Auckland concentrates national infrastructure to a degree that few cities of its size do. A large share of New Zealand's imports arrive through one port and one airport, both within a few kilometres of the central city, and the distribution network feeding much of the North Island runs south through a single motorway corridor.
That concentration means an Auckland disruption is rarely an Auckland problem. It becomes a national one, which is why continuity planning here has to consider obligations to customers who are nowhere near the event.
Nathan ISO Consulting implements business continuity management systems for Auckland organisations across financial services, health, logistics and distribution, technology and utilities.
Why ISO 22301 matters for Auckland businesses
Severe weather has moved from contingency to operating assumption. The events of early 2023 demonstrated that disruption here can affect premises, staff homes, suppliers and road access simultaneously across a wide area, and for longer than plans generally assumed. Arrangements built around relocating to an unaffected alternate site were the first to fail.
Financial services supplies the regulatory driver. The Reserve Bank and the Financial Markets Authority set expectations around operational resilience and outsourcing for registered banks, licensed insurers, deposit takers and market participants, and those expectations reach material service providers through contract. Auckland holds most of the technology and administration businesses serving that sector.
The third driver is third party concentration, and it is the one most organisations underestimate. In a market this size, your contingency provider and your competitor's are frequently the same firm, and both may depend on the same cloud region, the same telecommunications carrier or the same freight operator. Continuity planning that does not test that assumption is planning on paper.
Legal, regulatory and contractual drivers in New Zealand
| Driver | Who it captures | What it requires |
|---|---|---|
| Reserve Bank and FMA expectations | Registered banks, licensed insurers, deposit takers and market participants | Operational resilience and outsourcing arrangements, with obligations reaching material service providers |
| Critical infrastructure proposals | Operators of essential services | Government consulted during 2026 on strengthening resilience, including possible legislation. Nothing is in force yet |
| Civil defence emergency management duties | Lifeline utilities | Duties to function during and after an emergency and to participate in regional planning |
| Health and Safety at Work Act 2015 | All PCBUs | Emergency planning and response duties sitting alongside continuity arrangements |
| Health and aged care requirements | Providers delivering health and care services | Service continuity arrangements under sector standards and contracts |
| Contractual continuity requirements | Suppliers to government, financial services and enterprise customers | Evidence of continuity capability, tested recovery objectives and provider oversight |
| Privacy Act 2020 | Agencies handling personal information | Breach assessment and notification that incident and continuity processes must support |
New Zealand has no general business continuity statute. Obligations arrive by sector and, for most Auckland organisations, through customer contracts rather than legislation.
Auckland concentration risks worth planning against
Five exposures recur here often enough to warrant naming in any plan written for this city.
| Exposure | What it looks like in Auckland | Planning implication |
|---|---|---|
| Port and airport concentration | A large share of national import volume through facilities within one city | Model extended facility disruption rather than delayed consignments, and consider national customer obligations |
| Single motorway corridor | Distribution to much of the North Island running through one route south | Plan for extended closure affecting outbound capability, not only inbound supply |
| Regional severe weather | Events affecting premises, staff homes, suppliers and roads together across the region | Assume staff cannot travel and local suppliers are equally affected |
| Shared providers | Your contingency arrangement and your competitor's frequently resting on the same firm | Ask providers about their own concentration before relying on them |
| Cloud and connectivity | National dependency on a small number of regions and cable landings | Exercise scenarios where the provider fails while your own systems are healthy |
Exercising, and why most organisations do it too gently
A plan nobody has rehearsed is a set of assumptions about how people behave when information is incomplete and the phones are busy. Auckland organisations that went through early 2023 generally know this, because the plan that existed and the plan that worked were rarely the same document.
Useful scenarios are narrow rather than catastrophic. A distribution centre inaccessible for nine days with staff unable to reach it. A payments platform unavailable through a month-end cycle with the two people who understand the manual process uncontactable. A freight partner failing while your own operation runs normally. Each teaches something; total collapse teaches only that you would stop trading.
