aan

cessiewpS)lateontiBIAe mprov

ontinul for e(heretionsess whand thfor o

the organization. They reviewed the concept of resiliency anddescribed that those organizations having implemented businesscontinuity and disaster recovery plans, are more resilient thanother ones.

business continu-s life cycs based upMTPD and

measures for the key products and their identiedfunctions. Notably, critical functions are those required funactivities to provide the key products.

Fig. 2 shows the relationships between the BIA and otherelements of BCMS in an organization. A right BIA process shouldconsider goals of the organization, and should not have any contra-diction with them. Furthermore, BCM strategies try to keep thecontinuity of organizations key functions based on the outcomesof BIA (Cha et al., 2008). Therefore, the validity of developed BC

Corresponding author. Tel.: +98 21 61114267.E-mail addresses: satorabi@ut.ac.ir (S.A. Torabi), H.rezaeisu@ut.ac.ir

(H. Rezaei Sou), n.sahebjamnia@ut.ac.ir (N. Sahebjamnia).

Safety Science 68 (2014) 309323

Contents lists availab

Safety S

w.estudy research and explained the necessity of creating businesscontinuity plans in organizations to manage disruption risks.Bhamra et al. (2011) explained that the level of business continuityin an organization has a direct relation with the resilience level of

to codify a report to top managers for preparingity plan (BCP) (Sikdar, 2011). Based on the BCMoutputs of BIA is a list of prioritized key productranking of organizations products, as well as thehttp://dx.doi.org/10.1016/j.ssci.2014.04.0170925-7535/ 2014 Elsevier Ltd. All rights reserved.le, theon theMBCOcriticalctions/(ISO 22301, 2012). In this respect, implementing a business conti-nuity management system (BCMS) within an organization can pro-tect the organization against various disruptive events byproviding suitable business continuity/disaster recovery (BC/DR)plans for identied critical business processes/functions proac-tively (Randeree et al., 2012). Zsidisin et al. (2005) presented a case

organization objectives.BIA and risk assessment (RA) are two main elements for under-

standing the organization (ISO 22301, 2012). BIA is dened as aprocess of analyzing operational functions and the effect that a dis-ruption might have upon them (ISO 22313, 2012). The mainobjective of BIA is gathering and analyzing required information1. Introduction

During the last decade, business chas been evolved as an effective tooorganizations key products/servicesin the presence of various disrup2006). BCM is a management procinternal and external threats/risksprocesses and provides a frameworkity management (BCM)nsuring the delivery ofafter simply products)(Gibb and Buchanan,ich identies possibleeir impact to businessrganizational resilience

According to the international organization for standards (ISO),BCM life cycle involves six elements including the businesscontinuity program management, embedding competence andawareness in the culture of organization, understanding theorganization, selecting business continuity options, developingand implementing a business continuity response, and exercisingand testing the developed plans as shown in Fig. 1. A comprehen-sive understanding of an organization and its key processesensures that the BCMs program is established according to theFuzzy DEMATELANP

applicability and usefulness of the proposed approach. 2014 Elsevier Ltd. All rights reserved.A new framework for business impact anmanagement (with a case study)

S.A. Torabi , H. Rezaei Sou, Navid SahebjamniaSchool of Industrial Engineering, College of Engineering, University of Tehran, Tehran, Ir

a r t i c l e i n f o

Article history:Received 20 February 2014Received in revised form 23 April 2014Accepted 23 April 2014Available online 22 May 2014

Keywords:Business continuity managementBusiness impact analysis

a b s t r a c t

Resumption of critical probusiness continuity (BC) vmanagement system (BCMfunctions and their BC rethe minimum business cframework to conduct theby relying on some effectivpart manufacturer is also

journal homepage: wwlysis in business continuity

es/functions after occurrence of any disruptive event is essential from theoint. Business impact analysis (BIA) is a key part of a business continuityin which an organizations key products/services along with the criticald indices, i.e., the maximum tolerable period of disruption (MTPD) andnuity objective (MBCO) are determined. This study proposes a novelin organizations in a more systematic and comprehensive way mostly

ulti attribute decision making (MADM) techniques. A case study in an autoided to validate the proposed framework whose results demonstrate the

le at ScienceDirect

cience

lsevier .com/locate /ssc i

ScieBusiness Continuity Program

Management

Understanding the

Organization

Implementing a Business Continuity Response

Exercising and Testing

Selecting Business

Continuity Options

310 S.A. Torabi et al. / Safetyplans depends on the BIA results. Finally, the relationship betweenBIA and RA is undeniable because the results of BIA and RA aremerged to develop suitable BC plans. Remarkably, due to dynamicinternal and external conditions, an organizations goals and strat-egies might be changed over time; therefore the BIA outcomesalong with the RA and BCM strategies should also be concurredwith these changes leading to maintain an effective BCMS.

Due to the importance of BIA for developing an effective BCMS,several frameworks have ever been proposed in the literature forconducting a BIA process. Australian BCM institute (2000) proposesthe three steps: (1) identifying and ranking of organizations pro-cesses according to an analysis of their nancial and operationalimpacts, (2) recognizing the critical functions (3)matching requiredresources to critical functions. The federal nancial institutionsexamination council (FFIEC, 2008) introduces four steps for BIAwhich includes identication of key products, prioritizing them,determining insurance requirements, and identifying dependen-cies. Sayal (2006) proposes a time correlation basedmethod to esti-mate the impact of a disruptive event on a function and argues thatthe time correlation between each pair of functions during and aftera disruptive event can be considered as the impact of event on thisfunction. Tjoa et al. (2008) present the most important steps for BIAas: identifying business activities and functions, recognizing

Fig. 1. The lifecycle of BCM (BS 2599:1, 2006).

Business Impact Analysis (BIA)

Goals of Organization

Risk Analysis (RA)

BCM Strategies

Fig. 2. Relationships of BIA with other elements of a BCMS.appropriate resources, identifying those scenarios leading to severeimpacts on the companys reputation, assets or nancial positionand detecting the time-frames over which the business activitiesdisruption are unacceptable. Western Australian Government(2009) provides a framework and accounts for impact of anydisruption on the processes of an organization according to the vecriteria: public condence, reputation, operational efciency,statutory obligations and nance and proposes four steps forimplementing BIA as: preparation and set-up, identifying businessfunctions, assessing business impacts and determining prioritiesand identifying required resources for functions. Akkiraju et al.(2012) present a quantitative framework for modeling the impactof business processes outages. They dene a total business impactfunction for each incident. Sikdar (2011) introduces three steps forimplementing BIA in an organization including the data gathering,data analysis and report preparing. The author uses data gatheringto identify those critical and time-sensitive functions, data analysisto classify all functions of organization in the four levels accordingto their recovery time objectives (RTOs) and nally in last stepprepares a report for top managers. Ranjan et al. (2012) propose aframework for BIA implementation in eight steps including theexperts identication, determination of BIA scope, meetingorganization, information gathering, questionnaire designing,interviewing, providing tabulate information and reportpresentation.

After a disruption happens, the level of some organizationalresources might be decreased signicantly so that the organizationcannot recover all disrupted functions at the same time (Geelen-Baass and Johnstone, 2008). Hence, the key products and criticalfunctions are rst resumed by invoking suitable BC plans whileconsidering the available and required resources according to theMTPD and MBCO measures of these critical functions.

Various BIA methods could be described into three major stepsin which the procedure of identifying key products and their criti-cal functions are very similar. The main difference between thesemethods usually appears on applied data collection method suchas conducting interviews, developed questionnaires and designingfeedback forms (Australian BCM institute, 2000). Although it isnecessary to identify key products and their critical functions accu-rately, the lack of a more structured and quantitative method isobvious in the context of BIA. This issue becomes more important,when knowing that, the restoration and resumption of the organi-zations disrupted functions are carried out based on the BIAresults. On the other hand, it is necessary for any organization toknow which products and functions with what risk appetite rateand in what timeframes should be resumed (to a predened min-imum operating level) and then restored to the normal operatinglevel. Based upon a review of current frameworks, BIA processcan be categorized into three main steps: (1) identifying key prod-ucts, (2) identifying critical functions and (3) determining the con-tinuity measures of key products and their critical functions (i.e.,MTPD and MBCO). Also, the literature review demonstrates thelack of a comprehensive BIA framework with systematic and quan-tied steps. Accordingly, in this study, a novel and comprehensiveBIA framework is developed to identify an organizations key prod-ucts, critical functions and their respective MTPD and MBCO mea-sures. To do so, we review relevant studies and explore variousmeasures for ranking products and functions separately. Also, toaccount for interaction and interdependencies between rankingcriteria, analytic network process (ANP) and fuzzy Decision MakingTrial and Evaluation Laboratory (DEMATEL) techniques are utilizedfor ranking of identied products and functions. In addition, a newrelational work breakdown structure (RWBS) is developed to

nce 68 (2014) 309323determine the critical functions of key products. Finally, a MTPDalgorithm is proposed to calculate appropriate MTPD and MBCOmeasures for critical functions according to MTPD and MBCO mea-

The rest of this study is organized as follows. In Section 2, the

in a manner quite similar to that of the rst step. Finally, in the

Sciefourth step, the continuity parameters including the MTPD andMBCO measures of critical functions are determined by using ofa novel algorithm.

Fig. 3 depicts the whole process of proposed BIA framework. Inthe next section, all steps will be explained in more details.

2.1. Identifying of key products

As it was mentioned earlier, identifying key products in an orga-nization is of vital importance for business continuity. After a dis-ruption occurs, it is certainly not possible to recover all processespertaining to all products and it is necessary to prioritize productsof organization and identify those key products whose functionsmust be recovered rst. Due to complexity of structure of mostorganizations and importance of BIA role in business continuity,an effective implementation of BIA is needed through a step-by-step approach. While reorganization of key products is a multidis-ciplinary task, the previous research studies focus on just one ortwo measures for identication of key products among the deliveryproposed BIA framework is elaborated. In the third section, theproposed model is implemented on a real case study and in thefourth section, some implementation tips are presented. Finally,Section 5 provides concluding remarks and directions for furtherresearch.

2. Proposed BIA framework

Understanding the organization is known as the main step ofBCM (ISO 22301, 2012). A holistic understanding of the organiza-tion and its key products and critical functions ensures BCMs pro-gram to be established according to the organizations objectivesand strategies, and increases the success chance of BC plans inthe response phase. This study focuses on BIA implementation inan organization by developing a new framework in the four sepa-rate steps.

The rst step is identifying the key products of the organization.This process is carried out through determining some suitableselection indices/criteria and applying a hybrid ANP-fuzzy DEMA-TEL approach for ranking the products. Each key product is a resultof performing several functions. Hence, for a credible delivery ofkey products, identication of those critical functions is of vitalimportance. For this, key products structures should be rst bro-ken into the smallest essential functions. Through this step, allrequired functions in the organization related to key products arerst identied. The next step is identifying the business criticalfunctions. In this step, those functions which were identiedthrough the breakdown of key products structures are then rankedsures of related key products. In this manner, the main contribu-tions of this study could be highlighted as follows:

Proposing a novel framework for determining key products andtheir critical functions in an organization from the continuityviewpoint in which some efcient MADM techniques are usedto rank the identied products and functions.

Using a new relational work breakdown structure to determinethose required functions to provide the key products.

Developing a procedure to determine the MBCO and MTPDmeasures of the key products and their critical functions basedon the risk appetite concept and a MTPD algorithm.

S.A. Torabi et al. / Safetytime/amount, makespan, processing time, lead time and utilizedresources. For example, FFIEC (2008) denes key products basedon the amount of delivered products and then assesses eachproduct with this measure. However, in this study, for deningsuitable measures to identify key products, a literature reviewalong with some interviews with experts were conducted andtwelve measures were nally explored (see Table 1).

Two areas including BCMS and business process managementwere reviewed to explore key products measures. However, mostof these measures were explored from the BCM literature such as:loss of revenue, loss of interested parties, defection of customers,damage on organizations reputation, and importance of producton national view and objectives of organization. Noteworthy, byincreasing the competition between organizations around theworld, the reputation and prestige of organization is as importantas the loss of revenue.

Furthermore, other measures were dened through reviewingbusiness process management studies such as insurance cost forundeliverable products, inuence on markets, inuence on humanresources and technological level of company. These measuresaltogether can help the organization to have a comprehensive viewon its products encompassing all organizational aspects. Accord-ingly, all identied measures are used to rank the organizationsproducts. Table 1 provides these measures with a short descriptionabout each one.

Due to the nature of products ranking problem where compen-sation between criteria is allowed, a compensatory multi criteriadecision analysis (MCDA) method could be used. In this way, dueto existence of interaction and interdependency between criteria,analytic network process (ANP) is used to rank the organizationsproducts. Noteworthy, analytic hierarchy process (AHP) proposedby Saaty (1990), is only able to evaluate the inuence owsbetween various elements with hierarchically structured linearrelationships and does not consider non-linear interactions orinterdependencies such as cycle (mutual outer dependencies)and loop (inner dependencies) between elements. To account forsuch non-linear inuence ows, analytic network process (ANP)was proposed by Saaty (2001), enabling us to consider a networkof inuence ows between elements of different clusters. The mainstep of ANP is identifying a suitable network structure for the deci-sion problem which usually is identied through conducting abrain storming meeting or a Delphi process. However, in this study,fuzzy Decision Making Trial and Evaluation Laboratory (DEMATEL)method is adopted to derive the network in a more comprehensiveand quantitative manner (Chang et al., 2011).

When applying the fuzzy DEMATEL, experts judgments aboutinuence degrees of each element on other elements are gatheredin the form of linguistic terms which are then transformed to anumerical scale by modeling each linguistic term as a triangularfuzzy number (TFN). Then, the initial direct inuence matrix isformed by converting the fuzzy data into their crisp scores (CFCS)(Chang et al., 2011). Afterwards, the total inuence matrix is foundwhile taking indirect ows into account as well. Furthermore, toidentify stronger relations between criteria, a threshold value iscalculated by the maximum mean de-entropy (MMDE) algorithmdeveloped by (Li and Tzeng, 2009) and those relations with degreesgreater than the threshold value are remained in the nal networkstructure. More details about the ANP and DEMATEL methods havebeen provided in an Appendix A.

2.2. Key products breakdown structure

After determining the key products, their critical functionsshould be identied. For this, it is very important to ensure thatany function is not neglected through identication process ofrequired functions to deliver each key product. Work breakdown

nce 68 (2014) 309323 311structure (WBS) is a capable tool to detect all functions of theorganization. The US Government proposed this concept for projectmanagement in 1962 (Globerson, 1994). The main benet of WBS

SciePrepare a list which contains all products/services

Determine suitable criteria to

Determine the interactions

between criteria

Establish the exact structure of the problem

312 S.A. Torabi et al. / Safetyis providing a hierarchical breakdown structure such that the prob-ability of neglecting a function will be minimal. Moreover, by usingthis method, required cost and time for performing each functioncould be calculated.

There are several types of WBS such as department breakdownstructure, cost breakdown structure and resource breakdownstructure. Hashemi Golpayegani and Emamizadeh (2007) catego-rized the WBS of a project into two sets: (1) project control workbreakdown structure (PCWBS) depicting overall components of aprojects main outputs which here we dened them as an organi-zations key products and (2) functional work breakdown struc-ture (FWBS) showing all required functions which should beperformed to achieve main outputs. The authors then combined

Determine suitable criteria to

identify critical functions

Identify critical functions by

fuzzy DEMATEL and ANP

Identify key products by fuzzy DEMATEL and

ANP

identify key products

Breakdown structure of key

products to defineall functions

Define Continuity parameters (MTPD

and MBCO)

Normaand find

xmijn a

Computeleft nor

values: x

Compunorm

crisp v

Integravalu

Compuvalue

Define FWBS to determine

functions

Define PCWBS to determine sub-products

Calculate RWBS matrix to identify

all functions

Define risk appetite of

organization

Depict contourkey products

define MTPD rate of MBC

Key products breakdown

CFdefuzz

met

Define MTPD and M

Fig. 3. The proposedObtain ANP weights

Construct pairwise

comparisons

Develop final super matrix

ANP method

nce 68 (2014) 309323these two sets and created a new WBS model denoted as the rela-tional work breakdown structure (RWBS) indicating those compo-nents of FWBS that should be performed to obtain eachcomponent of PCWBS. Inspiring by this RWBS model, this studyhybridizes FWBS and PCWBS models to develop a customizedrelational work breakdown structure (RWBS) model. The custom-ized RWBS is displayed as a matrix whose rows are componentsof PCWBS and the columns are components of FWBS. All cellsof this matrix are binary values. Therefore, the value of a cell isequal to 1 if the function in the corresponding column is requiredfor producing the output in the corresponding row. In this man-ner, the developed RWBS indicates the required functions foreach key product.

lization ing xrijn, nd xlijn

right andmalized rsij

n, xlsijn

te total alized alue xijn

te crisp es, Zij

te crisp s, Zijn

Create direct fuzzy relation

matrix

Defuzzify fuzzy numbers with CFCS method

Acquire total influence matrix

Assign a threshold value by MMDE

method

Create final influence matrix

Tp

Calculate MTPD for critical

functions by MTPD algorithm

s for and for a O

Calculate ordered triplets

set, T*

Define ordered dispatch/receive node set, TDi/Re

Calculate HtDi/Re

and find TmaxDi/Re

Fuzzy DEMATEL

method

CS yfying hod

MMDE algorithm

BCO measures

BIA framework.

nt o

suppwn

andbre

ts inwnus boduill d

ts fodowry orimp

d orctur

tionanujecticturwill

Scie2.3. Identifying of critical functions

Table 1Measures used for selecting key products.

Measures References Short description

Loss of revenue (C1) Western AustralianGovernment (2009),Nosworthy (2000) and Ernest-Jones (2005)

Lost revenue in the evebreakdown

Loss of interestedparties supports(C2)

Western AustralianGovernment (2009); Ernest-Jones (2005)

Lost interested partiesmanufacturing breakdo

Defection ofcustomers (C3)

Ernest-Jones (2005), Mbuguaet al. (1999) and Nosworthy(2000)

Loss of customers demevent of manufacturing

Higher insurance cost(C4)

Ernest-Jones (2005) High compensation cosmanufacturing breakdo

Degree of damage oncompanys imageand reputation(C5)

Ernest-Jones (2005), WesternAustralian government (2009)and Nosworthy (2000)

Company become famomanufacturing some prmanufacturing them wcompany

Inuence on markets(C6)

Cooper and Kleinschmidt(1987)

Degree of losing markeof manufacturing break

Importance ofproduct for thecountry (C7)

Western AustralianGovernment (2009)

There are some statutowhen a product has an

Inuence on humanresources (C8)

Niazi et al. (2006), Hung et al.(2005) and Nosworthy (2000)

Number of staff are rein the event of manufa

Rate of deviationfrom companyobjectives (C9)

Australian BCM institute(2000)

Each product has a relaobjective that lack of mdamages companys ob

Loss of thetechnological levelof company (C10)

Abdel-Razek (1997) In the event of manufaof developing product

S.A. Torabi et al. / SafetyBy breaking down of organizations key products, a set ofrequired functions is identied for each product. Obviously,because of limited resources, the organization might not be ableto recover all disrupted functions at the same time after a disrup-tion occurs. So, all required functions should be prioritized to iden-tify those critical ones for each key product. Generally, researchersfocus on time based measures for identifying critical functions(Sikdar, 2011; Western Australian Government, 2009). Kepenach(2007) prepared a worksheet of functions consisting of the recov-ery time objective (RTO) and the critical employees and alterna-tives. Nosworthy (2000) calculated a qualitative rate (includingthe high, medium and low) for each function and sorted thembased on their rates. In Western Australian Government (2009),maximum acceptable outage (MAO) has been used for identifyingcritical functions. In FFIEC (2008), the importance of functions inachievement of organizations strategic goals is proposed to recog-nize critical functions. Western Australian Government (2009) alsodened critical functions as those functions that support organiza-tions objectives. Identifying critical functions based on just one ortwo measures is the main deciency of previous methods. To llthis gap, in this study, several measures for recognizing the criticalfunctions of key products have been explored by using a compre-hensive literature review as well as conducting some interviewswith experts. Table 2 summarizes these measures and gives a shortdescription for each of them.

Noteworthy, some of these measures including the functionrecovery cost and time, vulnerability and importance degree offunction in the production of key products have been borrowedfrom previous BCM studies while some others including the possi-bility of outsourcing function, possibility of insuring function andrequired manpower for recovery are extracted from previous stud-ies in the business process management area. Due to scarcity ofresearch works in the context of BIA, the number of measures usedfor identifying critical functions is so limited and the relevant stud-

Type of use

f manufacturing Key business process in BCM/consequence ofbreakdown in business processes/risk analysis andbusiness impact

orts in the event of Key business processes in BCM/consequence ofbreakdown in business processes

s completely in theakdown

Key business processes in BCM/consequence ofbreakdown in business processes/evaluating businessperformance/risk analysis and business impacts

the event of Consequence of breakdown in business processes

ecause ofcts and lack ofamage reputation of

Consequence of breakdown in business processes/identifying key processes in BCM/risk analysis andbusiness impacts

r products in the eventn

Critical Success factors for new product development

regulatory obligationsortant role in country

Key business processes in BCM

become unemployeding breakdown

CSFs for software process improvement/CSF forknowledge management system/risk analysis andbusiness impacts

with companysfacturing productves

Key business processes in BCM

ing breakdown abilitybe lost

Critical success/failure factors in project

nce 68 (2014) 309323 313ies have not accounted for all aspects of functions when conduct-ing the BIA process. As a result, this study introduces some newmeasures including the total oat time of function, required spe-cic conditions, technological level of function, the number ofproducts requiring the function and possibility of using parallelresources, to identify the critical functions. Similar to key productsidentication process, a combined technique of DEMATEL and ANPis applied to take the interrelationships between functions intoaccount when ranking them.

2.4. Estimating the continuity parameters

According to the BS25999 and ISO22301 terminologies, theMTPD measure for each key product is briey dened as the timeinterval after a disruption by which the disrupted functions shouldbe resumed, i.e., they should be recovered in at least the MBCOlevel by at most MTPD (t0t in Fig. 4). Also, the MBCO is denedas the minimum operating level of each key product that is accept-able for the organization to achieve its business objectives (e.g.,preserving reputation/brand, reducing nancial losses and contin-uous serving of products) during a disruption. Noteworthy, a dis-rupted key function is resumed when its operating level isincreased to respective MBCO after a disruptive incident andrestored when it comes back to its normal (100%) operating level.

According to the BIA results and in order to keep continuityobjectives, the operating level of disrupted key functions mustbe increased to at least their MBCO level during the respectiveMTPD. A graphical view of MTPD and MBCO measures are shownin Fig. 4.

Although different standards or guidelines dene MTPD andMBCO measures, but they do not propose a standard methodologyto estimate them. This study proposes a new method to determineMBCO and MTPD measures for each key product based on the riskappetite concept. According to the ISO terminology in regards to

ncti

ScieTable 2Measures used to determine critical functions.

Measures Reference Description

Function recovery time Hawkins et al. The time needed to return a fu

314 S.A. Torabi et al. / SafetyBCMS (ISO 22301, 2012), risk appetite is dened as the amount ofrisk that an organization is willing to pursue or retain. To establishthe context of the organization through BCMS implementation, riskappetite should be taken into account for key products. Risk appe-tite determines the total acceptable loss of all products of organi-zation during a disruption. By increasing the amount of riskappetite, the MTPD/MBCO measures would be increased/

(C1) (2000)Function recovery cost

(C2)Nosworthy (2000)and Hawkins et al.(2000)

Cost of operations for returning the

Possibility ofoutsourcing function(C3)

Black and Porter(1996)

Existence of companies to outsourc

Possibility of insuringfunction (C4)

Ernest-Jones (2005) Possibility of insuring function to cactivity

Possibility of usingparallel resources(C5)

It is a new measure Existence of parallel resources to p

Importance of functionin production of keyproducts (C6)

Sambasivan and Fei(2008) andNosworthy 2000

Functions have different role in proof functions can be done in any timdone at their specic time

Number of productsrequiring a givenfunction (C7)

It is a new measure Using the function for producing se

Required manpower forfunction recovery(C8)

Niazi et al. (2006)and Hung et al.(2005)

Manpower needed for returning th

Technological level offunction (C9)

It is a new measure Level of technology of the functionlabor and technological level of rec

Vulnerability of function(C10)

Nosworthy (2000) Degree of inuencing from threatsPriority Number (RPN)

Possibility of attack andany threat to thefunction (C11)

Nosworthy (2000) Likelihood of occurring threats is d

Total oat time offunction (C12)

It is a new measure The time that a function may be deoverall production time

Required specicconditions offunction (C13)

It is a new measure Conditions such as necessity of existwo functions, give a specic cond

MBCO

Normal Level

Operating level of a key Product

Incidence

tMTPD

t'

B

A

Fig. 4. A graphical denitType of use

on to its usual state Disaster recovery planning

nce 68 (2014) 309323decreased. In this manner, we introduce the following formula toconstruct a relationship between the risk appetite and MBCO/MTPD measures in which each part is normalized to obtain arational result:

Xni1

ai MBCOiai

MTPDiDDi FTi wi K 1

function to its usual state Risk analysis and business process/disasterrecovery planning

e the function CSFs for TQM in membership organizations

ompensate losses impairment in Consequence of breakdown in businessprocess

erform this function

duction of key products and somee while some of them should be

Benet of implementation environmentalmanagement system(EMS)/risk analysisand business impacts

veral key products

e function to its usual state CSFs for software process improvement/CSFfor knowledge management system/

affects the number of requiredovery operationsaccording to the value of Risk Risk analysis and business impacts

ifferent for each function Risk analysis and business impacts

layed without impacting the

tence at least l time unit betweenition to function

Time

Resuming point

Restoring point

A

BCompletely

Stopped (Include BCP

processes)

Operate under normal level

(Include disaster recovery processes)

ion of BIA measures.

In this equation, MTPDi indicates the MTPD of the ith key product,DDi is dened as the date on which product i is expected to be deliv-ered and FTi is dened as the total processing times of all requiredkey functions of the key product I (i.e., ow time). Notably, thedue date should be greater than or equal to ow time (Cheng andGupta, 1989). Moreover, ai, MBCOi andwi denote the normal operat-ing level, MBCO and relative importance of ith product obtainedfrom ANP, respectively. In addition, K is the total risk appetite oforganization determined based upon the organizations strategicviewpoints which can be represented as the percentage of total per-formance and n is the number of key products. Formula (1) has beeninspired by the resilience function proposed by Zobel and Khansa(2014) and it is based on the total loss of key products during the dis-ruption period. Based on Eq. (1), a surface can be drawn for eachvalue of risk appetitewith different combination ofMTPD andMBCOvalues for key products as shown in Fig. 5 schematically.

By xing the amount of risk appetite, for each MBCO a tally pointfor MTPD would be obtained. After determining the MBCO andMTPDmeasures for key products, the next step is determining theseparameters for critical functions. Notably, obtaining MBCO for criti-cal functions of key products is a simple task since the MBCO mea-sure for each critical function is equal to the MBCO of related keyproduct. However, calculating the MTPD measure for critical func-tions is more complicated. For this, we develop a backward progres-sive algorithm called MTPD algorithm to determine the MTPDmeasure for each critical function whose steps are as follow:

Step 1: Determine the different groups of critical functionsaccording to the precedence relations among them so that therst set of critical functions are those functions without anyprerequisite.

Step 2: Prioritize the current set of functions according to theirranks extracted by the ANP method and their required recoveryresources.

Step 3: By starting from the rst set of critical functions,set MTPD = 1 for those functions that could be recoveredat the rst available time slot (e.g., working day). After-wards, add one time unit for MTPD of remained functionsof the current set (if any) which can be recovered at thenext working day.

Step 4: Repeat step 3 for the rest of critical functions in the nextlevels.

In this manner, the MTPD of critical functions are determined insuch a way that they are recovered in the order of their ranking andrequired resources level by level. Noteworthy, it is assumed thatthe organization supplies its required resources from the outsidesuppliers at the recovery phase and thus there is no restriction inthe amount of supply. However, the only limitation is the requiredtimes for recovery of critical functions. Accordingly, we simply addone time unit to MTPD of those functions at the current group ofcritical functions which could be recovered in the next workingday.

Normal level=i10000

5000 4000

2

MBCO

ve fo

S.A. Torabi et al. / Safety Science 68 (2014) 309323 3153000 2000 1000

0 24 36 48 60 7

Fig. 5. A sample cur

Table 3Product groups.

Product group Part Code

Brake disks Peraid BDP1Peugeot 206 BDP2Peugeot 405 BDP3Peykan BDP4Roa BDR

Steering tuber Nissan STNPeraid STP1Peugeot 206 STP2Peugeot 405 STP3Peugeot RD STP4Peykan STP5Xantia STX

Torus tuber Mazda TTMNissan TTNPeraid TTP1Peugeot 405 TTP2

Peraid WSP2Peugeot 405 WSP396 120 144 200 MTPD (Hour)

r MTPD and MBCO.

Product group Part Code

Complete Torus Mazda CTMCylinder Benz 10 ton CB1

Benz Mayler CB2Complete Axle Peykan CAP1

Peugeot RD CAP2

Bush Mazda BMPeraid BP1Peugeot 405 BP2

Wheel Bearing Peykan WBP1Peraid WBP2Peugeot 405 WBP3

Wheel sink Peykan WSP1

Peraid WSP2Peugeot 405 WSP3

3. A case study

In this section, the proposed BIA framework is applied to anindustrial case company which produces some auto parts. Lahijansteering and suspension parts (LSSP) company is an auto partsmanufacturer since 1984 in the north of Iran and has 150 employ-ees. Due to importance of continuity in the delivery of companysproducts under any circumstances, BCMS is being implementedin the company, and the proposed methodology has been used toconduct the BIA process. Hereafter, the details of the proposedmethodology is elaborated step-by-step.

3.1. Determining the key products

LSSP Company is producing thirty products in nine categories assummarized in Table 3. According to the methodology, ANP wasutilized to rank the products. To this end, network structure ofkey products selection problem was identied by applying fuzzyDEMATEL technique. For this, a questionnaire was designed and

Super Decision software. Table 4 shows the corresponding resultsof the ANP method for ranking of products in which the rawweights are the values from limit super matrix, normal weightsare normalized values of raw weights and the ideal values areobtained from the normalized values by dividing each value bythe largest one in each column from which the nal ranks areobtained.

Accordingly, Brake disks for Peraid, Peugeot 206 and Peugeot405 (BDP3, BDP2 and BDP1) were selected as the key products ofthe company while considering the available budget and desiredmaturation level for implementing the BCMS within the company.

Importance of product for the

country

Loss of the technological

level of company

revenue

Rate of deviation from companys

objectivesage on ys image putation

Loss of interest parties supports

Table 4ANP weights and nal ranking of products.

Name Ideal weights Normal weights Raw weights Final ranks

BDP1 0.919275 0.0518811 0.049961 3BDP2 0.991354 0.0559487 0.053878 2BDP3 1 0.0564367 0.054348 1BDP4 0.84727 0.0478198 0.04605 5BDR 0.91613 0.0517035 0.04979 4STN 0.635009 0.0358373 0.034511 13STP1 0.611489 0.0345102 0.033233 15STP2 0.688565 0.0388602 0.037422 8STP3 0.715437 0.0403774 0.038883 7STP4 0.621795 0.0350917 0.033793 14STP5 0.601064 0.0339225 0.032667 16STX 0.780759 0.0440638 0.042433 6TTM 0.677687 0.0382465 0.036831 10TTN 0.647277 0.03653 0.035178 12TTP1 0.662384 0.0373825 0.035999 11TTP2 0.679422 0.0383441 0.036925 9CTM 0.505973 0.0285559 0.027499 19CB1 0.576093 0.0325123 0.031309 17CB2 0.574755 0.0324375 0.031237 18CAP1 0.482072 0.0272069 0.0262 21CAP2 0.490893 0.0277043 0.026679 20

316 S.A. Torabi et al. / Safety Science 68 (2014) 309323Higher Insurance cost

Influence on Market

Influence on human

Damcompan

and retwenty experts including four top managers of the company,twelve middle managers (e.g., Disks production manager, Bushproduction manager, Axle production manager, Quality controlmanager, and warehouse manager) and four interested parties ofthe organization (i.e., companys main shareholders, city authori-ties, main suppliers, and companys contractors) lled out thequestionnaire.

The opinions of experts were gathered as linguistic terms forwhich suitable fuzzy triangular numbers were considered to con-vert them into the numerical scale. CFCS method was used todefuzzify these triangular fuzzy numbers. After calculating the ini-tial direct and total inuence matrices denoted by D and T, respec-tively, and applying MMDE method proposed by Li and Tzeng(2009) to explore the important relationships between productsmeasures, the threshold value was calculated as 0.4458 (seeAppendix B for details). So, we kept those relationships with ascore greater than the threshold value in matrix T. In this way,the network structure of the key products selection problem canbe depicted as Fig. 6.

In the last step of identifying key products, all products shouldbe ranked by the ANP method. In this step, required pair-wise com-parison matrices were gathered by interviewing with top manag-ers of the company and nal weights were calculated by the

Defection of customers

Loss of Key products

Fig. 6. Network structure forBM 0.298898 0.0168683 0.016244 28BP1 0.286324 0.016159 0.015561 30BP2 0.294476 0.0166191 0.016004 29WBP1 0.342317 0.019319 0.018604 27WBP2 0.355924 0.0200874 0.019344 26WBP3 0.384937 0.021725 0.020921 23WSP1 0.360341 0.0203367 0.019584 25WSP2 0.382849 0.0216067 0.020807 24WSP3 0.388194 0.0219088 0.021098 22selection

key products selection.

3.2. Key products breakdown structure

To identify those required functions for producing the threeselected key products, RWBS matrix is used. In this way, to denePCWBS and FWBS and nally RWBS matrices, an interview wasconducted with the mangers of brake disks production departmentand according to Table 5, fourteen functions were identied forcompanys key products. In this table, rows show the main compo-nents of key products activities (PCWBS) and columns are the func-tions needed to produce key products.

