Update Review of Previous Audits:
- Management of heritage properties
- HQ NZDF business continuity management
- Management of the Tactical Mobile Communications System
Section 2: HQ NZDF business continuity management
Introduction
2.1
Evaluation Report 9/2008 HQ NZDF Business Continuity Management dated 15 October 2008 reported on our attempt to examine business continuity management within HQ NZDF.
2.2
The audit had intended to report on the organisational robustness and the availability of plans to enable the Headquarters to continue operating in the event of a disruption to services.
Report’s main points
2.3
We had expected that HQ NZDF would have plans to enable it to continue functioning during and after a major civil emergency, such as an earthquake. We also expected that the Headquarters and its branches would have plans to enable it to continue essential tasks in lesser emergencies such as localised fire, power failure, or non-availability of staff through pandemic.
2.4
We instead found that:
- there was no overarching NZDF business continuity policy or methodology on which organisational business continuity plans should be based;
- no senior manager had responsibility for NZDF business continuity policy and oversight;
- no senior manager had responsibility for business continuity management within HQ NZDF and there was no process or organisation within the Headquarters for managing its business continuity;
- only Communications and Information Systems (CIS) Branch had developed business continuity plans, and those related to its data facilities in Porirua and Devonport.
2.5
Our principal recommendations were that the NZDF:
- adopt a business continuity philosophy and issue business continuity policy for the whole NZDF;
- assign responsibility for the direction of business continuity management within HQ NZDF to a senior manager;
- indentify key business processes for each Headquarters business area, conduct impact analysis on each to determine the acceptable outage, and develop appropriate continuity treatments.
Subsequent actions
2.6
In early 2009 Strategic Commitments and Intelligence (SCI) Branch was directed to develop business continuity policy. Later that year the General Manager Organisational Support took over development of policy and an NZDF business continuity plan.1
2.7
There was little action until mid 2010, when KPMG was engaged to assist. In September 2010, a draft NZDF Business Continuity Management Policy was completed and circulated for consideration and comment. A Defence Force Order setting NZDF policy for business continuity management is expected to be issued by mid-2011.
2.8
The DFO, once issued, will provide corporate policy on business continuity management. It is designed to be scalable, and will include a template to enable Services, organisations and units across the NZDF to develop their own plans in a consistent manner.
2.9
There has not been action on developing business continuity plans for the Headquarters. This is being delayed until the policy has been promulgated.
2.10
Defence Shared Services has implemented its own business continuity plan. That plan was tested as part of its development but there has not yet been a full scale test. Defence Shared Services is developing a technical business continuity plan for Defence House.
2.11
CIS Branch has continued to develop and enhance its plans for its computer centres, and implemented a plan for the Branch in February 2010. That plan needs to be aligned with the recently revised CIS organisation structure.
2.12
We were told that CIS Branch has made assumptions on acceptable outages for NZDF areas that do not yet have a formal business continuity plan. More work is needed to identify business owners. The CIS plan still requires some fine tuning of the details of delivery of agreed business operational requirements.
Summary
2.13
Preparation of a business continuity management policy for the NZDF has been progressed since our last report. However, the time taken to have this approved and issued is delaying the preparation of plans for the management of business continuity in HQ NZDF. We think that it will still take some time to develop working level plans for the Headquarters and its components. In the interim, the absence of any business continuity organisation or structure in HQ NZDF puts at risk the ability of the Headquarters to continue to effectively support the Government and manage the NZDF in the event of a major business disruption.
2.14
Recent events in Christchurch demonstrate the disruption to business that could be experienced in the event of a major earthquake in Wellington.
Recommendation
2.15
It is recommended that the NZDF:
- issues without unnecessary delay, policy and guidance on business continuity management in the NZDF; and
- develops and promulgates as a matter of priority business continuity plans for HQ NZDF.
- Since we completed our field work for this audit, the lead has been handed back to Assistant Chief Strategic Commitments and Intelligence.
