Attachment 6 KPMG implications overview covid19.pdf

Guide for
New Zealand
business
executives
and directors
The potential impacts of COVID-19
on key sectors of the NZ economy.
March 2020
kpmg.com/nz

link to page 3 link to page 5 link to page 6 link to page 7 link to page 8 link to page 10 link to page 12 link to page 13 link to page 16

Index
  Overview
  Recovery Scenarios
  Debt Markets
  Sector Information
Agri-Food
Banking
Construction
Forestry
Infrastructure
Insurance
Leisure and Hospitality
Mid-Market
Property
Retail
Tourism
Transport
  Government Support and Stimulus Package
  Business Continuity and Crisis Management
  Impacts on Financial Reporting
  IT Resilience
  Cyber Safety

Overview
The information we are providing is a guide for New Zealand business executives and directors on
the potential impacts of COVID-19 on key sectors of the New Zealand economy. The situation is
fluid and changing on a daily basis, and we wil  update this content as and when new updates are
available.
Companies around the world need to act promptly.  The following information is to help
businesses understand the COVID-19 situation and how it may unfold in New Zealand; and take
steps to protect their employees, customers, supply chains and financial sustainability. It is clear
that there wil  be short, medium and long-term implications on both our domestic economy and
the global economy as a result of the pandemic.

Companies around the world need to act
To date COVID-19 has impacted a number of sectors in
promptly.
both at home and around the world, firstly in the service
sectors such as tourism, hospitality and leisure, including
This document is to help businesses understand the
bars, restaurants, gyms, airlines and hotels, but these
COVID-19 situation and how it may unfold in New
have now been followed by other sectors. The most
Zealand, and take steps to protect their employees,
immediate casualties of the crisis have seen a number of
customers, supply chains and financial sustainability. It is
redundancies and cost cutting measures being
now clear that there wil  be short, medium and long-term
implemented. The implementation of such cost saving
implications on both our domestic economy and the
measures and the implementation of social distancing is
global economy as a result of the pandemic.
likely to cause a significant further drop in discretionary
At the time of writing we were at alert stage three, with
spending over the coming months.
notification that this would be elevated to stage four as of
It is clear that businesses need to have a clear
25 March. As we face into lockdown, New Zealand
stakeholder engagement strategy to begin dialogue with
businesses need to look forward and consider what the
landlords, suppliers and banks to navigate future impacts.
future holds, how they wil  adapt to a home working
It is now also clear that every sector in the New Zealand
environment and what scenarios are likely to emerge as a
economy wil  be impacted in some way shape or form.
consequence of the COVID-19 outbreak both
domestical y and around the world. It is clear at this stage
There is, and wil  likely be, significant macroeconomic
that there wil  be businesses who wil  not survive the
volatility in the coming weeks and months and we are
crisis and those which remain may look very different on
likely to continue to see impacts on currency and inflation
the other side.
in unpredictable ways – the volatility in the New
Zealand/USD cross rate in the last four days is
COVID- 19 is unique in that it is a simultaneous supply
unprecedented.
shock, demand shock and market shock event. The
original hope for a “V” shaped or “U” shaped recovery
Despite the impacts that we are seeing
(as opposed to an “L” or “W” shape) wil  depend on the
domestically there is some positive news.
timing and magnitude of international Government
At the time of writing, the spread of the virus in China and
assistance as wel  as how companies and markets
South Korea is general y believed to be in decline, and
respond to changing demands.
Taiwan and Singapore have arguably demonstrated their
We wil  see further Government intervention and
abilities to contain the peak of the virus. Chinese
stimulus in the coming days, in addition to the first
production has ramped up again, meaning supply chains
stimulus, that is likely to reflect the package already
in and out of China are once again starting to move. In
announced by Australia. It is likely to have much further
Hubei province, quarantine has been lifted, public
reaching implications than the original stimulus and
transport has resumed, and factory production has
address emergency relief for SMEs and mortgage
resumed to pre- pandemic levels.
borrowers, along with the removal of the $150,000 wage
Both China and South Korea moved swiftly to lock down
subsidy cap. Quantitative easing has been exercised for
infected areas in an attempt to contain the virus. Whilst at
the first time in New Zealand in order to keep interest
the time the response was described by some
rates low with a programme which wil  inject $30b into
commentators as “draconian” the impacts of such
the economy over the next twelve months..
actions are noted. Both business and citizens are
   COVID-19 Sector Implications Report / KPMG / 3

general y accepting of the fact that a lock down is the

best chance of minimising the impact of the pandemic,

and, in particular, the impending pressure on the health

system that we have seen elsewhere global y.