3.3. Determining critical functions

Similar to key products selection procedure, relationshipsbetween thirteen criteria were evaluated by the same team ofexperts who were used in Section 3.1. By using CFCS method trian-gular fuzzy numbers were transformed to their crisp values andnally initial direct inuence matrix (D) and total inuence matrix(T) in DEMATELwere calculated (see Appendix B for details). Similarto Section 3.1, 0.1975 was calculated as the threshold value by theMMDE algorithm (see Appendix B for details). Next, the networkstructure for selecting the critical functions was depicted as Fig. 7.

Finally, functions were ranked by the ANP method throughSuper Decision software. Table 6 shows the nal ranking offunctions.

Accordingly, f11, f10, f13, f8 and f12 were identied as the mostcritical functions.

3.4. Estimating the MTPD and MBCO measures

Figs. 8ac shows the relevant charts for the above function.Accordingly, we can nd a feasible set of triplets (x,y,z) and deter-mine the MBCO andMTPDmeasures for each key product by draw-ing a set of contours.

After conducting an interview with the top managers of LSSP,k = 0.7 was selected as the acceptable risk appetite of the company.In other words, the maximum total loss of 30% is tolerable for com-panys top manager during any disruptive event. For each feasiblepoint in these surfaces, a MBCO and MTPD can be dened. Forexample, triplet (0.63,0.72,0.74) is a feasible point in Fig. 8b, there-fore we would have:

MTPDBDP15

1200MBCOBDP1 1200

0:63 3

MTPDBDP25

900MBCOBDP2 900

0:72 4

MTPDBDP35

1650MBCOBDP3 1650

0:74 5

Based on Fig. 9, company sets the following MBCO for each keyproduct. Therefore, the related MTPD for each key product is asfollows:

MBCOBDP1 300!MTPDBDP1 4:2 5MBCOBDP2 200!MTPDBDP2 4:6 5MBCOBDP3 400!MTPDBDP3 4:9 5Now, the MBCO measure for critical functions should be less

than or equal to the MBCO of related key products. To determine

inglucts

S.A. Torabi et al. / Safety Science 68 (2014) 309323 317Table 5RWBS matrix.

Getorders

Financeandadministrationactions

Controlofrawmaterials

Controlof discs

Storingrawmaterial

Stornaprod

Requestsand administrativeactivities

1 1 0 0 0 0

Control activities 0 0 1 1 0 0Table 7 shows the required information for each key product.Accordingly, based on Eq. (1) we would have:Body of disc 0 0 0 0 1 0Final product 0 0 0 0 0 1the MTPD measure for critical functions based on the proposedMTPD algorithm (Section 2.4), the required resources are shownin Table 8.

Sale andmarketingfunctions

Castingandcooling

TurningwithCNC

DrillingholeswithverticalCNC

Tolerancecontrolof holes

Cleaningfunctions

Protectivecoating

Packaging

1 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0

20 1 0 0 0 0 0 00 0 1 1 0 1 1 1

Function recovery cost Function recovery time

tica

funcey p

Capability of outsourcing

function

Capability of using parallel

resources

Manpower Possibility of

attack and any threat to

function

Vulnerabilitof function

Technological level of function

Fig. 7. Network structure for sel

318 S.A. Torabi et al. / Safety Science 68 (2014) 309323According to the proposed MTPD algorithm, the rst set of func-tions with no prerequisite (i.e., f1, f2, f3 and f8) are rst selected tobe recovered. In this manner, they are recovered in the order oftheir ranking and required resources (see Table 6). So, f3 that needsonly 1 manpower and 1 h is rst recovered. Then, f1 is chosenwhich needs 2 manpower and 2 h for recovery. Similarly f2 and f8are recovered next. In this way, for all of these functions we couldset: MTPD = 1 as they could be recovered at the rst working day.Similarly, for other critical functions, the MTPD measure is esti-mated in such a way that they could be recovered in the nextworking days. Notably, each working day includes 8 working hoursSelecting the cri

Number of products requiring a given function

Importance ofproduction of kin our case study.

4. Implementation tips

In this study, a novel framework has been developed for con-ducting a BIA process as the key element of a BCMS. To implementthe proposed BIA framework, some implementation tips should beregarded as follows:

Table 6Ranking of functions.

Name Ideal weights Normal weights Raw weights Final ranks

f1 0.3445 0.0368 0.0265 12f2 0.3293 0.0352 0.0253 14f3 0.3420 0.0366 0.0263 13f4 0.4000 0.0428 0.0307 10f5 0.3990 0.0427 0.0307 11f6 0.4036 0.0431 0.0310 9f7 0.4863 0.0520 0.0374 8f8 0.6665 0.0713 0.0512 4f9 0.5040 0.0539 0.0387 7f10 0.7873 0.0842 0.0605 2f11 1.0000 0.1069 0.0769 1f12 0.6164 0.0659 0.0474 5f13 0.7657 0.0819 0.0589 3f14 0.5689 0.0608 0.0437 6 The measures correlation: this study introduces several mea-sures to identify key products/critical functions. One of the mostimportant hints in this step is considering the correlationbetween measures. If we do not consider correlation betweenmeasures, the products/function will be ranked in a wrongway and the developed BCMS cannot work efciently. UsingDEMATEL could help to identify these correlations after whichthe ANP method can be applied to rank the products/functions.

Group decision making: BCMS is a comprehensive approach tocontrol those risks threatening the organization. Therefore, forimplementing an effective BCMS, the BIA process should be con-

l functions

tion in roducts

Capability of insuring function

Production specific

conditions

requirement for recover

function

y Total float time of function

ecting the critical functions.ducted in an accurate way for which the opinion of several peo-ple at different levels of the organization should be taken intoaccount via a group decision making process. Nevertheless, toget involved the BIA committee members effectively, theyshould be familiar with BCM concept for which they might betrained through a short workshop within the company.

MBCO determination: the most important purpose of imple-menting a BCMS is establishing a vital process in the organiza-tion so that the organizations strategic goals could be achievedeven any disruption happens. Also, as shown in Fig. 2, BIA is clo-sely related to the organizations goals. Accordingly, the BCMteam should be care about the risk appetite level they selectfor determining the key products MBCO measure. Therefore,in the proposed framework, the risk appetite is considered asthe main parameter when estimating the MBCO and MTPDmeasures (see Eq. (1)).

MTPD algorithm: to determine a feasible set of MTPD measuresfor critical functions, we suggested dening the MBCO for eachcritical function as equal to MBCO of its respective productwhile the level of MBCO denes the required resources for

Table 7Parameters of each key product.

Key product a DD (in days) FT (in days) Normal weight

BDP3 1200 7 2 0.2985BDP2 900 7 2 0.3492BDP1 1650 7 2 0.3523

mo

ScieFig. 8a. Chart of

S.A. Torabi et al. / Safetyrecover. Consequently, based on the required recovery timesand the resources of critical functions and their precedencerelations, the MTPD for each critical function can be dened.

5. Conclusion remarks

Business impact analysis (BIA) is one of the key processes whenimplementing a business continuity management system (BCMS)which gives a proper apperception about the organizations keyproducts and processes. Data gathering and data analysis are twomain steps of BIA. This study develops a novel methodology forconducting a BIA process in a systematic way. First, organizationskey products are identied through applying a hybrid fuzzy DEM-ATEL-ANP method for which several relevant criteria were sug-gested. Second, by preparing a RWBS matrix, all functions whichare needed to produce key products, are identied. Then, via iden-tifying relevant criteria, functions are ranked by using a similarfuzzy DEMATE-NPmethod to identify the critical functions. Finally,a novel algorithm is used to identify continuity parameters includ-ing the MTPD and MBCO measures for both key products and theircritical functions. In this manner, the MTPD and MBCO for keyproducts are rst dened based on the risk appetite level of theorganization and then the MTPD of critical functions are deter-mined through a simple MTPD algorithm.

According to the special characteristics of each organization,developing more tailored BIA frameworks for example forservice-oriented organizations (e.g., banking industry) could beconsidered as a good direction for further studies. In addition, byaccounting for resource limitations when developing business

Fig. 8b. Chart of model 2 for k = 0.7.del 2 for k = 0.6.

nce 68 (2014) 309323 319continuity and recovery plans, future researches can take resourceallocation considerations into account.

Acknowledgement

This study was supported by the University of Tehran under theresearch grant no. 8109920/1/14. The authors are grateful for thisnancial support.

Appendix A. Applied fuzzy DEMATEL-ANP method

Analytic network process (ANP) is a general form of analytichierarchy process (AHP) proposed by Saaty (2001) by which a net-work of interrelationships between the elements of a decisionproblem can be used instead of a linear hierarchy structure. Therst step of ANP is determining the network structure of the prob-lem for which this study uses the fuzzy DEMATEL method. DEMA-TEL is based on graph theory and uses the experts opinions aboutthe inuence degree of each element on other elements to nd thecasual relationships among them (Tzeng et al., 2007; Chen et al.,2011). Yang et al. (2008) proposed using DEMATEL for evaluatingthe interdependencies between a numbers of criteria. This studyproposes a hybrid approach of fuzzy DEMATEL and ANP for select-ing key products and their critical functions. Required data aregathered by using of distributing a questionnaire between decisionmakers (DM). After receiving DMs replies, the received data areanalyzed to rank the products and by considering the available

Fig. 8c. Chart of model 2 for k = 0.8.

