Business Continuity Statement

Charles Russell Speechlys maintains a formal and comprehensive Business Continuity Program to protect the Firm and its clients against disruptions that may affect business operations either in the UK or at its international offices.

The framework designed to ensure resilience and rapid recovery in the event of disruption. Based on the latest internal policy and communications.

Scope and Objectives

• The BCM programme covers any incident that could significantly disrupt operations, including:
  • Building-related issues
  • IT failures
  • Cybersecurity threats
  • Terrorism and other emerging risks.

Governance and Structure

• Managed under a Business Continuity Management System (BCMS) with oversight from senior leadership.
• Uses a Bronze, Silver, Gold command structure for incident response.
• Supported by specialist plans for IT and information security scenarios.
• Regular post-incident reviews and a tracking document for all BC plans.

The Program is comprised of three areas: Incident Management, Business Continuity, and IT Service Continuity.

1. Incident Management: A three-tier structure has been adopted based on the severity of the incident.

• Bronze level: Local/low-level impacts, which are disruptive but not serious for the location. Managed by staff at the affected location.
• Silver level: Serious impact, with significant consequences either locally or across the Firm. Managed by an Incident Management Team (IMT) based in London, in conjunction with local staff.
• Gold level: Severe impact, with potential staff safety/well-being issues; financial loss or reputational damage. Managed by the senior management team based in London with input from Global Partners

2. Business Continuity

• Business Impact and Business Continuity documentation has been created for the Business Services departments based in London:
  • BD, Marketing & Knowledge;
  • Internal Client Services & Facilities;
  • Finance;
  • Human Resources;
  • Information Technology;
  • Advanced Client Solutions;
  • Communications and Corporate Affairs
  • Strategy, Transformation and Project Delivery
• Business Impact and Incident Response documentation has been created for the legal teams based in London and updated regularly.
• Business Impact and Incident Response documentation has been created for all other UK offices and international offices and updated regularly.
• Periodic training and awareness sessions, along with exercises are held for Bronze, Silver and Gold level members.
• General staff awareness training is provided, including fire drills, as appropriate.

3. IT Service Continuity

• Implementation of resilient technology platforms and infrastructure to ensure continuity of service.
• Advanced cyber monitoring to ensure data integrity and confidentiality.
• Annual recovery exercise for core IT components.

Priorities during an incident

Following an incident, the top priority for Charles Russell Speechlys is the safety and well-being of our staff, clients and visitors, who may have been impacted by the event. Charles Russell Speechlys undertakes to take reasonable measures to mitigate the impact of any disruptive event in order to continue business operations and services for our clients. Full operations will be restored at the earliest suitable opportunity.

During an incident Charles Russell Speechlys will endeavour to communicate with impacted clients within a reasonable time period, indicating the nature of the incident, its status (i.e. under investigation; under resolution; resolved) and its impacts.

Key Components

Policy Statement & Response Plans

• Formal Business Continuity Policy reviewed annually.
• Operational and senior management response plans in place.

Communication Protocol

• Commitment to prompt client communication during incidents:
  • Inform clients of the nature, status, and impact of the incident.
  • Provide ongoing updates until resolution.
  • Ensure legal services remain available throughout disruptions.

Recovery Facilities

• Off-site workplace recovery options for building-related issues.
• Supplier continuity assurance for critical vendors.

Testing and Training

• Exercises conducted twice yearly to validate readiness.

Staff regularly trained to execute continuity plans effectively. Incident Management Team (IMT)

• Includes dedicated roles for communications, technical response, and client liaison.
• Monthly meetings and planned incident exercises for preparedness.