Natural disaster preparedness – a step-by-step guide for NZ businesses

New Zealand businesses lagged their trans-Tasman neighbours when it came to their level of preparation for natural disasters and health crises. This was what a 2020 study by the International Data Corporation (IDC) has found, which prompted a business continuity expert to call on industry leaders to do more to help companies prepare better.

Conducted at the height of the pandemic, the IDC survey showed that more than half, or 53%, of Kiwi companies felt that their business continuity plan and disaster recovery framework would need to be revamped for future crises, compared to less than a third, or 29%, of their Aussie counterparts.

In his analysis of the poll results, Frazer Scott, chief executive of Auckland-based business continuity and disaster recovery services provider Plan B, noted that while “[NZ’s] defence model is designed to [help] the public maintain their physical wellbeing in the event of a natural disaster, there is little preventative support offered to businesses.”

He added that small and medium-sized enterprises (SMEs) need to have a greater awareness of the risks they face to enable them to better prepare for disasters and save “millions in lost productivity, prevent job losses, and expedite our economic recovery.”

Read more: Limited pandemic preparedness can't be repeated in the future

 “Our concern is that many of the thousands of small and medium enterprises that make up New Zealand’s economy simply cannot afford the in-house resource to better prepare for natural disasters,” Frazer wrote. “What we have learned from the pandemic is that immediately beyond ensuring our physical safety, we start to look at securing our short-medium term financial needs.

“What we want to see is more support for businesses allowing them to better prepare for disasters by helping them to understand their points of vulnerability and barriers to continuity.”

Scott also pointed out the crucial role technology plays in business continuity, adding that while SMEs often do not suffer the legacy systems that larger companies have and can be more agile in moving to outsourced models or cloud services, they can lack the internal resources to build the capability necessary to prepare for a disaster.

“Our advice is to ensure you have a plan to operate your business securely, without access to your facilities,” he wrote. “Testing this capability quarterly is critical. Many organisations ‘back-up’ their data, but few test it religiously – and it should be something that executive teams and boards test for as part of their business continuity plans.”

Read more: "Every crisis is unique, but there are common elements"

A step-by-step guide to business continuity planning for NZ companies

To help companies better prepare for all types of disruptions, including natural calamities, Business.govt.nz – the New Zealand government's online resource for small businesses – in collaboration with Resilient New Zealand has created a guide detailing how to develop a sound business continuity plan (BCP). Here are the steps organisations need to take, along with insights from industry experts.

Step 1: Identify key products or services

Some of the key questions companies should ask themselves at this stage, according to Business.govt.nz, include:

• What are the biggest risks to your most profitable activity? How can you reduce these risks?
• What is essential to produce or carry out these key activities (e.g. raw materials, a fully functioning website)?
• Can you get by without your full suite of products or services?
• What is your least profitable activity? Are you prepared to pause or stop this until you get back on your feet?

Auckland-based software company Citrix added that preparing for disaster recovery should start with business impact analysis and risk assessment as these steps help companies quantify financial and operational costs that would likely be incurred when calamity strikes.

“It’s best to conduct these evaluations during times of stability, when various stakeholders can devote time to thoroughly assessing how safety, security, compliance, and other key components may be impacted by various events,” the firm noted.

Read more: Kiwis expecting more frequent and extreme flooding amid climate change

Step 2: Identify key internal people

These may include staff, other business partners, and the company’s board. Some key questions to ask during this step are:

• If you have staff, could your business continue without some or all of them on deck?
• Does your business rely heavily on one person for key tasks? What happens if this person is unavailable? What are the main duties of all staff?
• How might you get temporary staff at short notice?
• How can you support staff and their families if they are affected?

Citrix also pointed out the importance of having a clear decision-making hierarchy as part of disaster recovery plans.

“Each member of the disaster recovery plan team has a specific set of responsibilities to carry out should a disaster occur, with backup personnel to ensure all needs will be covered,” the firm explained. “By assigning roles, companies can help prevent confusion and ensure people won’t have to wonder who’s responsible for carrying out various portions of the plan in the event of an actual emergency.”

