A new framework for business impact analysis in business continuity

management (with a case study)

S.A. Torabi

, H. Rezaei Sou, Navid Sahebjamnia

School of Industrial Engineering, College of Engineering, University of Tehran, Tehran, Iran
a r t i c l e i n f o
Article history:
Received 20 February 2014
Received in revised form 23 April 2014
Accepted 23 April 2014
Available online 22 May 2014
Keywords:
Business continuity management
Business impact analysis
Fuzzy DEMATEL
ANP
a b s t r a c t
Resumption of critical processes/functions after occurrence of any disruptive event is essential from the
business continuity (BC) viewpoint. Business impact analysis (BIA) is a key part of a business continuity
management system (BCMS) in which an organizations key products/services along with the critical
functions and their BC related indices, i.e., the maximum tolerable period of disruption (MTPD) and
the minimum business continuity objective (MBCO) are determined. This study proposes a novel
framework to conduct the BIA in organizations in a more systematic and comprehensive way mostly
by relying on some effective multi attribute decision making (MADM) techniques. A case study in an auto
part manufacturer is also provided to validate the proposed framework whose results demonstrate the
applicability and usefulness of the proposed approach.
2014 Elsevier Ltd. All rights reserved.
1. Introduction
During the last decade, business continuity management (BCM)
has been evolved as an effective tool for ensuring the delivery of
organizations key products/services (hereafter simply products)
in the presence of various disruptions (Gibb and Buchanan,
2006). BCM is a management process which identies possible
internal and external threats/risks and their impact to business
processes and provides a framework for organizational resilience
(ISO 22301, 2012). In this respect, implementing a business conti-
nuity management system (BCMS) within an organization can pro-
tect the organization against various disruptive events by
providing suitable business continuity/disaster recovery (BC/DR)
plans for identied critical business processes/functions proac-
tively (Randeree et al., 2012). Zsidisin et al. (2005) presented a case
study research and explained the necessity of creating business
continuity plans in organizations to manage disruption risks.
Bhamra et al. (2011) explained that the level of business continuity
in an organization has a direct relation with the resilience level of
the organization. They reviewed the concept of resiliency and
described that those organizations having implemented business
continuity and disaster recovery plans, are more resilient than
other ones.
According to the international organization for standards (ISO),
BCM life cycle involves six elements including the business
continuity program management, embedding competence and
awareness in the culture of organization, understanding the
organization, selecting business continuity options, developing
and implementing a business continuity response, and exercising
and testing the developed plans as shown in Fig. 1. A comprehen-
sive understanding of an organization and its key processes
ensures that the BCMs program is established according to the
organization objectives.
BIA and risk assessment (RA) are two main elements for under-
standing the organization (ISO 22301, 2012). BIA is dened as a
process of analyzing operational functions and the effect that a dis-
ruption might have upon them (ISO 22313, 2012). The main
objective of BIA is gathering and analyzing required information
to codify a report to top managers for preparing business continu-
ity plan (BCP) (Sikdar, 2011). Based on the BCMs life cycle, the
outputs of BIA is a list of prioritized key products based upon the
ranking of organizations products, as well as the MTPD and MBCO
measures for the key products and their identied critical
functions. Notably, critical functions are those required functions/
activities to provide the key products.
Fig. 2 shows the relationships between the BIA and other
elements of BCMS in an organization. A right BIA process should
consider goals of the organization, and should not have any contra-
diction with them. Furthermore, BCM strategies try to keep the
continuity of organizations key functions based on the outcomes
of BIA (Cha et al., 2008). Therefore, the validity of developed BC
http://dx.doi.org/10.1016/j.ssci.2014.04.017
0925-7535/ 2014 Elsevier Ltd. All rights reserved.

Corresponding author. Tel.: +98 21 61114267.

E-mail addresses: satorabi@ut.ac.ir (S.A. Torabi), H.rezaeisu@ut.ac.ir
(H. Rezaei Sou), n.sahebjamnia@ut.ac.ir (N. Sahebjamnia).
Safety Science 68 (2014) 309323
Contents lists available at ScienceDirect
Safety Science
j our nal homepage: www. el sevi er . com/ l ocat e/ ssci
plans depends on the BIA results. Finally, the relationship between
BIA and RA is undeniable because the results of BIA and RA are
merged to develop suitable BC plans. Remarkably, due to dynamic
internal and external conditions, an organizations goals and strat-
egies might be changed over time; therefore the BIA outcomes
along with the RA and BCM strategies should also be concurred
with these changes leading to maintain an effective BCMS.
Due to the importance of BIA for developing an effective BCMS,
several frameworks have ever been proposed in the literature for
conducting a BIA process. Australian BCM institute (2000) proposes
the three steps: (1) identifying and ranking of organizations pro-
cesses according to an analysis of their nancial and operational
impacts, (2) recognizing the critical functions (3) matching required
resources to critical functions. The federal nancial institutions
examination council (FFIEC, 2008) introduces four steps for BIA
which includes identication of key products, prioritizing them,
determining insurance requirements, and identifying dependen-
cies. Sayal (2006) proposes a time correlation based method to esti-
mate the impact of a disruptive event on a function and argues that
the time correlation between each pair of functions during and after
a disruptive event can be considered as the impact of event on this
function. Tjoa et al. (2008) present the most important steps for BIA
as: identifying business activities and functions, recognizing
appropriate resources, identifying those scenarios leading to severe
impacts on the companys reputation, assets or nancial position
and detecting the time-frames over which the business activities
disruption are unacceptable. Western Australian Government
(2009) provides a framework and accounts for impact of any
disruption on the processes of an organization according to the ve
criteria: public condence, reputation, operational efciency,
statutory obligations and nance and proposes four steps for
implementing BIA as: preparation and set-up, identifying business
functions, assessing business impacts and determining priorities
and identifying required resources for functions. Akkiraju et al.
(2012) present a quantitative framework for modeling the impact
of business processes outages. They dene a total business impact
function for each incident. Sikdar (2011) introduces three steps for
implementing BIA in an organization including the data gathering,
data analysis and report preparing. The author uses data gathering
to identify those critical and time-sensitive functions, data analysis
to classify all functions of organization in the four levels according
to their recovery time objectives (RTOs) and nally in last step
prepares a report for top managers. Ranjan et al. (2012) propose a
framework for BIA implementation in eight steps including the
experts identication, determination of BIA scope, meeting
organization, information gathering, questionnaire designing,
interviewing, providing tabulate information and report
presentation.
After a disruption happens, the level of some organizational
resources might be decreased signicantly so that the organization
cannot recover all disrupted functions at the same time (Geelen-
Baass and Johnstone, 2008). Hence, the key products and critical
functions are rst resumed by invoking suitable BC plans while
considering the available and required resources according to the
MTPD and MBCO measures of these critical functions.
Various BIA methods could be described into three major steps
in which the procedure of identifying key products and their criti-
cal functions are very similar. The main difference between these
methods usually appears on applied data collection method such
as conducting interviews, developed questionnaires and designing
feedback forms (Australian BCM institute, 2000). Although it is
necessary to identify key products and their critical functions accu-
rately, the lack of a more structured and quantitative method is
obvious in the context of BIA. This issue becomes more important,
when knowing that, the restoration and resumption of the organi-
zations disrupted functions are carried out based on the BIA
results. On the other hand, it is necessary for any organization to
know which products and functions with what risk appetite rate
and in what timeframes should be resumed (to a predened min-
imum operating level) and then restored to the normal operating
level. Based upon a review of current frameworks, BIA process
can be categorized into three main steps: (1) identifying key prod-
ucts, (2) identifying critical functions and (3) determining the con-
tinuity measures of key products and their critical functions (i.e.,
MTPD and MBCO). Also, the literature review demonstrates the
lack of a comprehensive BIA framework with systematic and quan-
tied steps. Accordingly, in this study, a novel and comprehensive
BIA framework is developed to identify an organizations key prod-
ucts, critical functions and their respective MTPD and MBCO mea-
sures. To do so, we review relevant studies and explore various
measures for ranking products and functions separately. Also, to
account for interaction and interdependencies between ranking
criteria, analytic network process (ANP) and fuzzy Decision Making
Trial and Evaluation Laboratory (DEMATEL) techniques are utilized
for ranking of identied products and functions. In addition, a new
relational work breakdown structure (RWBS) is developed to
determine the critical functions of key products. Finally, a MTPD
algorithm is proposed to calculate appropriate MTPD and MBCO
measures for critical functions according to MTPD and MBCO mea-
Business
Continuity
Program
Management
Understanding
the
Organization
Implementing
a Business
Continuity
Response
Exercising
and Testing
Selecting
Business
Continuity
Options
Fig. 1. The lifecycle of BCM (BS 2599:1, 2006).

