For South African organisations, when it comes to disruptions, “it will never happen to us” has become business as usual. Resilience isn't a theoretical concept. We experience it daily through power challenges, water scarcity, economic pressures and governance complexities. Yet these realities have also taught us valuable lessons about adaptability, innovation and perseverance.
If your business is handling one of these disruptions like a power outage or a supply chain failure, chances are there are already defined workarounds. But if any of these crises coincide with a natural disaster or a cyber attack, keeping your business operating as usual is much harder.
“We call this a polycrisis, when multiple disruptions occur concurrently, putting pressure on businesses to figure out how to deal with more than one disruption at a time,” explains Nashikta Angadh, Head of Technology Risk at KPMG Southern Africa.
“I spoke at the BCI Southern Africa conference recently, and we divided the room in two. One group tackled disruptions individually, while the other had to respond to all disruptions simultaneously. The idea was to consider the best approach to dealing with a polycrisis. Of course, there was no clear winner.” Angadh advises that businesses need to understand their key priorities and know what to prioritise in the event of a crisis. Resources should be allocated according to these priorities.
Understanding how long a system can be unavailable (recovery time objective) and how much data you can afford to lose (recovery point objective) is important, she adds. But businesses are increasingly prioritising operational resilience, which asks a broader question: How much disruption can an important service tolerate before customers suffer unacceptable harm. Behind every system, process and performance metric are real people. Real people waiting for a funeral claim to be paid out or to access their bank account. Businesses need to consider this when making decisions about building resilience in the organisation.
According to her, crisis exercises and rehearsals are imperative and have evolved beyond desktop simulations. “We now use AI to generate deepfakes to make the scenario feel as real as possible. The more realistic it is, the greater the buy-in and the more authentic the responses are.” AI can accelerate misinformation, fraud and cyber attacks. Organisations are also embedding AI into critical processes. What happens when an AI service becomes unavailable, produces unreliable outputs or depends on inaccessible data or third parties? She adds: “The use of AI has put pressure on organisations to respond with speed and clarity. In the case of Mythos, you also cannot defend machine-speed attacks at human speed. This is why organisations need to be proactive and stay ahead.
“In the era of the polycrises, the lesson we need to take away is we must be prepared for the unexpected. This means thinking about tomorrow’s disruptions today and putting measures in place so we can respond to it, shape it and turn it into an opportunity rather than fearing it.”
Share
Editorial contacts