Critical functions in ensuring effective business continuity management. Evidence from Romanian companies
Abstract
The paper explores how business continuity management (BCM) is defined within the professional and academic communities that work in the field or research it. It sets out the framework for the composing elements of a BCM that emerge and considers how these various elements can interact with each other to build a sound business continuity management. Also, the paper aims to examine the organization’s critical functions that ensure an effective BCM. The research relies on a questionnaire-based survey, with data collected by personally interviewing top and middle-level managers from Romanian small and medium-sized companies. The results, which count on the responses of 119 participant companies, show that risk assessment takes a critical role in building the organization’s BCM strategy, while business continuity response planning has the strongest impact on the overall effectiveness of the organization’s BCM. The novelty of this research lies in a first time establishment of the critical functions that are vital for companies to maintain their essential business operations in case of disruptive incidents, to build organizational resilience. Future research should be grounded on testing if the BCM arrangements and business impact analysis influence the BCM strategy as the existing data did not prove that it did.
Keyword : business continuity management, critical functions, risk assessment, business continuity planning, ISO 22301, small and medium enterprises, Romania
How to Cite
Păunescu, C., & Argatu, R. (2020). Critical functions in ensuring effective business continuity management. Evidence from Romanian companies. Journal of Business Economics and Management, 21(2), 497-520. https://doi.org/10.3846/jbem.2020.12205
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
Bajgoric, N. (2014). Business continuity management: a systemic framework for implementation. Kybernetes, 43(2), 156–177. https://doi.org/10.1108/K-11-2013-0252
Bakar, Z. A., Yaacob, N. A., & Udin, A. M. (2015). The effect of business continuity management factors on organizational performance: A conceptual framework. International Journal of Economics and Financial Issues, 5, 128–134. https://doi.org/10.31580/jmi.v7i1.38
Bell, M. A. (2002, January 7). The five principles of organizational resilience. Gartner, Inc. https://www.gartner.com/doc/351410/principles-organizational-resilience
Braun, T., & Martz, B. (2007, August). Business continuity preparedness and the mindfulness state of mind. Paper presented at the 13th Americas Conference on Information Systems, AMCIS 2007, Keystone, Colorado.
Burnard, K. J., Bhamra, R. S., & Tsinopoulos, C. (2018). Building organizational resilience: Four configurations. IEEE Transactions on Engineering Management, 65(3), 351–362. https://doi.org/10.1109/TEM.2018.2796181
Casson, R. J., & Farmer, L. D. M. (2014). Understanding and checking the assumptions of linear regression: a primer for medical researchers. Clinical and Experimental Ophthalmology, 42, 590–596. https://doi.org/10.1111/ceo.12358
Dahlberg, R., & Guay, F. (2015). Creating resilient SMEs: is business continuity management the answer? In C. A. Brebbia (Ed.), Sustainable development (pp. 975–984). WIT Press. https://doi.org/10.2495/SD150852
Faertes, D. (2015). Reliability of supply chains and business continuity management. Procedia Computer Science, 55, 1400–1409. https://doi.org/10.1016/j.procs.2015.07.130
Ferreira Rebelo, M., Silva, R., & Santos, G. (2017). The integration of standardized management systems: managing business risk. International Journal of Quality & Reliability Management, 34(3), 395–405. https://doi.org/10.1108/IJQRM-11-2014-0170
Filipović, D., Krišto, M., & Podrug, N. (2018). Impact of crisis situations on development of business continuity management in Croatia. Management: Journal of Contemporary Management Issues, 23(1), 99–122. https://doi.org/10.30924/mjcmi/2018.23.1.99
Fischbacher-Smith, D. (2017). When organisational effectiveness fails: Business continuity management and the paradox of performance. Journal of Organizational Effectiveness: People and Performance, 4(1), 89–107. https://doi.org/10.1108/JOEPP-01-2017-0002
Fitzgerald, K. J. (1995). Establishing an effective continuity strategy. Information Management & Computer Security, 3(3), 20–24. https://doi.org/10.1108/09685229510092039
Foster, S. P., & Dye, K. (2005). Building continuity into strategy. Journal of Corporate Real Estate, 7(2), 105–119. https://doi.org/10.1108/14630010510812530
Ghandour, A. (2014). Identifying dimensions of business continuity plan from common expressions among business continuity professionals. International Journal of Business Administration, 5(3), 136–141. https://doi.org/10.5430/ijba.v5n3p136
Gibb, F., & Buchanan, S. (2006). A framework for business continuity management. International Journal of Information Management, 26, 128–141. https://doi.org/10.1016/j.ijinfomgt.2005.11.008
Gorzeń-Mitka, I. (2016). Shaping of organizational resilience in an unstable world: possibility or necessity? Problems of Management in the 21st Century, 11(2), 68–70.
