraph 2.5

310 Ibid. Paragraph 2.8

311 See for example https://www.spectator.co.uk/article/ben-wallace-takes-aim-at-the-misuse-of-the-military (accessed 14 March 2022)

312 House of Commons (2021c). Defence Committee: Manpower or mindset: Defence’s contribution to the UK’s

pandemic response. Paragraph 21.

313 Ibid. Page 4.

314 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(a)

315 UK Parliament (2005). The Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulation 13

316 Cabinet Office (2012f). Revision to Emergency Preparedness. Chapter 4: Local Responder Risk Assessment Duty

317 Ibid. Paragraph 4.1

318 Cabinet Office (2021a). Global Britain in a competitive age – The Integrated Review of Security, Defence, Development and Foreign Policy. Page 89

319 HM Government (2010b). A Strong Britain in an Age of Uncertainty: The National Security Strategy. Paragraph 3.6

320 Ibid. Paragraph 3.7

321 Ibid. Paragraph 3.10

322 Royal Academy of Engineering (2022). National Security Risk Assessment Methodology Review (webpage). The results of this review will be published in 2022

323 See for example Stock, M. and Wentworth, J. (2019). Evaluating UK natural hazards: the national risk assessment

324 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society.

325 Ibid. Paragraphs 222-225

326 House of Lords (2020). Risk Assessment and Risk Planning Committee. Corrected oral evidence: Risk Assessment and Risk Planning. Wednesday 25 November 2020. 10.30 am. Witness Roger Hargreaves, Director, Civil Contingencies Secretariat. Q2

327 Ibid. Q5

328 Private briefing

329 INT 109 – Kent LRF members

330 INT 104 – Merseyside LRF members

331 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 225

332 INT 055a – Essex LRF members

333 INT 117 – Police Scotland

334 INT 110 – Cumbria LRF members

335 INT 104 – Merseyside LRF members

336 INT 115 – Cambridgeshire and Peterborough LRF

337 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 89

338 INT 047a – North Yorkshire LRF members

339 INT 055a – Essex LRF members

340 INT 065 – Mayhew, G., Devon, Cornwall and Isles of Scilly LRF

341 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

342 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

343 INT 115 – Cambridgeshire and Peterborough LRF members

344 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

345 INT 101 – Bedfordshire LRF members

346 The House of Lords Select Committee on Risk Assessment and Risk Planning received evidence on the same point: see paragraph 131 of their Report Preparing for Extreme Risks: Building a Resilient Society

347 INT 104 – Merseyside LRF members

348 INT 115 – Cambridgeshire and Peterborough LRF

349 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

350 INT 109 – Kent LRF members

351 Ibid.

352 Ibid.

353 INT 047a – North Yorkshire LRF members

354 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

355 INT 055a – Essex LRF members

356 INT 102a and b – Norfolk LRF members

357 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

358 INT 068 – Maritime and Coastguard Agency

359 INT 047a – North Yorkshire LRF members

360 INT 116 – Ayton-Hill, S., Warwickshire LRF

361 INT 102a and b – Norfolk LRF members

362 INT 101 – Bedfordshire LRF members

363 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 135

364 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

365 INT 055a – Essex LRF members

366 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 62

367 Shilson-Thomas, A., Rees, S. and Pickles, C. (2021). Resilient State – A State of preparedness: How government can build resilience to civil emergencies. Reform. Page 5

368 Thomas, A. and Clyne, C. (2021). Responding to shocks: 10 lessons for government. IfG Insight. Institute for Government. Page 3

369 For example, by adopting the process used by UK and US security agencies of classifying individual sections and, if necessary, paragraphs

370 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(d)

371 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 4,

Regulations 19-26

372 Cabinet Office (2011h). Revision to Emergency Preparedness. Chapter 5: Emergency Planning

373 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(c)

374 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 4,

Regulation 19

375 Cabinet Office (2012g). Revision to Emergency Preparedness. Chapter 6 Business Continuity Management

376 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs): Version 3.0.

Standard #9: Business Continuity Management

377 Cabinet Office (2012g). Revision to Emergency Preparedness. Chapter 6 Business Continuity Management

Paragraph 6.6

378 British Standards Institution (2007). Business Continuity Management – Specification BS 25999-2:2007

379 British Standards Institution (2019). ISO 22301:2019 Business Continuity Management

380 INT 004 – Needham-Bennett, Dr C., Needhams 1834 Ltd

381 Business continuity refers to an organisation’s ability to maintain business operations in the face of an unexpected disruption. Organisational Resilience is much broader and more strategic. The International Organization for Standardization (in ISO 22316) defines Organisational Resilience as “the ability of an organization to absorb and adapt in a changing environment” which is the definition we are using. We should note that we are not referring to Operational Resilience as used in the finance sector. The FCA defines

Operational Resilience as “…the ability of firms and FMIs and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions” which has a more operational focus

382 INT 038 – Aitken, T. and Jones, P.

383 INT 109 – Kent LRF members

384 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs). Version 3.0.

