Continuity planning in Western Australia has to account for something planners elsewhere can assume away: that the replacement part, the specialist technician and the alternative supplier may all be on the other side of the country, and that the road between you and them may be cut.
A pump fails at a Pilbara processing plant. The spare is in Perth, sixteen hundred kilometres away, and the highway is closed by a cyclone crossing further north. That is not an exotic scenario; it is a Tuesday in February, and it is why continuity work here concentrates on stock position, redundancy and access rather than on office relocation.
Nathan ISO Consulting implements business continuity management systems for Western Australian organisations across resources operations and services, utilities, ports, health providers and government suppliers.
Why ISO 22301 matters for Perth businesses
Recovery objectives are the first thing that breaks in this state. A target assuming a replacement component arrives in a week is meaningless when the actual lead time is four months and the item ships from Europe. Objectives set without testing against procurement and logistics reality are aspirations, and an assessor will ask how they were validated.
Critical infrastructure obligations supply the regulatory layer. Ports, energy assets, water utilities, health operators and data facilities in Western Australia sit within declared sectors and carry all-hazards risk management programme obligations. Continuity work delivers the availability side of that.
The third driver is contractual. Operators require continuity capability from vendors supporting production-critical services, and government and utility procurement increasingly asks for evidence rather than assurance. A certificate answers that without a bespoke assessment per client.
Legal, regulatory and contractual drivers in Western Australia
| Driver | Who it captures | What it requires |
|---|---|---|
| Security of Critical Infrastructure Act 2018 | Declared WA assets across port, energy, water, health and data | A programme covering every category of hazard capable of taking an asset offline, not cyber alone |
| APRA CPS 230 | Regulated financial institutions plus the suppliers they classify as material | Naming the operations that must not fail, fixing how much disruption is survivable, holding plans that stand up, testing them methodically and overseeing providers |
| Work Health and Safety Act 2020 (WA) | All Western Australian workplaces | Emergency planning and response duties sitting alongside continuity arrangements |
| Emergency management arrangements | Operators interfacing with state and local emergency management during events | Coordination roles and communication paths that operators must understand in advance |
| Operator vendor requirements | Suppliers supporting production-critical services | Evidence of continuity capability, tested recovery objectives and provider oversight |
| Health and community service obligations | Health providers and contracted community services | Service continuity arrangements under sector requirements |
| Privacy Act 1988 and the NDB scheme | Businesses caught by federal privacy law | Assessing and reporting breaches, which your incident handling and continuity arrangements have to be able to sustain |
Prudential and critical infrastructure obligations impose requirements the standard does not cover. We build so one evidence set answers each audience rather than maintaining separate records.
Western Australian disruption patterns
Five exposures recur here often enough to warrant explicit treatment in any plan written for this state.
| Exposure | What it looks like in WA | Planning implication |
|---|---|---|
| Cyclone season | An annual window affecting Pilbara and Mid West operations, ports and supply routes | Set activation triggers before the season rather than making decisions during it |
| Single-route supply | Long highway and rail corridors with no practical alternative | Model route closure lasting weeks and set stock positions accordingly, not delayed delivery |
| Component lead times | Specialist plant items shipped from interstate or overseas | Recovery targets must reflect procurement reality, including qualification time for alternatives |
| Distance to expertise | Specialist technicians and contractors based in Perth or further afield | Plan for degraded operation while help travels, rather than for immediate intervention |
| Third party and platform failure | Cloud, telecommunications and supplier failures affecting you while sites are intact | Exercise scenarios where the provider fails and your own operation is entirely healthy |
Testing that reflects the conditions
Every plan carries hidden assumptions about how staff will act when facts are scarce and pressure is high. Those assumptions hold up poorly out here, since whoever would ordinarily step in is often uncontactable, grounded, or simply too far away to matter within the window that counts.
Useful exercises here are narrow and specific. A single critical component failing during a campaign with the spare in Perth and the road closed. A satellite link dropping during a shift change with the operations centre unable to see site status. A supplier entering administration with three months of qualification work required before an alternative can be used. Each produces genuine learning; a scenario where everything fails at once produces only a decision to stop.