Scie320 S.A. Torabi et al. / Safetyresources and desired maturation level of BCMS, some of them areselected as organizations key products.

This study uses the fuzzy DEMATEL method for identifying thenetwork of interrelationship between those criteria used to iden-

Fig. 9. The MTPD and MBCO for key products. (a) MTPD and MBCO for

Table 8Required manpower and cost of recovery based on MTPD algorithm.

Step Sets Functions Manpower Facility C

Step 1 {f1, f2, f3, f8} F1 2 0 2F2 1 0 1F3 1 0 1F8 5 2 6

Step 2 {f4, f7, f10} F4 1 2 8F7 3 0 3F10 1 1 8

Step 3 {f6, f11} F6 2 2 4F11 1 1 5

Step 4 {f5, f12, f13} F5 2 1 2F12 0 1 3F13 1 1 5

Step 5 {f9, f14} F9 4 1 8F14 2 1 6

Table A.1Linguistic terms used to determine inuence degrees.

Linguistic variable Inuence score Corresponding triangularfuzzy number (TFN)

No inuence (NO) 0 (0,0,0.25)Very low inuence (VL) 1 (0,0.25,0.5)Low inuence (L) 2 (0.25,0.5,0.75)High inuence (H) 3 (0.5,0.75,1)Very high inuence (VH) 4 (0.75,1,1)nce 68 (2014) 309323tify key products and critical functions. In this way, ve linguisticterms are used to indicate the inuence degree of each element

BDP1. (b) MTPD and MBCO for BDP2. (c) MTPD and MBCO for BDP3.

ost Required recovery time (h) MTPD Order of allocation

00$ 2 1 200$ 1 1 400$ 1 1 1000$ 4 1 3

00$ 3 2 300$ 3 2 2100$ 2 2 1

200$ 5 3 2100$ 3 3 1

100$ 4 4 3000$ 2 4 1100$ 2 4 2

00$ 5 5 2200$ 3 5 1

0 0.25 0.5 0.75 1

1 VHHLVLNO

Fig. A.1. Triangular fuzzy membership functions of linguistic terms.

ScieTable B.1Initial direct inuence matrix (D).

Initial direct matrix (D) C1 C2 C3 C4

C1 0.000 0.092 0.110 0.151C2 0.110 0.000 0.110 0.151C3 0.115 0.089 0.000 0.063C4 0.110 0.045 0.109 0.000C5 0.125 0.133 0.097 0.076C6 0.125 0.119 0.104 0.044C7 0.107 0.076 0.115 0.030C8 0.106 0.076 0.038 0.024C9 0.076 0.076 0.151 0.076C10 0.076 0.076 0.076 0.076

S.A. Torabi et al. / Safetyone another one. Table A.1 and Fig. A.1 show these linguistic termsalong with their equivalent fuzzy membership functions.

The steps of fuzzy DEMATEL are as follow:

Step 1: Calculating the average matrix A

Each member of the experts committee indicates her/his opin-ion about the inuence degree of criterion i on criterion j denotedby Xkij from which the matrix provided by kth expert is constructedas Xk. Notably, Xkij values are rst determined as linguistic termsand then transformed to their equivalent TFNs. Then, the averagematrix A is formed by calculating the average of Xkij values.

Table B.2Total inuence matrix (T).

Total relation matrix (T) C1 C2 C3 C4

C1 0.318 0.346 0.419 0.382C2 0.421 0.268 0.421 0.389C3 0.444 0.370 0.344 0.327C4 0.401 0.298 0.397 0.232C5 0.519 0.461 0.494 0.387C6 0.468 0.410 0.452 0.327C7 0.420 0.345 0.429 0.287C8 0.340 0.277 0.283 0.220C9 0.452 0.392 0.512 0.364C10 0.397 0.346 0.393 0.321

Table B.3Threshold value calculation.

Steps Calculation

Step 1: the ordered triplets set T {(0.5476,5,9), (0.5187,5,1), ((0.4521,6,3), (0.4520,9,1), (0

Step 2: dispatch-node set TDi {5,5,9,5,6,6,3,6,6,9,7,5,3,2Step 3.1: Tt

Di set and MDEtDi values T1 = {5}, MDE1 = 0; T2 = {5},MDE4 = 0.0654; T5 = {5,5,9,5

Step 3.2: set of 100 MDEtDi {0,0,0.0283,0.0654,0.0494,0Step 4.1: maximum MDEtDi 0.0654Step 4.2: dispath-node set of maximum MDEtDi T4 = {5,5,9,5} = {5,9}Step 5: receive-node set, TRe {9,1,3,3,9,9,1,2,3,1,9,7,1,9Step 6.1: Tt

Re set and MDEtRe values T1 = {9}, MDE1 = 0; T2 = {9,1MDE4 = 0.0196; T5 = {9,1,3,3T7 = {9,1,3,3,9,9,1}, MDE7 =

Step 6.2: Set of 100 MDEtRe {0,0,0,0.0196,0.0145,0.029,0.0404,0.0405,0.0423,0.0433

Step 7.1: maximum MDEtRe 0.0551Step 7.2: dispath-node set of maximum MDEtRe T14 = {9,1,3,3,9,9,1,2,3,1,9,Step 8.1: TDimax {(0.5476,5,9), (0.5187,5,1), (Step 8.2: TRemax {(0.5476,5,9), (0.5187,5,1), (

(0.4682,6,1), (0.4521,6,3), (0Step 8.3: TTh {(0.5476,5,9), (0.5187,5,1), (Step 8.4: threshold value 0.4458C5 C6 C7 C8 C9 C10

0.013 0.030 0.151 0.069 0.100 0.0440.110 0.030 0.036 0.051 0.100 0.0440.110 0.088 0.119 0.030 0.125 0.0380.039 0.118 0.038 0.110 0.110 0.0240.000 0.124 0.118 0.097 0.133 0.0600.124 0.000 0.044 0.024 0.125 0.1040.076 0.050 0.000 0.024 0.118 0.1510.076 0.047 0.030 0.000 0.118 0.0380.115 0.076 0.106 0.071 0.000 0.1510.115 0.097 0.097 0.071 0.071 0.000

nce 68 (2014) 309323 321 Step 2: Transforming the average matrix into the initial direct-rela-tion matrix

In this study, the average matrix A whose elements are in theform of triangular fuzzy numbers is transformed into the initialdirect relation matrix by the Converting Fuzzy data into CrispScores (CFCS) method (Chang et al., 2011).

Step 3: Calculating the normalized initial direct matrix D

s min 1max

i

Pnj1jaijj

;1

maxj

Pni1jaijj

24

35 A1

C5 C6 C7 C8 C9 C10

0.278 0.257 0.400 0.257 0.427 0.2760.362 0.264 0.307 0.248 0.430 0.2690.383 0.323 0.397 0.235 0.472 0.2910.288 0.319 0.289 0.280 0.418 0.2430.338 0.398 0.446 0.331 0.547 0.3560.410 0.255 0.348 0.241 0.487 0.3540.344 0.281 0.281 0.221 0.446 0.3760.273 0.217 0.239 0.149 0.364 0.2170.425 0.346 0.420 0.295 0.402 0.4130.375 0.322 0.361 0.262 0.410 0.238

0.5119,9,3), (0.4939,5,3), (0.4866,6,9), (0.4682,6,1), (0.4720,3,9), (0.4682,6,1),.4463,7,9), (0.4458,5,7), (0.4444,3,1), (0.42961,2,9), . . . , (0.1492,8,8),},7,1,9,2,2,7,9,1,4,9,6,6, . . .. . . ,8}MDE2 = 0;T3 = {5,5,9}, MDE3 = 0.0283; T4 = {5,5,9,5},,6}, MDE5 = 0.0494; T6 = {5,5,9,5,6,6}, MDE6 = 0.0290, MDE100 = 0.0290,0.0273,0.0327,0.0428,0.0266,0.0283,0.0503, . . .. . ... ,0.0013,0}

,3,9,5,1,3,7,7,3,9,10,2,5, . . .. . .. ,8}}, MDE2 = 0; T3 = {9,1,3}, MDE3 = 0; T4 = {9,1,3,3},,9}, MDE5 = 0.0145; T6 = {9,1,3,3,9,9}, MDE6 = 0.029;0.0065; T8 = {9,1,3,3,9,9,1,2}, MDE8 = 0.0163, . . . ,MDE100 = 00.0065,0.0163,0.0189,0.0181,0.0229,0.0272,0.0302,0.0551,0.0354,,0.0345, . . .. . .. . .. . .. . .. . .. . . ,0.0013,0}

7,1,9} = {9,1,3,2,7}0.5119,9,3), (0.4939,5,3)}0.5119,9,3), (0.4939,5,3), (0.4866,6,9), (0.4682,6,1), (0.4720,3,9),.4520,9,1), (0.4463,7,9), (0.4458,5,7), (0.4444,3,1), (0.42961,2,9)}0.5119,9,3), (0.4939,5,3), (0.4520,9,1), (0.4458,5,7)}

C6

ScieTable B.4Initial direct inuence matrix (D).