Standard #9: Business Continuity Management. Pages 22-23

385 UK Parliament (2004). Civil Contingencies Act 2004. Section 4(1)

386 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 7,

Regulation 38

387 Ibid. Regulation 38

388 Ibid. Regulation 40(2)

389 Cabinet Office (2012i). Revision to Emergency Preparedness. Chapter 8 Business continuity advice and assistance to business and the voluntary sector

390 Ibid. Paragraphs 8.13 and 8.15

391 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs): Version 3.0.

Standard #10: Business Continuity Promotion

392 Ibid. Desired Outcome

393 Ibid.

394 INT 038 – Aitken, T. and Jones, P.

395 INT 103 – Goldstone, M., West and North Yorkshire Chamber of Commerce

396 INT 098 – Fell, D., Doncaster Chamber of Commerce

397 INT 114 – Haynes, D., Dorset LRF

398 INT 095 – Reed, I., Lincolnshire LRF

399 INT 115 – Cambridgeshire and Peterborough LRF members

400 INT 052 – Crask, J. and Sawers, B.

401 INT 109 – Kent LRF members

402 UK Parliament (2004). Civil Contingencies Act 2004. Section 2(1)(f)

403 Ibid. Section 2(1)(g)

404 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulation 29

405 Cabinet Office (2012h). Revision to Emergency Preparedness – Chapter 7: Communicating with the Public

406 Ibid. Paragraph 7.1

407 Ibid. Paragraph 7.37

408 Ibid. Paragraph 7.6

409 Ibid. Paragraph 7.5

410 HM Government (2020). National Risk Register 2020 edition

411 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 247

412 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

413 INT 047b – North Yorkshire LRF members

414 INT 042 – VCS Emergencies Partnership (VCSEP) members

415 INT 005 – Dannatt, General Lord R. and Sharp, M., National Emergencies Trust

416 INT 018 – Reddish, P., Volunteering Matters

417 INT 008 – D’Albertanson B, and Barden, C., UK Power Networks

418 INT 004 – Needham-Bennett, Dr C., Needhams 1834 Ltd

419 INT 037 – Freeburn, M. and McEvoy, A., British Telecom (BT)

420 INT 038 – Aitken, T. and Jones, P.

421 INT 109 – Kent LRF members

422 INT 077 – Gloucestershire LRF

423 INT 095 – Reed, I., Lincolnshire LRF

424 Bollyky, T, Hulland, E. et al (2022). Pandemic preparedness and COVID-19: an exploratory analysis of infection and fatality rates, and contextual factors associated with preparedness in 177 countries, from Jan 1, 2020, to Sept 30, 2021

425 National Cyber Security Centre (2022). Cyber Security Information Sharing Partnership (CiSP) (webpage)

426 National Counter Terrorism Security Office (2022). What the National Counter Terrorism Security Office does (webpage)

427 INT 050 – Butler, M. and Binsley, A., Santander UK

428 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulations 27

and 30

429 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 237

430 INT 038 – Aitken, T. and Jones, P.

431 INT 097 – Hobson, C., East Midlands Chamber of Commerce, and Simon, P., Suffolk Chamber of Commerce

432 INT 113 – Lee, J., John Lewis & Partners

433 INT 032 – Dhonau, M., MDA Property Flood Resilience Consultants

434 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

435 INT 059 – Barker, Dr R., Institute of Directors

436 INT 061 – Holloway, K., Formerly Police and Crime Commissioner for Bedfordshire

437 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs): Version 3.0.

Standard #3: Communicating Risks to the Public

438 INT 130 – Hart, K., BBC

439 INT 084 – UK Health Security Agency

440 United States Government (2022). About the Ready campaign (webpage)

441 Government of Canada (Public Safety Canada) (2022). Get Prepared (webpage)

442 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

443 INT 109 – Kent LRF members

444 INT 077 – Gloucestershire LRF members

445 There have been previous attempts to create a single ‘brand’ for resilience in the UK, the most significant of which has been the Preparing for Emergencies ‘caterpillar’ logo still used by some Resilience Partnerships and other bodies. See Wikipedia (2022): Preparing for Emergencies (webpage)

446 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 248

447 Cabinet Office (2012e). Revision to Emergency Preparedness. Chapter 3: Formal Information Sharing Under the Civil Contingencies Act 2004. Paragraph 3.4

448 Cabinet Office (2009c). Civil Contingencies Act Enhancement Programme (CCAEP) Briefing Pack

449 Cabinet Office (2013a). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012: impact assessment. Page 10

450 Ibid.

451 Cabinet Office (2017a). Report Of The Post Implementation Review Of The Civil Contingencies Act (2004) (Contingency Planning) Regulations 2005. Page 10

452 INT 109 – Kent LRF members

453 Cabinet Office (2012e). Revision to Emergency Preparedness. Chapter 3: Formal Information Sharing Under the Civil Contingencies Act 2004