Hamid, A. H. A. (2018). Limitations and challenges towards an effective business continuity management in Nuklear Malaysia. IOP Conference Series: Materials Science and Engineering, 298, 1–11. https://doi.org/10.1088/1757-899X/298/1/012050
Hémond, Y., & Benoît, R. (2012). Preparedness: the state of the art and future prospects. Disaster Prevention and Management, 21(4), 404–417. https://doi.org/10.1108/09653561211256125
International Organization for Standardization (2019). Security and resilience – business continuity management systems – requirements (ISO 22301:2019). Geneva, Switzerland.
Islam, M., Habes, E., Karim, A., & Syed Agil, S. (2016). Quality certification and company performance – the newly developed country experience. Journal of Business Economics and Management, 17(4), 628–644. https://doi.org/10.3846/16111699.2015.1110712
Jrad, A., Morawski, T., & Spergel, L. (2004). A model for quantifying business continuity preparedness risks for telecommunications networks. Bell Labs Technical Journal, 9(2), 107–123. https://doi.org/10.1002/bltj.20029
Karakasidis, K. (1997). A project planning process for business continuity. Information Management & Computer Security, 5(2), 72–78. https://doi.org/10.1108/09685229710182857
Kareem, M. A., & Alameer, A. A. A. (2019). The impact of dynamic capabilities on organizational effectiveness. Management & Marketing. Challenges for the Knowledge Society, 14(4), 402–418. https://doi.org/10.2478/mmcks-2019-0028
Karim, A. J. (2011). Business disaster preparedness: An empirical study for measuring the factors of business continuity to face business disaster. International Journal of Business and Social Science, 2(18), 183–192.
Kato, M., & Charoenrat, T. (2018). Business continuity management of small and medium sized enterprises: Evidence from Thailand. International Journal of Disaster Risk Reduction, 27, 577–587. https://doi.org/10.1016/j.ijdrr.2017.10.002
Kippenberger, T. (1999). Reducing the impact of the unexpected. The Antidote, 4(3), 28–31. https://doi.org/10.1108/EUM0000000006698
Kirvan, P. (2014, June). The importance of performance metrics in business continuity. Paper presented at the Regional Business Continuity Conference on Continuity Insights, New York.
Lobel, B. (2015, September 15). Business continuity plans not a priority for small businesses. https://smallbusiness.co.uk/business-continuity-plans-not-a-priority-for-small-businesses-2493226/
Malachová, H., & Oulehlová, A. (2016). Application of business continuity management system into the crisis management field. Transactions of the VŠB – Technical university of Ostrava, Safety Engineering Series, 11(2), 43–50. https://doi.org/10.1515/tvsbses-2016-0016
Mallak, L. (1998). Putting organizational resilience to work. Industrial Management, 40(6), 8–13.
Mansol, N. H., Alwi, N. H. M., & Ismail, W. (2014). Success factors towards implementation of business continuity management in organizations. International Journal of Digital Society, 5(1), 909–911. https://doi.org/10.20533/ijds.2040.2570.2014.0110
Mansol, N. H., Alwi, N. H. M., & Ismail, W. (2016). Managing organizational culture requirement for Business Continuity Management (BCM) implementation using Goal-Question-Metric (GQM) approach. Jurnal Teknologi, 78(12–3), 13–22. https://doi.org/10.1109/ICOS.2015.7377283
Marisa, R., & Oigo, D. (2018). Influence of organizational resources and structure on business continuity management of private security firms in Kenya. Journal of Human Resource Management, 6(1), 18–25. https://doi.org/10.11648/j.jhrm.20180601.13
Miller, H. E., & Engemann, K. J. (2019). Business continuity management in data center environments. International Journal of Information Technologies and Systems Approach, 12(1), 52–72. https://doi.org/10.4018/IJITSA.2019010104
Mironescu, R., Turcu, O. L., & Ceocea, C. (2015). The operational risk management in the Romanian SMEs. Studies and Scientific Researches. Economics Edition, 21, 76–88. https://doi.org/10.29358/sceco.v0i21.311
Moh Heng, G. (2015). Business continuity management planning methodology. International Journal of Disaster Recovery and Business Continuity, 6, 9–16. https://doi.org/10.14257/ijdrbc.2015.6.02
Mohammed, S., Mohammed, S., & Fiaidhi, J. (2019). Business continuity planning and learning based on an extension to the JDL data fusion model. International Journal of Disaster Recovery and Business Continuity, 10, 1–6.
