• Section 1 - Summary
• Section 2 - Scope
• Section 3 - Policy Statement
• Commitment to Business Resilience 
• Safety and Wellbeing  
• Integrated Resilience Approach 
• Risk-Based Approach 
• Preparedness and Continuity 
• Incident and Crisis Management 
• Roles and Accountability 
• Continuous Improvement 
• Section 4 - Procedures
• Section 5 - TEQSA/ASQA/ESOS Alignment
• Section 6 - Definitions

Section 1 - Summary

(1) This Policy establishes Victoria University's approach to business resilience to ensure the University can prevent, prepare for, respond to and recover from disruptive events while maintaining the safety of people, continuity of critical operations and delivery of the University's strategic objectives. This Policy provides the overarching framework for business continuity, emergency management and crisis management across the University.

Section 2 - Scope

(2) This Policy applies to: 

1. all University operations, activities and services; 
2. all staff, contractors, consultants, office holders and volunteers engaged by the University; 
3. all University-controlled entities and wholly owned subsidiaries; and 
4. all University campuses, locations and operations, including onshore, offshore, transnational education, joint venture and related-party arrangements, where applicable.

Section 3 - Policy Statement

Commitment to Business Resilience 

(3) Victoria University is committed to maintaining an enterprise-wide approach to business resilience that enables the University to effectively manage disruptions and sustain critical operations during adverse events. 

Safety and Wellbeing  

(4) The safety and wellbeing of students, staff, contractors and visitors is the University's highest priority in the management of any emergency, incident, crisis or disruptive event. 

Integrated Resilience Approach 

(5) The University will maintain an integrated framework for business resilience that aligns with the University's risk management, emergency management, crisis management and operational planning arrangements. 

(6) The University's business resilience arrangements will support the lifecycle of: 

1. preventing and mitigating disruption where reasonably practicable; 
2. preparing for disruptive events; 
3. responding to disruptive events in a coordinated and effective manner; and 
4. recovering and restoring operations following disruption. 

Risk-Based Approach 

(7) The University will identify, assess and manage risks that may result in business disruption through its Enterprise Risk Management Framework and associated business resilience processes.  

(8) Business resilience arrangements will be developed, maintained and prioritised according to operational criticality and risk. 

(9) Business resilience arrangements must consider the specific operational, regulatory, geographic, technological and emergency management requirements of locations where the University conducts activities, including offshore and transnational operations. 

Preparedness and Continuity 

(10) The University will consider dependencies on critical suppliers, service providers, partners and other third parties when developing and maintaining business resilience arrangements. 

(11) University portfolios and business units must maintain appropriate business continuity arrangements to support the continuity and recovery of critical functions during and following a disruptive event. 

(12) Business continuity, emergency management and crisis management arrangements must be periodically reviewed, exercised and improved to ensure their ongoing effectiveness. 

Incident and Crisis Management 

(13) The University will maintain documented arrangements for: 

1. emergency management and response; 
2. critical incident and crisis management, including student critical incident response arrangements; 
3. business continuity planning and continuity of critical functions; and 
4. recovery and restoration of university operations following a disruptive event.  

(14) Critical incidents and crises will be managed through designated response arrangements, including appropriately constituted incident or crisis management teams, as detailed in supporting procedures. 

(15) Disruptive events will be managed through appropriate combinations of emergency, incident, crisis management and business continuity arrangements, commensurate with the nature, severity and impact of the event. 

(16) The University will maintain additional resilience, critical incident and emergency management arrangements where required by applicable legislation, regulation, accreditation requirements, contractual obligations or regulatory standards in jurisdictions where the University operates. 

Roles and Accountability 

(17) The Vice-Chancellor is accountable for the effectiveness of the University's business resilience arrangements.  

(18) The Vice-Chancellor's Group provides executive oversight, strategic direction and sponsorship of the University's business resilience arrangements.  

(19) The Office of the Chief Risk Officer is responsible for coordinating, monitoring and reporting on the implementation and continuous improvement of the University's business resilience arrangements.  

(20) Managers are responsible for implementing and maintaining resilience arrangements within their areas of responsibility, including business continuity arrangements, response capability, succession arrangements and key contact information necessary to support effective response and recovery activities. 

(21) All staff are responsible for complying with applicable business resilience, emergency management and crisis management requirements and directions. 

Continuous Improvement 

(22) The University will regularly review, test and continuously improve its business resilience capabilities to strengthen organisational preparedness, responsiveness and recovery.  

(23) Material changes to the University's operations, systems, facilities, organisational structure or service delivery arrangements must consider impacts on business resilience and recoverability.

Section 4 - Procedures

(24) Business Resilience Procedure 

(25) Critical Incident Procedure 

(26) Emergency Management Response Procedure (pending) 

(27) Student Crisis Response Procedure

Section 5 - TEQSA/ASQA/ESOS Alignment

(28) HESF: Standards 2.3 Wellbeing and Safety; 5.3 Monitoring, Review and Improvement; 6.1 Corporate Governance; 6.2 Corporate Monitoring and Accountability; 7.3 Information Management. 

(29) Outcome Standards for NVR Registered Training Organisations 2025: Standards 2.6 Wellbeing; 4.1 - 4.2 Leadership and Accountability, 4.3 Risk Management, 4.4 Continuous Improvement. 

(30) Compliance Standards for NVR Registered Training Organisations and FPP Requirements 2025: Standards 16 Notification of Material Changes; 17 Third Party Arrangements; 20 Compliance with Laws. 

(31) National Code of Practice for Providers of Education and Training to Overseas Students 2018: Standards 6 Overseas Student Support Services; 5 Younger Overseas Students. 

Section 6 - Definitions

(32) Business Continuity: The capability of the University to continue delivering critical services and functions at acceptable levels during and following a disruption, through the use of planned strategies, processes, resources, and recovery arrangements. 

(33) Business Continuity Plan: A documented plan that outlines how critical functions will be maintained and recovered during and following a disruptive event. 

(34) Business Resilience: The capability of the University to anticipate, prepare for, respond to and recover from disruptions while continuing to deliver its critical functions and strategic objectives. 

(35) Critical Function: A function, activity or service that is essential to the University's ongoing operations or ability to meet its obligations. 

(36) Crisis or Critical Incident: An event that has the potential to cause significant harm to people, disrupt critical University operations, impact the University's reputation, or require a coordinated response involving senior leadership and multiple functions. 

(37) Disruptive Event: Any event that adversely impacts or has the potential to adversely impact the University's people, operations, systems, facilities, services or reputation. 

(38) Emergency: An actual or imminent event that poses a risk to life, health, property, the environment or University operations and requires immediate action. 

(39) Recovery: Activities undertaken to restore operations and services following a disruptive event.