Domestical y we have seen a huge shift in consumer

demand and behaviour and we anticipate this to continue
in the short-term, applying further stress across the
economy.
Mainfreight have recently announced that with the
exception of air freight the transportation of goods
domestical y and international y is being roughly
maintained to normal levels of service. This is welcome
news to Kiwi exporters, however is largely driven by
strong demand in grocery and agri-food. That said, as a
consequence of the outbreak we are likely to see a shift
in both Chinese consumer behavior and confidence in the
coming months, with consumer spending having been
considerably down YOY, especial y across food and drink.
Elsewhere in the region, across New Zealand’s largest
trading partners, the situation remains fluid:
—  China - Trade returning to normalised levels, ports
have re-opened, manufacturing re-started, and
supply chains are moving.
—  Japan - Infected numbers are stil  rising, measures
are in place to try to contain the spread. Schools
are closed and travel has been restricted from
infected countries. GDP is in decline for the first
time in 5 quarters. Imports and exports are down.
—  South Korea - On 13 March 2020 South Korea
announced that for the first time the number of
COVID-19 recoveries had surpassed the number of
new cases and that they expected the trend to
continue.
—  USA - Al  major trade shows and events have
been cancelled in the US. Al  travellers from
Europe have been banned for a period of 30 days.
Domestic supply of dairy and meat has been
ramped up to meet demand, the economy is likely
to contract in Q2 at least as businesses ride out
the spread of the virus. Freight and cargo is stil
moving in and out of the US, however this could
change at short notice. The introduction of the
Families First Coronavirus Act is likely to impact
any Kiwi employers who have staff in the US.
—  Australia - The Australian Government announced
a $189 bil ion economic plan to support business
investment and provide cash flow to SMEs.
Australia is facing similar challenges to New
Zealand and currently remains open for imports
and exports although countrywide shut down wil
impact this.

4 / KPMG / COVID-19 Sector Implications Report

Recovery Scenarios
Given the rapidly evolving situation, we are advising clients to prepare for the future based on two
scenarios given current information.

1.  Recovery by the end of 2020
Businesses must plan for the worst-case scenario and
adapt to a world in which they need to be more agile and
The outbreak wil  be brought under control through
responsive to a multitude of changes and chal enges on a
extensive Government intervention such as social
daily, if not hourly, basis.
distancing and lock down, by the beginning of Q3.
New Zealand wil  be official y in recession and
Cash flows need to be forecast through to the end of
consumer behaviour wil  lag behind the decline in the
2021 where possible, with accompanying scenario
epidemic. It is likely that revenue wil  be in decline
analysis, and working capital facilities agreed early to
and investment wil  dry up, placing significant
enable businesses to manage both current and future
pressure on the banking sector. There are likely to be
volatility.
chances of business failures across multiple sectors.

However, under this scenario, by Q4 we would likely
start seeing a rebound of confidence and return to

normality, but not enough to counteract the
contraction of Q1 and Q2.
In this scenario we also have to consider the
possibility that whilst New Zealand may achieve
suppression, or potential eradication of the virus,
other economies may not, in which case we have to
consider a situation where the New Zealand
economy is operating in isolation from the rest of the
world. Our economy’s balance of payments would
stand New Zealand in good stead in this scenario in
terms of exporters, but we would stil  be at the
mercy of international chal enges such as restriction
of supply chains, shifts in consumer demands etc
causing a knock-on impact to trade and the economy.
2.  Longer term economic impact
A consequence of not being able to contain the virus
spread quickly enough both at home and abroad.
Under this scenario business tightens faster by the
end of Q2 as there are no signs of the epidemic
receding. Job losses and corporate failures are more
widespread, placing significant pressure on the
banking sector. Consumer confidence and spending
plummets as a consequence and a downward spiral
ensues. There is the chance of a double peak
pandemic in China and therefore recession. The
impact wil  be long lasting and far reaching and
unlikely to enter recovery until at least half way
through 2021.
   COVID-19 Sector Implications Report / KPMG / 5

Debt Markets
In recent days we’ve heard fears expressed that credit markets have ground to a halt as result of
COVID-19: so far this is not the case. While banks and non-bank deposit takers are certainly
cautious, markets are stil  very much open and functioning.
So far, we haven’t seen the rapid withdrawing of credit that was at the heart of the GFC. This
means that there is a real chance for businesses to remember those lessons and not be caught
sitting on their hands when liquidity is available to set-up for a post-crisis environment. But what
are the factors that need to be considered first?

