What crisis reveals about a startup

Many businesses overlook the importance of crisis planning when building their ventures. Founders are typically preoccupied with growth, attracting customers, hiring staff, launching products, and securing funding. Even in well-established organizations, preparing for disruptions is often postponed until something goes awry. For entrepreneurs in the Middle East and North Africa (MENA), however, such disruptions are not mere theories.

Companies are venturing into markets fraught with geopolitical tensions, economic instability, regulatory shifts, and fluctuating access to capital, frequently while operating teams, customers, and suppliers across several countries. Consequently, resilience transforms from a corporate exercise into an essential operating capability.

The businesses that thrive amidst disruption are often those that have proactively prepared their personnel, systems, and decision-making processes before facing such challenges. Experience may seem like a beacon guiding one through a crisis, but the reality is that most leadership skills are honed in normal circumstances, not under high-pressure situations.

When time is limited and the stakes are high, leaders are often forced to improvise, and improvisation can prove perilous. According to PwC's Global Crisis Survey, 95% of business leaders anticipate encountering a crisis, yet nearly a third allocate no staff to preparation. While 70% believe they would recover well from disruption, only around a third possess the resilience foundations necessary for resilience.

Not every disruption qualifies as a crisis, as a crisis threatens something an organization cannot afford to lose: its people, operations, reputation, or customer trust. It also compresses the decision-making timeframe and pushes the organization beyond its conventional operational parameters. For MENA startups operating across multiple jurisdictions, these risks can intersect.

A geopolitical event could disrupt a supply chain, impact customer demand, and delay fundraising concurrently. Regulatory changes in one market might compel a company to reassess its operations or expansion strategies. A crisis rarely confines itself to a single function. There are also varying levels of crisis. I conceptualize it as a ladder: a disruption tests the system, an incident shatters part of it, and a crisis jeopardizes the entire structure.

What propels you upward on this ladder is not solely the crisis's magnitude but how swiftly decision-making time evaporates and how much improvisation is required.

Regardless of the crisis type, each tests the same foundational elements: leadership, decision-making, trust, communication, and adaptability. During my 21-year tenure in special operations, crisis was not an interruption to the mission; it was the mission itself. It taught me three crucial lessons: you do not rise to the occasion; you fall to the level of your preparation.

Trust is cultivated before a crisis, not during it. The debrief is where growth occurs. The breach that goes unnoticed. The snake in the metaphor is subtler than the truck, such as ransomware locking your screens. The snake is the quiet, less conspicuous threat: an employee's credentials leaked through a third-party breach and subsequently utilized by an attacker to gain authorized access.

The alarm may not ring immediately, as nothing initially appears hacked. In one instance, breached credentials were detected before exploitation. The attack was initially perceived as an IT issue. However, the decisive leadership decisions often prove more impactful. Whether to trigger a company-wide reset, how to convey the issue, and who assumes responsibility for the response—these are leadership decisions.

While technology may precipitate the crisis, leadership determines the organization's response. In cases where trust is based on instinct alone—such as retaining employees from acquired businesses—the risk of a breach increases. This hold particular significance for MENA startups experiencing rapid expansion across diverse markets and operational cultures, where internal governance may not keep pace with growth.

Technology may reveal the problem, yet the underlying weakness typically lies within the organization's framework. Crisis planning does not necessitate exorbitant costs. Startups and SMEs do not require substantial budgets; instead, they require improved habits. Develop a concise one-page plan outlining decisions, communication channels, and contact points for the three most likely crises affecting the business.

Conduct a 30-minute tabletop exercise quarterly, simulating a realistic scenario and assessing the team's response within the first hour. Whether a significant customer's data is compromised, a payment provider goes offline, or regional disruption impacts one of your key markets, discussing the response once is far more beneficial than presuming everyone will instinctively know what to do during a crisis.