We write the scenario, facilitate the session and record every point where the plan stalled, judging the exercise by the length of the remediation list rather than by how comfortable the debrief felt.
How a Western Australian engagement runs
Impact analysis runs in workshops rather than by circulated form, because arguments about what genuinely depends on what are where the useful information sits. Recovery targets are then agreed with the people accountable and tested against procurement lead times, logistics reality and access constraints specific to your locations. Dependency mapping follows, then strategies, plans and a command structure built for degraded communications.
Assessor selection, terms and dates are our work. Before anyone arrives the audit is complete, a real exercise has run with the outcome documented, and the review is recorded. We attend throughout. Where critical infrastructure or prudential obligations run alongside, records are organised so one set satisfies every party.
Annual exercises, impact analysis refresh, internal audits and surveillance readiness stay with us. For WA clients the exercise is scheduled ahead of cyclone season rather than during it, when the operation is occupied with the conditions the exercise was meant to rehearse.
Documents and evidence you receive
Where Perth ISO 22301 projects go wrong
Who certifies you, and where we fit
We implement. An accredited body certifies.
Nathan ISO Consulting builds and implements management systems. We do not issue certificates, and no legitimate consultancy does. Your certificate comes from an independent certification body accredited by JAS-ANZ, the accreditation authority appointed jointly by the Australian and New Zealand governments. Accredited bodies operate under impartiality rules that prohibit them from certifying a system they helped build, which is precisely why the two roles are separate. Our job is to get you audit-ready, help you select the right accredited body, and stand alongside you through assessment.
Which accredited body you engage, on what terms and to what timetable, is work we take off you, matched against scope, sector and the audit approach that fits how you operate. Both assessment stages are attended by our people, and resolving whatever gets raised belongs to us rather than arriving as a list once the assessor leaves. Check one thing yourself first: that the JAS-ANZ register lists the body as accredited for your particular scope. Certificates from unaccredited providers cost little and take days, and procurement teams reject them regularly enough that the check pays for itself.
FAQ'S
No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.
A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.
Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.
No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.
Distance changes the arithmetic. Replacement parts, specialist technicians and alternative suppliers are frequently interstate or overseas, and the route between may be closed seasonally. Plans built around relocation rather than around endurance and stock position tend not to work here.
By working backwards from procurement and logistics reality rather than from what would be convenient. A target assuming a component arrives in a week when the actual lead time is four months is not an objective, and an assessor will ask how it was validated.
Ahead of cyclone season rather than during it. Scheduling an exercise for February in the north west means competing with the conditions it was designed to rehearse, and both attendance and attention suffer.
It applies to responsible entities in declared sectors, which in Western Australia includes ports, energy, water, health and data operators. Continuity work delivers the availability component of the all-hazards programme the Act requires.
Yes, and both belong in one system. Third party and platform failures are now the more frequent national cause, and scenarios where a provider goes dark while your sites are fully operational deserve as much exercise time as cyclones.
Annually at minimum, more often for critical operations or after material change. Regulated entities carry an explicit annual requirement. Scenario difficulty determines whether anything is learned far more than frequency does.
The pairing works well. Both share clause structure and overlap on restoring technology services, so governance and audit work is done once. WA organisations facing resilience questions from regulators or operators commonly hold both.
Rarely. Most plans handle response adequately and justify priorities poorly. We keep the workable content, build the analysis defending the priority order, then test whether the stated targets can actually be met.
Four to six months. The analysis phase governs the schedule because it needs people from across the business, and assessment cannot proceed until a genuine exercise has been run and written up.
Yes. Scenario design, facilitation and the write-up are ours. Plans exercised by their own authors reliably avoid the weakest areas, usually without anyone intending it, which is why external facilitation is worth the cost.
Start with what cannot stop
Name the activities that could not sit idle for two weeks without something breaking that matters. Few operations here can give a confident answer on day one, which is exactly the ambiguity the analysis phase is designed to resolve.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving