CHAPTER 2 REVIEW OF LITERATURE Interest continues to grow in the fields of emergency management and business continuity (together referred

to as contingency planning). The evolution of business continuity management from Disaster Recovery (DR) to Business Continuity Planning (BCP) to BC different definitions being !roffered over time. BCM "erbane (#$%$) states that& BC has become established as a formalised structure and has led to many

e'!ression of an organi(ation)s crisis management values and !ractices with standards develo!ed in the early #$$$s. BC focuses on assuring continuous business !rocesses and !lays a is also an on*going

!rominent !art in the organi(ations ability to recover after disru!tion. BC

!rocess and !lanning for it includes reviewing DR& business recovery& business resum!tion and contingency !lanning. The com!rehensive and on*going nature of BC included as !art of any BC definition. should therefore be

Research conducted by +lliott& ,wart( and "erbane (#$%$) suggests ado!ting a crisis management a!!roach to BC . They suggest e'!anding the !rocess of BC to include the

social elements that are often !art of a disru!tive event and maintain that organi(ations often !lay a role in causing failures themselves. They also note the im!ortant role that an organi(ation)s managers !lay in BC & the fact that interru!tions im!act on the many sta-eholders in an organi(ation and that if managed !ro!erly incidents do not necessarily

inevitably lead to a crisis. This means that the wider su!!ly chain and all an organi(ations sta-eholders both internal and e'ternal need to be covered in a BC definition. anagement framewor-

The Information Technology Infrastructure .ibrary (ITI.)& IT ,ervice offers an alternate ris- management view of BC

saying that it is the business !rocess

res!onsible for managing ris-s to the business and that it !rotects the interests of -ey sta-eholders& organi(ational re!utation& brand and value creating activities. The ITI. definition also notes that BC hel!s reduce ris-s to an acce!table level. It is

interesting to note the business focus of the ITI. definition as ITI. is mainly a technology focused !rocess. The ITI. definition further shifts the focus of BC away from technology and

on to the business and its sta-eholders. The Basel committee on ban-ing su!ervision& ta-ing a financial and business focus& define BC as/

01 whole*of*business a!!roach that includes !olicies& standards& and !rocedures for ensuring that s!ecified o!erations can be maintained or recovered in a timely fashion in the event of a disru!tion.2 (Basel Committee on Ban-ing ,u!ervision& #$$3& !.%) The BCI note that BC BC and ris- management sit side by side and that the main ob4ective of

is to allow organi(ations manage their business under adverse conditions by im!lementing and crisis management !lans in collaboration

resilience strategies& recovery ob4ectives& BC

with& or as a -ey com!onent of& an integrated ris- management initiative. 5ltimately the most com!rehensive definition of BC which aligns with the current BCI

definition and includes the multi!le elements covered by the earlier definitions !osed by

academics& is that !ut forward by the standard British ,tandards Institute (B,I) which states that BC is/ 01 holistic management !rocess that identifies !otential threats to an organi(ation and the im!acts to business o!erations that those threats& if reali(ed& might cause& and which !rovides a framewor- for building organi(ational resilience with the ca!ability for an effective res!onse that safeguards the interests of its -ey sta-eholders& re!utation& brand& and value*creating activities.2 (B,I #$$3& !.%) This definition notably recognises that BC is a !art of building based a!!roach to disru!tive

events and it enca!sulates the main elements of earlier definitions such as resuming business after a disru!tive event& the survival of the mission critical elements of the business& the ability to !re!are for disru!tive events& the continuous nature of BC & testing6rehearsing BC & the internal6e'ternal nature of events and the com!etitive advantages gained as a whole. BC as noted by "erbane (#$%$) which began as an 1nglo*centric& information technology

focused activity has become a !rocess that has now become an e'!ectation rather than lu'ury. The Literary Framework The framewor- around which the literature is reviewed is drawn from the BC lifecycle. 1 -ey

aim of the literature review is to identify and discuss what has been !ro!osed as constituting good !ractice in terms of BC . This is then used as the benchmar- against which the research can measure the e'ecution of BC in large organi(ations.