Initial direct matrix (D) C1 C2 C3 C4 C5

322 S.A. Torabi et al. / SafetyD s:A A2 Step 4: Calculating the total relation matrix TThe direct matrix D just account for direct inuence ows

between criteria. However, there will be innite sequence of indi-rect effects between criteria which should be considered. In this

C1 0.000 0.098 0.022 0.016 0.027 0.C2 0.104 0.000 0.040 0.016 0.008 0.C3 0.096 0.100 0.000 0.022 0.010 0.C4 0.057 0.068 0.064 0.000 0.045 0.C5 0.042 0.120 0.008 0.010 0.000 0.C6 0.022 0.022 0.034 0.041 0.010 0.C7 0.040 0.027 0.042 0.022 0.016 0.C8 0.120 0.137 0.008 0.010 0.040 0.C9 0.104 0.114 0.120 0.016 0.022 0.C10 0.067 0.068 0.040 0.034 0.045 0.C11 0.079 0.045 0.012 0.067 0.026 0.C12 0.088 0.120 0.034 0.022 0.016 0.C13 0.040 0.079 0.100 0.026 0.040 0.

Table B.5Total inuence matrix (T).

Total relation matrix (T) C1 C2 C3 C4 C5 C

C1 0.070 0.168 0.058 0.038 0.049 0C2 0.180 0.091 0.083 0.047 0.038 0C3 0.231 0.247 0.080 0.072 0.059 0C4 0.155 0.173 0.119 0.038 0.078 0C5 0.148 0.225 0.066 0.047 0.036 0C6 0.115 0.122 0.090 0.075 0.044 0C7 0.092 0.086 0.074 0.041 0.035 0C8 0.248 0.279 0.092 0.055 0.084 0C9 0.230 0.251 0.188 0.059 0.065 0C10 0.202 0.214 0.117 0.085 0.092 0C11 0.198 0.180 0.083 0.109 0.071 0C12 0.215 0.252 0.105 0.069 0.062 0C13 0.200 0.250 0.188 0.082 0.091 0

Table B.6Calculation of threshold value.

Steps Calculation

Step 1: the ordered triplets set T {(0.2786,8,2), (0.2521,12,2), (0.2514(0.2305,10,7), (0.2297,9,1), (0.2253(0.2174,10,11), (0.2146,12,1), (0.21

Step 2: dispatch-node set TDi {8,12,9,13,8,3,3,10,9,5,13,3,13,10,Step 3.1: Tt

Di set and MDEtDi values T1 = {8}, MDE1 = 0; T2 = {8,12}, MDEMDE4 = 0; T5 = {8,12,9,13,8}, MDE5

Step 3.2: set of 169 MDEtDi {0,0,0,0,0.0135,0.0097,0.0119,0.0090.0067,0.0073,0.0102,0.0122,0.0156

Step 4.1: maximum MDEtDi 0.0228Step 4.2: dispath-node set of maximum MDEtDi T26 = {8,12,9,13,8,3,3,10,9,5,13,3,Step 5: receive-node set, TRe {2,2,2,2,1,2,1,7,1,2,7,8,12,11,1,2,8Step 6.1: Tt

Re set and MDEtRe values T1 = {2}, MDE1 = 0; T2 = {2,2}, MDE2MDE4 = 0; T5 = {2,2,2,2,1}, MDE5 =

Step 6.2: set of 169MDEtRe {0,0,0,0,0.0963,0.1213,0.0474,0.0660.0425,0.0437,0.0506,0.0415,0.0377

Step 7.1: maximum MDEtRe 0.1213Step 7.2: dispath-node set of maximum MDEtRe T6 = {2,2,2,2,1,2} = {2,1}Step 8.1: TDimax {(0.2786,8,2), (0.2521,12,2), (0.2514

(0.2306,3,1), (0.2305,10,7), (0.2297(0.2197,13,12), (0.2174,10,11), (0.2(0.2061,13,11), (0.2056,8,12), (0.20

Step 8.2: TRemax {(0.2786,8,2), (0.2521,12,2), (0.2514Step 8.3: TTh {(0.2786,8,2), (0.2521,12,2), (0.2514

(0.2297,9,1), (0.2253,5,2), (0.2146,1Step 8.4: threshold value 0.1975C7 C8 C9 C10 C11 C12 C13

nce 68 (2014) 309323manner, the total inuence matrix denoted by T, reects the totalinuence degree among criteria whose elements are denoted bytij which indicates the total direct and indirect inuence of crite-rion i on criterion j. The Eq. (A3) calculates the matrix T.

T DI D1 A3

008 0.010 0.064 0.016 0.016 0.010 0.040 0.027042 0.047 0.045 0.008 0.045 0.057 0.034 0.027041 0.081 0.107 0.010 0.040 0.082 0.082 0.114042 0.068 0.016 0.040 0.064 0.064 0.026 0.022064 0.068 0.097 0.026 0.047 0.057 0.040 0.022000 0.112 0.040 0.034 0.068 0.063 0.040 0.045034 0.000 0.008 0.022 0.010 0.027 0.016 0.034045 0.068 0.000 0.088 0.026 0.022 0.114 0.100040 0.067 0.088 0.000 0.022 0.016 0.040 0.079079 0.107 0.100 0.042 0.000 0.120 0.026 0.068068 0.079 0.088 0.016 0.114 0.000 0.079 0.034045 0.068 0.079 0.040 0.088 0.100 0.000 0.040057 0.079 0.067 0.114 0.068 0.088 0.108 0.000

6 C7 C8 C9 C10 C11 C12 C13

.050 0.069 0.118 0.051 0.060 0.061 0.089 0.073

.092 0.120 0.117 0.051 0.099 0.118 0.096 0.085

.128 0.203 0.221 0.088 0.135 0.186 0.188 0.203

.106 0.160 0.108 0.087 0.130 0.141 0.099 0.092

.128 0.162 0.180 0.080 0.115 0.134 0.116 0.094

.062 0.196 0.120 0.083 0.130 0.135 0.108 0.110

.067 0.051 0.058 0.049 0.048 0.069 0.058 0.071

.126 0.184 0.118 0.154 0.115 0.125 0.206 0.184

.117 0.179 0.195 0.068 0.104 0.115 0.140 0.170

.164 0.231 0.214 0.115 0.096 0.217 0.133 0.162

.145 0.193 0.189 0.084 0.191 0.100 0.165 0.120

.126 0.184 0.189 0.104 0.171 0.194 0.097 0.129

.155 0.223 0.206 0.187 0.173 0.206 0.220 0.115

,9,2), (0.2501,13,2), (0.2482,8,1), (0.2474,3,2), (0.2306,3,1),,5,2), (0.2229,13,7), (0.2208,3,8), (0.2197,13,12),45,10,2), (0.2140,10,8), (0.2063,13,8), . . . , (0.0348,7,5),}12,10,10,13,13,8,3,3,10,13,11,6,9, . . . ,7}2 = 0; T3 = {8,12,9}, MDE3 = 0; T4 = {8,12,9,13},= 0.0135; T6 = {8,12,9,13,8,3}, MDE6 = 0.0097, . . .. . .. . .. ,MDE169 = 08,0.0094,0.0084,0.0074,0.0117,0.0145,0.0107,,0.0140,0.0145,0.0163,0.0177,0.0199,0.0221,0.0228,0.0212, . . .. . ... ,0.0001,0}

13,10,12,10,10,13,13,8,3,3,10,13,11,6} = {8,12,9,13,3,10,5,11,6},8,11,12,13,7,1,1,1,7,8, . . .. . .. ,5}= 0; T3 = {2,2,2}, MDE3 = 0;T4 = {2,2,2,2},0.0963; T6 = {2,2,2,2,1,2}, MDE6 = 0.1213, . . .. . .. . .. ,MDE169 = 01,0.0539,0.0669,0.0345,0.0468,0.0463,,0.0292,0.0212,0.0241, . . . ,0.0001,0}

,9,2), (0.2501,13,2), (0.2482,8,1), (0.2474,3,2),,9,1), (0.2253,5,2), (0.2229,13,7), (0.2208,3,8),146,12,1), (0.2145,10,2), (0.2140,10,8), (0.2063,13,8),33,3,13), (0.2032,3,7), (0.2016,10,1), (0.2005,13,1), (0.1975,11,1), (0.1958,6,7)},9,2), (0.2501,13,2), (0.2482,8,1), (0.2474,3,2)},9,2), (0.2501,13,2), (0.2482,8,1), (0.2474,3,2), (0.2306,3,1),2,1), (0.2145,10,2), (0.2016,10,1), (0.2005,13,1), (0.1975,11,1)}

Step 5: Dening a threshold value to create impact relation mapTo nd the nal network of inuence ows among criteria, a

threshold value is used to discriminate between considerable andnegligible inuence ows. The threshold value can be chosen bydecision makers through discussions with experts. However, thismethod is not appropriate at all. Hence, this study uses the maxi-mum mean de-entropy (MMDE) algorithm developed by Li andTzeng (2009) to determine a good threshold value.