Step 3: Identify key connections

These may include suppliers, service providers, clients, or regular customers. When identifying key connections, it is best to ask the following questions:

• How robust is your supply chain?
• If your business relies on external suppliers or manufacturers, do you have a backup if something goes wrong?
• If your business uses transport to deliver products or services, what are your alternatives if something goes wrong? Can you rent vehicles? What if the port, airport, road, or rail system is disrupted? Could customers come to you in the short term?
• Who might help you get back on your feet? Do you have good relationships with your bank, landlord or advisors?
• Who can help if you can’t get into your premises or IT systems?

Step 4: Identify essential equipment and supplies

When identifying key assets, Business.govt.nz detailed the following issues that companies should consider:

• If you rely on your own equipment to make products, could you borrow or rent alternative equipment or premises if yours are out of action?
• Could your staff use their home computers for work if business computers are unavailable?

The department recommended that companies find out which employees have suitable devices and that they help pay for internet use.

Regional business magazine APC Insider, meanwhile, added that organisations must determine which assets are indispensable for their operations and these need to be “protected at all costs.”

“One way to make sure you’re planning for the right assets is to identify what you need in order to keep your operations running,” the publication noted. “You can start this process by creating a list of the essential functions your business needs to continue operating and meeting customer demands. Think of these functions as the ‘must-haves’ for your company.”

Read more: EQC looks back at New Zealand's deadliest natural disaster

Step 5: Consider relocation options

Businesses should also prepare for the eventuality that a natural disaster or other crises may force them to move to a new location. Some issues to consider include:

• If you need to vacate your usual premises unexpectedly, how can you keep your business ticking along?
• Could staff work from an alternative site, or from home, if your premises can’t be used? You may want to ask your main suppliers, customers — even competitors — if they could spare room on their premises in an emergency.
• If you need to move, how can you best communicate with your customers about your new location — and from your new location?

Step 6: Consider insurance options

When determining the right coverage that fits their needs, businesses should consider:

• What could go wrong with my business or at work?
• Have I got it covered?
• Is business interruption insurance, which covers against losses after an emergency, a good option?

APAC Insider advised companies to look for coverage that suits the nature of their business.

“If you’re operating a brick-and-mortar establishment, you may want to get property insurance coverage,” the publication noted. “On the other hand, if you run an online business, you may want to get business interruption insurance coverage instead.

“Moreover, you should consider your location. If you’re in an area where hurricanes are not an extreme rarity, you should buy appropriate insurance.”

Step 7: Identify who can run the business in your absence

If an organisation’s leaders become out of commission due to a disaster, someone needs to take over. It is important for businesses to find the answers to the following questions:

• If something takes you or another important team member away from the business, who can take over important tasks?
• If there’s a major disruption, what is each staff member’s role in getting the business back on its feet?

Read more: New Zealand's costliest natural disasters in the past decade

Step 8: Keep contact details handy

This list may include staff, emergency services, clients, and suppliers. Businesses may also include their insurance details, security company, and neighbouring businesses. Key questions to ask are:

• Do you have emergency contact details handy?
• When were contact details last updated — is it time to check for any changes?

Step 9: Back-up important data

A natural disaster can wipe out a business’s entire data and this could prove fatal to its operations. When creating a plan to back-up critical company information, Business.govt.nz advised organisations to consider these questions:

• What data — customer details, emails, files, and spreadsheets — are critical to your business?
• What sensitive data — personnel files, bank details, tax documents — do you need to keep safe?
• Do you regularly back up data on a hard drive, server or in the cloud?

“Creating backups of your data is a crucial step that every business should take,” APAC Insider explained. “These days, backup solutions can be inexpensive and automated, which makes it even easier to do. The most critical data for you to back up are your financial records, company data, and customer data. You don’t want to lose any of this information.”

Step 10: Put the plan into practice

A business continuity plan needs to be tried and tested with relevant staff at least once a year, Business.govt.nz advises, adding that doing so doesn’t need to be expensive or time-consuming.

“Run 20-minute stress test exercises where you give staff a scenario to plan for,” the department suggested. “Rather than fixating on the cause of the disruption – a natural disaster or power cut, focus on how to manage the consequences.”

Some key questions to answer include:

• What will they do if an important machine isn’t working?
• What options do they have if the premises are closed for a week or longer?

The agency added that as “no two crises are the same” a business continuity plan will change as the business evolves, so it is critical for companies to debrief staff after each test and update the plan if necessary. The plan should also be easily accessible as employees need to know what to do even if the organisation’s leaders are not available.