Cost of credit is rising but will be mitigated
In Australia we’re hearing some new-to-bank sign offs wil
now automatical y go to the national head of credit, (and
The profile of borrowers that lenders wil  provide funding
maybe even offshore for foreign banks), for approval and
to – and the price at which they wil  advance that funding
we’d expect the same to apply here.
– has changed swiftly as a result of the pandemic and the
length of the crisis wil  dictate what further movements
Several businesses are saying they need short-term
there wil  be in the coming months.
financing and working capital support to deal with the
cash flow implications of coronavirus. Developing a solid
The coronavirus-triggered increases in the cost of credit
plan and identifying the levers available to the business to
could be anywhere between 50 and 150 basis points or
manage short-term funding requirements wil  be an
higher, depending on where you fit in terms of exposure
important element in discussions with lenders. The long-
to date and therefore on the credit spectrum
term outlook and impact of COVID-19 is stil  uncertain.
Offsetting this, however, is the fact that interest rates
Planning for a period of volatility wil  be a critical feature
have reduced as the Reserve Bank has reacted swiftly to
of any plan.
cut rates. This means that any increase in margins in the
Accessing the debt market or equity markets for liquidity
short term is likely to be partial y offset by the reduction
will require a clearly articulated plan and strategy.
in the base rate. It has also deferred planned capital rules
by 12 months delaying what would otherwise have
There are alternate funding options that weren’t
resulted in an increase in pricing.
available during the GFC
Banks have liquidity ready
New Zealand has only just started to see the influx of
new players into the private credit market that has been a
The strong message we are getting currently from the
feature of the Australian debt markets over the past
banks is that they are open for business with liquidity to
decade. What has been a feature is the emergence of
deploy to help shore up businesses. Banks are certainly
new international players in the New Zealand banking
signal ing that they are keen to step up and support their
market, particularly from Asia and Europe. There is
customers.
available liquidity outside of the traditional sources in the
New Zealand’s major banks are relatively wel  capitalised
New Zealand market if you know where to look,
and have buffers in place to ride the wave of events like
particularly for higher quality credits.
the current pandemic. With these factors considered,
The culmination of these factors makes the current
along with the scope of the RBNZ to provide additional
situation significantly better for borrowers than it was in
support, we believe the banking system is well placed to
2009/2010. Back then, given the position of the banks
continue supporting long-term growth, however under
and the significant cost of accessing the equity markets
scenario 2 - a longer term recovery - it remains unclear
for listed companies, a number of companies had limited
what appetite banks wil  have to lend.
options which meant that many just rode the crisis out.
If you want funding, you need a solid plan
Today that may not be necessary.
Let’s be clear: It won’t be straightforward for most

businesses to secure credit in this environment. That’s

especial y the case if you operate in a vulnerable sector

severely impacted by COVID-19. The hurdles to get

approvals wil  be higher than they have been historically.

6 / KPMG / COVID-19 Sector Implications Report

Sector Information
In the articles that accompany this overview, we share the views of our Industry Sector Leaders
across our key sectors, and consider first the impact to date, then look to the future under two
scenarios - one assuming recovery by the end of 2020, and the second assuming a longer-term
recovery.

You can find al of the key sector information gathered here or you can view specific sectors individually:
Agri-Food
Banking
Construction
Forestry
Infrastructure
Insurance
Leisure and Hospitality
Mid-Market
Property
Retail
Tourism
Transport

COVID-19 Sector Implications Report / KPMG / 7

Government Support and Stimulus Package
On 17 March the Government released its fiscal and economic response to the COVID-19
pandemic. It was original y costed at $12.1b which is equivalent to around 4% of New Zealand’s
annual GDP. Changes have been made to the package over the last few days as New Zealand
moved to alert level 4 at 11:59pm on 25 March 2020.

