New Zealand businesses lagged their trans-Tasman neighbours when it came to their level of preparation for natural disasters and health crises. This was what a 2020 study by the International Data Corporation (IDC) has found, which prompted a business continuity expert to call on industry leaders to do more to help companies prepare better.
Conducted at the height of the pandemic, the IDC survey showed that more than half, or 53%, of Kiwi companies felt that their business continuity plan and disaster recovery framework would need to be revamped for future crises, compared to less than a third, or 29%, of their Aussie counterparts.
In his analysis of the poll results, Frazer Scott, chief executive of Auckland-based business continuity and disaster recovery services provider Plan B, noted that while “[NZ’s] defence model is designed to [help] the public maintain their physical wellbeing in the event of a natural disaster, there is little preventative support offered to businesses.”
He added that small and medium-sized enterprises (SMEs) need to have a greater awareness of the risks they face to enable them to better prepare for disasters and save “millions in lost productivity, prevent job losses, and expedite our economic recovery.”
Read more: Limited pandemic preparedness can't be repeated in the future
“Our concern is that many of the thousands of small and medium enterprises that make up New Zealand’s economy simply cannot afford the in-house resource to better prepare for natural disasters,” Frazer wrote. “What we have learned from the pandemic is that immediately beyond ensuring our physical safety, we start to look at securing our short-medium term financial needs.
“What we want to see is more support for businesses allowing them to better prepare for disasters by helping them to understand their points of vulnerability and barriers to continuity.”
Scott also pointed out the crucial role technology plays in business continuity, adding that while SMEs often do not suffer the legacy systems that larger companies have and can be more agile in moving to outsourced models or cloud services, they can lack the internal resources to build the capability necessary to prepare for a disaster.
“Our advice is to ensure you have a plan to operate your business securely, without access to your facilities,” he wrote. “Testing this capability quarterly is critical. Many organisations ‘back-up’ their data, but few test it religiously – and it should be something that executive teams and boards test for as part of their business continuity plans.”
Read more: "Every crisis is unique, but there are common elements"
A step-by-step guide to business continuity planning for NZ companies
To help companies better prepare for all types of disruptions, including natural calamities, Business.govt.nz – the New Zealand government's online resource for small businesses – in collaboration with Resilient New Zealand has created a guide detailing how to develop a sound business continuity plan (BCP). Here are the steps organisations need to take, along with insights from industry experts.
Step 1: Identify key products or services
Some of the key questions companies should ask themselves at this stage, according to Business.govt.nz, include:
Auckland-based software company Citrix added that preparing for disaster recovery should start with business impact analysis and risk assessment as these steps help companies quantify financial and operational costs that would likely be incurred when calamity strikes.
“It’s best to conduct these evaluations during times of stability, when various stakeholders can devote time to thoroughly assessing how safety, security, compliance, and other key components may be impacted by various events,” the firm noted.
Read more: Kiwis expecting more frequent and extreme flooding amid climate change
Step 2: Identify key internal people
These may include staff, other business partners, and the company’s board. Some key questions to ask during this step are:
Citrix also pointed out the importance of having a clear decision-making hierarchy as part of disaster recovery plans.
“Each member of the disaster recovery plan team has a specific set of responsibilities to carry out should a disaster occur, with backup personnel to ensure all needs will be covered,” the firm explained. “By assigning roles, companies can help prevent confusion and ensure people won’t have to wonder who’s responsible for carrying out various portions of the plan in the event of an actual emergency.”
Step 3: Identify key connections
These may include suppliers, service providers, clients, or regular customers. When identifying key connections, it is best to ask the following questions:
Step 4: Identify essential equipment and supplies
When identifying key assets, Business.govt.nz detailed the following issues that companies should consider:
The department recommended that companies find out which employees have suitable devices and that they help pay for internet use.
Regional business magazine APC Insider, meanwhile, added that organisations must determine which assets are indispensable for their operations and these need to be “protected at all costs.”
“One way to make sure you’re planning for the right assets is to identify what you need in order to keep your operations running,” the publication noted. “You can start this process by creating a list of the essential functions your business needs to continue operating and meeting customer demands. Think of these functions as the ‘must-haves’ for your company.”
Read more: EQC looks back at New Zealand's deadliest natural disaster
Step 5: Consider relocation options
Businesses should also prepare for the eventuality that a natural disaster or other crises may force them to move to a new location. Some issues to consider include:
Step 6: Consider insurance options
When determining the right coverage that fits their needs, businesses should consider:
APAC Insider advised companies to look for coverage that suits the nature of their business.
“If you’re operating a brick-and-mortar establishment, you may want to get property insurance coverage,” the publication noted. “On the other hand, if you run an online business, you may want to get business interruption insurance coverage instead.
“Moreover, you should consider your location. If you’re in an area where hurricanes are not an extreme rarity, you should buy appropriate insurance.”
Step 7: Identify who can run the business in your absence
If an organisation’s leaders become out of commission due to a disaster, someone needs to take over. It is important for businesses to find the answers to the following questions:
Read more: New Zealand's costliest natural disasters in the past decade
Step 8: Keep contact details handy
This list may include staff, emergency services, clients, and suppliers. Businesses may also include their insurance details, security company, and neighbouring businesses. Key questions to ask are:
Step 9: Back-up important data
A natural disaster can wipe out a business’s entire data and this could prove fatal to its operations. When creating a plan to back-up critical company information, Business.govt.nz advised organisations to consider these questions:
“Creating backups of your data is a crucial step that every business should take,” APAC Insider explained. “These days, backup solutions can be inexpensive and automated, which makes it even easier to do. The most critical data for you to back up are your financial records, company data, and customer data. You don’t want to lose any of this information.”
Step 10: Put the plan into practice
A business continuity plan needs to be tried and tested with relevant staff at least once a year, Business.govt.nz advises, adding that doing so doesn’t need to be expensive or time-consuming.
“Run 20-minute stress test exercises where you give staff a scenario to plan for,” the department suggested. “Rather than fixating on the cause of the disruption – a natural disaster or power cut, focus on how to manage the consequences.”
Some key questions to answer include:
The agency added that as “no two crises are the same” a business continuity plan will change as the business evolves, so it is critical for companies to debrief staff after each test and update the plan if necessary. The plan should also be easily accessible as employees need to know what to do even if the organisation’s leaders are not available.
Insurance Business NZ
