The level of interest by African organisations in business continuity management (BCM) has risen in recent years.
The report of a KPMG BCM Survey performed in 18 African countries in 2013, entitled Business Continuity Management in Africa: Building Resilience in a Volatile Environment, reveals that a growing number of African leaders are concerned with key risks of doing business in Africa, such as, information systems and critical infrastructures disruptions, corruption, cyber attacks and fire dangers.

As a result, IT disaster recovery planning is becoming a priority and crisis management and business recovery planning are also starting to form part of the agenda.

In Africa, most economies are growing at a rapid rate, compared to economies in more developed countries. Despite this, the continent is still plagued with old challenges in poor infrastructure, regulations and corruption.

Added to this, in recent years, the continent has suffered from floods in West and Southern Africa, cyclones in Madagascar, earthquakes in Malawi and cyber-attacks threats.

With significant investments into African markets driving rapid urbanisation and transformation towards modern societies that are more dependent on interconnected critical infrastructure, resilience planning to face natural disasters, cyber attacks, terrorism and other threats is a clear imperative to sustained and profitable operations.

“As business markets become increasingly more complex and competitive, to build on the opportunities and succeed, companies doing business in Africa need to consider internal, regional and global risks and build resilience to a volatile environment,” says Moses Kgosana, chairman and senior partner at KPMG Africa.

“Africa’s fast economic growth has highlighted the need to pay more attention to risk management and ultimately to business continuity management as a corporate discipline.”

BCM is about a holistic process that identifies potential threats to an organisation and the potential impact those threats might have on business operations. The idea behind BCM is to provide a framework for building organisational resilience that safeguards the interests of key stakeholders by preventing financial losses and reputation or brand damage in the event of internal or external business disruptions.

According to the survey results, almost two thirds of the respondents have a BCM programme in place and 27% state that that have had their programme implemented for more than five years.

Additionally, the survey noted that the people in charge of BCM programmes typically held high management positions, with the CEO having the ultimate responsibility over implementation in 50% of the organisations.

Other common C-level executives who were responsible for the overall success of BCM programmes included the chief operating officer (13%), the CIO (12%) and the chief risk officer (11%).

Although the appreciation of business resilience and the adoption of BCM programmes have increased in Africa, business continuity has not reached a state of maturity that it is being embedded in the organisational culture and only 26% of the organisations stated that they have a business continuity director that is fully dedicated to the function.

In most organisations the role is assumed by another function, for example, an information systems director or risk management director with a partial dedication to the business continuity manager role. In such cases it is possible and even likely that the BCM programme could become a second, or eventually a last priority, for the manager.

Added to this, the survey revealed that BCM standards adoption is still low in Africa, 61% of the organisations across Africa did not follow a BCM standard to support the implementation of their BC programme, less than 2% had their BC programme certified and less than 6% were planning to certify their BC programme in the next three years.

The adoption of standards would allow organisations throughout Africa to follow international business continuity best practices and reduce current weaknesses in their BC programmes.

“We have found that many organisations in Africa either have not implemented the majority of the BCM components or have not reviewed them in the last three years. These businesses, for instance, don’t perform business impact analysis to identify critical business processes and adequate recovery strategies or have performed it so long ago that it does not cover recent business changes,” says Cristina Alberto, head of Business Continuity services at KPMG Angola and the author of the report.

In addition, these organisations often don’t have crisis management or business recovery plans, nor do these businesses perform regular BCM tests, exercises, reviews, updates and comprehensive awareness campaigns.

This can be a direct result of the board’s ability to appropriately assign funding and resources to BCM responsibilities and the risk to these businesses is that they will most likely not be able to respond to an operational disruption in a co-ordinated manner or not have adequate recovery solutions in place.

“In these challenging times, business continuity should be a priority area on the corporate agenda. BC programmes cannot prevail without a clear and effective funding and resourcing allocation strategy that will enable the business to implement all required BCM components and keep BC alive in the organisation culture.

“The only way to minimise risk and uncertainty is to be prepared to respond to a disruptive incident, keeping the business running,” says Alberto.