The package is now expected to cost approximately
Please check our Q&A page which we wil  keep updating
$17-18b. The bulk of the package comprises spending of:
as more information becomes available on the wage
subsidy and other relief available to businesses
  $8-10b to support businesses, the self-employed
and jobs;
Wage subsidy eligibility
  $2.8b in assistance to those receiving benefits, via a
The wage subsidy is available to employers, contractors,
$25 per week increase in core benefits from 1 April
sole traders, the self-employed, registered charities,
and a doubling of the winter energy payment;
incorporated societies, non-governmental organisations
and post-settlement governance entities. The businesses
  $500 mil ion in additional health funding, to improve
must be registered and operating in New Zealand.
the COVID-19 response;
The wage subsidy is aimed at al owing employers to
  $600 mil ion to support the aviation sector
continue to employ staff. The subsidy is $585 or $350 per
The more recent extension to the package includes the
employee for 12 weeks depending on whether the
following:
employee works for more or less than 20 hours per
week.
  The Government, retail banks and the Reserve Bank
have announced a six-monthly principal and interest
There is no cap on the subsidy (original y there was a cap
payment holiday for mortgage holders and SME
of $150,000 per organisation.)
customers whose incomes have been affected by
There are some key matters to accessing the scheme:
COVID-19.
  A 30% decline in actual or predicted revenue in any
  The Government and the banks wil  implement a
month when compared to the same month last year
$6.25b Business Finance Guarantee Scheme for
and the revenue loss is attributable to the COVID-19
smal  and medium-sized businesses. This is to
pandemic.
provide short-term credit to cushion the financial
distress of SMEs. The scheme wil  include a limit of
  The business needs to have tried active means (for
$500,000 per loan and wil  apply to firms with a
example, the bank, making an insurance claim) to
turnover of between $250,000 and $80 mil ion per
manage the effects of the decline;
annum. The loans wil  be for a maximum of three
  Committing, on a “best endeavours” basis, to
years and expected to be provided by the banks at
paying the subsidised employees 80% of their
competitive rates. The Government wil  carry 80%
normal income for the period of the subsidy as
of the credit risk, with the other 20% to be carried
specified in their employment agreement.
by the banks.
  Committing to pay the ful  amount of the subsidy to
  The Government has agreed to freeze al  rent
employees and retaining the employees for the
increases and to look to extend no-cause
period the subsidy is received.
terminations.
New businesses (e.g. that are less than a year old) and
Wage subsidy scheme
high growth firms (e.g. firms that have had significant
For businesses and the self-employed, there is a wage
increase in revenue) are also eligible. They need to
subsidy scheme (the accompanying leave payment
demonstrate the 30% revenue loss over a relevant
scheme was discontinued with effect from 3:00pm 27
period, for example, March 2020 compared to January
March 2020, although applications submitted before then
2020, rather than to last year’s equivalent month.
wil  stil  be processed by Work and Income New Zealand).
The application is made online.
More detail of these payments can be found at the links
below. We have summarised the key parts of each policy.
However, as the policy has been developed and evolved
quickly, there remain unanswered questions.
8 / KPMG / COVID-19 Sector Implications Report

Links to applications
The extension of the package is welcome as assisting to
improve business liquidity in the short to medium term.
The application for each is available at the following links:
The Government response is evolving as public health
  Employer application
measures are taken and the effects of the packages are
  Self-employed application
assessed. The removal of the $150,000 limit for the wage
subsidy is an example.
  Large employer application (over 100 employees)
There wil  also be further specific initiatives for specific
Tax changes and tax payments
sectors and across the broader economy. For example:
The Government also announced tax changes. Included in
  Detail of the aviation sector support were
the Government’s response are a number of tax
announced 24 March 2020; and
measures:
  A $56M package of support for Māori communities
  The reintroduction, from the 2020-21 income year,
and businesses to respond COVID-19. This includes
of a 2% DV depreciation deduction for commercial
targeted health funding and community support but
and industrial buildings. This includes hotels and
also funding to enable a needs assessment for
motels.
Māori businesses leading to a Māori business
  Bringing forward R&D refundability rules to the
response plan.
2019-20 income year.

  A temporary increase in the threshold for expensing

low-value assets from $500 to $5,000 during the
2020-21 income year. The threshold wil  be $1,000
from the 2021-22 income year.
  The threshold for paying provisional tax wil  increase
from $2,500 to $5,000 of residual income tax, from
the 2020-21 income year.
  Inland Revenue wil  be given the power to write off
interest on late payments for those adversely,
financially, impacted by COVID-19 for tax payments
due after 14 February 2020.
  Changes to the calculation of the in-work tax credit
to remove the hours worked test.
  Inland Revenue wil  have greater information sharing
powers to facilitate a whole of government
response to COVID-19.
These are covered in our Taxmails on the Government's
COVID-19 fiscal and economic response package and on
COVID-19 Tax Act and late payment and were included in
the COVID-19 Response (Taxation and Social Assistance
Urgent Measures) Act which was enacted on 25 March
2020.
The Act also al ows refunds of research and development
tax credits one year earlier than planned (for the 2019-20
income year rather than for the 2020-21 income year. This
had not been previously announced.
If you have difficulties with tax payments, Inland Revenue
can accept instalment arrangements through MyIR or
through agreement with their debt recovery team. Inland
Revenue announced its intention to waive penalties and
interest for late payments in a media release on 25 March
2020. There are no apparent requirements, but further
detail and explanation may follow.
   COVID-19 Sector Implications Report / KPMG / 9

Business Continuity and Crisis Management
As a Business Executive, or a Director you need a clear focus on where to from here. We highlight below
key areas of focus and questions you should be addressing and discussing around the Boardroom table,
looking to the future under two scenarios: one assuming recovery by the end of 2020; and the second
assuming a longer-term recovery.

