Business Continuity Management System Research Articles

Business continuity management: trends, structures and future issues

PurposeThis study assesses the current landscape of business continuity management (BCM) research while exploring research trends, structures and delineating potential future directions.Design/methodology/approachA comprehensive bibliometric analysis was conducted on 360 articles from the Scopus and Web of Science databases using Biblioshiny software. A meta-synthesis was employed to aggregate and synthesize findings from the bibliometric results.FindingsThe results demonstrate a notable increase in publication numbers since the onset of the pandemic, reaching a peak in 2022 with a total of 342 articles. A collaborative bond among scholars transcends geographical boundaries and national affiliations. The analytical results propose avenues for future research, addressing crucial areas such as the integration of business continuity management systems (BCMS), the development of BCM frameworks and a comparative analysis of business impact analysis (BIA) frameworks through pertinent theories.Research limitations/implicationsThe study contributes theoretical and practical implications, serving as a valuable resource for academics and practitioners seeking to deepen their understanding of BCM’s role in business recovery and preserving organizational continuity in the face of disruptions.Originality/valueThis study pioneers a comprehensive approach by integrating bibliometric analysis and qualitative meta-synthesis, providing a consolidated overview of BCM research. Additionally, it presents future research proposals in this area.

Threats and Hazards of Grey Rhino Paradigm

Grey Rhino is a metaphor for security threat, which is unkept irrational for large extent also high probability of harmful effect on a subject of risk owner. Business continuity management system is assessed in a diagram as controlling instrument aimed at operational hazard mitigation of continuity disturbance of affected subject. A ´from Operations´ Value Added – O´VA is established as qualitative dynamic information about productivity of activities. The measures are designed in crisis scenario for quality improvement of subject´s crisis readiness. An indicator of business risk continuity slip is defined. In a connection with war conflict on Ukraine is assessed if it is Grey Rhino manifestation.

Improvement of Cyber Resilience by Implementation of a Digital Business Continuity Management System: Evidence from Romania

Abstract This paper aims to present a model for increasing the cyber resilience of organizations. Under the business context when cyber incidents risk is the most important risk worldwide for organizations for the third consecutive year, the model proposes a solution for improvement of cyber resilience of organizations, by implementation of a management system based on Business Continuity Management framework and a related software solution for handling the Risk Management data, Business Impact Analysis, Emergency and Recovery Planning, as well as Cyber Crisis Management. The implementation of the digital Business Continuity Management System and Cyber Crisis Management processes is tested through a simulation of a cyber incident leading to disruption of activities and cyber crisis caused by a ransomware attack. The simulation is presented both as design and execution and it can be implemented in any organization having the Business Continuity Management System in place and an internal IT department. The results of the simulation bring evidence for the contribution of the study to the increase of the cyber resilience of the organization. The novelty of the study is represented by the mix of concepts and instruments brought together in the model through which the framework of Business Continuity Management is implemented by means of a dedicated software solution, facilitating steps towards the digitization of the management processes and increase of the organizational and cyber resilience.

Methodological aspects of ensuring the smooth functioning of the digital ruble platform

Subject. The article addresses the smooth functioning of the digital ruble platform (SFDRP). Objectives. The purpose is to disclose methodological aspects of ensuring the SFDRP, considering the practices of ensuring the smooth functioning of payment systems (SFPS). Methods. The study provides a comparative analysis of characteristics of the digital ruble platform and of payment systems. It is determined that the activity of both is based on smooth functioning of individual independent actors, thus, the practices of ensuring SFPS can be applied to ensure SFDRP. Based on GOST R ISO 31000-2019 "Risk Management. Principles and Guidelines" and GOST R ISO 22301-2014 "Business Continuity Management Systems", I offer a methodological approach to ensuring SFDRP. Results. The study discloses unified SFDRP support structure and the risk and continuity management processes. Risk management is aimed at reducing the expected severity of consequences of events that may occur. At the same time, continuity management involves influencing the events that have already occurred. Conclusions. It is necessary to consider the fact of interaction between the digital ruble platform and the Bank of Russia Payment System, which implements the practices of ensuring SFPS. Efficiency of the organization of SFPS of the Bank of Russia will have a direct impact on the ability to ensure SFDRP, and vice versa. Supporting the SFDRP is especially important from the perspective of regulating the volatility of cash flows to maintain the financial stability of the economy.

