What follows are not generic outbreak management principles. They are observations drawn from direct field experience coordinating outbreak surveillance and response within WHO Nigeria's programmes observations about what the theory of outbreak response fails to account for when it meets operating conditions in West Africa.
These lessons are not exhaustive. They are the ones that changed how I design surveillance systems.
Lesson 1: The First 72 Hours Reveal Everything About the System
The first 72 hours of an outbreak response tell you more about the health system's surveillance architecture than months of routine monitoring data. In that window, every structural weakness becomes an operational failure: the LGA DSNO whose position has been vacant for six months, the contact tracing form that has never been used in a real investigation, the laboratory that does not have a protocol for the relevant specimen type.
In the COVID-19 response at scale coordinating 53,000+ case investigations across multiple states the systems that functioned in the first 72 hours were the ones that had been stress-tested before the emergency. The systems that failed were the ones that had been designed for routine operations and assumed that emergency conditions would somehow activate capabilities that did not exist in routine conditions.
The implication: Outbreak preparedness is not primarily a training exercise. It is a system resilience exercise. The question is not "do our staff know the outbreak response protocol?" The question is "can our system perform the protocol under the conditions that will actually exist during an outbreak with stressed staff, degraded communication infrastructure, and simultaneous demands across multiple response functions?"
Lesson 2: Contact Tracing Is Where Outbreaks Are Controlled or Lost
For person-to-person transmitted diseases, contact tracing is the intervention that determines whether an outbreak is contained or amplified. It is also the response function most frequently under-resourced and under-executed.
Contact tracing has two components that are equally important and frequently confused: listing (identifying who was in contact with a confirmed case during the infectious period) and follow-up (monitoring listed contacts for symptoms for the full incubation period of the disease). Contact listing without follow-up is not contact tracing it is contact listing. It identifies who might be at risk. It does not interrupt transmission.
In the Mpox response across Imo State covering 231 investigated cases across 27 LGAs contact listing was generally well executed. Follow-up completion was the gap. When the follow-up workload exceeded the capacity of available surveillance officers, contacts were listed and not followed, cases in contacts were not detected during the incubation period, and transmission chains extended beyond the reach of the response.
The implication: Scale contact tracing capacity to the follow-up workload, not the listing workload. Listing is faster than follow-up. A response that is well-staffed for listing but not for follow-up will consistently fail at the point where it matters most. This is a resource planning decision that must be made before the outbreak, not during it.
Lesson 3: Laboratory Integration Is a Response Speed Multiplier When It Works
Outbreak confirmation without laboratory confirmation is epidemiological inference important and actionable, but uncertain. Laboratory confirmation converts probable outbreaks into confirmed ones, enables pathogen characterisation, and provides the evidence base for specific interventions (vaccine selection for meningitis, antibiotic guidance for cholera).
The challenge in the responses I have been part of is that laboratory integration the chain from specimen collection at investigation through transport, testing, and result communication back to the surveillance system is the most fragile link in the entire response architecture.
Cold chain failures during specimen transport are common in West African settings. Laboratory queue times extend during high-volume outbreak responses precisely when fast results are most needed. Result communication through informal channels (phone calls, WhatsApp messages) rather than the surveillance system means that laboratory data and clinical-epidemiological data exist in parallel rather than being integrated into a single case record.
The implication: Invest in laboratory integration infrastructure before the outbreak, not after. Pre-positioned specimen transport kits, defined specimen courier routes, standardised result reporting templates that feed directly into SORMAS or DHIS2, and defined turnaround time standards with escalation protocols these are not emergency measures. They are preparedness investments that determine response speed at the moment of highest demand.
Lesson 4: Risk Communication Determines Community Compliance
A technically perfect outbreak response that generates community fear, mistrust, or non-compliance is not a successful response. It is a response that managed the pathogen while losing the community with consequences for vaccine uptake, care-seeking behaviour, and future response cooperation that outlast the specific outbreak event.
The COVID-19 response in Nigeria generated significant community-level mistrust in some LGAs in part because risk communication was centralised, delayed, and technically framed rather than community-centred, timely, and trust-building. Cases who feared stigma or quarantine sought care outside the formal health system. Contacts who feared the response avoided identification. Both behaviours amplified transmission.
Risk communication is a surveillance function, not just a communication function. How communities understand and respond to the outbreak and to the response determines the quality of the case and contact data that the surveillance system receives. Surveillance systems that treat community cooperation as a given rather than a designed outcome will consistently undercount cases in the populations where trust is lowest.
