It is 10 p.m. on a Sunday. A screenshot is spreading on WhatsApp groups – your customers’ data, apparently leaked.
By breakfast, Kenyans on X have a hashtag, a verdict and a sentence. Your board has not yet met.
When it does, it will do what boards do: consult counsel, draft a resolution and wait for the minutes. Hours later, someone will turn to the communications team and say, “Fix the messaging.”
That sentence is where the damage is done. By then the real decisions have been made, and nobody asked how they would land.
Picture a Nairobi insurer on a Monday morning. A video of a rejected claim has been shared thousands of times.
The lawyers are drafting a holding statement, the board is waiting for a quorum, and the communications manager is learning about the crisis from X.
When the company speaks on Wednesday, the public has decided who is to blame. Nothing in the statement was untrue. It was simply late, and in a crisis, that is often the same thing.
Yet, most boards still treat public relations as a fire extinguisher, grabbed once the building is burning. It should be a smoke alarm, wired into the walls to catch the first whiff of trouble, and it must be connected to the whole building.
Many crises begin inside, with a leaked memo, a whistleblower or an employee’s post. A board that makes bad news hard to send upward will hear it first from the public.
Why do capable boards keep getting this wrong? Partly, it is manners. Directors are respectful people who value process, and in a crisis, that respect hardens into groupthink. Partly, it is a quiet turf war.
Lawyers advise silence to limit liability; communicators know that silence reads as guilt. Both are right, and a board that hears only one, will choose badly.
The law has already moved the clock. Section 43 of the Data Protection Act, 2019 requires a data controller to notify the Data Commissioner within 72 hours of becoming aware of a breach, a legal deadline with a public consequence.
Section 145 of the Companies Act, 2015 requires directors to exercise the care, skill and diligence of a reasonably diligent person, and the Capital Markets Authority’s Code of Corporate Governance expects listed companies to oversee risk, as the Mwongozo Code does for state corporations. Reputation is part of that risk.
Technology will not rescue us. A smart board portal and a dashboard of sentiment scores feel like readiness, but they are not.
Misinformation, disinformation and deepfakes, can knock millions off a share price while the board debates its first sentence.
This is the proposal. Give the Chief Communications Officer a permanent seat as an adviser next to the general counsel in the Board Risk Committee or the Audit and Governance Committee. Since members are directors, they do not have a vote.
Add reputational risk to the risk register, decide ahead of time what will cause escalation, and monitor metrics like time to first statement.
The first hour is a bad moment to find out who gets to say what, so practice a crisis together.
Governance builds integrity from the inside out; communication builds trust from the outside in. Public relations is not spin.
Done well, it tells the board what is being said, why it matters, and what to do about it, before the damage is done.
So, before your next board meeting, ask three questions. When did communications last review our risk register? Who decides what we say in the first hour? And who in the room is watching the story right now?
Because somewhere tonight, a screenshot is spreading.