454 Cabinet Office (2018a). Government Security Classifications. Version 1.1

455 INT 068 – Maritime and Coastguard Agency

456 INT 106 – Towers, F. and Glot, G., West Yorkshire LRF

457 INT 119 – Whittaker, D., Sussex LRF

458 C19 National Foresight Group and Nottingham Trent University (2020a). Covid-19 Pandemic National Interim Operational Review. Recommendation 2.3

459 INT 104 – Merseyside LRF members

460 INT 055a – Essex LRF members

461 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

462 INT 094 – Cleveland LRF members

463 C19 National Foresight Group and Nottingham Trent University (2020a). Covid-19 Pandemic National Interim Operational Review. Recommendation 3.5

464 Ibid. Recommendation 3.7

465 C19 National Foresight Group and Nottingham Trent University (2020c). Covid-19 Pandemic Third Interim Operational Review. Recommendation 1.5

466 INT 008 – D’Albertanson, B. and Barden, C., UK Power Networks

467 INT 034 – Moss, R., Thames Water

468 INT 011 – Oppenheim, G. and Banks, J., London Emergencies Trust

469 Simmons, Dr A. (2022). The Data-sharing Imperative: Lessons from the Pandemic. National Preparedness Commission. Foreword

470 HM Government (2006b). Addressing lessons from the emergency response to the 7 July 2005 London Bombings. What we learned and what we are doing about it. Paragraph 36

471 HM Government (2007). Data Protection and Sharing – Guidance for Emergency Planners and Responders

472 Ibid. Foreword by the Information Commissioner

473 Information Commissioner’s Office (2020). Data Sharing Code of Practice. Came into force in October 2021 following approval by the UK Parliament

474 Simmons, Dr A. (2022). The Data-sharing Imperative: Lessons from the Pandemic. National Preparedness Commission. Page 16

475 Such as would be captured in Schedule 11 to the Data Protection Act 2018

476 INT 129 – Adams, N., Counter Terrorism Policing HQ

477 INT 085 – Sparks, P., National Disaster Victim Identification Unit

478 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

479 INT 109 – Kent LRF members

480 UK Parliament (2004). Civil Contingencies Act 2004. Sections 3, 4, 4A and 5(i)

481 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 8: Information

482 Cabinet Office (2012e). Revision to Emergency Preparedness. Chapter 3: Formal Information Sharing Under the Civil Contingencies Act 2004

483 Simmons, Dr A. (2022). The Data-sharing Imperative: Lessons from the Pandemic. National Preparedness Commission. Page 25

484 UK Parliament (2004). Civil Contingencies Act 2004. Schedule 1

485 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 8, Clause

49(2)

486 Ibid. Part 8, Clauses 45(1)-(3)

487 Cabinet Office (2012e). Revision to Emergency Preparedness. Chapter 3: Formal Information Sharing Under the Civil Contingencies Act 2004. Paragraph 3.26, 3.37, 3.48, 3.71-3.72

488 INT 121 – OFCOM

489 Department for Digital, Culture, Media and Sport (2021). Data – A new direction

490 UK Parliament (2012). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012. Regulation 4 (1)-(3)

491 Ibid. Regulation 4 (4)(b). There are also equivalent Resilience Partnership arrangements set out for the Devolved Administration areas

492 Ibid. Regulation 4 (7)(a)

493 UK Parliament (2012). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012. Regulation 4(4)

494 Scottish Parliament (2005). The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005, Regulation 3(2)(b), as amended by The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Amendment Regulations 2013, Regulation 2(2)(a)

495 Scottish Parliament (2005). The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005, Regulation 3(3), as amended by The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Amendment Regulations 2013, Regulation 2(3)

496 The Executive Office (2021). Building Resilience Together – NI Civil Contingencies Framework

497 Ibid. Paragraph 4.1

498 UK Parliament (2012). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2012. Regulation 4(7)(a)

499 Scottish Parliament (2005). The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005. Regulation 3(4)

500 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Regulation 3. London is now covered by a single LRF as amended in UK Parliament (2011). The Civil Contingencies Act 2004 (Contingency Planning) (Amendment) Regulations 2011

501 Scottish Parliament (2013). The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Amendment Regulations 2013. Regulation 2(2)(a)

502 Cabinet Office (2012d). Revision to Emergency Preparedness. Chapter 2: Co-operation, especially paragraphs

2.39 et seq.