Ernest-Jones, T., 2005. Business continuity strategy the life line. Network Secur.2005 (8), 59.

Geelen-Baass, B.N., Johnstone, J.M., 2008. Building resiliency: ensuring businesscontinuity is on the health care agenda. Austral. Health Rev. 32 (1), 161173.

Gibb, F., Buchanan, S., 2006. A framework for business continuity management. Int.J. Inf. Manage. 26 (2), 128141.

Globerson, S., 1994. Impact of various work-breakdown structures on projectconceptualization. Int. J. Project Manage. 12 (3), 165171.

Hashemi Golpayegani, S.A., Emamizadeh, B., 2007. Designing work breakdownstructures using modular neural networks. Decis. Support Syst. 44 (1), 202222.

Hawkins, S.M., Yen, D.C., Chou, D.C., 2000. Disaster recovery planning: a strategy for

S.A. Torabi et al. / Safety Science 68 (2014) 309323 323Now according to the calculated threshold value, we can elim-inate minor effects and dene the nal matrix Tp whose elementsare as follows:

tpij 0 if tij < ptij if tij P p

A4

At last, according to the network constructed from the mean-ingful inuences, products are ranked by ANP method. The inter-ested reader is referred to Chung et al. (2005) for details of ANPmethod.

Appendix B. Initial direct and total inuence matrices

The initial direct inuence matrix and total inuence matrixwhich denoted by matrix D and T, respectively for key productsare shown in Tables B.1 and B.2. To calculate the proper thresholdvalue, MMDE method is used, and the exact value is calculated as0.4458. The implementation process of MMDE method for keyproducts is shown in Table B.3.

Similar to key products selection procedure, the details of Dand T matrices and implementing the MMDE algorithm for criticalfunctions are shown in Tables B.4B.6, respectively.

References

Abdel-Razek, R.H., 1997. How construction managers would like their performanceto be evaluated. J. Constr. Eng. Manage. 123 (3), 208213.

Akkiraju, R., Bhattacharjya, D., Gupta, S., 2012. Towards effective business processavailability management. J. Serv. Sci. Res. 4 (2), 319351.

Bhamra, R., Dani, S., Burnard, K., 2011. Resilience: the concept, a literature reviewand future directions. Int. J. Prod. Res. 49 (18), 53755393.

Black, S.A., Porter, L.J., 1996. Identication of the critical factors of TQM. Decis. Sci.27 (1), 121.

British Standard Institute, 2006. BS 25999-1. Business continuity management Codeof practice. United Kingdom: BSI Knowledge Centre.

Business continuity management, Keeping the wheels in motion, 2000. AustralianBusiness Continuity Management Institute.

Cha, S.-C., Juo, P.-W., Liu, L.-T., Chen, W.-N., 2008. Riskpatrol: a risk managementsystem considering the integration risk management with business continuityprocesses. IEEE Int. Conf. Intell. Secur. Inform., 110115.

Chang, B., Chang, C.-W., Wu, C.-H., 2011. Fuzzy DEMATEL method for developingsupplier selection criteria. Exp. Syst. Appl. 38 (3), 18501858.

Chen, F.-H., Hsu, T.-S., Tzeng, G.-H., 2011. A balanced scorecard approach toestablish a performance evaluation and relationship model for hot spring hotelsbased on a hybrid mcdm model combining dematel and anp. Int. J. Hospital.Manage. 30 (4), 908932.

Cheng, T., Gupta, M., 1989. Survey of scheduling research involving due datedetermination decisions. Eur. J. Oper. Res. 38 (2), 156166.

Chung, S.-H., Lee, A.H., Pearn, W.-L., 2005. Analytic network process approach forproduct mix planning in semiconductor fabricator. Int. J. Prod. Econ. 96 (1), 1536.

Cooper, R.G., Kleinschmidt, E.J., 1987. New products: what separates winners fromlosers? J. Prod. Innov. Manage 4 (3), 169184.data security. Inform. Manage. Comput. Secur. 8 (5), 222230.Hung, Y.-C., Huang, S.-M., Lin, Q.-P., 2005. Critical factors in adopting a knowledge

management system for the pharmaceutical industry. Indus. Manage. Data Syst.105 (2), 164183.

ISO 22301, 2012. Societal security Business continuity management systems -Requirements. Switzerland: International Organization for Standardization.

ISO 22313, 2012. Societal security. Business continuity management systemsrequirements. Terms and denitions. Terms and denitions. Switzerland:International Organization for Standardization.

Kepenach, R.J., 2007. Business continuity plan design. IEEE Int. Conf. InternetMonitor. Protect., ICIMP 2007, 27.

Li, C.-W., Tzeng, G.-H., 2009. Identication of a threshold value for the dematelmethod using the maximummean de-entropy algorithm to nd critical servicesprovided by a semiconductor intellectual property mall. Exp. Syst. Appl. 36 (6),98919898.

Mbugua, L.M., Harris, P., Holt, G.D., Olomolaiye, P.O., 1999. A framework fordetermining critical success factors inuencing construction businessperformance. In: Proceedings of the Association of Researchers inConstruction Management, 15th Annual ARCOM Conference, pp. 255264.

Niazi, M., Wilson, D., Zowghi, D., 2006. Critical success factors for software processimprovement implementation: an empirical study. Software Process: ImprovePract. 11 (2), 193211.

Nosworthy, J.D., 2000. A practical risk analysis approach: managing BCM risk.Comput. Secur. 19 (7), 596614.

Randeree, K., Mahal, A., Narwani, A., 2012. A business continuity managementmaturity model for the UAE banking sector. Business Process Manage. J. 18 (3),472492.

Ranjan, P., Kumar, P., Abhishek, K., 2012. Business continuity planning in Indianperspective. J. Adv. Comput. Res.: Int. J. 1 (12).

Saaty, T.L., 1990. How to make a decision: the analytic hierarchy process. Eur. J.Oper. Res. 48 (1), 926.

Saaty, T.L., 2001. The Analytic Network Process: Decision Making with Dependenceand Feedback. RWS Publication.

Sambasivan, M., Fei, N.Y., 2008. Evaluation of critical success factors ofimplementation of ISO 14001 using analytic hierarchy process (AHP): a casestudy from Malaysia. J. Clean. Prod. 16 (13), 14241433.

Sayal, M., 2006. Business Impact Analysis Using Time Correlations, DEECS, LNCS4055, pp. 167 181.

Sikdar, P., 2011. Alternate approaches to business impact analysis. Inform. Secur. J,:A Global Perspect. 20 (3), 128134.

The Federal Financial Institutions Examination Council (FFIEC), 2008. BusinessContinuity Planning Booklet.

Tjoa, S., Jakoubi, S., Quirchmayr, G., 2008. Enhancing Business Impact Analysis andRisk Assessment applying a Risk-Aware Business Process Modeling andSimulation Methodology. In: The Third International Conference onAvailability, Reliability and Security.

Tzeng, G.-H., Chiang, C.-H., Li, C.-W., 2007. Evaluating intertwined effects in e-learning programs: a novel hybrid mcdm model based on factor analysis anddematel. Exp. Syst. Appl. 32 (4), 10281044.

Western Australian Government, 2009. Business continuity management:Guidelines. Second ed.

Yang, Y.-P.O., Shieh, H.-M., Leu, J.-D., Tzeng, G.-H., 2008. A novel hybrid MCDMmodel combined with DEMATEL and ANP with applications. Int. J. Operat. Res. 5(3), 160168.

Zsidisin, G.A., Melnyk, S.A., Ragatz, G.L., 2005. An institutional theory perspective ofbusiness continuity planning for purchasing and supply management. Int. J.Prod. Res. 43 (16), 34013420.

Zobel, C.W., Khansa, L., 2014. Characterizing multi-event disaster resilience.Comput. Oper. Res. 42, 8394.