Business Impact
Analysis (BIA)
Goals of
Organization
Risk Analysis
(RA)
BCM
Strategies
Fig. 2. Relationships of BIA with other elements of a BCMS.
310 S.A. Torabi et al. / Safety Science 68 (2014) 309323
sures of related key products. In this manner, the main contribu-
tions of this study could be highlighted as follows:
Proposing a novel framework for determining key products and
their critical functions in an organization from the continuity
viewpoint in which some efcient MADM techniques are used
to rank the identied products and functions.
Using a new relational work breakdown structure to determine
those required functions to provide the key products.
Developing a procedure to determine the MBCO and MTPD
measures of the key products and their critical functions based
on the risk appetite concept and a MTPD algorithm.
The rest of this study is organized as follows. In Section 2, the
proposed BIA framework is elaborated. In the third section, the
proposed model is implemented on a real case study and in the
fourth section, some implementation tips are presented. Finally,
Section 5 provides concluding remarks and directions for further
research.
2. Proposed BIA framework
Understanding the organization is known as the main step of
BCM (ISO 22301, 2012). A holistic understanding of the organiza-
tion and its key products and critical functions ensures BCMs pro-
gram to be established according to the organizations objectives
and strategies, and increases the success chance of BC plans in
the response phase. This study focuses on BIA implementation in
an organization by developing a new framework in the four sepa-
rate steps.
The rst step is identifying the key products of the organization.
This process is carried out through determining some suitable
selection indices/criteria and applying a hybrid ANP-fuzzy DEMA-
TEL approach for ranking the products. Each key product is a result
of performing several functions. Hence, for a credible delivery of
key products, identication of those critical functions is of vital
importance. For this, key products structures should be rst bro-
ken into the smallest essential functions. Through this step, all
required functions in the organization related to key products are
rst identied. The next step is identifying the business critical
functions. In this step, those functions which were identied
through the breakdown of key products structures are then ranked
in a manner quite similar to that of the rst step. Finally, in the
fourth step, the continuity parameters including the MTPD and
MBCO measures of critical functions are determined by using of
a novel algorithm.
Fig. 3 depicts the whole process of proposed BIA framework. In
the next section, all steps will be explained in more details.
2.1. Identifying of key products
As it was mentioned earlier, identifying key products in an orga-
nization is of vital importance for business continuity. After a dis-
ruption occurs, it is certainly not possible to recover all processes
pertaining to all products and it is necessary to prioritize products
of organization and identify those key products whose functions
must be recovered rst. Due to complexity of structure of most
organizations and importance of BIA role in business continuity,
an effective implementation of BIA is needed through a step-by-
step approach. While reorganization of key products is a multidis-
ciplinary task, the previous research studies focus on just one or
two measures for identication of key products among the delivery
time/amount, makespan, processing time, lead time and utilized
resources. For example, FFIEC (2008) denes key products based
on the amount of delivered products and then assesses each
product with this measure. However, in this study, for dening
suitable measures to identify key products, a literature review
along with some interviews with experts were conducted and
twelve measures were nally explored (see Table 1).
Two areas including BCMS and business process management
were reviewed to explore key products measures. However, most
of these measures were explored from the BCM literature such as:
loss of revenue, loss of interested parties, defection of customers,
damage on organizations reputation, and importance of product
on national view and objectives of organization. Noteworthy, by
increasing the competition between organizations around the
world, the reputation and prestige of organization is as important
as the loss of revenue.
Furthermore, other measures were dened through reviewing
business process management studies such as insurance cost for
undeliverable products, inuence on markets, inuence on human
resources and technological level of company. These measures
altogether can help the organization to have a comprehensive view
on its products encompassing all organizational aspects. Accord-
ingly, all identied measures are used to rank the organizations
products. Table 1 provides these measures with a short description
about each one.
Due to the nature of products ranking problem where compen-
sation between criteria is allowed, a compensatory multi criteria
decision analysis (MCDA) method could be used. In this way, due
to existence of interaction and interdependency between criteria,
analytic network process (ANP) is used to rank the organizations
products. Noteworthy, analytic hierarchy process (AHP) proposed
by Saaty (1990), is only able to evaluate the inuence ows
between various elements with hierarchically structured linear
relationships and does not consider non-linear interactions or
interdependencies such as cycle (mutual outer dependencies)
and loop (inner dependencies) between elements. To account for
such non-linear inuence ows, analytic network process (ANP)
was proposed by Saaty (2001), enabling us to consider a network
of inuence ows between elements of different clusters. The main
step of ANP is identifying a suitable network structure for the deci-
sion problem which usually is identied through conducting a
brain storming meeting or a Delphi process. However, in this study,
