• Section 1 - Purpose
• Section 2 - Scope/Application
• Section 3 - Roles and Responsibilities
• Approval Authority
• Governing Authority
• Responsible Officer
• Other relevant stakeholders
• Section 4 - Categories and Codes
• Events, Incidents and Critical Incidents Assessment Categories
• Incident and Critical Incident Codes
• Section 5 - Responsible Staff
• Incident Convenors
• Incident Response Group
• Critical Incident Convener and Response Group
• Section 6 - Activation and Management
• Event
• Incident
• Critical Incident
• Section 7 - Communication
• Section 8 - Privacy
• Section 9 - Campus and Service Closure
• Section 10 - Post Incident Report
• Section 11 - Business Continuity and Resilience
• Section 12 - Review
• Section 13 - Further Assistance

Section 1 - Purpose

(1) The Critical Incident Management Policy provides guidance for ACU to plan for, respond to and manage Events, Incidents and Critical Incidents from a personnel, hazard identification, and risk management perspective.

(2) It ensures the University meets its legislative and duty of care obligations in providing the highest possible standard of health and safety to its staff, students, contractors, volunteers and visitors.

Section 2 - Scope/Application

(3) The terms ‘Event’, ‘Incident’ and ‘Critical Incident’ are used to define categories and levels of issues or disruptions and their associated response and management. For the purposes of this Policy, the term Critical Incident Management refers to all three levels (Event, Incident and Critical Incident) unless otherwise specified.

(4) This Policy and Critical Incident Management Procedure inform parts of ACU’s Business Resilience Program.

(5) This Policy applies to staff, students, contractors, volunteers and visitors while they are participating in university-related activities, both on and off campus, within Australia or overseas.

(6) No part of this Policy overrides the Code of Conduct for Staff or the Student Conduct Policy.

(7) This Policy applies to ACU and is subject to all applicable laws, regulations and codes.

(8) The Policy and its related procedures demonstrate ACU’s commitment to:

1. identifying, managing and preventing Events, Incidents and Critical Incidents in compliance with ACU’s incident management procedures; ACU Mission, Identity and Values, legal and reporting obligations and Risk Management Model and Principles;
2. evaluating the effectiveness and adequacy of its Critical Incident Management response and processes; and
3. managing its reputation by delivering the highest possible standard of health and safety for staff, students, contractors, volunteers, visitors, the ACU community and the public.

Section 3 - Roles and Responsibilities

Approval Authority

(9) The Vice-Chancellor and President is the Approval Authority for this Policy.

Governing Authority

(10) The Chief Operating Officer, as Governing Authority, will raise awareness of this Policy and Critical Incident Management Procedure to ensure that all staff, students, contractors, volunteers and visitors comply with their requirements.

Responsible Officer

(11) The Deputy Chief Operating Officer and Director, Campus Leadership, as Responsible Officer, is responsible for the establishment, operation and review of the Policy and Critical Incident Management Procedure.

Other relevant stakeholders

(12) The Director, Student Experience, Director, Student Administration and the Chief People Officer will ensure students and staff receive information about this Policy and related procedures as part of their induction or orientation to the University. All staff who support the University’s business continuity and recovery processes are required to familiarise themselves with this Policy and Critical Incident Management Procedure.

Section 4 - Categories and Codes

Events, Incidents and Critical Incidents Assessment Categories

(13) The following criteria apply to the categorisation of Events, Incidents and Critical Incidents. 

Incident and Critical Incident Codes

(14) Due to the broad definition of what comprises a Critical Incident, ACU has adopted the following coding of incidents to increase its response preparedness and effectiveness. (Refer also to the Incident and Critical Incident Codes for a visual code colour representation).

Section 5 - Responsible Staff

Incident Convenors

(15) Incidents are allocated to one of the Incident Convenors based on five categories - Students, Staff, Physical, Virtual, and Reputation.

(16) The Critical Incident Convener and each Incident Convener must nominate one proxy to act as Convener on their behalf.