Business Impact
Financial and External factors
Awareness and Communications
Cash Flow and Financing
  Do you have a communications plan for staff and for
customers?
  Have you reviewed and revised cash flow, working
capital and inventory forecasts alongside supply and
  Have you communicated with priority customers,
demand predictions?
employees and suppliers?
  Do you have access to adequate funding under
  How wil  you deal with the impact on your
banking facilities to manage through potential
workforce? How can you ensure the safety of your
chal enges and/ or need to engage with lenders to
employees whilst trying to maintain business as
refinance facilities or amend financial covenants that
usual activities?
may be impacted?
  Have you assessed the cyber security and health
Financial Stability
and safety risks associated with employees working
from home?
  How wil  your financial stability be impacted from
further stock market declines and restricted
Technology and System Resilience-
funding?
  Have your 3rd party IT suppliers been impacted? Wil
  Wil  the completion of your financial statements be
this impact your SLAs and system support?
delayed? Is this likely to cause a delay to your audit
  Does your workplace/ communications technology
opinions and therefore market communications?
allow you to reduce travel and enable remote
Global Trade and Protectionism
working?
  Are you aware of Government mitigation plans and
Commercial Plans
the consequential impacts on our supply chain?
  How wil  your change plans and programs be
  Do you have domestic alternative suppliers?
impacted?
Government & Public Health requirements
  Wil  project deadlines and investment need to be
delayed or halted? What impact does this have on
  Do you have dedicated resources reviewing public
your strategy?
health requirements and other related Government
announcements and ensuring that you stay
Board Governance
compliant?
  If travel bans are enforced, how wil  this impact your
  Have you assessed the responsibilities as an
board governance and the way you run your
employer in relation to public health requirements
business?
for employees?
  For legal coverage, have you identified how to
Sector Disruption
document the additional requirements to meet
governance commitments?
  How wil  you maintain trust with your customers
and assure them that your product/ service is stil
safe?
  How will a drop-in demand impact your cost base
and profitability?
  Are you aware of the phasing of impacts within your
sector?
10 / KPMG / COVID-19 Sector Implications Report

Supply Chain and Operations
People
Suppliers
Immigration
  Do you know where your key suppliers are located?
  Do your employees have the right to stay and work
Do they have contingency plans in place to ensure
in locations if they are staying in countries for longer
the continuation of supply?
than planned?
Physical Logistics
  If you need to relocate employees, wil  they have
the right to work in their new locations?
  Do you know your supply routes? Have you spoken
with your logistics providers to understand any
Global Mobility
potential impacts and how they propose to mitigate

against them?
If your employee is staying in a country longer than
planned and working in that country, have you
  What are your contingency plans if routes are
considered employee or employer tax and social
cancel ed?
security obligations?
Contracts
  If you need to relocate employees, have you
considered employers registration and withholding
  Have you reviewed your contracts with key
obligations?
customers and suppliers to understand liability in the
event of supply shortages?
Employment Tax
  How will you respond if suppliers invoke Force
  If you need employees to work from home, would
Majeure clauses?
the support you provide (e.g. expenses
reimbursements) be considered taxable?
Inventory
Employment Law
  Have you assessed your inventory cover? Do you
need to ring fence inventory for particular customers
  If you need employees to work from home, what
in the case of shortages?
are your obligations to provide support?
  Do you have the ability to track shipments in real

time and therefore manage customer expectations?

   COVID-19 Sector Implications Report / KPMG / 11

Impacts on Financial Reporting
Companies should monitor the current and potential effects that the COVID-19 outbreak may have on
financial statements and mandatory disclosures, and should strongly consider the following key points to
help ensure that their financial reporting and audit processes are as robust as possible:

Periodic disclosures including continuous disclosure

Companies should consider their disclosure obligations

regarding business risks related to the impacts of COVID-
19 within the context of the New Zealand regulatory
requirements. Disclosures should be specific to individual
circumstances, avoiding broad or generic language.
Accounting and financial reporting, including
subsequent events
Companies should consider whether economic
uncertainties and market volatility have or wil affect
accounting conclusions, particularly focusing on asset
valuations and funding covenant compliance. Additional y,
companies should evaluate whether events occurring
after the reporting period, but before the financial
statements for that period have been issued, require
disclosure or possibly recognition.
Ability to obtain information
A company’s ability to obtain and provide financial
statements or information could be impacted.
Notwithstanding those companies with significant
operations in other countries, local entities with enforced
work from home may struggle to access financial data to
prepare financial statements.
Financial reporting and Internal controls
Companies should consider whether there is any effect
on internal control over financial reporting due to the local
impacts of COVID-19. For example, new controls may be
implemented and/or revised as companies start to modify
IT access to enable remote workforces. Disclosure of
material changes would need to be disclosed in ICFR.