fuzzy Decision Making Trial and Evaluation Laboratory (DEMATEL)
method is adopted to derive the network in a more comprehensive
and quantitative manner (Chang et al., 2011).
When applying the fuzzy DEMATEL, experts judgments about
inuence degrees of each element on other elements are gathered
in the form of linguistic terms which are then transformed to a
numerical scale by modeling each linguistic term as a triangular
fuzzy number (TFN). Then, the initial direct inuence matrix is
formed by converting the fuzzy data into their crisp scores (CFCS)
(Chang et al., 2011). Afterwards, the total inuence matrix is found
while taking indirect ows into account as well. Furthermore, to
identify stronger relations between criteria, a threshold value is
calculated by the maximum mean de-entropy (MMDE) algorithm
developed by (Li and Tzeng, 2009) and those relations with degrees
greater than the threshold value are remained in the nal network
structure. More details about the ANP and DEMATEL methods have
been provided in an Appendix A.
2.2. Key products breakdown structure
After determining the key products, their critical functions
should be identied. For this, it is very important to ensure that
any function is not neglected through identication process of
required functions to deliver each key product. Work breakdown
structure (WBS) is a capable tool to detect all functions of the
organization. The US Government proposed this concept for project
management in 1962 (Globerson, 1994). The main benet of WBS
S.A. Torabi et al. / Safety Science 68 (2014) 309323 311
is providing a hierarchical breakdown structure such that the prob-
ability of neglecting a function will be minimal. Moreover, by using
this method, required cost and time for performing each function
could be calculated.
There are several types of WBS such as department breakdown
structure, cost breakdown structure and resource breakdown
structure. Hashemi Golpayegani and Emamizadeh (2007) catego-
rized the WBS of a project into two sets: (1) project control work
breakdown structure (PCWBS) depicting overall components of a
projects main outputs which here we dened them as an organi-
zations key products and (2) functional work breakdown struc-
ture (FWBS) showing all required functions which should be
performed to achieve main outputs. The authors then combined
these two sets and created a new WBS model denoted as the rela-
tional work breakdown structure (RWBS) indicating those compo-
nents of FWBS that should be performed to obtain each
component of PCWBS. Inspiring by this RWBS model, this study
hybridizes FWBS and PCWBS models to develop a customized
relational work breakdown structure (RWBS) model. The custom-
ized RWBS is displayed as a matrix whose rows are components
of PCWBS and the columns are components of FWBS. All cells
of this matrix are binary values. Therefore, the value of a cell is
equal to 1 if the function in the corresponding column is required
for producing the output in the corresponding row. In this man-
ner, the developed RWBS indicates the required functions for
each key product.
Prepare a list
which contains all
products/services
Determine
suitable criteria to
identify critical
functions
Identify critical
functions by
fuzzy DEMATEL
and ANP
Identify key
products by fuzzy
DEMATEL and
ANP
Determine
suitable criteria to
identify key
products
Breakdown
structure of key
products to define
all functions
Define Continuity
parameters (MTPD
and MBCO)
Determine the
interactions
between criteria
Establish the
exact structure
of the problem
Obtain ANP
weights
Construct
pairwise
comparisons
Develop final
super matrix
Normalization
and finding xrij
n
,
xmij
n
and xlij
n
Compute right and
left normalized
values: xrsij
n
, xlsij
n
Compute total
normalized
crisp value xij
n
Integrate crisp
values, Zij
Compute crisp
values, Zij
n
Create direct
fuzzy relation
matrix
Defuzzify fuzzy
numbers with
CFCS method
Acquire total
influence matrix
Assign a threshold
value by MMDE
method
Create final
influence matrix
Tp
Define FWBS
to determine
functions
Define PCWBS
to determine
sub-products
Calculate RWBS
matrix to identify
all functions
Define risk
appetite of
organization
Calculate MTPD
for critical
functions by MTPD
algorithm
Depict contours for
key products and
define MTPD for a
rate of MBCO
ANP method
Key products
breakdown
Calculate
ordered triplets
set, T
*
Define ordered
dispatch/receive
node set, T
Di/Re
Calculate Ht
Di/Re
and find
Tmax
Di/Re
Fuzzy
DEMATEL
method
CFCS
defuzzyfying
method
MMDE
algorithm
Define MTPD and MBCO measures
Fig. 3. The proposed BIA framework.
312 S.A. Torabi et al. / Safety Science 68 (2014) 309323
2.3. Identifying of critical functions
By breaking down of organizations key products, a set of
required functions is identied for each product. Obviously,
because of limited resources, the organization might not be able
to recover all disrupted functions at the same time after a disrup-
tion occurs. So, all required functions should be prioritized to iden-
tify those critical ones for each key product. Generally, researchers
focus on time based measures for identifying critical functions
(Sikdar, 2011; Western Australian Government, 2009). Kepenach
(2007) prepared a worksheet of functions consisting of the recov-
ery time objective (RTO) and the critical employees and alterna-
tives. Nosworthy (2000) calculated a qualitative rate (including
the high, medium and low) for each function and sorted them
based on their rates. In Western Australian Government (2009),
maximum acceptable outage (MAO) has been used for identifying
critical functions. In FFIEC (2008), the importance of functions in
achievement of organizations strategic goals is proposed to recog-
nize critical functions. Western Australian Government (2009) also
dened critical functions as those functions that support organiza-
tions objectives. Identifying critical functions based on just one or
two measures is the main deciency of previous methods. To ll
