Prepare for the unexpected - A case for crisis management

At approximately 8:30 am on 11 December 2023, a fire broke out at City House, a large business and shopping complex located in Kampala, Uganda's capital. The complex houses several rental spaces, including the Democratic Party offices, Semu Semu Hotel, Bata Shoes and Forte Betting offices.Tragically, the fire resulted in potential damage to business merchandise and the loss of a life. Despite the response by the relevant agencies to contain the situation, a lot of property, monetary and business losses are anticipated.

No business, company or institution is immune to unforeseen incidents, emergencies and disasters such as fires, floods, terrorist attacks, pandemics, civil unrest etc. Such events depending on their magnitude can render critical resources required for service delivery unavailable. This can in turn result in dire consequences including operational shutdown, financial loss, reputational damage (loss of trust and credibility), legal penalties, strained stakeholder relationships, loss of employee morale etc.

On the flip side, companies and institutions can choose to be resilient - the ability to respond in an organised and coordinated manner in the event of unforeseen incidents, emergencies or disasters. By doing so, the impact of these events can be minimised to acceptable levels, and lives and resources are protected. Moreover, the business is also able to resume to normal operations within a timeframe that is predetermined and approved. This would not only ensure that the value of the company is protected, it would also represent a key competitive edge.

Resilience requires proactive thinking and planning against and ahead of unforeseen risk events. Organisations need to establish the required business continuity, crisis and emergency response framework and policies to set the tone and provide guidance on how it would achieve resilience. This would typically provide the structure for the practices that should be adopted and the processes that should be performed. Once the framework and policies have been established, organisations should at the minimum perform the following:

• conduct risk assessments and business impact analysis to identify potential risk events and establish the impact that the risk events could create.

• design and implement control measures to minimise the probability of occurrence and/or the impact it could create.

• establish recovery targets and objectives which are aligned with the company's tolerance levels and resilience targets.

• identify recovery options which enable the achievement of the recovery targets and objectives at an optimal cost. 

• define crisis management and emergency response plans based on selected recovery options, providing step by step action that would be taken to preserve life and other key resources. 

• define test plans and conduct periodic tests of the plan through drills and simulations to confirm that they achieve the desired results and allow for timely remediation of any gaps noted.