Read more in our latest edition of Reporting News –
COVID-19 edition
12 / KPMG / COVID-19 Sector Implications Report

IT Resilience
Concern over the scale and impact of the COVID-19 pandemic is growing, leading organisations to consider
their response, and the actions they need to take now to maintain their business. The CIO and CISO have
vital roles in making sure the organisation can function as pandemic containment measures are
implemented.

Can your business function effectively through
  Do you need to consider alternate cloud-based
remote working?
conferencing and teleworking solutions?
  Under New Zealand's new four level alert system in
  Do all members of staff have the necessary access
response to the COVID-19 pandemic we have now
to al ow them to access the video conference
moved to Level 4. It is critical now that your
bridges, is training material readily available, and
business can work remotely and flexibly. This may
should you establish a helpline?
require you to revisit decisions on access rights,
  Can your help desk operate if the help desk staff
entitlements and risk posture. Some key questions
have to work from home?
to consider are:
  Have you prepared simple guides to be distributed
  Have you scaled your VPN concentrators, portals
to staff on key help desk related queries:
and gateways to handle a large number of
colleagues who wil  need to work remotely?
–  How do I login?
  Have you considered the potential key suppliers,
–  How do I change my password?
contractors and vendors, who wil  require access
–  How do I access key services?
and the additional scale that wil  bring?
–  How can I get help from the help desk?
  Have you tested the infrastructure to find out
–  Who are my key contacts if I have pandemic
whether it can handle the expected loading?
related issues?
  Are there single points of failure in the
infrastructure, and can you provide additional
Are you able to scale digital channels to deal
resilience?
with demand?
  Do you need to relax some access controls or
Restrictions on travel and the spread of the virus may
provide additional remote login accounts or
lead to new patterns of demand, and higher traffic on
credentials without also creating a security risk?
digital channels.
  Is there sufficient help desk capacity to handle any
More customers and clients may expect to transact with
queries from users who are unable to login, or are
you through digital channels, can you scale those
unfamiliar with remote working?
systems and services to deal with changing demand?
  Where employees require access to laptops for
  How would you monitor loading and performance,
remote working, do you have devices available or
and who can make the decisions to scale or cut
can more be procured and instal ed to meet
capacity, or create dynamic choices on prioritisation
demand, and how should al ocation be prioritised?
if capacity is an issue?
  Where the equipment pool is limited, have you
  Are you clear which services you may need to shed,
considered essential services and/or splitting access
or how customer journeys may need to alter if
to them across alternative access solutions e.g.
systems are overloaded?
O365/One Drive vs. in-house applications?
  Are you dependent on key cal  centers, and if those
  Do you have the ability to whitelist specific
call centers are closed or inaccessible, can
applications and block al  non-essential services
customers and clients interact with you through
whilst stil  providing operational and security
other channels?
monitoring?
  Is there the option to al ow cal  center staff to work
  Do you have limitations on video and audio
remotely, or to transfer their loads to another cal
teleconferencing bridges, and can you do anything
center location?
to scale that infrastructure?
   COVID-19 Sector Implications Report / KPMG / 13