this gap, in this study, several measures for recognizing the critical
functions of key products have been explored by using a compre-
hensive literature review as well as conducting some interviews
with experts. Table 2 summarizes these measures and gives a short
description for each of them.
Noteworthy, some of these measures including the function
recovery cost and time, vulnerability and importance degree of
function in the production of key products have been borrowed
from previous BCM studies while some others including the possi-
bility of outsourcing function, possibility of insuring function and
required manpower for recovery are extracted from previous stud-
ies in the business process management area. Due to scarcity of
research works in the context of BIA, the number of measures used
for identifying critical functions is so limited and the relevant stud-
ies have not accounted for all aspects of functions when conduct-
ing the BIA process. As a result, this study introduces some new
measures including the total oat time of function, required spe-
cic conditions, technological level of function, the number of
products requiring the function and possibility of using parallel
resources, to identify the critical functions. Similar to key products
identication process, a combined technique of DEMATEL and ANP
is applied to take the interrelationships between functions into
account when ranking them.
2.4. Estimating the continuity parameters
According to the BS25999 and ISO22301 terminologies, the
MTPD measure for each key product is briey dened as the time
interval after a disruption by which the disrupted functions should
be resumed, i.e., they should be recovered in at least the MBCO
level by at most MTPD (t
0
t in Fig. 4). Also, the MBCO is dened
as the minimum operating level of each key product that is accept-
able for the organization to achieve its business objectives (e.g.,
preserving reputation/brand, reducing nancial losses and contin-
uous serving of products) during a disruption. Noteworthy, a dis-
rupted key function is resumed when its operating level is
increased to respective MBCO after a disruptive incident and
restored when it comes back to its normal (100%) operating level.
According to the BIA results and in order to keep continuity
objectives, the operating level of disrupted key functions must
be increased to at least their MBCO level during the respective
MTPD. A graphical view of MTPD and MBCO measures are shown
in Fig. 4.
Although different standards or guidelines dene MTPD and
MBCO measures, but they do not propose a standard methodology
to estimate them. This study proposes a new method to determine
MBCO and MTPD measures for each key product based on the risk
appetite concept. According to the ISO terminology in regards to
Table 1
Measures used for selecting key products.
Measures References Short description Type of use
Loss of revenue (C1) Western Australian
Government (2009),
Nosworthy (2000) and Ernest-
Jones (2005)
Lost revenue in the event of manufacturing
breakdown
Key business process in BCM/consequence of
breakdown in business processes/risk analysis and
business impact
Loss of interested
parties supports
(C2)
Western Australian
Government (2009); Ernest-
Jones (2005)
Lost interested parties supports in the event of
manufacturing breakdown
Key business processes in BCM/consequence of
breakdown in business processes
Defection of
customers (C3)
Ernest-Jones (2005), Mbugua
et al. (1999) and Nosworthy
(2000)
Loss of customers demands completely in the
event of manufacturing breakdown
Key business processes in BCM/consequence of
breakdown in business processes/evaluating business
performance/risk analysis and business impacts
Higher insurance cost
(C4)
Ernest-Jones (2005) High compensation costs in the event of
manufacturing breakdown
Consequence of breakdown in business processes
Degree of damage on
companys image
and reputation
(C5)
Ernest-Jones (2005), Western
Australian government (2009)
and Nosworthy (2000)
Company become famous because of
manufacturing some products and lack of
manufacturing them will damage reputation of
company
Consequence of breakdown in business processes/
identifying key processes in BCM/risk analysis and
business impacts
Inuence on markets
(C6)
Cooper and Kleinschmidt
(1987)
Degree of losing markets for products in the event
of manufacturing breakdown
Critical Success factors for new product development
Importance of
product for the
country (C7)
Western Australian
Government (2009)
There are some statutory or regulatory obligations
when a product has an important role in country
Key business processes in BCM
Inuence on human
resources (C8)
Niazi et al. (2006), Hung et al.
(2005) and Nosworthy (2000)
Number of staff are red or become unemployed
in the event of manufacturing breakdown
CSFs for software process improvement/CSF for
knowledge management system/risk analysis and
business impacts
Rate of deviation
from company
objectives (C9)
Australian BCM institute
(2000)
Each product has a relation with companys
objective that lack of manufacturing product
damages companys objectives
Key business processes in BCM
Loss of the
technological level
of company (C10)
Abdel-Razek (1997) In the event of manufacturing breakdown ability
of developing product will be lost
Critical success/failure factors in project
S.A. Torabi et al. / Safety Science 68 (2014) 309323 313
BCMS (ISO 22301, 2012), risk appetite is dened as the amount of
risk that an organization is willing to pursue or retain. To establish
the context of the organization through BCMS implementation, risk
appetite should be taken into account for key products. Risk appe-
tite determines the total acceptable loss of all products of organi-
zation during a disruption. By increasing the amount of risk
appetite, the MTPD/MBCO measures would be increased/
decreased. In this manner, we introduce the following formula to
construct a relationship between the risk appetite and MBCO/
MTPD measures in which each part is normalized to obtain a
rational result:
X
n
i1
a
i
MBCO
i

