A generator is not a business continuity plan. Neither is a backup that has never been restored. Business continuity planning for Nigerian SMEs means identifying the few services that must continue, understanding what they depend on and preparing practical alternatives before power, connectivity, supply, cash flow, technology or key people fail.
ISO 22301 describes a management framework for protecting against disruption, responding and recovering. An SME can apply the same logic without producing a large manual: know the priorities, assign authority, prepare workable options, practise them and improve.
Start with a business impact analysis
List products and services, then ask how their interruption affects people, customers, cash, contracts, reputation and legal obligations after two hours, one day, three days and one week. Identify the maximum tolerable disruption and the minimum level of service that must continue.
For each priority activity, map dependencies:
- named people and specialist knowledge;
- electricity, fuel, connectivity and communications;
- premises, equipment and vehicles;
- applications, data and credentials;
- suppliers, couriers, payment providers and banks; and
- working capital and customer payments.
Set recovery targets
The recovery time objective is the target time to restore a service or system. The recovery point objective is the amount of data loss the business can tolerate, expressed as time. A business that can recreate one day of enquiries has a different backup need from one that cannot lose a single paid order.
Targets should be realistic and funded. “Immediate recovery” sounds safe but may require costly duplication. Match protection to customer, financial and safety impact.
Prepare for power and connectivity disruption
- Identify the critical electrical load instead of trying to power everything.
- Maintain generators, inverters, solar systems and safe fuel arrangements.
- Test runtime under load and document the switching procedure.
- Use at least one alternative internet path for priority work where feasible.
- Keep approved offline forms or procedures for short outages.
- Protect equipment from unsafe shutdown, surges and improvised wiring.
Record who may authorise workarounds and how offline transactions will be reconciled without duplication when systems return.
Reduce supplier and inventory concentration
Identify single-source inputs, long lead times and suppliers whose failure would stop the business. Prequalify alternatives, keep current contacts, understand substitute specifications and set trigger levels for critical stock. Do not wait for a shortage to discover that an alternative supplier requires new payment terms or quality approval.
Share forecasts and constraints with important suppliers. Continuity improves when both parties understand demand, lead time and escalation.
Protect data and access
Maintain supported systems, strong multifactor authentication and role-based access. Keep tested backups that cannot all be altered by the same compromised administrator or ransomware event. Document how to restore priority applications, where clean credentials are held and who can contact the provider.
Prepare a paper or offline contact list for response leaders, technology support, insurers, banks, landlords, critical suppliers and key customers. A plan stored only inside the unavailable system is not available.
Plan for key-person absence
List decisions and tasks that only one person can complete. Create deputies, controlled access to essential information, current procedures and a handover rhythm. Separate duties for sensitive payments and approvals; continuity should not weaken fraud controls.
Build a cash-flow continuity layer
Model how a disruption affects sales, collections, payroll, supplier payments and emergency costs. Maintain a current receivables list, prioritise critical payments, understand available facilities and agree who can approve exceptional spending. Communicate early with customers and lenders; silence usually reduces options.
Create a short incident structure
Define the trigger, incident lead, operations lead, communications lead and technology or facility support. State who can stop unsafe work, activate an alternative site, contact customers, approve spending and declare recovery.
The plan should answer:
- What happened and is anyone unsafe?
- Which priority service is affected?
- What decision is required now?
- Who needs accurate information?
- Which workaround is approved?
- What evidence and transactions must be recorded?
- What conditions allow a safe return to normal?
Test the plan in small exercises
Run a quarterly tabletop scenario and focused technical tests throughout the year. Examples include restoring a sample backup, operating a priority workflow on backup power, reaching the response team, switching internet connection, processing an offline order and responding to an unavailable supplier.
Each exercise should record the expected result, actual result, gaps, owner and correction date. A failed test is valuable when it leads to a safer plan.
One-page continuity plan template
- Priority services and minimum acceptable level
- Activation triggers and incident leader
- Response team and contact methods
- Power, connectivity, people, supplier and data workarounds
- Customer, staff and stakeholder communication
- Recovery targets and return-to-normal checks
- Transaction and decision log
- Last exercise, lessons and next review date
G-Consulting helps businesses diagnose operational risk, strengthen processes and build management capability. Learn more about our multidisciplinary services or discuss a continuity and resilience review.
Frequently asked questions
Is business continuity the same as insurance?
No. Insurance may transfer some financial loss. Continuity planning helps the business protect people, maintain priority services and recover operations.
How often should an SME test its plan?
Review after material change or an incident, run periodic tabletop exercises and test critical technical controls such as power and backup restoration on a defined schedule.
What is the first continuity document to create?
Create a one-page priority-service and response plan supported by current contacts, recovery instructions and a decision log.
Does a cloud system remove continuity risk?
No. It changes the risk. The business still depends on credentials, internet, provider availability, configuration, data export, support and its own recovery procedures.
