Criticality Assessment Matrix Template for New Zealand

A Criticality Assessment Matrix is a systematic evaluation framework that helps you identify, categorize, and prioritize the most important elements of your business operations. This structured document provides clear criteria for assessing the criticality of assets, processes, systems, and functions within your organization, enabling informed resource allocation and strategic decision-making.

When do you need this document?

You need a Criticality Assessment Matrix when establishing or updating your organization's risk management framework, particularly if you're operating in sectors involving critical infrastructure, healthcare, manufacturing, or government services. This document becomes essential during business continuity planning, emergency preparedness initiatives, or when regulatory bodies require evidence of systematic risk assessment processes. It's also crucial when implementing new systems, conducting organizational restructures, or preparing for external audits where you need to demonstrate comprehensive understanding of your critical operations.

Key legal considerations

Your Criticality Assessment Matrix must incorporate robust evaluation criteria that align with your legal obligations and industry standards. Key considerations include defining clear criticality levels with specific thresholds, establishing objective scoring methodologies, and ensuring comprehensive coverage of all business functions. The matrix should include assessment criteria for operational impact, regulatory compliance requirements, financial implications, and reputational risks. You must also consider data protection requirements when handling sensitive information during assessments, ensure appropriate stakeholder involvement in the evaluation process, and establish regular review cycles to maintain accuracy and relevance.

Legal requirements in New Zealand

Under New Zealand law, your Criticality Assessment Matrix must comply with the Health and Safety at Work Act 2015, which requires systematic identification and management of workplace risks and hazards. The Privacy Act 2020 governs how you handle personal information during criticality assessments, requiring appropriate safeguards for sensitive data. If your organization manages critical infrastructure, you must align with the Critical Infrastructure Protection Framework and may need to comply with the Civil Defence Emergency Management Act 2002. The Building Act 2004 may apply to facility-based assessments, while the Resource Management Act 1991 is relevant for environmental risk considerations. Government agencies and contractors must also adhere to Protective Security Requirements, ensuring national security considerations are incorporated into criticality assessments.