BCM Programme Management Programme management is central to the BC !rocess and includes/

+nsuring !artici!ation of to! management7

1ssigning res!onsibilities (8overnance)7

Im!lementing business continuity in the organi(ation7

The on*going management of business continuity.

Participation of Top Management 9hen reviewing the body of literature it is evident that the !artici!ation of senior management is crucial to the success of BC . ,eow (#$$:) !oints out that not getting to! management buy in and commitment to starting and sustaining a BC !rogramme in an organi(ation can be an !rogramme will almost certainly fail.

obstacle to the !rogramme)s success. 9ithout it the BC

It is the res!onsibility of the board of directors to review the business continuity !rogramme annually according to ;och (#$$<). Directors have a fiduciary duty to !rotect cor!orate assets and safeguard the long*term survival of the organi(ation. If the board does not !lay an active !art in BC & sustaining a !rogramme will be difficult. The literature identifies the need to strategically sell BC to senior e'ecutives by showing them to senior e'ecutives is

its im!ortance to the organi(ation. 1s noted by ,eow (#$$:)& selling BC

im!ortant. ,eow (#$$:) advocates that this is achieved not 4ust by using business models to illustrate the returns on shareholder value& citing statistics on the number of com!anies without

business continuity !lans (BCPs) that failed after a disaster event and !roviding case studies of !ast incidents& as these tend to be generic and su!erficial. ,uch a!!roaches often fail to motivate senior e'ecutives into engaging with BC . To attract the attention of senior e'ecutives& ,eow (#$$:) advises that where !ossible the BC leader needs to ma-e the case for BC by

!resenting it in the right management conte't that has direct relevance to the senior e'ecutives !ersonally. .oo-ing further towards raising senior management awareness of im!ortance of BC & .indstedt (#$$=) !oints out that e'ecutives cannot be e'!ected to su!!ort a BC !rogramme if they

consider it as sim!ly !art of another function of the business& li-e ris- management. The BC !ractitioner therefore needs to find out what are the !riorities of senior management> 9hat sta-es do they have in su!!orting or not su!!orting BC > 9hat motivates them> "ow can these !riorities be leveraged> De 9aal (#$$3)& !oints out that disasters that resonate in the moral imagination elicit res!onses. De 9aal (#$$3) notes that there are four !olitical com!onents of disaster !revention/ the visibility of the disaster7 the !olitical salience of the disaster7 the constituencies affected and involved in the res!onse7 and the availability of technologies for effective res!onse. These need to be borne in mind when trying to get the re?uired !ositive management res!onse regarding any BC initiative. message and trying to illicit the re?uired senior management res!onse& it

In delivering the BC

is im!ortant to note that most !eo!le are influenced more by one clear& vivid !ersonal e'am!le than by an abundance of statistical data according to 1ranson (%:::). The BC to be delivered by a credible communicator. message needs

yers (#$$3) also advocates that the !erson with

BC

res!onsibility needs to ensure BC is !ositioned correctly which means !ositioning and

selling senior management on a cor!orate contingency !lanning !olicy and strategy& and documenting this !olicy and strategy in writing before any other activities are underta-en in the !rogramme !rocess. Involvement in BC !rogrammes on an on*going basis should therefore be a normal !art of

senior management)s role as it would with o!erational ris- management for instance. ;nowledge of senior management !riorities and issues will enable the BC bac-ing for the BC !ractitioner to get the re?uired

!rogramme in order for it to be established on a firm footing. !rogramme after gaining management a!!roval and bac-ing