503 Ibid. Paragraph 2.40

504 Ibid. Paragraph 2.45

505 INT 092 – Hanson, T. and Marshall, S., Cleveland LRF

506 Including the introduction of Police and Crime Commissioners, and devolution in England to Mayors and combined authorities

507 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom

508 INT 123 – Savege, J., Scottish Resilience Partnership

509 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 120

510 INT 074 – Mulvihill, S., Avon and Somerset LRF

511 INT 109 – Kent LRF members

512 INT 104 – Merseyside LRF members

513 There would also be significant issues surrounding the ability of a separate body to task Police Forces and other statutory bodies in an emergency

514 INT 090 – Harwin, J., Lincolnshire LRF

515 INT 105 – Northumbria LRF members

516 UK Parliament (2004). Civil Contingencies Act 2004. Section 10(1), as amplified in Cabinet Office (2012k).

Revision to Emergency Preparedness. Chapter 13: Support and Challenge. Paragraphs 13.37-13.40

517 Cabinet Office (2012k). Revision to Emergency Preparedness. Chapter 13: Support and Challenge.

Paragraphs 13.21-13.26

518 Ibid. Paragraph 13.27-13.28

519 Ibid. Paragraph 13.33

520 INT 078 – Avon and Somerset LRF members

521 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 120

522 For example, Cabinet Office (2013d). The role of Local Resilience Forums: A reference document

524 Davies, N., Atkins, G., et al. (2020). How fit were public services for coronavirus? Institute for Government and the Chartered Institute of Public Finance and Accountancy (CIPFA). Page 31

525 INT 114 – Haynes, D. Dorset LRF

526 INT 105 – Northumbria LRF members

527 Currently in Resilience Partnerships this type of post might be known as an LRF Co-ordinator, LRF Secretariat or LRF Partnership or Business Manager

528 We also heard representations that, depending on the current structure of LRF teams, flexibility should be allowed for the functions outlined above to be grouped in different ways to better tie into existing structures. We were sympathetic to those arguments, although we recognise that consistency of post names and duties would aid cross-LRF working and make it easier for people to move between posts

529 There would be consequential increases to the funding provided for resilience-building work to the Devolved Administrations

530 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 130

531 Such a funding contribution could be provided by an equivalent level of ‘in kind’ support

532 INT 062a – Suffolk LRF members

533 INT 078 – Avon and Somerset LRF members

534 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom. Page 136- 140

535 Ibid. Page 136

536 Ibid. Table 2.3

537 INT 047b – North Yorkshire LRF members

538 INT 055a – Essex LRF members

539 INT 062a – Suffolk LRF members

540 INT 084 – UK Health Security Agency

541 INT 111 – Owen-Hughes, S., Surrey LRF

542 Cabinet Office (2013c). Responding To Emergencies – the UK Central Government Response: Concept of Operations. Paragraphs 6.4-6.5

543 See Cabinet Office (2011a). List of lead government departments’ responsibilities for planning, response, and recovery from emergencies, for the risk-based list of Lead Government Departments

544 Cabinet Office (2019a). Sector Security and Resilience Plans 2018: Summary. Page 4

545 Cabinet Office (2012k). Revision to Emergency Preparedness. Chapter 13: Support and Challenge. Paragraph 13.33

546 INT 009 – Lampard, B., REACT Disaster Response

547 INT 026 – Lewis, S., British Red Cross

548 INT 007 – Dunmore, S., Royal Voluntary Service

549 INT 018 – Reddish, P., Volunteering Matters

550 INT 047b – North Yorkshire LRF members

551 INT 071 – Mahoney, J, Wiltshire and Swindon LRF

552 C19 National Foresight Group and Nottingham Trent University (2020a). Covid-19 Pandemic National Interim Operational Review. Recommendation 3.6

553 Thomas, A. and Clyne, C. (2021). Responding to shocks: 10 lessons for government. IfG Insight. Institute for Government. Page 10

554 INT 104 – Merseyside LRF members

555 C19 National Foresight Group and Nottingham Trent University (2020c). Covid-19 Pandemic Third Interim Operational Review. Recommendation 2.4

556 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

557 INT 078 – Avon and Somerset LRF members

558 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

559 INT 102a and b – Norfolk LRF members

560 House of Lords and House of Commons (2003). Draft Civil Contingencies Bill. Joint Committee on the Draft Civil Contingencies Bill

561 Ibid. Paragraph 256

562 Ibid. Paragraph 256

563 Ibid. Paragraph 257

564 Ibid. Paragraph 258

565 Ibid. Paragraph 258

566 Ibid. Paragraph 318

567 Ibid. Paragraph 260

568 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 26

569 Omand, Sir, D. and Raine, S. (2021). How to Unlock the National Security Strategy. RUSI Newsbrief

570 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 265

571 Maddox, B. and Thomas, A. (2021). The answers to Dominic Cummings’s critique – 10 essential reforms to Government. IfG Insight. Institute For Government. Page 4

572 Omand, Sir, D. and Raine, S. (2021). How to Unlock the National Security Strategy. RUSI Newsbrief

573 We seek thereby to address a key recommendation of the House of Lords Select Committee about the need for more formal mechanisms to engage the Devolved Administrations. House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 141

574 Maddox, B. and Thomas, A. (2021). The answers to Dominic Cummings’s critique – 10 essential reforms to Government. IfG Insight. Institute For Government. Page 4

575 Bingham, Dame K. (2021). Romanes Lecture: From Wartime to Peacetime: Lessons from the Vaccine Task Force

576  See https://www.gov.uk/government/publications/meeting-notes-for-uk-resilience-forum/uk-resilience-

forum-inaugural-meeting-14-july (accessed 14 March 2022)

