HR Succession Planning Policy

1. Purpose

Losing a person who holds unique knowledge, authority or access can stop a service or open a security gap as surely as a technical failure. This policy makes sure that for every critical role the Organisation knows who could step in, what that person must be able to do, and how the duties, knowledge and access pass over safely, whether the change is planned, such as a retirement, or sudden, such as illness or resignation.

It supports continuity of the information security management system, the competence requirements of its roles, and the key-person risk recorded in the risk register.

2. Scope

• In scope: roles designated critical under this policy, including top management, heads of function, the Head of IT Security, data protection lead, system owners for critical systems, privileged administrators, key account and delivery leads, and holders of unique technical or regulatory knowledge.
• In scope: planned departures (retirement, transfer, promotion, end of contract) and unplanned ones (resignation, illness, death, dismissal, long absence).
• In scope: employees and long-term contractors who hold critical roles.
• Out of scope: general workforce planning, recruitment budgeting and career development, covered in the HR manual, except where they feed successor readiness.

3. Terms and definitions

4. Roles and Responsibilities

5. Policy Statements

5.1 Identifying critical roles

• Each year, [in the first quarter], line managers assess each role in their area against the criteria below. Any role that scores [7 or more] out of 12 is designated critical and entered in the register.
• The assessment is also done when an organisation change, new service or new risk alters how much depends on a role.

5.2 Naming successors and emergency cover

• Every critical role has at least [one ready-now or emergency-cover successor] and at least [one ready-later successor] named in the register.
• No individual is named as the sole successor for more than [two] critical roles, so that one departure does not create several gaps.
• Successors are chosen on competence, integrity and the screening level the role needs under the HR Security Policy. The decision is fair, documented and free from conflict of interest.
• Naming a successor does not guarantee promotion. Staff are told of their inclusion in a way that avoids creating expectations.

5.3 Development and knowledge transfer

• Each successor has a development plan with training, shadowing, delegated tasks and periodic review, so readiness moves from later to now.
• Incumbents keep current process documents, runbooks, contact lists and decision records for their role in the document management system, and review them [every 6 months].
• Rotation, deputising and joint working are used so that no single person alone knows how a critical activity is done.
• Individuals do not hold private copies of operational knowledge. Anything essential is in an approved shared location, classified under the Information Classification and Handling Policy.

5.4 Access and authority continuity

• Delegated authority, signing powers and approval rights have a named alternate, recorded in the approval authority table, so decisions do not wait for one person.
• Privileged credentials and keys are held in a password vault with a named backup holder, never only in one person's memory or device.
• Successors receive access only when they take on the duties, either as cover or permanently, by request under the Access Control Policy. Access is not granted in advance just because someone is named.
• When duties pass over, the outgoing person's access is removed on the same day unless a short overlap is approved with an end date.

5.5 Planned succession and handover

For a planned departure the line manager starts the handover as soon as notice or the plan is known. The timeline below sets the minimum.

1. Notice and planThe line manager and HR confirm the last day, the successor and the handover plan within [5 working days] of notice.
2. Handover packThe incumbent compiles the pack: duties, processes, systems and access list, contacts, open issues, pending decisions and secrets held in the vault. Target: complete [10 working days] before the last day.
3. OverlapThe successor shadows the incumbent and then performs tasks under supervision for the overlap period of [4 weeks] where possible.
4. Access transferThe service desk grants the successor's access and removes the incumbent's on the agreed day, per the Access Control Policy.
5. Sign-offThe line manager confirms the successor can perform the role and records the sign-off in the register. HR completes the exit steps in the HR Security Policy.

5.6 Unplanned and emergency succession

• When a critical role is vacated without notice, the line manager activates the named emergency cover on the same working day and informs HR and the Head of IT Security.
• The cover receives only the access needed, recorded as temporary access with an end date of at most [30 days], extendable by HR approval.
• A permanent decision is made within [30 days]: appoint the ready-now successor, recruit, or restructure.
• Lessons from every sudden loss are recorded and used to update plans.

5.7 Information security aspects

• Key-person dependency is entered in the risk register and treated under the Risk Management Policy, with the owner reviewing each critical role's risk rating at least [every 6 months].
• Business continuity plans identify role-based dependencies and name alternates, as required by the Information Security Aspects of Business Continuity Policy.
• Succession information is Confidential and restricted to HR, the Head of IT Security and top management, because it reveals vulnerabilities and affects individuals.
• Succession plans use only data needed, kept under the Organisation's data protection duties under the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement].

5.8 Fairness and diversity

Succession planning is open to everyone who meets the criteria, uses objective measures, and avoids discrimination on any ground protected by law. Succession decisions can be explained and challenged through the HR grievance process.

6. Succession Readiness Reporting

HR presents a succession summary to top management [every 6 months].

7. Compliance and monitoring

The Head of HR checks the register against the organisation chart and the risk register [every 6 months]. Internal audit samples succession files and handovers at least [once a year] and reports gaps. Any critical role without a named successor for more than [60 days] is escalated to top management.

8. Records and evidence

• Register of critical roles, successors and readiness: kept current, with history for [5 years].
• Handover packs and sign-offs: [3 years] after the handover.
• Development plans and review notes: employment plus [3 years].
• Criteria assessments and reports to top management: [5 years].

Annexure A: Succession register entry

9. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

10. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

11. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• HR Security Policy
• Risk Management Policy
• Information Security Aspects of Business Continuity Policy
• Access Control Policy
• Documents and Records Management Procedure