Management frameworks information technology and cyber risks during the digital transformation of the organization

Problem statement. It is necessary to effectively manage the implementation of digital security measures of an organization to ensure the cybersecurity of an information system in the context of digital transformation and minimize the risk of possible losses and security breaches. Goal. Perform a comprehensive analysis and benchmarking of frameworks in this area. Results. The main documents regulating cybersecurity and IT risks in digital transformation are analyzed, standard guidelines, recommendations and frameworks for information security and cybersecurity management are analyzed. System solutions for the development of a cyber and digital security strategy have been identified. Practical significance. A model of a cybersecurity and business continuity management system in the context of an organization's digital transformation is proposed. Recommendations for the organization's digital security management mechanism are described.

Business continuity plan in the management and operations of hospitals: First experience to certify the PDTA processes with the requirements defined by ISO 22301:2019 in emergency medical services.

A business continuity plan (BCP) facilitates the performance of primary functions during emergencies or other situations that can disrupt normal operations. If risk management is done analytically, a business impact analysis (BIA), according to ISO 22301 certification, makes it possible to define the best strategy for supporting the company's assets and image, optimizing the operational efficiency of service recovery and redesigning spaces for health. Since 2015, our healthcare company has embarked on a certification process for all sectors and activities through the implementation and development of diagnostic and therapeutic paths for operational diagnos-tic-therapeutic-assistance pathways (PDTAs). PDTA processes are all certified by the ISO 9001:2015 management system hospital. Our hospital is the first healthcare company to have obtained ISO 22301:2019 certification concerning PDTA processes, offering patients the highest standards of quality and safety of care in emergency medical services. The formal BCP process includes several steps prior to the creation of a BCP: create a BCP team, conduct a BIA, determine the continuity plan by using the results of the analyses, and conduct training and exercises to educate staff and improve the BCP. From the BIA analysis, the team identified the time-employee PDTAs in company paths under emergency and urgency: acute ST-elevation myocardial infarction (STEMI), TRAUMA, and STROKE, providing for a planning path that took advantage of the duration of approximately 12 months. This path included the creation of structural procedures, the redefinition and updating of the PDTA in the light of the BCP, the preparation of exercises aimed at guaranteeing the business continuity objectives, and, finally, the awareness of our stakeholders regarding its correct application. With a business continuity management (BCM) system, companies take preventative measures to ensure they can start operations again quickly in an emergency. An exhaustive BIA in a hospital company reveals the effects when processes fail, how critical each process is for the company, and the amount of time required to get up and running again, thus providing the organization with important information for risk management. The measures for handling risks derived from this analysis are incorporated into a BCM system where the emergency plans are defined, too, so that business operations continue even in the event of an emergency.

Performance Evaluation of Business Continuity Plan in Dealing with Threats and Risks in Cilegon Companies Use ISO 22301:2019 & NIST Sp 800-30 R1 Frameworks Case Study: PT. X

This research was conducted at PT.X which is located in Cilegon, Merak-Banten. Seeing the geographical location of PT.X which is in a disaster-prone area, the company must ensure an effective business continuity process. In accordance with government regulations on Electronic-Based Government Systems (SPBE) related to corporate and government business activities, companies must be able to ensure business continuity in every condition that poses a threat and risk, but with no specific obligation that is the basis for the company's business continuity if it does not have a Business Continuity Plan (BCP) process, it will get a sanction. The purpose of this research is to evaluate the existing BCP process at PT X Cilegon and provide recommendations for a standardized BCP framework in the company to ensure business continuity as the company's Business Continuity Management System (BCMS) to avoid all threats and risks. BCP has standards regulated in ISO 22301: 2019 as its framework, and in BCP there is a risk analysis process and this research will be carried out using the NIST SP 800-30 Revision 1 method as its best practice. The evaluation results show that the previous BCP process at PT X Cilegon was not in accordance with the standards and the risk analysis carried out was still based on the ISO that the company had implemented but not ISO 31000 which is the risk management standard, so this study provides recommendations for a BCP framework that is in accordance with the standards and risk analysis with risk analysis methods that produce risk priorities.