577 Thomas, A. and Clyne, C. (2021). Responding to shocks: 10 lessons for government. IfG Insight. Institute for Government. Page 7

578 Ibid. Page 9

579 INT 102a and b – Norfolk LRF members

580 INT 109 – Kent LRF members

581 Cabinet Office (2011-12). Revision to Emergency Preparedness [different chapters have different publication dates – see Annex E for full details]

582 HM Government (2013b). Emergency Response and Recovery

583 Cabinet Office (2013c). Responding to Emergencies: The UK Central Government Response. Concept of Operations

584 JESIP (2022). What is JESIP? (webpage)

585 INT 099 – Darch, W., Avon and Somerset LRF

586 Cabinet Office (2011a). List of lead government departments’ responsibilities for planning, response, and recovery from emergencies

587 Cabinet Office (2012e). Revision to Emergency Preparedness. Chapter 3: Formal Information Sharing Under the Civil Contingencies Act 2004. Paragraph 3.71-3.72

588 Cabinet Office (2016b). Human Aspects in Emergency Management: Guidance on supporting individuals affected by emergencies

589 Information Commissioner’s Office (2020). Data Sharing Code of Practice

590 Cabinet Office (2016b). Human Aspects in Emergency Management: Guidance on supporting individuals affected by emergencies

591 Ibid. Footnote 10, page 13

592 JESIP (2016a). Joint Doctrine: The Interoperability Framework. Edition 2

593 Ibid. Page 13 embedded link

594 JESIP (2021). Joint Doctrine: The Interoperability Framework. Edition 3

595 Cabinet Office (2013b). Emergency Responder Interoperability: Lexicon of UK civil protection terminology.

596 INT 047a – North Yorkshire LRF members

597 NHS England (2019a). Summary of Published Key Strategic Guidance for Health Emergency Preparedness, Resilience and Response (EPRR)

598 HM Government (2013b). Emergency Response and Recovery. Chapter 7: Meeting the needs of those affected by an emergency

599 As described in NHS England and NHS Improvement (2021). Responding to the needs of people affected by incidents and emergencies. Guidance for planning, delivering and evaluating psychosocial and mental healthcare

600 Including HM Government (2013b). Emergency Response and Recovery and JESIP (2021). Joint Doctrine: The Interoperability Framework. Edition 3

601 INT 047a – North Yorkshire LRF members

602 Pollock, Dr K. (2013). Review of Persistent Lessons Identified Relating to Interoperability from Emergencies and Major Incidents since 1986. Page 18

603 INT 047b – North Yorkshire LRF members

604 INT 102a and b – Norfolk LRF members

605 In using the word ‘competences’, we are referring to knowledge, skills, attitudes and experience

606 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 88

607 This includes emergency plans and business continuity plans

608 UK Parliament (2005). Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005. Part 2: General; Co-operation and Local Resilience Forums – England and Wales. Part 4, Regulation 25

609 Ibid. Part 6, Regulation 31

610 Cabinet Office (2011h). Revision to Emergency Preparedness. Chapter 5: Emergency Planning and Cabinet Office (2012g). Revision to Emergency Preparedness. Chapter 6: Business Continuity Management

611 HM Government (2015). The Control of Major Accident Hazards Regulations 2015. Schedule 2. 2(a)(ii)

612 Kerslake Arena Review Panel (2018). The Kerslake Report: An independent review into the preparedness for, and emergency response to, the Manchester Arena attack on 22nd May 2017. Page 209

613 HM Government (2016a). National Cyber Security Strategy 2016-2021. Section 7.1

614 Department for Digital, Culture, Media and Sport (2018a). Implementing the National Cyber Security Strategy – Developing the cyber security profession in the UK. Government Consultation. Foreword.

615 Department for Digital, Culture, Media and Sport (2022a). Open Consultation: Embedding standards and pathways across the cyber profession by 2025. Executive Summary.

