Queensland businesses do not need disruption explained to them. Most Brisbane organisations of any age have operated through a flood, and businesses north of the capital plan around cyclone season as an ordinary feature of the operating year rather than as a contingency.
What varies enormously is whether that experience produced a system or produced a story. Organisations that rebuilt after an event frequently have detailed knowledge of what failed, held informally by whoever was there, and no structure that would transfer it to anyone who was not.
Our Queensland continuity work concentrates in financial services, health providers, utilities, freight and logistics operators, and the services businesses supporting the resources sector.
Looking for an ISO 22301 Consultant in Brisbane?
Why ISO 22301 Matters for Brisbane Businesses
Queensland’s exposure is distinctive in one respect that generic continuity material misses: disruption here is frequently regional rather than site-specific. A flood or cyclone does not take out your premises while leaving your suppliers, your staff and the road network intact. It takes out all of them at once, across an area, for a period measured in weeks rather than days.
That changes plan design fundamentally. Arrangements assuming staff can reach an alternate location, or that a supplier fifty kilometres away is unaffected, are assuming away the actual problem. Recovery objectives have to reflect access and isolation rather than only systems restoration.
Alongside that sits the regulatory layer. Prudential obligations reach financial services entities and, through contract, the administrators and technology suppliers serving them. Critical infrastructure duties apply to port, energy, water, health and data operators across the state. Both expect capability that has been tested, not documented.
Legal, Prudential and Contractual Drivers in Queensland
| Driver | Who It Captures | What It Requires |
|---|---|---|
| APRA CPS 230 | Financial entities and their material service providers | Critical operations identified, tolerance levels set, credible plans, systematic testing and provider oversight |
| Security of Critical Infrastructure Act 2018 | Declared Queensland assets spanning port, electricity, water, health and data facilities | A programme covering every hazard category able to interrupt the asset, not cyber alone |
| Disaster Management Act 2003 (Qld) | Local and district disaster management arrangements, with implications for participating entities | Coordination arrangements that private operators frequently interface with during events |
| Work Health and Safety Act 2011 (Qld) | All Queensland businesses | Emergency planning and response duties sitting alongside continuity arrangements |
| Queensland health sector requirements | Hospital and health services, aged care and private providers | Service continuity and emergency arrangements under sector obligations |
| Contractual continuity requirements | Suppliers to government, resources operators and enterprise customers | Evidence of continuity capability, tested recovery objectives and provider oversight |
| Privacy Act 1988 and the NDB scheme | Organisations within the federal privacy regime | Breach evaluation and reporting duties which your incident and continuity processes have to be capable of supporting |
Prudential standards impose obligations the standard does not cover, particularly around service provider registers and regulator notification. We build so one evidence set answers each audience.
Queensland Disruption Patterns Worth Planning Against
Five exposures recur often enough here to warrant explicit treatment in any plan written for this state.
| Exposure | What It Looks Like in Queensland | Planning Implication |
|---|---|---|
| Regional inundation | Flooding affecting premises, staff homes, suppliers and road access simultaneously across a catchment | Assume staff cannot travel and local suppliers are equally affected, rather than planning around premises alone |
| Cyclone season | An annual window with forecast lead time but uncertain landfall and extended post-event isolation | Build activation triggers ahead of the season rather than decision-making during it |
| Highway and rail dependency | Long single-corridor supply routes north and west with limited alternatives | Model extended route closure, not delayed delivery, and identify stock positions accordingly |
| Power and communications loss | Extended outages across regional areas following severe weather | Plan for manual operation and degraded communications rather than assuming restoration timeframes |
| Third party and platform failure | Cloud, telecommunications and supplier failures that affect you while your own sites are intact | Exercise scenarios where the provider fails and your operations are perfectly healthy |
Have an APRA, SOCI or customer continuity requirement to meet?
Testing: What Separates a Plan From a Capability
An untested plan is a set of assumptions about how people behave when information is incomplete and communications are unreliable. In Queensland that scenario is not hypothetical, which makes untested plans a more expensive gamble here than elsewhere.
Regulated entities carry an explicit annual exercise requirement across critical operations under severe but credible conditions. Credible is the word that matters. A scenario in which everything fails teaches nothing because the only decision available is to stop. A scenario in which a regional depot is inaccessible for eleven days, two key staff are uncontactable and a primary supplier is in the same catchment produces genuine learning.