Moraru, G. M., & Popa, D. (2018). Strategic management problems in Romanian small and mediumsized enterprises. MATEC Web of Conferences, 184(3), 1–4. https://doi.org/10.1051/matecconf/201818404015
Nienimaa, M., Jarvelainen, J., Heikkila, M., & Heikkila, J. (2019). Business continuity of business models: Evaluating the resilience of business models for contingencies. International Journal of Information Management, 49, 208–216. https://doi.org/10.1016/j.ijinfomgt.2019.04.010
Păunescu, C., Popescu, M. C., & Blid, L. (2018). Business impact analysis for business continuity: Evidence from Romanian enterprises on critical functions. Management & Marketing. Challenges for the Knowledge Society, 13(3), 1035–1050. https://doi.org/10.2478/mmcks-2018-0021
Păunescu, C. (2017). How prepared are small and medium sized companies for business continuity management? Quality – Access to Success, 18(161), 43–48.
Quendler, E. (2017). Organizational resilience: building business value in a changing world. Journal for International Business and Entrepreneurship Development, 10(2), 101–119. https://doi.org/10.1504/JIBED.2017.084301
Raşcă, L., & Deaconu, A. (2007). Romanian small and medium sized enterprises-challenges upon accession into the European Union. The Annals of the University of Oradea. Economic Sciences, 1, 578–581.
Ruiz-Martin, C., López-Paredes, A. & Wainer, G. (2018). What we know and do not know about organizational resilience. International Journal of Production Management and Engineering, 6(1), 11–28. https://doi.org/10.4995/ijpme.2018.7898
Sahebjamnia, N., Torabi, S. A., & Mansouri, S. A. (2018). Building organizational resilience in the face of multiple disruptions. International Journal of Production Economics, 197, 63–83. https://doi.org/10.1016/j.ijpe.2017.12.009
Soufi, H. R., Torabi, S. A., & Sahebjamnia, N. (2019). Developing a novel quantitative framework for business continuity planning. International Journal of Production Research, 57(3), 779–800. https://doi.org/10.1080/00207543.2018.1483586
Speight, P. (2011). Business continuity. Journal of Applied Security Research, 6(4), 529–554. https://doi.org/10.1080/19361610.2011.604021
Svata, V. (2013). System view of business continuity management. Journal of Systems Integration, 4(2), 19–35.
Torabi, S. A., Rezaei Soufi, H., & Sahebjamnia, N. (2014). A new framework for business impact analysis in business continuity management (with a case study). Safety Science, 68, 309–323. https://doi.org/10.1016/j.ssci.2014.04.017
Torabi, S. A., Giahi, R., & Sahebjamnia, N. (2016). An enhanced risk assessment framework for business continuity management systems. Safety Science, 89, 201–218. https://doi.org/10.1016/j.ssci.2016.06.015
Tvrdíková, M. (2016). Increasing the business potential of companies by ensuring continuity of the development of their information systems by current information technologies. Journal of Business Economics and Management, 17(3), 475–489. https://doi.org/10.3846/16111699.2013.839475
Urbanec, J., & Urbancová, H. (2015). The benefits of business continuity management in Czech organizations. Acta Universitatis Agriculturae Et Silviculturae Mendelianae Brunensis, 63(3), 1061–1071. https://doi.org/10.11118/actaun201563031061
Uyanık, G. K., & Güler, N. (2013). A study on multiple linear regression analysis. Procedia – Social and Behavioral Sciences, 106, 234–240. https://doi.org/10.1016/j.sbspro.2013.12.027
Venclova, K., Urbancova, H., & Vostra Vydrova, H. (2013). Advantages and disadvantages of business continuity management. International Journal of Industrial and Systems Engineering, 7(4), 895–899.