616 Ibid.

617 Ibid.

618 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

619 JESIP (2016b). JESIP Learning Outcomes Framework. Version 1.1

620 Skills for Justice (2015). National Occupational Standards for Civil Contingencies

621 INT 096 – London LRF members

622 INT 087 – Nottingham and Nottinghamshire LRF members

623 INT 092 – Hanson, T. and Marshall, S., Cleveland LRF

624 INT 074 – Mulvihill, S., Avon and Somerset LRF

625 INT 088 – Morgan, B., Staffordshire LRF

626 INT 125 – Parkinson, E., Coventry University

627 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

628 INT 047b – North Yorkshire LRF members

629 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

630 INT 087 – Nottingham and Nottinghamshire LRF members

631 INT 096 – London LRF members

632 INT 110 – Cumbria LRF members

633 INT 102a and b – Norfolk LRF members

634 INT 095 – Reed, I., Lincolnshire LRF

635 INT 104 – Merseyside LRF members

636 INT 109 – Kent LRF members

637 INT 126 – Fire Service College

639 INT 055b – Essex LRF members

640 INT 086 – Gladstone, M., South Yorkshire LRF

641 INT 119 – Whittaker, D., Sussex LRF

642 INT 086 – Gladstone, M., South Yorkshire LRF

643 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

645 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

646 INT 068 – Goldstein, W. and Newey, T., Maritime and Coastguard Agency

647 INT 055b – Essex LRF members

648 INT 096 – London LRF members

649 INT 055b – Essex LRF members

650 Ibid.

651 INT 086 – Gladstone, M., South Yorkshire LRF

652 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

653 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

654 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

655 INT 095 – Reed, I., Lincolnshire LRF

656 INT 102a and b – Norfolk LRF members

657 INT 088 – Morgan, B., Staffordshire LRF

658 INT 094 – Cleveland LRF members

659 The College of Policing, the Fire Service College and the Emergency Planning College

660 INT 071 – Mahoney, J. Wiltshire and Swindon LRF

661 INT 063 – Scovell-Strickland, L. and Davies ,T., Hampshire and Isle of Wight LRF

662 INT 116 – Ayton-Hill, S., Warwickshire LRF

663 INT 078 – Avon and Somerset LRF members

664 INT 087 – Nottingham and Nottinghamshire LRF members

665 INT 092 – Hanson, T. and Marshall, S., Cleveland LRF

666 INT 105 – Northumbria LRF members

667 INT 055b – Essex LRF members

668 INT 047b – North Yorkshire LRF members

669 INT 101 – Bedfordshire LRF members

670 INT 094 – Cleveland LRF members

671 INT 078 – Avon and Somerset LRF members

672 INT 096 – London LRF members

673 INT 055b – Essex LRF members

674 INT 105 – Northumbria LRF members

675 INT 072 – Pape, M., Northamptonshire LRF

676 INT 110 – Cumbria LRF members

677 INT 088 – Morgan, B., Staffordshire LRF

678 The Multi-Agency Gold Incident Command (MAGIC) training course is a 3.5 day course run by the College of Policing and involves multi-agency participants

679 Continuous Professional Development (CPD) can be through training or multi-agency live command of an incident

680 The course approves commanders but does not accredit them

681 The point was put to us by some interviewees that it might be better to have fewer, better trained people on rotas

682 Recommendation 88 proposes that the initial round of individual training should be co-funded by the UK Government with time-limited, one-off funding provided to Resilience Partnerships

683 With feedback provided on any areas of weakness and, ideally, connections made to suitable mentoring support to assist personal development

684 We recommend in the Resourcing of Local Bodies and Resilience Partnerships section that this should be funded by the UK Government as part of the sustainable funding grant to Resilience Partnerships

685 Arrangements should, however, allow for those senior leaders who have recently taken up appointment but not had sufficient time to undertake the necessary training to join Strategic Co-ordinating Groups (SCG) if

686 INT 086 – Gladstone, M., South Yorkshire LRF

687 INT 104 – Merseyside LRF members

688 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

689 INT 081 – Blacksell, C., Humber LRF

690 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

691 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

692 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

693 INT 091 – West Yorkshire LRF members

694 INT 095 – Reed, I., Lincolnshire LRF

695 INT 096 – London LRF members

696 INT 071 – Mahoney, J., Wiltshire and Swindon LRF

697 INT 079 – Errington, S. and Lawton, D., County Durham and Darlington LRF

698 INT 055b – Essex LRF members

699 INT 047b – North Yorkshire LRF members

700 INT 043 – Netherton, P., Formerly National Police lead on Civil Contingencies, Resilience and Risk Management

701 INT 065 – Mayhew, G., Devon, Cornwall and Isles of Scilly LRF

702 INT 102a and b – Norfolk LRF members

703 INT 073 – Odin, N., Hampshire and Isle of Wight LRF

704 INT 065 – Mayhew, G., Devon, Cornwall and Isles of Scilly LRF

705 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

706 INT 074 – Mulvihill, S., Avon and Somerset LRF

707 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Summary

708 Cabinet Office (2022b). Government Skills and Curriculum Unit: About Us (webpage)

709 RUSI (2021). RUSI Conference on National Security Skills and the Integrated Review. Session 1. Pamela Dow, Executive Director, Government Skills and Curriculum Unit

710 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom. Page 132

711 Thomas, A. and Clyne, C. (2021). Responding to shocks: 10 lessons for government. IfG Insight. Institute for Government. Page 4

712 We understand that the Cabinet Office hopes to revert to the practice of running 2-3 major exercises each year. But this would not be sufficient to allow for the assessment of the collective competence of each Lead Government Department

713 INT 105 – Northumbria LRF members

714 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 99

715 Ibid. Paragraph 276

716 Ibid. Paragraph 97

717 The need for this has also been highlighted by others, for example, https://www.civilserviceworld.com/professions/article/former-dfe-perm-sec-blasts-whitehalls-reality- disconnect?s=03 (accessed 14 March 2022)