The role of ISO 22301 "Business continuity management systems" in the management system of the organization

The article deals with the issues of maintaining sustainability and business continuity in the face of changing exchange rates, changing partners, changes in legislation, disruption of contracts, changes in distribution channels. The author reveals the role of the ISO 22301 "Business Continuity Management Systems" standard in the organization's management system and the impact of the document on the sustainability of companies. The issues of introducing a business continuity management system (BCMS) are considered and points are established that contribute to improving the efficiency of this system.

Business continuity and resilience management: A conceptual framework

AbstractThe overall objective of business continuity management (BCM) systems is to provide guidance and analytical subcomponents on how to assess and manage risk and sustain operations when facing a disruptive event. Current BCM practices largely follow a standard structure for formal planning processes and risk‐assessment activities. An underlying assumption in standard practices is that systems can be decomposed in subsystems in a meaningful way, as they are tractable and data are available to predict the system's future functionality. However, the reality is much more complex in our volatile world. Standard BCM approaches do not pay adequate attention to the treatment of uncertainties. Thus, they fall short of addressing the complexity of operations involved with emergencies and crisis. Lack of focus on uncertainty hampers the ability of BCM systems to provide sufficient support for decision making in highly uncertain situations. Dealing with such situations necessitates a shift from a defensive risk‐management approach, grounded on an illusion of control and accountability, to a proactive stance based on resilience thinking. Responding to this call, we use concepts from the resilience engineering (RE) field and link them to different components of a BCM system. We develop a novel BCM framework and identify a set of resilience influence factors to enhance resilience in BCM systems. We use a case‐example, hosted by a leading organization in a second‐line emergency response operation in Norway to reflect on the application of a suggested BCM framework.

Faktor dan Rencana Aksi Implementasi BCMS Pada Sektor Publik: Studi Kasus Pada Sekretariat Utama BPKP

Purpose: Business Continuity Management System (BCMS) is not widely implemented in Indonesian public sector, therefore his study aims to reveal the drivers of BCMS implementation at the public sector and preparation that organization should done for BCMS implementation as required by the ISO 22301:2019 standard. The object of the study is Chief Secretariat of Badan Pengawasan Keuangan dan Pembangunan (BPKP) which has supporting function for government’s internal audit as BPKP core-business. Methodology/Approach: The research done with case study method with qualitative approach. The primary data in the study was collected through semi-structured interview with people from risk management unit, incidents management unit, and IT management unit. The data analysis carried out with the benchmarking the drivers of BCMS implementation with previous study and literature and benchmarking the organizaiton existing condition with BCMS requirements. Findings: The study found that there are urgency and need for BCMS implementation in the organization, with the main drivers are informal top-management support, uneven continuity practices, and the increase of organization’s dependency of information technology. Practical and Theoretical Contribution/Originality: Organization need to create the BCMS policy, enhance the competency and awareness about BCMS, and update the incident response procedure as the preparations of BCMS implementation. This research contributing for future public sector implementation of BCMS.

Risk capability building post Covid-19 through improving competency in risk management

This study aims to understand how a pioneer Bus Rapid Transit (BRT) company in Indonesia strengthens its business resilience when facing uncertainty due to the COVID-19 pandemic. A qualitative research approach with the case study method is used where the primary data source is respondents, who are determined based on the purposive sampling method. Data collection and analysis were conducted using triangulation techniques by distributing questionnaires, structured interviews, and focus group discussions, which have helped discover that the pioneer BRT company is not fully prepared for the COVID-19 pandemic. The company then decided to strengthen risk management capabilities by increasing risk management competencies that support decision-making in responding to the impact of the COVID-19 pandemic. Risk leaders believe that strengthening risk capabilities can boost the company's resilience in the face of the COVID-19 pandemic and help it succeed in the new-normal era later. However, it is recommended that companies implement a business continuity management system based on the ISO 22301:2019 Business Continuity Management System (BCMS) standard as a systematic and comprehensive approach. The implication of implementing this standard is strengthening the company's readiness to deal effectively with risks of resilience and business continuity in the future.