Wong, W. N. Z. (2019). Transforming corporate performance: A business continuity management approach. Organizational Dynamics, 48(2), 29–36. https://doi.org/10.1016/j.orgdyn.2018.08.004
Zeng, Z., & Zio, E. (2017). An integrated modelling framework for quantitative business continuity assessment. Process Safety and Environmental Protection, 106, 76–88. https://doi.org/10.1016/j.psep.2016.12.002
Bakar, Z. A., Yaacob, N. A., & Udin, A. M. (2015). The effect of business continuity management factors on organizational performance: A conceptual framework. International Journal of Economics and Financial Issues, 5, 128–134. https://doi.org/10.31580/jmi.v7i1.38
Bell, M. A. (2002, January 7). The five principles of organizational resilience. Gartner, Inc. https://www.gartner.com/doc/351410/principles-organizational-resilience
Braun, T., & Martz, B. (2007, August). Business continuity preparedness and the mindfulness state of mind. Paper presented at the 13th Americas Conference on Information Systems, AMCIS 2007, Keystone, Colorado.
Burnard, K. J., Bhamra, R. S., & Tsinopoulos, C. (2018). Building organizational resilience: Four configurations. IEEE Transactions on Engineering Management, 65(3), 351–362. https://doi.org/10.1109/TEM.2018.2796181
Casson, R. J., & Farmer, L. D. M. (2014). Understanding and checking the assumptions of linear regression: a primer for medical researchers. Clinical and Experimental Ophthalmology, 42, 590–596. https://doi.org/10.1111/ceo.12358
Dahlberg, R., & Guay, F. (2015). Creating resilient SMEs: is business continuity management the answer? In C. A. Brebbia (Ed.), Sustainable development (pp. 975–984). WIT Press. https://doi.org/10.2495/SD150852
Faertes, D. (2015). Reliability of supply chains and business continuity management. Procedia Computer Science, 55, 1400–1409. https://doi.org/10.1016/j.procs.2015.07.130
Ferreira Rebelo, M., Silva, R., & Santos, G. (2017). The integration of standardized management systems: managing business risk. International Journal of Quality & Reliability Management, 34(3), 395–405. https://doi.org/10.1108/IJQRM-11-2014-0170
Filipović, D., Krišto, M., & Podrug, N. (2018). Impact of crisis situations on development of business continuity management in Croatia. Management: Journal of Contemporary Management Issues, 23(1), 99–122. https://doi.org/10.30924/mjcmi/2018.23.1.99
Fischbacher-Smith, D. (2017). When organisational effectiveness fails: Business continuity management and the paradox of performance. Journal of Organizational Effectiveness: People and Performance, 4(1), 89–107. https://doi.org/10.1108/JOEPP-01-2017-0002
Fitzgerald, K. J. (1995). Establishing an effective continuity strategy. Information Management & Computer Security, 3(3), 20–24. https://doi.org/10.1108/09685229510092039
Foster, S. P., & Dye, K. (2005). Building continuity into strategy. Journal of Corporate Real Estate, 7(2), 105–119. https://doi.org/10.1108/14630010510812530
Ghandour, A. (2014). Identifying dimensions of business continuity plan from common expressions among business continuity professionals. International Journal of Business Administration, 5(3), 136–141. https://doi.org/10.5430/ijba.v5n3p136
Gibb, F., & Buchanan, S. (2006). A framework for business continuity management. International Journal of Information Management, 26, 128–141. https://doi.org/10.1016/j.ijinfomgt.2005.11.008
Gorzeń-Mitka, I. (2016). Shaping of organizational resilience in an unstable world: possibility or necessity? Problems of Management in the 21st Century, 11(2), 68–70.