718 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

719 INT 125 – Parkinson, E., Coventry University

720 United Nations (2015a). Sendai Framework for Disaster Risk Reduction 2015-2030

721 INT 100 – Griffiths, B. and Mashiter, S., University of Wolverhampton

722 INT 120 – Shaw, Professor D., The University of Manchester

723 INT 100 – Griffiths, B. and Mashiter, S., University of Wolverhampton

724 INT 125 – Parkinson, E, Coventry University

725 INT 108 – Hill, Dr R., Nottingham Trent University

726 INT 124 – Gordon, R., Bournemouth University

727 INT 108 – Hill, Dr R., Nottingham Trent University

728 INT 100 – Griffiths, B. and Mashiter, S., University of Wolverhampton

729 Ibid.

730 INT 108 – Hill, Dr R., Nottingham Trent University

731 INT 063 – Scovell-Strickland, L. and Davies, T., Hampshire and Isle of Wight LRF

732 INT 087 – Nottingham and Nottinghamshire LRF members

733 INT 108 – Hill, Dr R., Nottingham Trent University

734 INT 118 – Fordham, Professor M., University College London

735 INT 109 – Kent LRF members

736 INT 124 – Gordon, R., Bournemouth University

737 Ibid.

738 INT 095 – Reed, I., Lincolnshire LRF

739 INT 124 – Gordon, R, Bournemouth University

740 See https://www.gov.uk/government/collections/areas-of-research-interest#departments’-areas-of-

research-interest (accessed 14 March 2022)

741 Potential areas of research interest identified in our interviews included: societal and public expectations of UK resilience arrangements; the potential benefits for the safety and wellbeing of people of the move to needs- based planning, especially by analysing the response to the COVID-19 pandemic against the counter-factual of the benefits that would have been gained had people’s needs been known at the onset; the development of arrangements to gather data against the targets set out in the Sendai Framework, at national and local levels 742 INT 108 – Hill, Dr R., Nottingham Trent University

743 INT 118 – Fordham, Professor M., University College London

744 INT 105 – Northumbria LRF members

745 INT 108 – Hill, Dr R., Nottingham Trent University

746 INT 118 – Fordham, Professor M., University College London

747 INT 108 – Hill, Dr R., Nottingham Trent University

748 INT 094 – Cleveland LRF members

749 INT 125 – Parkinson, E., Coventry University

750 HM Government (2015). National Security Strategy and Strategic Defence and Security Review 2015 – A Secure and Prosperous United Kingdom. Paragraph 7.19

751 Cabinet Office (2021a). Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy. Page 99

752 Andrews, Sir I. (2021). A College for National Security (and Resilience?). National Preparedness Commission

753 Cabinet Office (2022a). New National Security College founded to boost UK and Australian National Security
(press release)

754 Roast, L. (2021). Learning That Can Save Lives. Psychological Perspectives on the Process of Learning Lessons from Major Incidents and Disasters. Disaster Management Centre, Bournemouth University and the National Preparedness Commission

755 National Preparedness Commission (2021). Report on the launch of the Learning That Can Saves Lives report

(webpage)

756 Pollock, Dr K. (2013). Review of Persistent Lessons Identified Relating to Interoperability from Emergencies and Major Incidents since 1986

757 INT 125 – Parkinson, E., Coventry University

758 INT 118 – Fordham, Professor M., University College London

759 C19 National Foresight Group and Nottingham Trent University (2020b). Covid-19 Pandemic Second Interim Operational Review. Recommendation 2.1

760 INT 065 – Mayhew, G., Devon, Cornwall and Isles of Scilly LRF

761 INT 084 – UK Health Security Agency

762 INT 081 – Blacksell, C, Humber LRF

763 UK Parliament (2015). The Control of Major Accident Hazards Regulations 2015

764 UK Parliament (2019b). The Radiation (Emergency Preparedness and Public Information) Regulations 2019

765 NHS England and NHS Improvement (2019b). NHS Core Standards for Emergency Preparedness, Resilience and Response

766 Department for Transport and Maritime and Coastguard Agency (2016). Port Marine Safety Code for all UK Harbour Authorities and other marine facilities, berths and terminals

767 UK Parliament (2019a). The Merchant Shipping (Prevention of Oil Pollution) Regulations 2019

768 Cabinet Office (2013e). Expectations and Indicators of Good Practice Set for Category 1 and 2 Responders

769 Ibid. Paragraph 12

770 Cabinet Office (2013d). The role of Local Resilience Forums: A reference document. Version 2

771 Ibid. Paragraphs 7 and 8

772 HM Government (2015). National Security Strategy and Strategic Defence and Security Review 2015. Paragraph 4.147

773 Cabinet Office (2020a). National Resilience Standards for Local Resilience Forums (LRFs). Version 3.0

774 Ibid. Page 2

775 Ibid.

776 INT 055b – Essex LRF members

777 INT 114 – Haynes, D., Dorset LRF

778 INT 115 – Cambridgeshire and Peterborough LRF members

779 HM Treasury (2020). The Orange Book – Management of Risk: Principles and Concepts. Section A: Governance and Leadership

780 INT 069 – Perritt, G., Devon, Cornwall and the Isles of Scilly LRF

781 Cabinet Office (2004a). The Lead Government Department and its role – Guidance and Best Practice

782 Ibid, especially page 5 and Chapter 7

783 House of Lords and House of Commons (2003). Joint Committee on the Draft Civil Contingencies Bill. Draft Civil Contingencies Bill

784 Ibid. Paragraph 246

785 Ibid. Paragraph 247

786 Ibid. Paragraph 249

787 Ibid. Paragraph 250

788 UK Parliament (2004). Civil Contingencies Act 2004. Section 9

789 Cabinet Office (2012k). Revision to Emergency Preparedness. Chapter 13 – Support and challenge. Box 13.1

790 Ibid. Paragraph 13.9

791 Ibid. Paragraph 13.14

792 Ibid. Paragraph 13.9

793 Ibid. Paragraphs 13.9, 13.12 and 13.14

794 House of Lords and House of Commons (2003). Joint Committee on the Draft Civil Contingencies Bill. Draft Civil Contingencies Bill. Paragraph 246

795 See for example Department of Health (2010). Letter to Chief Executives of all NHS Organisations about the National Capability Survey 2010 and Department of Health (2012). Letter to Emergency Planning Officers and Emergency Planning Liaison Officers about the National Capabilities Survey 2012

796 INT 115 – Cambridgeshire and Peterborough LRF members

797 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 79

798 INT 092 – Hanson, T. and Marshall, S., Cleveland LRF

799 INT 062a – Suffolk LRF members

800 INT 067 – Hamlyn, N., Devon, Cornwall and Isles of Scilly LRF

801 INT 109 – Kent LRF members

802 See https://www.local.gov.uk/our-support/sector-support-offer/what-sector-led-improvement (accessed 14 March 2022)

803 See https://www.local.gov.uk/our-support/council-improvement-and-peer-support/peer-challenge-and-

remote-peer-support (accessed 14 March 2022)

804 INT 112 – Casserly, P., Her Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS)

805 INT 105 – Northumbria LRF members

806 INT 095 – Reed, I., Lincolnshire LRF

807 Validation arrangements in the Devolved Administrations would be the responsibility of those Governments

808 INT 104 – Merseyside LRF members

809 INT 115 – Cambridgeshire and Peterborough LRF members

810 UK Parliament (2004). Civil Contingencies Act 2004. Section 9(1)(a)

811 Cabinet Office (2012k). Revision to Emergency Preparedness. Chapter 13: Support and Challenge.

Paragraphs 13.8 to 13.10

812 Including not only of local authority scrutiny committees, but also Police and Crime Commissioners, introduced over a decade ago, and Mayors of combined authorities

813 Ibid. Paragraph 13.14

814 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society.

815 Ibid. Paragraph 265

816 UK Parliament (2015). The Control of Major Accident Hazards Regulations 2015

817 UK Parliament (2019b). The Radiation (Emergency Preparedness and Public Information) Regulations 2019

818 NHS England and NHS Improvement (2019b). NHS Core Standards for Emergency Preparedness, Resilience and Response Paragraph 4.1

819 INT 055a – Essex LRF members

820 INT 092 – Hanson, T. and Marshall, S., Cleveland LRF

821 INT 114 – Haynes, D., Dorset LRF

822 INT 124 – Gordon, R., Bournemouth University

823 HM Government (2021a). Declaration on Government Reform. Page 7

824 In London, for example, the Deputy Mayor of Fire and Resilience is designated ‘Chief Resilience Officer’.

See Resilient Cities Network (2022). London’s resilience journey (webpage)

825 Rockefeller Foundation, The (2014). What a Chief Resilience Officer Does (blog)

826 We are aware of the recommendation of the House of Lords Select Committee on Risk Assessment and Risk Planning (paragraph 79) that the Government should create the post of Government Chief Risk Officer. Our understanding is that HM Treasury lead on risk management generally across government, including in their sponsorship of the ‘Orange Book’ (HM Treasury (2020). The Orange Book – Management of Risk: Principles and Concepts). The recommendation for a UK Government Chief Resilience Officer is intended to take the spirit of the Select Committee’s recommendation and focus the role specifically on resilience, as part of the wider work on risk management in government

827 INT 116 – Ayton-Hill, S., Warwickshire LRF

828 INT 036 – Desforges, M., NAVCA

829 INT 032 – Dhonau, M., MDA Property Flood Resilience Consultants

830 INT 105 – Northumbria LRF members

831 Department for Levelling Up, Housing and Communities (2022). Levelling Up the United Kingdom. Page 16

832 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 267

833 Cabinet Office (2019a). Sector Security and Resilience Plans 2018: Summary

834 House of Lords (2021). Risk Assessment and Risk Planning Committee: Report: Preparing for Extreme Risks: Building a Resilient Society. Paragraph 267

835 Shilson-Thomas, A., Rees, S. and Pickles, C. (2021). Resilient State – A State of preparedness: How government can build resilience to civil emergencies. Reform. Page 6

836 Ibid.