  Have you considered the interactions between cal
Are you able to scale your cloud capabilities?
centers and service/help desks and the impact of
any outsourcing arrangements?
There may be additional demands on cloud-based
services, requiring you to quickly scale the available
  Have you discussed the arrangements with key
computing power, which may incur additional costs.
suppliers of those services, and how wil  they
Other services may also show reduced demand.
prioritise your needs against those of other clients?
  Are you able to monitor the demand for cloud
computing services, and manage the al ocation of
Are you dependent on key IT personnel?
resources effectively?
Unfortunately, employees may be infected, may be
  Have you made arrangements to meet any
unable to travel or have to meet family care
additional costs which may be incurred from scaling
commitments; you should plan for a significant level of
or provisioning other cloud services?
absenteeism.
  Are you wil ing to al ow non-approved cloud based
  What would happen if key IT personnel (including
services to al ow people to continue to work?
contractors, CISO or CIO) are unable to travel, or are
il  with the virus. Are you dependent on a smal
number of key individuals that require specific
Are you dependent on specific suppliers?
plans?
Your suppliers and partners wil  also be under pressure,
  How could you reduce that dependency, for
and their operations disrupted too.
example, ensuring that there are “break glass”
  Do you know your critical suppliers, and the
procedures in place to al ow other administrators
implications if they are unable to operate?
access to critical systems?
  Are there steps you could take now to reduce that
  What about the Security team? Who are the key
dependency, including using your team resources?
individuals, and if the CISO is not available, then
who wil  make the decision on the security posture
  Are you discussing the implications with your key
and the acceptable risks to your organisation?
suppliers, and do you have the right points of
contact with those suppliers?
What would happen if disruption to a data
  Have you identified which IT suppliers may come
center occurs?
under financial pressure, and what would be your
alternate sourcing strategy if they did fail?
  Data centres may also be impacted by the virus. A
  If you have an ESCROW agreement do you know
positive test may result in an evacuation and deep
how to activate it?
clean of the building; transport infrastructure
disruption may prevent access, and data center staff
may be unable to work.
What would happen if there's a cyber incident?
  In the event that one of your data centers is
Organised crime groups are using the fear of COVID-19 to
evacuated, do you have disaster recovery plans in
carry out highly targeted spear-phishing campaigns and
place to deal with the disruption, and have you
set up fake websites, leading to an increased risk of a
tested those plans?
cyber security incident.
  How quickly can you fail-over to an alternate site,
  Have you made it clear to employees where to get
and who manages that process?
access to definitive information on the COVID-19
pandemic and your organisations response to
  Are you dependent on key individuals (including
COVID-19?
contractor support) for the operation of the data
center, and how can you manage that dependency?
  Have you warned staff of the increased risk of
phishing attacks using COVID-19 as a cover story?
  If you're dependent on alternative systems or
solutions, including cloud services, who would you
handle a security incident involving those systems?
  Do you need to change your approach to security
operations during the pandemic, including the level
of monitoring of security events?
  Have you planned for how you would manage a
security incident remotely?
14 / KPMG / COVID-19 Sector Implications Report

What would happen if there's an IT incident?
Are you setting an example?
While COVID-19 dominates the news, you should stil  be
Amongst al  of these organisational considerations, you
aware of the possibility of an IT failure given the changing
are stil  a senior manager, and your team wil  look to you
demands on your infrastructure, or an opportunistic
for leadership and support.
cyberattack.
  Have you made sure your team is implementing
  Would you be able to co-ordinate the incident
sensible hygiene practices, including offering flexible
remotely, and do you have the necessary
and remote working to meet changing needs?
conferencing facilities and access to incident

management sites/processes and guides?
Do you have up to date points of contact details for
al  of your team? Is your team aware of who to
  Do you have a virtual war room setup, in case
contact in an emergency?
physical access is limited or restricted?
  Do you model the behaviors you expect of your
  Are you dependent on key individuals for the
team, and what would happen if you were
incident response, and if so, what can you do to
incapacitated? Who would step in for you?
reduce that dependency?

  How does the emergency/incident response crisis

management structure change if key incident

managers/recovery leads are unavailable?

  Are you confident that your backups are current, and
that in the worst case you can restore vital corporate
data and systems?
  How would you deal with a widespread ransomware
incident, when large parts of your workforce are
home working?
Are you making the best use of your resources?
You wil  need to be able to function with limited
employee numbers and be clear on the priorities your
team needs to be able to complete.
  Have you prioritised your team’s activities, are there
tasks which you can defer and release staff for
contingency planning and priority preparation tasks?
  Do you have the ability to access emergency funds
if you need to source equipment, or additional
contractor/specialist support rapidly?
  If you are placed under pressure to reduce
discretionary spend to preserve cash, are you clear
on which spend must be protected and where to
make those savings?
   COVID-19 Sector Implications Report / KPMG / 15

Cyber Safety
The COVID-19 pandemic is changing our lives. People are concerned, and with that concern comes a desire
for information, safety and support. Organised crime groups are exploiting the fear, uncertainty and doubt
which COVID-19 brings to target individuals and businesses in a variety of ways.

