Developing a novel quantitative framework for business continuity planning

Abstract

Today’s competitive and turbulent environment persuades every organisation to implement a business continuity management system (BCMS) for dealing with disruptive incidents such as earthquake, flood, and terrorist attacks. Within a BCMS, effective and efficient business continuity plans (BCPs) must be provided to ensure the continuity of organisation’s key products. This study develops a novel approach to select the most appropriate BCPs which can meet the business continuity key measures. First, a risk assessment process is conducted to define the disruptive incidents for which the organisation should have suitable BCPs. Then, two different possibilistic programming models including hard and soft BCP selection models are developed to determine appropriate BCPs under epistemic uncertainty of input data. These models aim to maximise the resilience level of the organisation while minimising the establishment cost of selected BCPs.‏ Finally, a real case study is provided whose results demonstrate the applicability and usefulness of the proposed approach.

Keywords:

• risk management
• optimisation
• organisational resilience
• business continuity management
• business continuity plan
• possibilistic programming

Disclosure statement

No potential conflict of interest was reported by the authors.

Supplemental data

Supplemental data for this article can be accessed at https://doi.org/10.1080/00207543.2018.1483586.

ORCID

S. Ali Torabi http://orcid.org/0000-0002-9764-9679

Navid Sahebjamnia http://orcid.org/0000-0001-5727-9477

Notes

1. Consider two plans which have low RTO and RPO and high RTO and RPO. These plans will be rejected based on the continuity obligations in the HBCPS model, but they have a good chance for being selected in SBCPS model.

2. Each BCP has different tolerability level in different disruptive incidents. For example, a warm strategy will ensure the key products continuity in low or moderate impact disruptive incidents but it does not guarantee the continuity of key products in high impact disruptive incidents. So, the confidence level of the availability of BCPs is a key parameter in the developed model.