업무연속성관리체계(BCMS) 평가지표 개발에 관한 연구

This paper aims to develop evaluation indicators of Leadership part in the PDCA(Plan-Do-Check-Act) requirements of ISO 22301(2019) which is an international standard for Business Continuity Management System(BCMS). The research method is that panel of 20 experts in the area of BCMS reviewed for the validity of the detailed evaluation indicators of Leadership part through the modified Delphi technique and relative importance are surveyed by the panel group based on the AHP(Analysis Hierarchy Process). As the results, the 15 evaluation indicators that could be applied for BCMS evaluation for the organizations are selected and for the quantified evaluation model, score indicators out of 1,000 are applied to convert them into points for individual evaluation indicators. In the conclusion, in order to develop a quantitative evaluation indicators of the BCMS, it is concluded that evaluation should be selected and given relative importance so that they can be used for effective evaluation.

COVID-19, business continuity management and standardization: case study of Huawei

Purpose This paper aims to theoretically and empirically demonstrate the role played by business continuity management (BCM) to address risks such as trade conflicts and natural disasters. This paper also answers whether compliance with international standards such as the International Organization for Standardization (ISO) 22301 is adequate. Design/methodology/approach A case study of Chinese telecommunications giant Huawei is conducted to examine how a robust end-to-end BCM system has been established in two decades and in what way it has helped Huawei to efficiently maintain growth under pressure, such as being added to the “Entity List” and the pandemic. Findings Huawei case contributes to BCM theory in its approach to establishing the BCM system and its well-established BCM model. Huawei establishes and continually improves its BCM system by applying the Plan (establish), Do (implement and operate), Check (monitor and review) and Act (maintain and improve) cycle. Characterized as 4Ps: BCM policy, BCM process, incident management plan and business continuity plan, Huawei BCM system is shaped into a loop with end-to-end BCM process, covering all steps along its value chain – from suppliers and partners to Huawei itself and then on to its customers – with key initiatives for all domains such as R&D, procurement, manufacturing, logistics and global technical services. In practice, implementing international standards such as ISO 22301 enables Huawei to develop business continuity but not enough. Optimizing the BCM system is an ongoing effort, and BCM maturity is ever present: continually improving Huawei’s own BCM system and benchmarking against best practices available worldwide. Research limitations/implications Apart from the case study, other methods such as counter-factual analysis can be used to further test whether Huawei’s BCM system is cost-effective. Another direction for future study is whether suggested BCM maturity levels should be supplemented into ISO 22301. In the digital age, how to use digitalization to ensure business continuity is a current issue not just for practitioners such as Huawei but also for researchers worldwide. Practical implications In practice, implementing international standards such as ISO 22301 enables Huawei to develop business continuity but not enough. Optimizing the BCM system is an ongoing effort, and BCM maturity is ever present: continually improving Huawei’s own BCM system and benchmarking against best practices available worldwide. Originality/value To the best of the authors’ knowledge, this is one of the first studies to focus on how an organization continually improves the suitability, adequacy and effectiveness of its BCM system, with special attention to standards compliance.

THE ROLE OF INTERNAL AUDITING IN BUSINESS CONTINUITY

The goal of auditing business continuity is to establish factual phenomena and to answer the question of whether the business continuity plan is effective and in line with the goals of the organization. The subject of the paper is examining the importance and need to consider business continuity at the entity level, analyzing the business continuity management system in the Republic of Serbia regulatory framework, the relationship of internal audit to business continuity, scanning techniques in information technology audit after disasters and analysis of critical information system applications.

PENERAPAN SISTEM MANAJEMEN KEBERLANGSUNGAN BISNIS (BUSINESS CONTINUITY MANAGEMENT SYSTEM) DI PERUSAHAAN INDUSTRI SELAMA PANDEMI COVID-19 : KAJIAN LITERATUR

The COVID-19 pandemic which increased rapidly in early 2020 causes losses that can result in companies going out of business. To overce this, it is necessary to have a management system that manage continuity of the Business. Business Continuity Management System (BCMSS) is one of system management for employer to take an action a business continuity. However, there are still industries that have not implemented Business Continuity Management System (BCMS). Therefore, the purpose of this research is to see the difference in the impact of industries that apply and do not apply BCMS during the COVID-19 pandemic. This study uses the Preferred Reporting Items for Systematic Review & Meta-Analysis (PRISMA) method with inclusion criteria, namely articles that answer research, are published, use Indonesian or English, and were written in the last two years. The impacts on industries that implement BCMS are maintaining business continuity, returning to normal industrial conditions, mitigating disruptions, and reducing COVID-19 transmission. The impacts on industries that do not implement BCMS are labor problems, economic problems, and disruption of the supply chain. There is a significant difference between industries that implement BCMS and industries that do not apply BCMS where industries that apply BCMS can maintain business continuity.