Hamid, A. H. A. (2018). Limitations and challenges towards an effective business continuity management in Nuklear Malaysia. IOP Conference Series: Materials Science and Engineering, 298, 1–11. https://doi.org/10.1088/1757-899X/298/1/012050
Hémond, Y., & Benoît, R. (2012). Preparedness: the state of the art and future prospects. Disaster Prevention and Management, 21(4), 404–417. https://doi.org/10.1108/09653561211256125
International Organization for Standardization (2019). Security and resilience – business continuity management systems – requirements (ISO 22301:2019). Geneva, Switzerland.
Islam, M., Habes, E., Karim, A., & Syed Agil, S. (2016). Quality certification and company performance – the newly developed country experience. Journal of Business Economics and Management, 17(4), 628–644. https://doi.org/10.3846/16111699.2015.1110712
Jrad, A., Morawski, T., & Spergel, L. (2004). A model for quantifying business continuity preparedness risks for telecommunications networks. Bell Labs Technical Journal, 9(2), 107–123. https://doi.org/10.1002/bltj.20029
Karakasidis, K. (1997). A project planning process for business continuity. Information Management & Computer Security, 5(2), 72–78. https://doi.org/10.1108/09685229710182857
Kareem, M. A., & Alameer, A. A. A. (2019). The impact of dynamic capabilities on organizational effectiveness. Management & Marketing. Challenges for the Knowledge Society, 14(4), 402–418. https://doi.org/10.2478/mmcks-2019-0028
Karim, A. J. (2011). Business disaster preparedness: An empirical study for measuring the factors of business continuity to face business disaster. International Journal of Business and Social Science, 2(18), 183–192.
Kato, M., & Charoenrat, T. (2018). Business continuity management of small and medium sized enterprises: Evidence from Thailand. International Journal of Disaster Risk Reduction, 27, 577–587. https://doi.org/10.1016/j.ijdrr.2017.10.002
Kippenberger, T. (1999). Reducing the impact of the unexpected. The Antidote, 4(3), 28–31. https://doi.org/10.1108/EUM0000000006698
Kirvan, P. (2014, June). The importance of performance metrics in business continuity. Paper presented at the Regional Business Continuity Conference on Continuity Insights, New York.
Lobel, B. (2015, September 15). Business continuity plans not a priority for small businesses. https://smallbusiness.co.uk/business-continuity-plans-not-a-priority-for-small-businesses-2493226/
Malachová, H., & Oulehlová, A. (2016). Application of business continuity management system into the crisis management field. Transactions of the VŠB – Technical university of Ostrava, Safety Engineering Series, 11(2), 43–50. https://doi.org/10.1515/tvsbses-2016-0016
Mallak, L. (1998). Putting organizational resilience to work. Industrial Management, 40(6), 8–13.
Mansol, N. H., Alwi, N. H. M., & Ismail, W. (2014). Success factors towards implementation of business continuity management in organizations. International Journal of Digital Society, 5(1), 909–911. https://doi.org/10.20533/ijds.2040.2570.2014.0110
Mansol, N. H., Alwi, N. H. M., & Ismail, W. (2016). Managing organizational culture requirement for Business Continuity Management (BCM) implementation using Goal-Question-Metric (GQM) approach. Jurnal Teknologi, 78(12–3), 13–22. https://doi.org/10.1109/ICOS.2015.7377283
Marisa, R., & Oigo, D. (2018). Influence of organizational resources and structure on business continuity management of private security firms in Kenya. Journal of Human Resource Management, 6(1), 18–25. https://doi.org/10.11648/j.jhrm.20180601.13
Miller, H. E., & Engemann, K. J. (2019). Business continuity management in data center environments. International Journal of Information Technologies and Systems Approach, 12(1), 52–72. https://doi.org/10.4018/IJITSA.2019010104
Mironescu, R., Turcu, O. L., & Ceocea, C. (2015). The operational risk management in the Romanian SMEs. Studies and Scientific Researches. Economics Edition, 21, 76–88. https://doi.org/10.29358/sceco.v0i21.311
Moh Heng, G. (2015). Business continuity management planning methodology. International Journal of Disaster Recovery and Business Continuity, 6, 9–16. https://doi.org/10.14257/ijdrbc.2015.6.02
Mohammed, S., Mohammed, S., & Fiaidhi, J. (2019). Business continuity planning and learning based on an extension to the JDL data fusion model. International Journal of Disaster Recovery and Business Continuity, 10, 1–6.