The ne't im!ortant ste! in the BC

is to ma-e sure that the !rogramme res!onsibilities are correctly assigned to the relevant grou!s and individuals. Assigning Responsibilities (Governance) 9hen assigning res!onsibilities for the BC !rogramme the literature clearly states that those

res!onsible need to have the re?uired levels of authority and seniority in order to ma-e the !rogramme successful& res!onsibility should not be given to a member of the IT team as the danger will be that BC will be loo-ed on as an IT initiative by the rest of the organi(ation. 1ll

levels of the organi(ation should be involved in the im!lementation of BC . It is im!erative that an organi(ation should a!!oint someone with the a!!ro!riate seniority& authority and s-ills to be accountable for its im!lementation and should a!!oint a team or grou! to im!lement and maintain the BC !rogramme. It is noteworthy that the em!hasis is on an

individual with the a!!ro!riate seniority and authority and that a team rather than one individual

is res!onsible for im!lementing and maintaining the !lan. 1ronson (%:::) also recognises that one of the most crucial ste!s when assigning res!onsibilities for a BC !rogramme is that the

correct !erson with the re?uired levels of authority is chosen to head u! the !rogramme. To enable the BC !rogrammes success it is crucial that res!onsibilities are not s!lit across to

many grou!s or de!artments but are focused in the a!!ro!riate areas. @rgani(ations still tend to s!lit BC res!onsibilities between o!erations& security& IT& management& and other de!artments&

thereby increasing the ris- that something will fall through the crac-s according to 1d-ins& Thornton and Bla-e (#$$:). +lliott& ,wart( and "erbane (#$%$) warn that the BC !ro4ect an IT

management role should not be given to an IT s!ecialist either as this then ma-es BC

issue and not a business wide issue and advise that the board a!!oint a business continuity steering grou! to su!!ort the BC !ro4ect manager in order to drive the !rocess at local or

de!artmental level. The steering grou! should include senior and influential staff from different business units or de!artments and acts as a conduit between o!erative level em!loyees and any central BC team. The involvement of em!loyees in the BC should be achieved through

selected re!resentatives from across the organi(ation by function or location to hel! im!lement the BC !rogramme and advocates that BC roles& accountabilities& res!onsibilities and

authorities should be integrated into 4ob descri!tions and s-ill sets. To reinforce these res!onsibilities they must be included in the a!!raisal and reward system of the organi(ation. @nce the correct res!onsibility for BC !rogramme is the ne't logical ste!. Implementing Business Continuity in the rgani!ation has been identified the im!lementation of the

The activities which need to be underta-en when im!lementing the BC

!rogramme or indeed

any !rogramme in an organi(ation include the design& building& and im!lementation of the !rogramme. The literature states that a !ro!er !ro4ect management framewor- should be used to ensure the !rogramme is effective. Designing and building BC !lans& and -ee!ing them u!dated in a large organi(ation can be a daunting tas- according to "owe (#$$A). "e advocates that !ro!er !ro4ect re!orting relationshi!s are used throughout the initial BC going basis to ensure the !rocess is integrated into cor!orate !rocesses. Barnes (#$$%) identifies the main !hases as being& !ro4ect foundation& business assessment& strategy selection& !lan develo!ment& testing and maintenance. +lliott& ,wart( and "erbane (#$%$) refer to the continuity management !rocess as having four distinct !hases namely& initiation& !lanning for business continuity& im!lementation and o!erational management. "owe (#$$A) maintains that a BC !ro4ect can be bro-en down into three !hases& information !ro4ect and on an on*

gathering& !lan develo!ment and the transformation !hase where the BCP !ro4ect becomes an ongoing cor!orate*wide !rocess. Regardless of the BC (%::#) notes that the resulting BC !lan formation !rocess used& 8inn

!lan needs to be modular in design so that it can be easily

u!dated and bro-en down into readable sections as not all disasters will be ma4or ones. @nce the BC !lan is in !lace the issue of its ongoing management needs to be addressed.