Incident Response Group

(17) A new Incident Response Group is formed by the Incident Convener for the management of each Incident. Incident Conveners can select and approve any ACU staff for inclusion in an Incident Response Group. Staff are selected based on the Incident type, colour code and campus, to provide expertise and resources to support the Incident Convener during the management of an Incident.

(18) For the purposes of oversight and communication, the Critical Incident Convener and the five Incident Conveners are members of each Incident Response Group.

(19) Representatives from Ask ACU Operations, Service Central and Facilities Management must be kept informed of decisions so that they can prepare for queries and provide a response that is consistent with the organisational message coordinated by the Incident Convenor (Reputation).

(20) The procedures accompanying this policy provide further guidance on organisational staff positions that may inform an Incident Response Group.

Critical Incident Convener and Response Group

(21) The Chief Operating Officer is the Critical Incident Convenor and can declare a Critical Incident at their discretion and activate the Critical Incident Response Group (CIRG) if required.

(22) The CIRG includes the Incident Conveners and other officers of the University who can provide their expertise, resources and support to the Critical Incident Convener while managing a Critical Incident.

Section 6 - Activation and Management

Event

(23) Events (Level 1) are managed by local responsible frontline staff and supervisors including, but not limited to, staff from National Security Centre, campus facilities, fire wardens, first aid officers, Student Accommodation, Campus Ministry, Service Central, Ask ACU Operations, Student Experience.

(24) The Event is either resolved or escalated to an Incident and the National Security Centre is notified.

Incident

(25) Incidents (Level 2) are managed by one of the five Incident Convenors (Students, Staff, Physical, Virtual, Reputation).

(26) The National Security Centre notifies the five Incident Convenors and the Critical Incident Convenor. The Incident is allocated to one of the five Incident Convenors who also determines the Incident Colour Code, campus location and Incident Response Group members.

(27) The Incident is either resolved or escalated to a Critical Incident.

(28) The Critical Incident Management Procedure that accompany this Policy provide further details on the incident management process, refer to the Event, Incident and Critical Incident Response Flowchart for a visual representation of the incident management workflow.

Critical Incident

(29) Critical Incidents (Level 3) are managed by the Critical Incident Convener in conjunction with the Incident Conveners and the CIRG.

(30) The Critical Incident Convenor and the CIRG provide regular updates on the management of, and response to, the Critical Incident to the Vice-Chancellor and President and members of the Vice-Chancellor's Advisory Committee, ACU staff and students, the Chancellor, members of Senate and external regulatory bodies, as required.

(31) Any incident involving the unexpected death of a staff or student on campus, in student accommodation or at off-campus, University-related activities will be immediately classified as Critical and managed by the Critical Incident Convenor or their proxy.

(32) ACU’s Business Continuity and Business Impact Assessment information is utilised in the management of a Critical Incident.

Section 7 - Communication

(33) Incident Convenors should communicate regularly with their Incident Response Group and hold work-in-progress or briefing meetings during the management of an Incident. During these meetings, communications to external or other stakeholders should be discussed and managed.

(34) All communication to staff, students, contractors, volunteers or visitors concerning an Incident or a Critical Incident will be coordinated by the Incident Convenor (Reputation), who is the Chief Marketing Officer, in consultation with the Critical Incident Convenor. Ask ACU Operations, Service Central and Facilities Management are informed so that they can prepare for queries and provide a response to staff and students that is consistent with the organisational message coordinated by the Incident Convenor (Reputation).

(35) Such communication should be sent first and foremost by the Critical Incident Convenor, however, staff designated as ‘Incident Convenor’ or ‘Critical Incident Convenor’, their designated proxies and those additionally listed below, are authorised within the ACU Email Distribution List Policy to send to all Dynamic Distribution Lists for the purposes of communication information regarding a major university disruption.