Оценка непрерывности деятельности в соответствии с международными стандартами аудита и национальными стандартами Российской Федерации

Th e article discusses proposals for the inclusion of an assessment based on the provisions of the national standards of the Russian Federation on the formation of a business continuity management system in order to prevent threats of business termination and their leveling in the methodology of assessing the continuity of an audited entity by an external auditor.

What makes for effective business continuity implementation?

The process of implementing and maintaining a business continuity management system is associated with various challenges that make it hard for organisations to realise their business continuity objectives. This paper describes how to implement three key drivers to support organisations in their business continuity efforts. First, the organisation must establish a culture conducive to business continuity. This can be reinforced through the distribution of roles and responsibilities for business continuity, in order to spread the operational burden and raise awareness regarding the necessity of business continuity processes. Finally, organisations can benefit from the latest advancements in technology and software to make business continuity efforts easier to implement at all organisational levels. This latter aspect is important not just for business continuity managers, but also their colleagues, who may not be as well versed in the area of business continuity, but whose support is essential to the smooth functioning of the business continuity management system.

Business Continuity During the COVID-19 Pandemic Era: Surviving and Improving the Quality Process Management System

Worldwide health and the global economy have been heavily damaged by the COVID-19 pandemic, with business continuity being the primary issue of every company operating in the health industry. A critical instrument for enterprise survival is the establishment of a business continuity management system that enables them to manage risks, discover opportunities created by the pandemic, and secure their continuity. The purpose of this paper is to examine how a pharmaceutical firm may ensure business continuity by adopting ISO 22301:2019 in parallel with the existing ISO 9001:2015 quality standard, as well as the similarities and differences between the two management standards. According to the results, the pharmaceutical company, whose case was studied, managed to create an effective action plan in order to mitigate at an acceptable level the identified risks, to maintain its business continuity and to ensure the quality of the product and the health of the patients and its employees.

기업 재해경감활동 성숙도 조사 신뢰성 분석

In order to maintain major functions and continuity during crisis, companies are establishing a Business Continuity Management System in accordance with a standard for disaster management under the Act on assistance to the autonomous activities of enterprises for disaster mitigation. This process is based on the presentation of the level of introduction of business continuity activities through the survey of the company’s preparation (maturity) for business continuity activities; however, the maturity survey in practice does not consider the importance of the survey items, indicating a problem in that the discriminating ability of maturity and the differentiation by field of business continuity activities cannot be considered. Therefore, this study reviewed the reliability of the survey results through case analysis of the maturity survey of the business continuity activity and analyzed the differences in the results by applying weight to each survey item. As a result, it was found that 34 questions in a total of 8 areas of the maturity survey lacked reliability in the classification between areas due to the burden of discrimination between items and the likelihood of similar responses of the survey subjects was high.

واقع إدارة استمرارية الأعمال أيزو 22301 في القطاع العام لمواجهة الأزمات: المملكة العربية السعودية نموذجاً

يسعى هذا البحث إلى تسليط الضوء على واقع إدارة استمرارية الأعمال في القطاع العام لمواجهة الأزمات في المملكة العربية السعودية. وقد اعتمدنا لقياس الواقع معيار أيزو 22301 لاستمرارية الأعمال، فيما أسفرت النتائج على تبني بعض منظمات القطاع العام لنظام إدارة استمرارية الأعمال وفق معيار أيزو 22301. وكما قدم بحثنا الحالي العديد من التوصيات والمقترحات التي تكفل تطوير إدارة استمرارية الأعمال BCM في القطاع العام بالمملكة العربية السعودية بما يحفظ كفاءة أداء القطاع العام في مواجهة الأزمات.