n"going Management of Business Continuity 1s evidenced from the literature on a regular basis senior management should communicate the im!ortance of the BC !rogramme to the whole organi(ation and a!!ro!riate sta-eholders in training should ta-e !lace for all staff and senior should ensure that

order to -ee! it in focus. 1!!ro!riate BC

management must ensure that the BC !lan is -e!t as a living document. BC

systems and !lans are u!dated whenever there is a significant change in the organi(ation)s environment& !ersonnel& !rocesses or technology. BC !lans also need to be u!dated when an e'ercise or incident highlights deficiencies. 1ccording to Bra(eau (#$$=)& everyone within an organi(ation must embrace BC effective. 1s noted by +lliott& ,wart( and "erbane (#$%$)& effective BC management !ractice and not a bolt on !rocess. In order to ensure that BC is -e!t u! to date it is crucial that it is embedded into the for it to be

is a !art of sound

organi(ations culture beginning at the to! of the organi(ation and wor-ing its way down through it using continual communication so that it will become !art of the way that an organi(ation is managed. 1t each stage of the BC organi(ation)s BC !rocess& o!!ortunities e'ist to introduce and enhance an

culture to ensure this ha!!ens.

#n$erstan$ing rgani!ational Culture 9hen embedding BC into the organi(ations culture it is hel!ful to have an understanding from

general management literature of what is meant by organi(ational culture. ;ello (#$$:) states that most definitions of culture em!hasi(e that culture re!resents a high*level& sum*total of attitudes& beliefs& norms& and behaviours. In these terms& culture s!ecifies 0how things woraround here.2 ;ello (#$$:) identifies that there has always been a bit of a 0chic-en*and egg2 !roblem with culture and its measurement which comes first& the behaviours and attitudes& or the culture> It is im!ortant to ac-nowledge as outlined by ;ello (#$$:)& that there are often both e'!licit (what the organi(ation says it is about) and im!licit (inferences& often unwritten that the

em!loyees draw from their e'!erience in the organi(ation) cultures evident and in o!eration in organi(ations. itroff& Pauchant& Binny and Pearson (%:=:) as cited by +lliott& ,wart( and

"erbane (#$%$) suggest that an organi(ations culture is the set of Cunwritten rules) that govern Cacce!table behaviour) within and outside the organi(ation. Culture an$ BCM 9hen viewing culture from a BC !ers!ective& Rossing (#$$A) states that culture is !resent in !rocess the culture

all stages of the !rocess. 9hen auditing6reviewing an organi(ation)s BC that develo!s over time should be ta-en into account. 1 strong BC li-ely reflect that the BC

culture will more than

!rogramme has strong senior management su!!ort and therefore culture these

visible investments in maintaining high levels of resilience. 9ith a wea- BC

elements will most li-ely be missing. 1lesi (#$$=) stresses that when creating a culture of resiliency7 accountability needs to be co*located with authority and BC com!onents should be

integrated into day*to*day o!erations. It is im!ortant to ma-e every em!loyee !art of a !lan& and ma-e the !lan accessible to them. The organi(ation must be !re!ared to im!rovise. ,heffi (#$$A) states that when creating a culture of resiliency within an organi(ation where em!loyees are able to res!ond ?uic-ly to incidents using familiar tools& which creates a model that lends itself to the re?uired fle'ibility& the right cor!orate culture& 0a shared !assion to be successful2 is a crucial ingredient in creating resilient enter!rises. +mbedding BC into the organi(ational culture therefore re?uires an awareness of the wider

e'isting organi(ational culture and must be underta-en carefully in order for it to become internali(ed by em!loyees for the future. "aving all of the above BC !rogramme elements in

