Business Continuity Planning for NZ Businesses

Business continuity planning (BCP) is the process of creating systems and procedures that enable your business to continue operating during and after a disruption. Unlike disaster recovery, which focuses on getting IT systems back up and running, business continuity takes a holistic approach to keeping your entire operation functioning.

A comprehensive business continuity plan identifies potential threats, assesses their impact on your operations, and establishes clear procedures for response and recovery. The goal is to minimise downtime, protect your people, preserve your reputation, and ensure you can serve your customers even in challenging circumstances.

Business Continuity vs Disaster Recovery

While related, these are distinct concepts:

• Business Continuity – Focuses on keeping all business functions running during a crisis, including people, processes, facilities, and technology
• Disaster Recovery – Specifically addresses restoring IT infrastructure and data after a technological or physical disaster

Think of business continuity as the umbrella strategy, with disaster recovery as one of its critical components.

New Zealand's geographic location makes it particularly vulnerable to natural disasters. From the Alpine Fault to cyclones and flooding, the risks are real and present. But natural disasters aren't the only threat – cyber attacks, supply chain disruptions, and public health emergencies can all impact your operations.

The New Zealand Context

• Earthquakes – New Zealand experiences thousands of earthquakes annually. The Alpine Fault has a high probability of a major rupture within the next 50 years, which could severely impact South Island infrastructure.
• Flooding – Low-lying areas in Auckland, Wellington, and Canterbury are prone to flooding. Climate change is increasing the frequency and severity of extreme weather events.
• Volcanic Activity – New Zealand's volcanic zone poses risks to central North Island businesses, with potential ash disruption affecting air travel and operations nationwide.
• Cyber Threats – NZ businesses are increasingly targeted by ransomware and phishing attacks. The 2021 Waikato DHB attack demonstrated how a single incident can disrupt critical services.

The Cost of Inaction

The statistics are sobering:

• 93% of companies that experience significant data loss go out of business within five years
• The average cost of IT downtime is approximately NZD $10,000 per hour for small to medium businesses
• Small businesses are particularly vulnerable – 60% of small businesses that experience a major disaster never reopen

A comprehensive business continuity plan should cover several key areas. Each element works together to ensure your organisation can respond effectively to any disruption.

Building a business continuity plan is a systematic process. Follow these steps to develop a plan that's tailored to your organisation's needs.

Step 1: Get Leadership Buy-in

Successful business continuity planning requires commitment from senior leadership. Secure their support early to ensure adequate resources and organisational priority.

Step 2: Form a Planning Team

Assemble a cross-functional team representing different areas of your business. Include representatives from operations, IT, HR, finance, and communications. Assign clear roles and responsibilities.

Step 3: Conduct a Business Impact Analysis (BIA)

Work with key stakeholders to identify:

• Critical business functions and processes
• Resources each function requires (people, equipment, information)
• Financial and operational impact of downtime
• Maximum Tolerable Downtime (MTD) – how long you can survive without the function
• Recovery Time Objective (RTO) – target time for restoration

Step 4: Identify Risks and Threats

Consider the following threat categories relevant to NZ businesses:

• Natural hazards – Earthquakes, floods, storms, volcanic eruption, tsunami
• Technological – System failures, cyber attacks, data loss, power outages
• Human factors – Staff shortages, industrial action, fraud, terrorism
• External factors – Supply chain disruption, regulatory changes, market conditions

Step 5: Develop Response Strategies

For each critical function, develop strategies to maintain or restore operations. Consider:

• Manual workarounds for technology failures
• Alternative suppliers or contractors
• Remote work capabilities
• Backup data and system recovery procedures
• Temporary relocation options

Step 6: Document Your Plan

Create a comprehensive document that includes:

• Plan objectives and scope
• Emergency contact details
• Incident response procedures
• Recovery procedures for each critical function
• Resource lists (equipment, supplies, alternative locations)
• Communication templates and protocols

Store copies of your plan in multiple locations – both on-site and off-site (including cloud storage). Ensure key personnel have access to the plan at all times.

A business continuity plan is only valuable if it works when needed. Regular testing and updates ensure your plan remains effective and relevant.

Types of Testing

• Tabletop exercises – Walk through scenarios with team members to test decision-making and identify gaps. These are low-cost and can be done quarterly.
• Functional tests – Test specific components like backup restoration or communication systems. Conduct these bi-annually.
• Full simulations – Simulate a complete disaster scenario with all team members participating. Run these annually if possible.

When to Update Your Plan

Review and update your business continuity plan:

• At least annually – even if nothing has changed
• After any significant business change – new locations, services, or systems
• Following a near-miss or actual incident
• When key personnel leave or new staff join
• When new threats emerge or risk assessments change

Continuous Improvement

After each test or real incident, conduct a debrief to identify lessons learned. Document what worked well and what needs improvement. Use this feedback to refine your plan and enhance your organisation's resilience.

Consider engaging with industry groups and government resources like the National Emergency Management Agency (NEMA) to stay informed about emerging threats and best practices specific to New Zealand.