The implication: Design community engagement into the surveillance architecture, not as a secondary communication activity but as a core data quality function. Community health workers who have established trust relationships in their communities produce higher quality case notifications than those who are deployed only during emergencies. Those relationships are built in routine, not deployed in emergency.
Lesson 5: cVPV2 Taught Us That Surveillance Assumptions Have Expiry Dates
Circulating vaccine-derived poliovirus type 2 (cVPV2) is in many ways the most instructive surveillance story in recent Nigerian public health history not because of the pathogen itself, but because of what its emergence revealed about the limitations of surveillance system design assumptions.
The acute flaccid paralysis (AFP) surveillance system designed to detect wild poliovirus is a sophisticated, well-resourced system with high sensitivity for classical polio presentation. cVPV2 presented challenges that exposed the gaps between what the system was designed to detect and what it was actually encountering: cases presenting with atypical neurological features, geographic clustering in populations with high OPV coverage but low mOPV2 coverage, and transmission chains that operated below the threshold at which AFP surveillance was calibrated to signal.
The system had not failed. Its assumptions had aged. The surveillance architecture designed for wild poliovirus in the early 2000s was meeting a pathogen variant and an immunological context that its design had not anticipated.
The implication: Every surveillance system embeds assumptions about the pathogens it is designed to detect, the populations it is designed to serve, and the health system conditions under which it will operate. These assumptions have expiry dates. Scheduled, systematic reviews of whether the surveillance system's design assumptions still hold ideally after every significant outbreak event are a core function of surveillance governance. Not a response to failure, but a prevention of it.
Lesson 6: M&E During Outbreak Response Is Not Paperwork It Is Operational Intelligence
In the early days of a rapidly evolving outbreak, M&E is often the first function to be reduced to "we'll catch up with documentation later." This is understandable. It is also costly.
Real-time documentation of response activities case investigation timeliness, contact listing completeness, specimen collection rates, follow-up completion rates is not administrative burden. It is the operational intelligence that enables response coordination to identify where the response is working and where it is failing before those failures compound.
In the COVID-19 response, the programmes that maintained real-time response monitoring using SORMAS dashboards and daily data reviews were able to identify geographic gaps in contact tracing coverage, reallocate rapid response teams to underperforming LGAs, and accelerate case investigation in facilities where investigation timeliness was degrading. The programmes that suspended monitoring to focus on operations discovered the same failures weeks later, when the compounding had already occurred.
The implication: Response M&E is a real-time management function, not a documentation function. The minimum viable monitoring package for an outbreak response should be defined before the outbreak a set of five to eight response performance indicators that can be collected and reviewed daily with minimal administrative burden. See How to Design M&E Indicators for the design framework.
Lesson 7: After-Action Reviews Are Only Valuable if They Are Honest
Every significant outbreak response I have been part of has been followed by an after-action review. Some of them have been genuinely valuable: honest, specific, analytically rigorous, and productive of changes that improved subsequent response capacity. Others have been consensus documents accounts of what happened that preserved institutional relationships at the cost of institutional learning.
The difference between a valuable and a performative AAR is almost always the same: the willingness of programme leadership to name what failed specifically, including the system failures that are uncomfortable to acknowledge because they reflect on institutional decisions, not just individual performance.
A system that generated 53,000 case investigations across a major pandemic response produced failures at every level in detection, in investigation, in laboratory linkage, in contact tracing follow-up, in risk communication. Naming those failures specifically, tracing them to their system causes, and designing concrete changes to address them is what makes an after-action review an investment in future response capacity rather than a report that sits in a shared drive.
The implication: Build psychological safety into the AAR process explicitly. Name, at the start of every after-action review, that the purpose is institutional learning and system improvement not individual accountability. Then honour that framing in how findings are documented and acted on.
The Common Thread
Looking across the COVID-19, Cholera, Mpox, and cVPV2 responses, the failures that amplified transmission and the successes that contained it share a common pattern.
The responses that worked fastest were the ones that had invested in system preparedness the infrastructure, protocols, relationships, and data quality foundations that allowed the response to start at full operational capacity on Day 1. The responses that struggled were the ones that were building the system during the emergency.
Preparedness is not a separate activity from response. It is the investment that determines the starting position from which every response begins. And the starting position the quality of the surveillance system, the completeness of the response protocols, the strength of the community trust relationships, the reliability of the laboratory integration determines the outcome more than any decision made after the outbreak begins.