!lace should lead to the organi(ations BC

!rogramme being com!rehensive and functional

from its ince!tion and throughout the lifetime of the organi(ation. BCM an$ Change Management It is vital that BC !lans are constantly maintained& 8allagher (#$$D) warns that if BC !lans are not -e!t u! to date following organi(ational changes they will become irrelevant. +lliott& ,wart( and "erbane (#$$#) ma-e reference to the fact that more attention has often been directed to the !lanning dimension of the BC !rocess than that of im!lementation& both in !ractice and in

various !ublications. ;4aergaard (#$$:) outlines that when it comes to organi(ational change and maintaining BCP)s& organi(ations face a dilemma when they engage in strategy ma-ing& because they must reconcile the constant tension between continuity and change. 1s organi(ations face constant change as a result of today)s business environment& the BC management strategy

needs to be fle'ible enough to be able to -ee! !ace with this challenge. The literature notes that it is im!ortant that in any BC !rocess !lans are -e!t u!dated as the

organi(ation evolves over time through a change management (C ) !rocess. The BC !rogramme therefore needs to be !art of the organi(ational C !rogramme in order for it to be

-e!t current. 1rmit (#$$A) refers to this noting that !lans reflect the business re?uirements at that time. Re?uirements and recovery times are not constant and must be maintained via a BC & C !rocess. Commenting on the C of the BC !rogramme& +lliott& ,wart( and "erbane (#$%$) state

that generic change management strategies should be used to ensure effective BC im!lementation.

Con e!t"a# Framework A F"n tiona# Framework $or an Enter!ri%e Wi&e BCM Program 1 logical starting !oint for identifying !rogram and function s!ecific com!etencies is a functional framewor- for an enter!rise wide BC !rogram. The develo!ment of such a

framewor- facilitated the identification and logical grou!ing of candidate com!etencies for clarity of !resentation and survey structure. ,everal candidate framewor-s were identified and are described in the review of literature. The most useful to this research study was the 0Crisis anagement and Business Continuity2 framewor- ("arrald %::=) which served as the unifying model for the structure of Bederal +mergency anagement 1gency "igher +ducation Pro4ect anagement (,haw %:::). Bor the !ur!ose

5niversity level course Business and Industry Crisis

of this research study& several framewor-s& !rimarily the framewor- set forth by Eohn R. "arrald& were synthesi(ed into a single framewor- under which s!ecific functional com!etencies were identified and analy(ed. This framewor- dis!lays a hierarchy of the functions (from to! to bottom) and the tem!oral nature of each (from left to right). It is !resented as a model for a com!rehensive and integrated BC !rogram (Bigure %).

Framework% o$ BCM Prior to the !ublication of Eohn R. "arrald)s %::= !a!er& A Strategic Framework for Corporate Crisis Management, no overall gra!hic framewor- for a functionally integrated business crisis and continuity management has been identified in the literature review. ,uch a framewor- could be e?ually valuable for BCC and is viewed as a logical starting !oint for visuali(ing the su!!orting functions and identifying and grou!ing !rogram

integration of enter!rise wide BCC and function s!ecific com!etencies.

Fig"re 2 Com!rehen%i'e Emergen y Management Framework

Re$eren e% 1d-ins& 8. ..& Bla-e& ;.& F Thornton& T. E. (#$$:). 1 content analysis investigating relationshi!s between communication and business continuity !lanning. The Journal of Business Communication& (D).