a
i

MTPD
i
DD
i
FT
i
w
i
K 1
Table 2
Measures used to determine critical functions.
Measures Reference Description Type of use
Function recovery time
(C1)
Hawkins et al.
(2000)
The time needed to return a function to its usual state Disaster recovery planning
Function recovery cost
(C2)
Nosworthy (2000)
and Hawkins et al.
(2000)
Cost of operations for returning the function to its usual state Risk analysis and business process/disaster
recovery planning
Possibility of
outsourcing function
(C3)
Black and Porter
(1996)
Existence of companies to outsource the function CSFs for TQM in membership organizations
Possibility of insuring
function (C4)
Ernest-Jones (2005) Possibility of insuring function to compensate losses impairment in
activity
Consequence of breakdown in business
process
Possibility of using
parallel resources
(C5)
It is a new measure Existence of parallel resources to perform this function
Importance of function
in production of key
products (C6)
Sambasivan and Fei
(2008) and
Nosworthy 2000
Functions have different role in production of key products and some
of functions can be done in any time while some of them should be
done at their specic time
Benet of implementation environmental
management system(EMS)/risk analysis
and business impacts
Number of products
requiring a given
function (C7)
It is a new measure Using the function for producing several key products
Required manpower for
function recovery
(C8)
Niazi et al. (2006)
and Hung et al.
(2005)
Manpower needed for returning the function to its usual state CSFs for software process improvement/CSF
for knowledge management system/
Technological level of
function (C9)
It is a new measure Level of technology of the function affects the number of required
labor and technological level of recovery operations
Vulnerability of function
(C10)
Nosworthy (2000) Degree of inuencing from threats according to the value of Risk
Priority Number (RPN)
Risk analysis and business impacts
Possibility of attack and
any threat to the
function (C11)
Nosworthy (2000) Likelihood of occurring threats is different for each function Risk analysis and business impacts
Total oat time of
function (C12)
It is a new measure The time that a function may be delayed without impacting the
overall production time
Required specic
conditions of
function (C13)
It is a new measure Conditions such as necessity of existence at least l time unit between
two functions, give a specic condition to function
MBCO
Normal
Level
Operating level of a key Product
Incidence
t
Time
MTPD
t'
Resuming point
Restoring point
A
B
B
Completely
Stopped
(Include BCP
processes)
Operate under
normal level
(Include disaster
recovery processes)
A
Fig. 4. A graphical denition of BIA measures.
314 S.A. Torabi et al. / Safety Science 68 (2014) 309323
In this equation, MTPD
i
indicates the MTPD of the ith key product,
DD
i
is dened as the date on which product i is expected to be deliv-
ered and FT
i
is dened as the total processing times of all required
key functions of the key product I (i.e., ow time). Notably, the
due date should be greater than or equal to ow time (Cheng and
Gupta, 1989). Moreover, a
i
, MBCO
i
and w
i
denote the normal operat-
ing level, MBCO and relative importance of ith product obtained
from ANP, respectively. In addition, K is the total risk appetite of
organization determined based upon the organizations strategic
viewpoints which can be represented as the percentage of total per-
formance and n is the number of key products. Formula (1) has been
inspired by the resilience function proposed by Zobel and Khansa
(2014) and it is based on the total loss of key products during the dis-
ruption period. Based on Eq. (1), a surface can be drawn for each
value of risk appetite with different combination of MTPDand MBCO
values for key products as shown in Fig. 5 schematically.
By xing the amount of risk appetite, for each MBCO a tally point
for MTPD would be obtained. After determining the MBCO and
MTPD measures for key products, the next step is determining these
parameters for critical functions. Notably, obtaining MBCO for criti-
cal functions of key products is a simple task since the MBCO mea-
sure for each critical function is equal to the MBCO of related key
product. However, calculating the MTPD measure for critical func-
tions is more complicated. For this, we develop a backward progres-
sive algorithm called MTPD algorithm to determine the MTPD
measure for each critical function whose steps are as follow:
Step 1: Determine the different groups of critical functions
according to the precedence relations among them so that the
rst set of critical functions are those functions without any
prerequisite.
Step 2: Prioritize the current set of functions according to their
ranks extracted by the ANP method and their required recovery
resources.
Step 3: By starting from the rst set of critical functions,
set MTPD = 1 for those functions that could be recovered
at the rst available time slot (e.g., working day). After-
wards, add one time unit for MTPD of remained functions
of the current set (if any) which can be recovered at the
next working day.
Step 4: Repeat step 3 for the rest of critical functions in the next
levels.
In this manner, the MTPD of critical functions are determined in
such a way that they are recovered in the order of their ranking and
required resources level by level. Noteworthy, it is assumed that
the organization supplies its required resources from the outside
suppliers at the recovery phase and thus there is no restriction in
the amount of supply. However, the only limitation is the required
times for recovery of critical functions. Accordingly, we simply add
one time unit to MTPD of those functions at the current group of
critical functions which could be recovered in the next working
day.
Normal level=
i 10000
5000
4000
3000
2000
1000
0
24 36 48 60 72 96 120 144 200 MTPD
(Hour)
MBCO
Fig. 5. A sample curve for MTPD and MBCO.
Table 3
Product groups.
Product group Part Code Product group Part Code
Brake disks Peraid BDP1 Complete Torus Mazda CTM
Peugeot 206 BDP2 Cylinder Benz 10 ton CB1
Peugeot 405 BDP3 Benz Mayler CB2
Peykan BDP4 Complete Axle Peykan CAP1
Roa BDR Peugeot RD CAP2
Steering tuber Nissan STN Bush Mazda BM
Peraid STP1 Peraid BP1
Peugeot 206 STP2 Peugeot 405 BP2
Peugeot 405 STP3 Wheel Bearing Peykan WBP1
Peugeot RD STP4 Peraid WBP2
Peykan STP5 Peugeot 405 WBP3
Xantia STX Wheel sink Peykan WSP1
Torus tuber Mazda TTM Peraid WSP2
Nissan TTN Peugeot 405 WSP3
Peraid TTP1
Peugeot 405 TTP2
Peraid WSP2
Peugeot 405 WSP3
S.A. Torabi et al. / Safety Science 68 (2014) 309323 315