Moraru, G. M., & Popa, D. (2018). Strategic management problems in Romanian small and mediumsized enterprises. MATEC Web of Conferences, 184(3), 1–4. https://doi.org/10.1051/matecconf/201818404015
Nienimaa, M., Jarvelainen, J., Heikkila, M., & Heikkila, J. (2019). Business continuity of business models: Evaluating the resilience of business models for contingencies. International Journal of Information Management, 49, 208–216. https://doi.org/10.1016/j.ijinfomgt.2019.04.010
Păunescu, C., Popescu, M. C., & Blid, L. (2018). Business impact analysis for business continuity: Evidence from Romanian enterprises on critical functions. Management & Marketing. Challenges for the Knowledge Society, 13(3), 1035–1050. https://doi.org/10.2478/mmcks-2018-0021
Păunescu, C. (2017). How prepared are small and medium sized companies for business continuity management? Quality – Access to Success, 18(161), 43–48.
Quendler, E. (2017). Organizational resilience: building business value in a changing world. Journal for International Business and Entrepreneurship Development, 10(2), 101–119. https://doi.org/10.1504/JIBED.2017.084301
Raşcă, L., & Deaconu, A. (2007). Romanian small and medium sized enterprises-challenges upon accession into the European Union. The Annals of the University of Oradea. Economic Sciences, 1, 578–581.
Ruiz-Martin, C., López-Paredes, A. & Wainer, G. (2018). What we know and do not know about organizational resilience. International Journal of Production Management and Engineering, 6(1), 11–28. https://doi.org/10.4995/ijpme.2018.7898
Sahebjamnia, N., Torabi, S. A., & Mansouri, S. A. (2018). Building organizational resilience in the face of multiple disruptions. International Journal of Production Economics, 197, 63–83. https://doi.org/10.1016/j.ijpe.2017.12.009
Soufi, H. R., Torabi, S. A., & Sahebjamnia, N. (2019). Developing a novel quantitative framework for business continuity planning. International Journal of Production Research, 57(3), 779–800. https://doi.org/10.1080/00207543.2018.1483586
Speight, P. (2011). Business continuity. Journal of Applied Security Research, 6(4), 529–554. https://doi.org/10.1080/19361610.2011.604021
Svata, V. (2013). System view of business continuity management. Journal of Systems Integration, 4(2), 19–35.
Torabi, S. A., Rezaei Soufi, H., & Sahebjamnia, N. (2014). A new framework for business impact analysis in business continuity management (with a case study). Safety Science, 68, 309–323. https://doi.org/10.1016/j.ssci.2014.04.017
Torabi, S. A., Giahi, R., & Sahebjamnia, N. (2016). An enhanced risk assessment framework for business continuity management systems. Safety Science, 89, 201–218. https://doi.org/10.1016/j.ssci.2016.06.015
Tvrdíková, M. (2016). Increasing the business potential of companies by ensuring continuity of the development of their information systems by current information technologies. Journal of Business Economics and Management, 17(3), 475–489. https://doi.org/10.3846/16111699.2013.839475
Urbanec, J., & Urbancová, H. (2015). The benefits of business continuity management in Czech organizations. Acta Universitatis Agriculturae Et Silviculturae Mendelianae Brunensis, 63(3), 1061–1071. https://doi.org/10.11118/actaun201563031061
Uyanık, G. K., & Güler, N. (2013). A study on multiple linear regression analysis. Procedia – Social and Behavioral Sciences, 106, 234–240. https://doi.org/10.1016/j.sbspro.2013.12.027
Venclova, K., Urbancova, H., & Vostra Vydrova, H. (2013). Advantages and disadvantages of business continuity management. International Journal of Industrial and Systems Engineering, 7(4), 895–899.
Wong, W. N. Z. (2019). Transforming corporate performance: A business continuity management approach. Organizational Dynamics, 48(2), 29–36. https://doi.org/10.1016/j.orgdyn.2018.08.004
Zeng, Z., & Zio, E. (2017). An integrated modelling framework for quantitative business continuity assessment. Process Safety and Environmental Protection, 106, 76–88. https://doi.org/10.1016/j.psep.2016.12.002