• Chief Operating Officer (Critical Incident Convenor)
• Deputy Chief Operating Officer and Director, Campus Leadership (Proxy)
• Director, Student Administration (Incident Convenor)
• Associate Director, Student Systems (Proxy)
• Chief People Officer (Incident Convenor)
• Associate Director, HR Business Partnering and Talent Management (Proxy)
• Director, Properties and Facilities (Incident Convenor)
• State Facilities Manager VIC/SA (Proxy)
• Chief Information and Digital Officer (Incident Convenor)
• Associate Director, Client Services
• Chief Marketing Officer (Incident Convenor)
• Associate Director, Communications and Creative Services (Proxy)

Section 8 - Privacy

(36) Incident Convenors should consult the Privacy Officer to ensure that any disclosure of personal information associated with an Incident or Critical Incident is managed in accordance with the Privacy Policy and Privacy Inquiry and Complaints Procedure and Third Party Access to Personal Information Protocol.

(37) Any external and/or third-party requests for personal information or access to ACU property must be directed to the Privacy Coordinator for the purpose of providing advice to the Privacy Officer concerning the release of personal information.

Section 9 - Campus and Service Closure

(38) In the event of an Incident or Critical Incident ACU campuses remain open and staff are to stay at work until advice is received only from the Critical Incident Convenor.

(39) The decision to close a campus is made when it is requested by State or Federal Government authorities, or decided by the Critical Incident Convenor to be necessary in the best interests of the campus, students and staff.

Section 10 - Post Incident Report

(40) A Post Incident Review (PIR) report should be delivered to Incident Convenors and the Critical Incident Convenor at the next Critical Incident Management meeting.

(41) The Post Incident Review (PIR) report should be completed by the Convener who managed the Incident (or a designated member of their response team) and should:

1. assess:
   1. What happened?;
   2. What went well?; and
   3. What can we do differently?
2. be timely, accurate, interactive, objective and constructive, but not personal;
3. exclude, to the extent possible, personal information of staff, students and affected individuals except to the extent that, following the provision of advice from the Privacy Coordinator, the inclusion of personal information is necessary for the completion of the report;
4. consider areas such as:
   1. Crisis Management – plans, structure, notification, escalation and Incident assessment;
   2. Communications – systems, internal, external, timeliness, repetition; and
   3. Response Systems – IT systems, manual systems.
5. be conducted internally, while a review of a critical incident or major University-wide business disruption may be conducted by an independent external person/company.

Section 11 - Business Continuity and Resilience

(42) Business continuity is the management of the priorities, recovery procedures, responsibilities and resources that support the University and each individual business unit in managing recovery from a business disruption.

(43) In the event of a major Incident or Critical Incident, the University can implement business continuity and recovery management measures in addition to the Critical Incident processes identified in this policy and its accompanying procedures.

(44) Business resilience resources include:

1. Business Impact Assessment - identifies key internal systems, responsible staff, required equipment as well as allowable outage and recoverable time frames of all critical business processes across the University.
2. Business Continuity Plan - documents the priorities, procedures, responsibilities and resources that will support the business unit when managing a business disruption. Key inputs include the results of the BIA process, a threat assessment outlining credible disruption scenarios, and agreed response structures and strategies.
3. Business Recovery Plan - documents the priorities, recovery procedures, responsibilities and processes that will support the University in managing recovery from a major critical incident or business disruption. Key inputs include the results of the BIA process, response to Business Continuity Plans, recovery budget management etc.

Section 12 - Review

(45) This Policy and Critical Incident Management Procedure will be regularly reviewed to ensure they:

1. facilitate prompt action when adverse trends are detected or a non-conformity occurs; and
2. continue to be an effective system for managing disruption-related risk.

(46) ACU may conduct scenario exercises to:

1. build familiarisation with staff roles, responsibilities, processes and available tools;
2. identify practical program improvements; and
3. provide a high level of stakeholder assurance in the University’s recovery capability.

Section 13 - Further Assistance

(47) Please contact the Office of the Deputy Chief Operating Officer for any proposed changes or amendments.