The threat
The response
Since mid-February there has been a rapid build-out of
There are some key steps you should take to reduce the
infrastructure by cyber criminals used to launch COVID-19
risk to your organisation and your employees, particularly
themed spear-phishing attacks and to lure targets to fake
as you move to remote working:
websites seeking to collect Office 365 credentials.
  Raise team awareness warning them of the
Examples of campaigns to date include:
heightened risk of COVID-19 themed phishing
attacks
  COVID-19 themed phishing emails attaching
malicious Microsoft documents which exploit a
  Share a list of legitimate sources of advice on how
known Microsoft vulnerability to run malicious code
to stay safe and provide regular communications on
the approach your organisation is taking
  COVID-19 themed phishing emails attaching macro-
enabled Microsoft word documents containing
  Make sure you enforce strong/long passwords, and
health information which trigger the download of
preferably two-factor authentication, for al  remote
Emotet or Trickbot malware
access accounts; particularly for Office 365 access
  Multiple phishing emails luring target users to fake
  Provide remote workers with guidance on how to
copies of Government websites which solicit user
use approved remote working solutions securely
credentials and passwords
and tips on the identification of phishing
  A selection of phony customer advisories purporting
  Ensure that al  laptops have up to date anti-virus,
to provide customers with updates on service
Endpoint Detection and Response (EDR) and firewal
disruption due to COVID-19 and which download
software
malware
  Consider running a specific helpline or online chat
  Phishing emails purporting to come from various
line which staff can easily access for advice, or
government Ministries of Health or the World Health
report any security concerns including potential
Organization directing precautionary measures,
phishing
again embedding malware
  Encrypt data at rest on laptops used for remote
  COVID-19 tax rebate phishing lures encouraging
working given the increase risk of theft
recipients to browse to a fake website that collects
financial and tax information from unsuspecting
  Disable USB drives to avoid the risk of malware,
users.
offering employees an alternate way of transferring
data such as a col aboration tool
Many existing organised crime groups have changed their
tactics to use COVID-19 related materials on health
  Reviewing your remote access including:
updates, fake cures, fiscal packages, emergency benefits
–  security settings/configurations
and supply shortages. Typical giveaways that an email
–  ensuring approved access methods are used
may be suspect include:
by staff
  Poor grammar, punctuation and spelling
–  remote user lists are up to date and access
  Design and quality of the email isn’t what you would
privileges are appropriate
expect
–  the level of security and operational
monitoring and defined exception events are
  Not addressed to you by name but uses terms such
appropriate (e.g. baselines for peak usage
as “Dear colleague,” “Dear friend” or “Dear
times may differ.
customer”
  Includes a veiled threat or a false sense of urgency
  Directly solicits personal or financial information.
Of course, if it sounds too good to be true, it probably is.
16 / KPMG / COVID-19 Sector Implications Report

Also make sure that your finance processes require
finance teams to put in additional measures to confirm
any requests for large payments during the COVID-19
pandemic. This confirmation can help to guard against the
increased risk of business email compromise and CEO
frauds. Ideal y, use a different channel such as phoning or
texting to confirm an email request.
Ensure that you apply critical security patches and update
firewalls and anti-virus software across your IT
environment, including any laptops in use for remote
working. You should expect organised crime groups to
exploit any failures in the maintenance of IT systems
during this pandemic.
Make certain that you back up all critical systems and
validate the integrity of backups, ideal y arranging for
offline storage of backups regularly. Expect an increased
risk of ransomware during the COVID-19 pandemic as
organised crime groups exploit COVID-19 themed
phishing.
Lastly, work with your incident and crisis management
team to strive to ensure your organisation has an
alternate audio and video conferencing environment
available. This alternate platform wil  be needed if you do
have a ransomware incident that disrupts your IT
systems. And wil  also provide additional redundancy if
your primary conferencing provider has capacity or
availability issues.
COVID-19 wil  drive significant changes in how you and
your organization work, stay safe and stay secure.

   COVID-19 Sector Implications Report / KPMG / 17

Please free to contact either the authors or your regular KPMG
contact if you would like any further information.
Kay Baldock
National Managing Partner, Brand & Growth
T  +64 9 367 5316
E  [email address]
James Ikonen
Head of Business Development, Audit
T  +64 9 367 5837
E  [email address]
kpmg.com/nz
This document is made by KPMG, a New Zealand Partnership and a member firm of the KPMG network of independent firms affiliated with KPMG International Cooperative
(“KPMG International”), a Swiss entity, and is in al  respects subject to the negotiation, agreement, and signing of a specific engagement letter or contract. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis-à-vis third parties, nor does KPMG International
have any such authority to obligate or bind any member firm.
© 2020 KPMG, a New Zealand partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG
International”), a Swiss entity. Al  rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative (“KPMG International”), a Swiss entity.