Business Continuity Plan

Purpose. Sets out how Meridian will keep serving clients and protect its people and information during and after a disruption such as loss of an office, a cyber incident, a major system outage or the unavailability of key staff.

1.Purpose and scope

This plan applies to both offices and to all Meridian services. It defines the disruption scenarios the firm plans for, the recovery priorities, the roles of the continuity team and the actions to take in the first hours and days. The plan is tested by a tabletop exercise every year.

2.Recovery priorities

Meridian will restore services in the order of their impact on clients and legal obligations. Payroll processing for clients and Meridian, client deadlines with regulators or lenders, and access to client records are restored first. Marketing campaigns and internal projects are restored last.

• Priority 1: payroll, statutory deadlines, client record access (within 24 hours)
• Priority 2: advisory, bookkeeping and project delivery (within 3 business days)
• Priority 3: marketing, events and internal projects (within 10 business days)

3.Continuity team

The General Manager leads the continuity team and decides when to activate the plan. The Quality, Risk and Compliance Manager coordinates the response and keeps the log. Department managers lead recovery in their areas. The Finance and Administration Manager manages premises and suppliers and the Marketing and Communications Manager manages client and public communication.

4.Loss of an office

If an office cannot be used, staff will work from home or from the other office using the firm's cloud systems. The Finance and Administration Manager will arrange alternative meeting space for client meetings and will manage the building owner and insurers. Client meetings scheduled at the affected office will be moved online.

5.Cyber incident or system outage

On a suspected cyber incident, the Quality, Risk and Compliance Manager will engage the managed service provider, isolate affected systems, preserve evidence and assess whether personal information has been compromised under the Privacy and Information Security Policy. Staff must not attempt their own fixes. Manual workarounds for payroll and invoicing are held in the finance folder.

6.Key person unavailability

Every client has a named backup engagement lead recorded in the client relationship system, and every system has at least two administrators. Department managers will maintain handover notes for their critical tasks and will review them quarterly.

7.Communication and review

Staff will be updated through the emergency messaging group and clients through the engagement leads using approved messages. After any activation or test, the continuity team will debrief within two weeks and update the plan and the risk register.