We write the scenario, facilitate the session and record where the plan stalled. The measure is how much remediation work the exercise generates, which is why we design them to be uncomfortable rather than reassuring.
Working with us in Auckland
We run the analysis face to face, since the value emerges from watching managers disagree about which activities genuinely underpin which services. Targets are then set with whoever will be held to them and stress-tested against what your systems, your suppliers and the transport network can realistically achieve on a bad week. Mapping of dependencies comes next, followed by response strategies, the plans themselves, and a command structure written on the assumption that information will be patchy.
Picking the assessor, agreeing the fee and booking the dates fall to us, and in a market this size booking happens early. By the time an assessor walks in, the internal audit is behind you, a real exercise has taken place with its findings written up, and the review sits on record. We are there for both visits.
Yearly exercises, refreshing the analysis, the audit cycle and surveillance preparation all remain on our side. Provider landscapes shift fast in a market this small, with acquisitions and consolidation reshaping who you actually depend on, so a plan that was accurate a year and a half ago often is not.
What gets delivered
Where Auckland ISO 22301 projects go wrong
Who certifies you, and where we fit
| We implement. An accredited body certifies. Nathan ISO Consulting builds and implements management systems. We do not issue certificates, and no legitimate consultancy does. Your certificate comes from an independent certification body accredited by JAS-ANZ, the accreditation authority established jointly by the New Zealand and Australian governments. Accredited bodies operate under impartiality rules that prohibit them from certifying a system they helped build, which is precisely why the two roles are separate. Our job is to get you audit-ready, help you select the right accredited body, and stand alongside you through assessment. |
Choosing the accredited body, agreeing what it costs and fixing when it happens are tasks we absorb, weighed against your scope, your sector and the audit style that suits how you work. We sit through Stage 1 and Stage 2 with your team, and clearing whatever is raised falls to us rather than landing on your desk afterwards. One check worth making yourself: confirm on the JAS-ANZ register that the body holds accreditation for your scope. Unaccredited certificates are cheap and fast, and procurement teams decline them often enough to justify the minute it takes.
FAQ'S
No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.
A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.
Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.
No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.
There is no general statute. Obligations arrive by sector, including Reserve Bank and FMA expectations for financial institutions and civil defence duties for lifeline utilities, and most commonly through contracts imposed by enterprise and government customers.
Not currently. The Government consulted during 2026 on strengthening critical infrastructure resilience, including possible legislation, and submissions have closed. Operators are building capability ahead of any regime rather than waiting for one.
By assuming staff cannot travel, local suppliers are affected and road access is restricted, rather than assuming relocation to an unaffected site. Events here reach premises, homes and supply routes together across a wide area.
Because in a market this size your contingency arrangement and your competitor's are frequently the same firm, often depending on the same cloud region or carrier. Testing that assumption is one of the more valuable outputs of the work.
At least yearly, with extra rounds where activities are critical or the business has shifted. What decides whether an exercise teaches anything is how hard it is, not how often you run one. An easy debrief means the scenario let everyone off.
They can, through contract rather than directly. Where a regulated entity treats your service as material, continuity evidence requirements typically follow at the next renewal with a deadline attached.
They sit together neatly, sharing clause architecture and common ground on technology recovery, so the governance layer gets built a single time. Auckland businesses fielding resilience questions from regulators or clients frequently carry both.
Almost never needed. Existing documents usually describe response reasonably while offering nothing to justify why those priorities were chosen. We preserve what functions, construct the reasoning beneath it, then check the targets hold up.
Around four to six months. Timing is dictated by the analysis stage, which draws on people right across the organisation, and no assessor will proceed before a real exercise has been completed and written up.
We do. Writing the scenario, running the session and producing the findings report are all ours. Teams testing their own plans consistently steer clear of the soft spots, rarely deliberately, which is the argument for bringing someone external in.
Start with what cannot stop
Which activities could not pause for a fortnight without unacceptable consequences, including for customers outside Auckland? Most organisations cannot answer that precisely at the outset, and the analysis phase exists to close that gap.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving