An enhanced risk assessment framework for business continuity management systems

Safety Science

Volumn 89, Issue , 2016, Pages 201-218

  Torabi, S Ali ^a   Giahi, Ramin ^a   Sahebjamnia, Navid ^b  

^a UNIVERSITY OF TEHRAN   (Iran)

^b UNIVERSITY OF SCIENCE AND TECHNOLOGY OF MAZANDARAN   (Iran)

Author keywords

Benefit cost analysis; Best worst method; Business continuity management; Organizational resilience; Resource allocation; Risk assessment

Indexed keywords

COST BENEFIT ANALYSIS; DISASTERS; OFFSHORE PIPELINES; RESOURCE ALLOCATION; RISK MANAGEMENT;

BENEFIT-COST ANALYSIS; BEST-WORST METHOD; BUSINESS CONTINUITY MANAGEMENT; ORGANIZATIONAL RESILIENCE; RISK ASSESSMENT AND MANAGEMENTS; RISK ASSESSMENT FRAMEWORK; RISK MANAGEMENT FRAMEWORK; RISK MANAGEMENT SYSTEMS;

RISK ASSESSMENT;

ANALYTIC METHOD; ARTICLE; ATTRIBUTABLE RISK; BUSINESS CONTINUITY MANAGEMENT; CONCEPTUAL FRAMEWORK; HUMAN; ORGANIZATION; PRIORITY JOURNAL; RISK ASSESSMENT; RISK FACTOR; RISK MANAGEMENT; RISK REDUCTION;

EID: 84978916808     PISSN: 09257535     EISSN: 18791042     Source Type: Journal    
DOI: 10.1016/j.ssci.2016.06.015     Document Type: Article

References (88)

1. Aagedal, J.O., Den Braber, F., Dimitrakos, T., Gran, B.A., Raptis, D., Stolen, K., Model-based risk assessment to improve enterprise security. Enterprise Distributed Object Computing Conference, 2002. EDOC’02. Proceedings. Sixth International, 2002, IEEE, 51–62.
2. Altay, N., Ramirez, A., Impact of disasters on firms in different sectors: implications for supply chains. J. Supply Chain Manage. 46:4 (2010), 59–80.
3. Asgary, A., Anjum, M.I., Azimi, N., Disaster recovery and business continuity after the 2010 flood in Pakistan: case of small businesses. Int. J. Disaster Risk Reduction 2 (2012), 46–56.
4. Beyer, H., Sendhoff, B., Robust optimization – a comprehensive survey. Comput. Methods Appl. Mech. Eng. 196:33–34 (2007), 3190–3218.
5. BS25999, B.S., 2007. Business Continuity Management-Part2: Specification Business Continuity Management.
6. Bubeck, P., Botzen, W.J.W., Aerts, J.C.J.H., A review of risk perceptions and other factors that influence flood mitigation behavior. Risk Anal: Off. Publ. Soc. Risk Anal. 32:9 (2012), 1481–1495.
7. Campbell, D.T., Stanley, J.C., 1963. Experimental and Quasi-Experimental Designs for Research.
8. Cerullo, V., Cerullo, M.J., Business continuity planning: a comprehensive approach. Inform. Syst. Manage. 21:3 (2004), 70–78.
9. Chang, J.-R., Chang, K.-H., Liao, S.-H., Cheng, C.-H., The reliability of general vague fault-tree analysis on weapon systems fault diagnosis. Soft Comput. 10:7 (2006), 531–542.
10. Chang, K.-H., Cheng, C.-H., A risk assessment methodology using intuitionistic fuzzy set in FMEA. Int. J. Syst. Sci. 41:12 (2010), 1457–1471.
11. Chopra, S., Reinhardt, G., Mohan, U., The importance of decoupling recurrent and disruption risks in a supply chain. Naval Res. Logist. 54:5 (2007), 544–555.
12. Christopher, M., Mena, C., Khan, O., Yurt, O., Approaches to managing global sourcing risk. Supply Chain Manage.: Int. J. 16:2 (2011), 67–81.
13. Clarke, C.J., Varma, S., Strategic risk management: the new competitive edge. Long Range Plan. 32:4 (1999), 414–424.
14. Cooke, R.M., Experts in Uncertainty: Opinion and Subjective Probability in Science. 1991, Oxford University Press, New York.
15. Craighead, C.W., Blackhurst, J., Rungtusanatham, M.J., Handfield, R.B., The severity of supply chain disruptions: design characteristics and mitigation capabilities. Decis. Sci. 38:1 (2007), 131–156.
16. Dunjó, J., Fthenakis, V., Vílchez, J.A., Arnaldos, J., Hazard and operability (HAZOP) analysis. A literature review. J. Hazard. Mater. 173:1–3 (2010), 19–32.
17. Ebrahim Nejad, A., Niroomand, I., Kuzgunkaya, O., Responsive contingency planning in supply risk management by considering congestion effects. Omega 48 (2014), 19–35.
18. Feng, N., Wang, H.J., Li, M., A security risk analysis model for information systems: causal relationships of risk factors and vulnerability propagation analysis. Inform. Sci.; Bus. Intell. Risk Manage. 256 (2014), 57–73.
19. Fera, M., Macchiaroli, R., Appraisal of a new risk assessment model for SME. Saf. Sci. 48:10 (2010), 1361–1368.
20. Finch, P., Supply chain risk management. Supply Chain Manage.: Int. J. 9:2 (2004), 183–196.
21. Galindo, G., Batta, R., Review of recent developments in OR/MS research in disaster operations management. Eur. J. Oper. Res. 230:2 (2013), 201–211.
22. Ganguly, K.K., Guin, K.K., Supply side risk assessment: an application of Yager's methodology based on fuzzy sets. Int. J. Bus. Continuity Risk Manage. 1:2 (2010), 136–150.
23. Gibb, F., Buchanan, S., A framework for business continuity management. Int. J. Inform. Manage. 26:2 (2006), 128–141.
24. Goossens, L.H.J., Cooke, R.M., Hale, A.R., Rodic-Wiersma, L.J., Fifteen years of expert judgment at TUDelft. Saf. Sci. 46:2 (2008), 234–244.
25. World Economic Forum, Global Risks 2015, 10th ed. Retrieved from , 2015.
26. Greenberg, M.R., Lahr, M., Mantell, N., Understanding the economic costs and benefits of catastrophes and their aftermath: a review and suggestions for the U.S. federal government. Risk Anal. : Off. Publ. Soc. Risk Anal. 27:1 (2007), 83–96.
27. Halliday, S., Badenhorst, K., Von Solms, R., A business approach to effective information technology risk analysis and management. Inform. Manage. Comput. Secur. 4:1 (1996), 19–31.
28. Hallikas, J., Karvonen, I., Pulkkinen, U., Virolainen, V.-M., Tuominen, M., Risk management processes in supplier networks. Int. J. Prod. Econ. 90:1 (2004), 47–58.
29. Harland, C., Brenchley, R., Walker, H., Risk in supply networks. J. Purchasing Supply Manage. 9:2 (2003), 51–62.
30. Heckmann, I., Comes, T., Nickel, S., A critical review on supply chain risk – definition, measure and modeling. Omega 52 (2015), 119–132.
31. Herbane, B., Exploring crisis management in UK small and medium sized enterprises. J. Contingencies Crisis Manage. 21:2 (2013), 82–95.
32. Hiles, A., The Definitive Handbook of Business Continuity Management. 2010, John Wiley & Sons.
33. Holzmann, R., Jørgensen, S., Social Risk Management: a new conceptual framework for Social Protection, and beyond. Int. Tax Pub. Finance 8:4 (2001), 529–556.
34. Holzmann, R., Sherburne-Benz, L., Tesliuc, E., Unit, S.P., Social Risk Management: The World Bank's Approach to Social Protection in a Globalizing World. 2003, World Bank, Washington, DC.
35. ISO 22301, Societal Security—Business Continuity Management Systems – Requirements. 2012, International Organization for Standardization, Switzerland.
36. ISO 31010, Risk Management-Risk Assessment Techniques. 2009, International Organization for Standardization.
37. ISO 27005, Information Security Risk Management. 2008, International Organization for Standardization.
38. Kangas, A.S., Kangas, J., Probability, possibility and evidence: approaches to consider risk and uncertainty in forestry decision analysis. For. Policy Econ. 6:2 (2004), 169–188.
39. Karimi, I., Hüllermeier, E., Risk assessment system of natural hazards: a new approach based on fuzzy probability. Fuzzy Sets Syst. 158:9 (2007), 987–999.
40. Kelly, D.L., Smith, C.L., Bayesian inference in probabilistic risk assessment – the current state of the art. Reliab. Eng. Syst. Saf. 94 (2009), 628–643.
41. Kleindorfer, P., Saad, G., Managing disruption risks in supply chains. Prod. Oper. 14:1 (2005), 53–68.
42. Knemeyer, a.M., Zinn, W., Eroglu, C., Proactive planning for catastrophic events in supply chains. J. Oper. Manage. 27:2 (2009), 141–153.
43. Kull, T., Closs, D., The risk of second-tier supplier failures in serial supply chains: implications for order policies and distributor autonomy. Eur. J. Oper. Res. 186:3 (2008), 1158–1174.
44. Lai, I.K.W., Lau, H.C.W., A hybrid risk management model: a case study of the textile industry. J. Manuf. Technol. Manage. 23:5 (2012), 665–680.
45. Lavastre, O., Gunasekaran, A., Spalanzani, A., Effect of firm characteristics, supplier relationships and techniques used on Supply Chain Risk Management (SCRM): an empirical investigation on French industrial firms. Int. J. Prod. Res. 52:11 (2014), 3381–3403.
46. Lindhe, A., Rosén, L., Norberg, T., Bergstedt, O., Fault tree analysis for integrated and probabilistic risk analysis of drinking water systems. Water Res. 43:6 (2009), 1641–1653.
47. Liu, H.C., Li, P., You, J.X., Chen, Y.Z., A novel approach for FMEA: Combination of interval 2-tuple linguistic variables and gray relational analysis. Qual. Reliab. Eng. Int. 31:5 (2015), 761–772.
48. Liu, H.C., You, J.X., Lin, Q.L., Li, H., Risk assessment in system FMEA combining fuzzy weighted average with fuzzy decision-making trial and evaluation laboratory. Int. J. Comput. Integr. Manuf. 28:7 (2015), 701–714.
49. Liu, Y., Fan, Z.-P., Yuan, Y., Li, H., A FTA-based method for risk decision-making in emergency response. Comput. Oper. Res. 42 (2014), 49–57.
50. Lockamy, A. III, Assessing disaster risks in supply chains. Ind. Manage. Data Syst. 114:5 (2014), 755–777.
51. Mahdevari, S., Shahriar, K., Esfahanipour, A., Human health and safety risks management in underground coal mines using fuzzy TOPSIS. Sci. Total Environ. 488 (2014), 85–99.
52. Manuj, I., Mentzer, J.T., Global supply chain risk management strategies. Int. J. Phys. Distrib. Logist. Manage. 38:3 (2008), 192–223.
53. Marhavilas, P.K., Koulouriotis, D.E., Developing a new alternative risk assessment framework in the work sites by including a stochastic and a deterministic process: a case study for the Greek Public Electric Power Provider. Saf. Sci. 50:3 (2012), 448–462.
54. Nijaz, B., Mario, S., Lejla, T., Implementation of the IT governance standards through business continuity management: cases from Croatia and Bosnia-Herzegovina. Information Technology Interfaces (ITI), Proceedings of the ITI 2011 33rd International Conference on, 2011, IEEE, 43–50.
55. Nocco, B.W., Stulz, R.M., Enterprise risk management: theory and practice. J. Appl. Corp. Finance 18:4 (2006), 8–20.
56. Norrman, A., Jansson, U., Ericsson's proactive supply chain risk management approach after a serious sub-supplier accident. Int. J. Phys. Distrib. Logist. Manage. 34:5 (2004), 434–456.
57. Ojala, M., Hallikas, J., Investment decision-making in supplier networks: management of risk. Int. J. Prod. Econ. 104:1 (2006), 201–213.
58. Oke, A., Gopalakrishnan, M., Managing disruptions in supply chains: a case study of a retail supply chain. Int. J. Prod. Econ. 118:1 (2009), 168–174.
59. Olson, D.L., Wu, D.D., A review of enterprise risk management in supply chain. Kybernetes 39:5 (2010), 694–706.
60. Ou Yang, Y.P., Shieh, H.M., Tzeng, G.H., A VIKOR technique based on DEMATEL and ANP for information security risk control assessment. Inf. Sci. 232 (2013), 482–500.
61. Park, J., Seager, T.P., Rao, P.S.C., Convertino, M., Linkov, I., Integrating risk and resilience approaches to catastrophe management in engineering systems. Risk Anal.: Off. Publ. Soc. Risk Anal. 33:3 (2013), 356–367.
62. Parnell, G.S., Smith, C.M., Moxley, F.I., Intelligent adversary risk analysis: a bioterrorism risk management model. Risk Anal.: Off. Publ. Soc. Risk Anal. 30:1 (2010), 32–48.
63. Rezaei, J., Best-worst multi-criteria decision-making method. Omega 53 (2015), 49–57.
64. Ritchie, B., Brindley, C., Supply chain risk management and performance: a guiding framework for future development. Int. J. Oper. Prod. Manage. 27:3 (2007), 303–322.
65. Sahebjamnia, N., Torabi, S.A., Mansouri, S.A., Integrated business continuity and disaster recovery planning: towards organizational resilience. Eur. J. Oper. Res. 242:1 (2015), 261–273.
66. Samantra, C., Datta, S., Mahapatra, S.S., Risk assessment in IT outsourcing using fuzzy decision-making approach: an Indian perspective. Expert Syst. Appl. 41:8 (2014), 4010–4022.
67. Sawik, T., Selection of supply portfolio under disruption risks. Omega 39:2 (2011), 194–208.
68. Shafiee, M., A fuzzy analytic network process model to mitigate the risks associated with offshore wind farms. Expert Syst. Appl. 42:4 (2015), 2143–2152.
69. Shafieezadeh, A., Cha, E.J., Ellingwood, B.R., A decision framework for managing risk to airports from terrorist attack. Risk Anal. 35:2 (2015), 292–306.
70. Shakhsi-Niaei, M., Torabi, S.A., Iranmanesh, S.H., A comprehensive framework for project selection problem under uncertainty and real-world constraints. Comput. Ind. Eng. 61:1 (2011), 226–237.
71. Skogdalen, J.E., Vinnem, J.E., Quantitative risk analysis offshore—human and organizational factors. Reliab. Eng. Syst. Saf. 96:4 (2011), 468–479.
72. Song, W., Ming, X., Wu, Z., Zhu, B., A rough TOPSIS approach for failure mode and effects analysis in uncertain environments. Qual. Reliab. Eng. Int. 30:4 (2014), 473–486.
73. Stamatis, D.H., Failure Mode and Effect Analysis: FMEA from Theory to Execution. 2003, ASQC Quality Press.
74. Tang, C.S., Perspectives in supply chain risk management. Int. J. Prod. Econ. 103:2 (2006), 451–488.
75. Tjoa, S., Jakoubi, S., Quirchmayr, G., Enhancing business impact analysis and risk assessment applying a risk-aware business process modeling and simulation methodology. Third International Conference on Availability, Reliability and Security, 2008, 179–186.
76. Torabi, S.A., Rezaei Soufi, H., Sahebjamnia, N., A new framework for business impact analysis in business continuity management (with a case study). Saf. Sci. 68 (2014), 309–323.
77. Torabi, S.A., Baghersad, M., Mansouri, A., Resilient supplier selection and order lot-sizing under operational and disruption risks. Transport. Res. Part E: Logist. Transport. Rev. 79 (2015), 22–48.
78. Trammell, S.R., Davis, B.J., Using a modified HAZOP/FMEA methodology for assessing system risk. Engineering Management for Applied Technology, 2001. EMAT 2001. Proceedings. 2nd International Workshop on, 2001, IEEE, 47–53.
79. Trkman, P., Mccormack, K., Supply chain risk in turbulent environments—a conceptual model for managing supply chain network risk. Int. J. Prod. Econ. 119:2 (2009), 247–258.
80. Tsai, C.H., Chen, C.W., An earthquake disaster management mechanism based on risk assessment information for the tourism industry-a case study from the island of Taiwan. Tourism Manage. 31:4 (2010), 470–481.
81. Tuncel, G., Alpan, G., Risk assessment and management for supply chain networks: a case study. Comput. Ind. 61:3 (2010), 250–259.
82. Vinnem, J.E., Aven, T., Husebø, T., Seljelid, J., Tveit, O.J., Major hazard risk indicators for monitoring of trends in the Norwegian offshore petroleum sector. Reliab. Eng. Syst. Saf. 91:7 (2006), 778–791.
83. Wallace, Michael, Webber, Lawrence, The Disaster Recovery Handbook: A Step-by-Step Plan to Ensure Business Continuity and Protect Vital Operations, Facilities, and Assets. 2010, AMACOM Div American Mgmt Assn.
84. Wijnia, Y., Nikolic, I., Assessing business continuity risks in IT. 2007 IEEE International Conference on Systems, Man and Cybernetics, 2007, 3547–3553.
85. Wreathall, J., Assessing risk: the role of probabilistic risk assessment (PRA) in patient safety improvement. Qual. Saf. Health Care 13:3 (2004), 206–212.
86. Wu, T., Blackhurst, J., Chidambaram, V., A model for inbound supply risk analysis. Comput. Ind. 57:4 (2006), 350–365.
87. Wulan, M., Petrovic, D., A fuzzy logic based system for risk analysis and evaluation within enterprise collaborations. Comput. Ind. 63:8 (2012), 739–748.
88. Zsidisin, G.A., Melnyk, S.A., Ragatz, G.L., An institutional theory perspective of business continuity planning for purchasing and supply management. Int. J. Prod. Res. 43:16 (2005), 3401–3420.