Business Continuity Planning to Overcome Adversity

The past two years have been a difficult time for Kenyan organisations. Many Kenyan businesses have failed as a result of the global pandemic. Sadly, even those organisations that “weathered” the proverbial storm may continue to suffer as the world enters a likely recession. A primary difference between those organisations that succeed and those that fail is preparation and purposeful adaptation. Those organisations that can proactively plan for adverse events and quickly adapt to overcome challenges are considered resilient–and resiliency is a characteristic towards which all organisations should strive.

Resilient organisations have adopted emerging technology and innovative ways of working with their employees and customers. Further, these organisations have adapted to decentralise critical business functions, enfranchise entrepreneurship among their employees, and create more efficient organisational structures that are better suited to a remote and decentralised workforce. These adaptations, however, are often challenging to implement–particularly among industries and sectors where the adoption of new technology has been slow.

Kenyan organisations have not yet “missed the boat”, however. There is still ample opportunity to build a more resilient organisation. Further, organisations that survived the COVID-19 pandemic now have a chance to review their successes (and failures) and learn valuable lessons to better prepare for the next global crisis. While informal reviews of successes and failures are likely to yield positive results, there are more formal methods through which organisations can become more resilient and better prepare for the next crisis.

Business Continuity Plans (“BCP”) is a set of procedures, policies and guidelines that an organisation can build to enhance resilience in the face of adversity. Just as organisations conduct fire drills to help minimise the consequences of a fire, BCPs help organisations prepare for various adverse events. Although there is no “set” formula for building a business continuity plan, successful plans will generally contain three elements: a business impact analysis, risk mitigation, and continuity strategies.

A business impact analysis (“BIA”) is a process designed to identify critical business functions. The BIA will assess the consequences of their failure and assign value to those failures. The BIA will then attempt to prioritise these critical functions based on their relative importance to the organisation’s success.

Using the information gathered during the BIA, continuity planners should then assess risk. The risk assessment is designed to inform the continuity planner about the likelihood of a critical function being affected by an adverse event. The greater the risk, the greater the planning for the event must be. The BIA will help planners understand these relationships and prioritise risk based on this information.

Finally, organisations should build continuity strategies and plans based on the BIA and risk assessment. While every organisation is unique, such strategies may include;

1. Building redundant infrastructure for core functions,
2. Proactively establishing remote working capabilities,
3. Diversifying supply chains and identifying multiple sources for critical inputs,
4. Establish partnerships with other businesses to provide critical functions if your organisation is adversely affected.

When building continuity plans and procedures, it is crucial to consider that some business functions cannot be replaced or eliminated. One area of great concern in Kenya is the apparent retasking of security guards. Those individuals who were there to safeguard us from violence have become defacto public health officials. While ensuring COVID-19 safety guidelines are enforced is an important job, security is an equally critical function. Business continuity plans must account for such discrepancies.

Critically, BCPs are not static documents. As such, they must be managed and updated regularly. Organisations should test the plans at periodic intervals to ensure that they remain relevant and account for changes in the organisation or environment. Additionally, organisations should adapt their business continuity plans to account for emerging threats and risks.

Finally, and most importantly, organisations need to train their staff to implement all continuity plans properly. When the key stakeholders are aware of the plan–and their responsibilities under the plan–the entire organisation is better prepared to respond quickly and effectively during a crisis.

The global pandemic may have been a difficult time for many Kenyan organisations. Yet, it presents an unprecedented opportunity for businesses to adapt and grow stronger for the next crisis proactively.