3. A case study
In this section, the proposed BIA framework is applied to an
industrial case company which produces some auto parts. Lahijan
steering and suspension parts (LSSP) company is an auto parts
manufacturer since 1984 in the north of Iran and has 150 employ-
ees. Due to importance of continuity in the delivery of companys
products under any circumstances, BCMS is being implemented
in the company, and the proposed methodology has been used to
conduct the BIA process. Hereafter, the details of the proposed
methodology is elaborated step-by-step.
3.1. Determining the key products
LSSP Company is producing thirty products in nine categories as
summarized in Table 3. According to the methodology, ANP was
utilized to rank the products. To this end, network structure of
key products selection problem was identied by applying fuzzy
DEMATEL technique. For this, a questionnaire was designed and
twenty experts including four top managers of the company,
twelve middle managers (e.g., Disks production manager, Bush
production manager, Axle production manager, Quality control
manager, and warehouse manager) and four interested parties of
the organization (i.e., companys main shareholders, city authori-
ties, main suppliers, and companys contractors) lled out the
questionnaire.
The opinions of experts were gathered as linguistic terms for
which suitable fuzzy triangular numbers were considered to con-
vert them into the numerical scale. CFCS method was used to
defuzzify these triangular fuzzy numbers. After calculating the ini-
tial direct and total inuence matrices denoted by D and T, respec-
tively, and applying MMDE method proposed by Li and Tzeng
(2009) to explore the important relationships between products
measures, the threshold value was calculated as 0.4458 (see
Appendix B for details). So, we kept those relationships with a
score greater than the threshold value in matrix T. In this way,
the network structure of the key products selection problem can
be depicted as Fig. 6.
In the last step of identifying key products, all products should
be ranked by the ANP method. In this step, required pair-wise com-
parison matrices were gathered by interviewing with top manag-
ers of the company and nal weights were calculated by the
Super Decision software. Table 4 shows the corresponding results
of the ANP method for ranking of products in which the raw
weights are the values from limit super matrix, normal weights
are normalized values of raw weights and the ideal values are
obtained from the normalized values by dividing each value by
the largest one in each column from which the nal ranks are
obtained.
Accordingly, Brake disks for Peraid, Peugeot 206 and Peugeot
405 (BDP3, BDP2 and BDP1) were selected as the key products of
the company while considering the available budget and desired
maturation level for implementing the BCMS within the company.
Key products selection
Defection of
customers
Higher
Insurance cost
Importance of
product for the
country
Influence on
Market
Loss of the
technological
level of
company
Loss of revenue
Rate of deviation
from companys
objectives
Influence on
human
Damage on
companys image
and reputation
Loss of interest
parties supports
Fig. 6. Network structure for key products selection.
Table 4
ANP weights and nal ranking of products.
Name Ideal weights Normal weights Raw weights Final ranks
BDP1 0.919275 0.0518811 0.049961 3
BDP2 0.991354 0.0559487 0.053878 2
BDP3 1 0.0564367 0.054348 1
BDP4 0.84727 0.0478198 0.04605 5
BDR 0.91613 0.0517035 0.04979 4
STN 0.635009 0.0358373 0.034511 13
STP1 0.611489 0.0345102 0.033233 15
STP2 0.688565 0.0388602 0.037422 8
STP3 0.715437 0.0403774 0.038883 7
STP4 0.621795 0.0350917 0.033793 14
STP5 0.601064 0.0339225 0.032667 16
STX 0.780759 0.0440638 0.042433 6
TTM 0.677687 0.0382465 0.036831 10
TTN 0.647277 0.03653 0.035178 12
TTP1 0.662384 0.0373825 0.035999 11
TTP2 0.679422 0.0383441 0.036925 9
CTM 0.505973 0.0285559 0.027499 19
CB1 0.576093 0.0325123 0.031309 17
CB2 0.574755 0.0324375 0.031237 18
CAP1 0.482072 0.0272069 0.0262 21
CAP2 0.490893 0.0277043 0.026679 20
BM 0.298898 0.0168683 0.016244 28
BP1 0.286324 0.016159 0.015561 30
BP2 0.294476 0.0166191 0.016004 29
WBP1 0.342317 0.019319 0.018604 27
WBP2 0.355924 0.0200874 0.019344 26
WBP3 0.384937 0.021725 0.020921 23
WSP1 0.360341 0.0203367 0.019584 25
WSP2 0.382849 0.0216067 0.020807 24
WSP3 0.388194 0.0219088 0.021098 22
316 S.A. Torabi et al. / Safety Science 68 (2014) 309323
3.2. Key products breakdown structure
To identify those required functions for producing the three
selected key products, RWBS matrix is used. In this way, to dene
PCWBS and FWBS and nally RWBS matrices, an interview was
conducted with the mangers of brake disks production department
and according to Table 5, fourteen functions were identied for
companys key products. In this table, rows show the main compo-
nents of key products activities (PCWBS) and columns are the func-
tions needed to produce key products.
3.3. Determining critical functions
Similar to key products selection procedure, relationships
between thirteen criteria were evaluated by the same team of
experts who were used in Section 3.1. By using CFCS method trian-
gular fuzzy numbers were transformed to their crisp values and
nally initial direct inuence matrix (D) and total inuence matrix
(T) in DEMATEL were calculated (see Appendix B for details). Similar
to Section 3.1, 0.1975 was calculated as the threshold value by the
MMDE algorithm (see Appendix B for details). Next, the network
structure for selecting the critical functions was depicted as Fig. 7.
Finally, functions were ranked by the ANP method through
Super Decision software. Table 6 shows the nal ranking of
functions.
Accordingly, f
11
, f
10
, f
13
, f
8
and f
12
were identied as the most
critical functions.
3.4. Estimating the MTPD and MBCO measures
Table 7 shows the required information for each key product.
Accordingly, based on Eq. (1) we would have:
Figs. 8ac shows the relevant charts for the above function.
Accordingly, we can nd a feasible set of triplets (x, y, z) and deter-
mine the MBCO and MTPD measures for each key product by draw-
ing a set of contours.
After conducting an interview with the top managers of LSSP,
k = 0.7 was selected as the acceptable risk appetite of the company.
In other words, the maximum total loss of 30% is tolerable for com-
panys top manager during any disruptive event. For each feasible
point in these surfaces, a MBCO and MTPD can be dened. For
example, triplet (0.63, 0.72, 0.74) is a feasible point in Fig. 8b, there-
fore we would have:
MTPD
BDP
1
5