Scenario authorship, running the room and capturing each failure point are ours. The measure we apply is how much remediation work an exercise generates, which means designing sessions that put people under genuine pressure rather than confirming that the document reads sensibly.
How We Run a Queensland Project
The analysis is run in workshops, not distributed as a questionnaire, since the value lies in watching managers disagree about which activities genuinely underpin which services. Targets get agreed with the people carrying responsibility for hitting them, then reality-tested against access constraints, supplier locations and what your infrastructure can genuinely restore. Dependency mapping comes next, followed by strategies, response plans and a command structure built on the assumption that information will be patchy and phones may not work.
Choosing the assessor, agreeing terms and locking the date are our tasks. Before anyone arrives, your internal audit is complete, a real exercise has taken place with the outcome documented, and the review is on record. We are in attendance. Where prudential or infrastructure obligations sit alongside the standard, the records are organised so one set satisfies every party asking.
Yearly exercises, refreshing the analysis, internal audits and surveillance readiness remain our responsibility. In Queensland we deliberately book the exercise before the wet season begins, since running one in February means competing for attention with the very conditions it was meant to rehearse.
What Is Handed Over
Where Brisbane ISO 22301 Projects Go Wrong
Preparing for an upcoming audit?
Who Certifies You, and Where We Fit
We implement. An accredited body certifies.
Nathan ISO Consulting builds and implements management systems. We do not issue certificates, and no legitimate consultancy does. Your certificate comes from an independent certification body accredited by JAS-ANZ, the accreditation authority appointed jointly by the Australian and New Zealand governments. Accredited bodies operate under impartiality rules that prohibit them from certifying a system they helped build, which is precisely why the two roles are separate. Our job is to get you audit-ready, help you select the right accredited body, and stand alongside you through assessment.
We handle which accredited body you engage, what it costs and when it happens, choosing on the basis of your scope, your sector and the audit style that suits your operation. Our people sit through Stage 1 and Stage 2 alongside yours, and closing out whatever gets raised is our work rather than a list left behind. Do verify one thing independently beforehand: that the JAS-ANZ register shows the body accredited for your specific scope. Unaccredited certificates are quick and cheap to obtain and are turned away by procurement teams often enough to make that check worthwhile.
Start With What Cannot Stop
Which parts of the operation could not pause for a fortnight without unacceptable consequences? Most Queensland organisations cannot answer that precisely at the outset, and the impact analysis exists to close exactly that gap.
Ready to start your ISO 22301 certification journey?
FAQ'S
No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.
A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.
Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.
No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.
Disruption here is frequently regional rather than site-specific. An event affecting your premises commonly affects staff homes, local suppliers and road access at the same time, which invalidates plans built around relocating to an unaffected alternate site.
Largely, but gaps remain. Obligations concerning service provider registers and notifying the regulator sit beyond the reach of the standard itself. We construct the evidence so the same records satisfy both the certification assessor and the prudential requirement.
Annually as a floor, with additional testing after significant change or for your most critical activities. Regulated organisations must exercise every year. In practice the difficulty of the scenario determines whether anything is learned, far more than the frequency does.
Ahead of the wet season rather than during it. Scheduling an exercise for February in Queensland means competing with the conditions it was designed to prepare for, and attendance and attention both suffer accordingly.
Yes, and both belong in the same system. Third party and platform failures are now the more frequent cause nationally, and scenarios where a provider goes dark while your own operations are healthy deserve as much exercise time as weather events.
It applies to responsible entities in declared sectors, which in Queensland includes port, energy, water, health and data operators. Continuity work delivers the availability side of the all-hazards program the Act requires.
Queensland operates local and district disaster management arrangements that private operators frequently interface with during events. Knowing where your organisation sits in that structure, and who contacts whom, belongs in the plan rather than being worked out during an event.
They sit together comfortably. Shared clause structure and common ground on restoring technology services mean governance and audit work is done once. Queensland organisations facing resilience questions from either regulators or customers frequently maintain both certificates.
Usually not. Existing documents tend to describe response adequately while offering no defence of why those priorities were chosen. We keep the workable parts, build the analysis underneath them, and verify the recovery targets can actually be achieved.
Four to six months is realistic. The analysis phase controls the schedule because it requires input from every part of the business, and assessment cannot happen until an exercise has actually been run and documented.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving