What a business continuity plan actually needs to include (ISO 22301, for Kenyan SMEs)
In most of the internal audits we run for clients across Nairobi and the wider region, the business continuity plan is the document that gets the least attention, usually because it's a template downloaded once, filled in for a certification audit, and never opened again. That's a problem, because a BCP that hasn't been tested is really just a set of assumptions about how your business will behave under pressure, and those assumptions are usually wrong.
Start with the business impact analysis, not the plan
The single most common gap we see is organisations writing a continuity plan before they've done a proper business impact analysis (BIA). The BIA is what tells you which processes actually need to be back up within hours versus days, and what the real cost of downtime looks like, in lost revenue, contractual penalties, or reputational damage with key clients. Without it, a plan ends up treating every process as equally urgent, which means none of them get the resourcing they actually need when something goes wrong.
The sections your plan needs, at minimum
Under ISO 22301, a workable plan needs to cover:
Activation criteria and roles. Who decides the plan is being invoked, and what specifically triggers that decision? Vague language like "in the event of a major disruption" leaves too much room for delay when speed matters most.
Recovery time objectives per critical process. Pulled directly from the BIA, not estimated on the day the plan is written.
Communication protocols. Internal (staff, management) and external (clients, regulators, suppliers), including who is authorised to speak publicly about an incident. We've seen otherwise solid recovery efforts undermined by inconsistent messaging to clients in the first 24 hours.
Resource and alternate-site arrangements. Where does the team work from if the office is inaccessible? What's the fallback if your primary ISP or power supplier fails, which is a real risk for Kenyan businesses regardless of sector?
A tested recovery procedure, not just a list of contacts.
Why "tested" is the part most plans skip
A plan that has never been exercised is, in our experience, close to useless in a real incident. Testing doesn't need to mean a full-scale simulation every quarter. A tabletop walkthrough with the response team, run once or twice a year, surfaces most of the gaps: missing contact details, unclear authority to act, dependencies nobody had mapped. ISO 22301 expects this kind of exercise and documented review as part of maintaining certification, and it's also simply the difference between a plan that works and one that looks good in an audit file.
Where this fits with your other certifications
If you're already certified to ISO 9001 or ISO/IEC 27001, a lot of the groundwork for ISO 22301 (risk assessment methodology, document control, management review) is already in place. Business continuity tends to be a faster add-on for organisations that have already built that discipline, which is worth factoring in if you're weighing where to invest next.
Getting a second opinion on your current plan
If you already have a continuity plan and aren't sure whether it would hold up in a real disruption, a short gap review is usually enough to tell you. We're happy to have that conversation without a sales pitch attached.