Business continuity and resilience management: A conceptual framework

Abstract

The overall objective of business continuity management (BCM) systems is to provide guidance and analytical subcomponents on how to assess and manage risk and sustain operations when facing a disruptive event. Current BCM practices largely follow a standard structure for formal planning processes and risk-assessment activities. An underlying assumption in standard practices is that systems can be decomposed in subsystems in a meaningful way, as they are tractable and data are available to predict the system's future functionality. However, the reality is much more complex in our volatile world. Standard BCM approaches do not pay adequate attention to the treatment of uncertainties. Thus, they fall short of addressing the complexity of operations involved with emergencies and crisis. Lack of focus on uncertainty hampers the ability of BCM systems to provide sufficient support for decision making in highly uncertain situations. Dealing with such situations necessitates a shift from a defensive risk-management approach, grounded on an illusion of control and accountability, to a proactive stance based on resilience thinking. Responding to this call, we use concepts from the resilience engineering (RE) field and link them to different components of a BCM system. We develop a novel BCM framework and identify a set of resilience influence factors to enhance resilience in BCM systems. We use a case-example, hosted by a leading organization in a second-line emergency response operation in Norway to reflect on the application of a suggested BCM framework.