1lesi& P. (#$$=). Building enter!rise*wide resilience by integrating business continuity ca!ability into day*to*day business culture and technology. Journal Of Business Continuity & mergency !lanning& "(D)& #%<*##$. 1rmit& T. #$$A. BCP Plan Testing #$% "iles& 1. (ed) The &an'(ook Of Business Continuity Management& ,econd +dition& +ngland/ Eohn 9iley F ,ons .td& !!.D#D*DD=. 1ronson& +. (%:::). The Social Animal& 9orth !ublishers& 5nited ,tates of 1merica/ 9.". Breeman and Com!any. Barnes& E. C. (#$$%). A gui'e to (usiness continuity planning. Chichester/ Eohn 9iley. Basel Committee on Ban-ing ,u!ervision (#$$3). &igh)le*el principles for (usiness continuity. Basel& ,wit(erland/ Ban- for International ,ettlements. Bra(eau, P+ ,#$$=-+ "olistic Protection+ Canadian 5nderwriter, .ol+ /0, #ssue 1, pp+ "2)+ "3+ Business continuity management+ !art 4, Co'e of practice. (#$$3). .ondon/ British ,tandards Institution. de 9aal& 1. (#$$3). Towards 1 Com!arative Political +thnogra!hy @f Disaster Prevention. Journal Of #nternational Affairs& 05(#)& %#:*%<:. +lliott& D. ,wart(& +. and "erbane& B.& #$$#. Business Continuity Management 6 A crisis management approach& .ondon/ Routledge. +lliott& D.& F ,wart(& +. (#$$#). Business continuity management% a crisis management approach. .ondon/ Routledge. +lliott& D.& F ,wart(& +. (#$$#). Business continuity management% a crisis management approach. .ondon/ Routledge. +lliott& D.& ,wart(& +.& F "erbane& B. (#$%$). Business continuity management% a crisis management approach (#nd ed.). Gew Hor-& GH/ Routledge.

8allagher&

. (#$$D). Business continuity management% how to protect your company from

'anger. .ondon/ Prentice "all6Binancial Times. 8inn& R. D. (%::#). Continuity planning% pre*enting, sur*i*ing, an' reco*ering from 'isaster. @'ford& +ngland/ +lsevier 1dvanced Technology. "arrald& Eohn R. (%::=). A Strategic Framework for Corporate Crisis Management+ The International +mergency 9ashington& DC. "erbane& B. (#$%$) The evolution of business continuity management/ 1 historical review of !ractices and drivers. Business "istory& I# (3) !!. :A=*%$$# "iles& 1. (#$$A). The 'efiniti*e han'(ook of (usiness continuity management (#nd ed.). "obo-en& G.E./ 9iley. &owe& J. "77/. J!ro8ect #nitiation an' Management+9 #n The :efiniti*e &an'(ook of Business Continuity Management& edited by 1. "iles. #nd ed. 9est ,usse' ;ello, E+ ,#$$:). "ow to assess your culture+ Industrial ,afety F "ygiene Gews,+ ;1,2-, ";)"2+ <8aergaar'& 1... ("775) JOrgani=ational i'entity an' strategyJ& #nternational Stu'ies of Management an' Organi=ation& Kol.D: Go.% !!I$*3:. <och& >. ("77;). Best !ractices in Business Continuity. Communications $ews& Kol. <%& !art %%& !!. #<*#I. .indstedt& D. (#$$=). 8rounding the disci!line of business continuity !lanning/ 9hat needs to be done to ta-e it forward> Journal of (usiness continuity & emergency planning& "(#)& %:A*#$I. itroff& I. I.& Pearson& C.& Binney& .& F Pauchant& T. (%:=:). Do (some) organi(ations cause anagement Conference %::= (TI+ , ):=) Proceedings.

their own crises> The cultural !rofiles of crisis*!rone vs. crisis*!re!ared organi(ations.

Organi=ation & n*ironment. yers& ;. G. (#$$3). Business continuity strategies% protecting against unplanne' 'isasters (Drd ed.). "obo-en& G.E./ 9iley. Rossing& T. D. (#$$A). Springer han'(ook of acoustics. Gew Hor-& G.H./ ,!ringer. ,eow& ;. (#$$:). 8aining senior e'ecutive commitment to business continuity/ otivators and

reinforcers. Journal Of Business Continuity & mergency !lanning& 1(D)& #$%*#$=. ,haw& 8regory. .. (#$$<). Personal notes from the Ready.gov& Ready Business Internet ,ite and Program Roll @ut. Gational Chamber of Commerce. 9ashington& DC. ,heffi& H. (#$$A). The resilient enterprise% o*ercoming *ulnera(ility for competiti*e a'*antage (#nd ed.). Cambridge& ass./ IT Press.