1200 MBCO
BDP
1

1200

0:63 3
MTPD
BDP
2
5

900 MBCO
BDP
2

900

0:72 4
MTPD
BDP
3
5

1650 MBCO
BDP
3

1650

0:74 5
Based on Fig. 9, company sets the following MBCO for each key
product. Therefore, the related MTPD for each key product is as
follows:
MBCO
BDP1
300 ! MTPD
BDP1
4:2 5
MBCO
BDP2
200 ! MTPD
BDP2
4:6 5
MBCO
BDP3
400 ! MTPD
BDP3
4:9 5
Now, the MBCO measure for critical functions should be less
than or equal to the MBCO of related key products. To determine
the MTPD measure for critical functions based on the proposed
MTPD algorithm (Section 2.4), the required resources are shown
in Table 8.
Table 5
RWBS matrix.
Get
orders
Finance
and
administration
actions
Control
of
raw
materials
Control
of discs
Storing
raw
material
Storing
nal
products
Sale and
marketing
functions
Casting
and
cooling
Turning
with
CNC
Drilling
holes
with
vertical
CNC
Tolerance
control
of holes
Cleaning
functions
Protective
coating
Packaging
Requests
and administrative
activities
1 1 0 0 0 0 1 0 0 0 0 0 0 0
Control activities 0 0 1 1 0 0 0 0 0 0 1 0 0 0
Body of disc 0 0 0 0 1 0 0 1 0 0 0 0 0 0
Final product 0 0 0 0 0 1 0 0 1 1 0 1 1 1
2
S.A. Torabi et al. / Safety Science 68 (2014) 309323 317
According to the proposed MTPD algorithm, the rst set of func-
tions with no prerequisite (i.e., f
1
, f
2
, f
3
and f
8
) are rst selected to
be recovered. In this manner, they are recovered in the order of
their ranking and required resources (see Table 6). So, f
3
that needs
only 1 manpower and 1 h is rst recovered. Then, f
1
is chosen
which needs 2 manpower and 2 h for recovery. Similarly f
2
and f
8
are recovered next. In this way, for all of these functions we could
set: MTPD = 1 as they could be recovered at the rst working day.
Similarly, for other critical functions, the MTPD measure is esti-
mated in such a way that they could be recovered in the next
working days. Notably, each working day includes 8 working hours
in our case study.
4. Implementation tips
In this study, a novel framework has been developed for con-
ducting a BIA process as the key element of a BCMS. To implement
the proposed BIA framework, some implementation tips should be
regarded as follows:
The measures correlation: this study introduces several mea-
sures to identify key products/critical functions. One of the most
important hints in this step is considering the correlation
between measures. If we do not consider correlation between
measures, the products/function will be ranked in a wrong
way and the developed BCMS cannot work efciently. Using
DEMATEL could help to identify these correlations after which
the ANP method can be applied to rank the products/functions.
Group decision making: BCMS is a comprehensive approach to
control those risks threatening the organization. Therefore, for
implementing an effective BCMS, the BIA process should be con-
ducted in an accurate way for which the opinion of several peo-
ple at different levels of the organization should be taken into
account via a group decision making process. Nevertheless, to
get involved the BIA committee members effectively, they
should be familiar with BCM concept for which they might be
trained through a short workshop within the company.
MBCO determination: the most important purpose of imple-
menting a BCMS is establishing a vital process in the organiza-
tion so that the organizations strategic goals could be achieved
even any disruption happens. Also, as shown in Fig. 2, BIA is clo-
sely related to the organizations goals. Accordingly, the BCM
team should be care about the risk appetite level they select
for determining the key products MBCO measure. Therefore,
in the proposed framework, the risk appetite is considered as
the main parameter when estimating the MBCO and MTPD
measures (see Eq. (1)).
MTPD algorithm: to determine a feasible set of MTPD measures
for critical functions, we suggested dening the MBCO for each
critical function as equal to MBCO of its respective product
while the level of MBCO denes the required resources for
Function recovery cost Function recovery time
Selecting the critical functions
Number of products
requiring a given function
Importance of function in
production of key products
Capability of insuring function
Capability of
outsourcing
function
Production
specific
conditions
Capability of
using parallel
resources
Manpower
requirement
for recover
function
Possibility of
attack and
any threat to
function
Vulnerability
of function
Total float
time of
function
Technological
level of
function
Fig. 7. Network structure for selecting the critical functions.
Table 6
Ranking of functions.
Name Ideal weights Normal weights Raw weights Final ranks
f
1
0.3445 0.0368 0.0265 12
f
2
0.3293 0.0352 0.0253 14
f
3
0.3420 0.0366 0.0263 13
f
4
0.4000 0.0428 0.0307 10
f
5
0.3990 0.0427 0.0307 11
f
6
0.4036 0.0431 0.0310 9
f
7
0.4863 0.0520 0.0374 8
f
8
0.6665 0.0713 0.0512 4
f
9
0.5040 0.0539 0.0387 7
f
10
0.7873 0.0842 0.0605 2
f
11
1.0000 0.1069 0.0769 1
f
12
0.6164 0.0659 0.0474 5
f
13
0.7657 0.0819 0.0589 3
f
14
0.5689 0.0608 0.0437 6
Table 7
Parameters of each key product.
Key product a DD (in days) FT (in days) Normal weight
BDP3 1200 7 2 0.2985
BDP2 900 7 2 0.3492
BDP1 1650 7 2 0.3523
318 S.A. Torabi et al. / Safety Science 68 (2014) 309323
recover. Consequently, based on the required recovery times
and the resources of critical functions and their precedence
relations, the MTPD for each critical function can be dened.
5. Conclusion remarks
Business impact analysis (BIA) is one of the key processes when
implementing a business continuity management system (BCMS)
which gives a proper apperception about the organizations key
products and processes. Data gathering and data analysis are two
main steps of BIA. This study develops a novel methodology for
conducting a BIA process in a systematic way. First, organizations
key products are identied through applying a hybrid fuzzy DEM-
ATEL-ANP method for which several relevant criteria were sug-
gested. Second, by preparing a RWBS matrix, all functions which
are needed to produce key products, are identied. Then, via iden-
tifying relevant criteria, functions are ranked by using a similar
fuzzy DEMATE-NP method to identify the critical functions. Finally,
a novel algorithm is used to identify continuity parameters includ-
ing the MTPD and MBCO measures for both key products and their
critical functions. In this manner, the MTPD and MBCO for key
products are rst dened based on the risk appetite level of the
organization and then the MTPD of critical functions are deter-
mined through a simple MTPD algorithm.
According to the special characteristics of each organization,
developing more tailored BIA frameworks for example for
service-oriented organizations (e.g., banking industry) could be
considered as a good direction for further studies. In addition, by
accounting for resource limitations when developing business
continuity and recovery plans, future researches can take resource
allocation considerations into account.
Acknowledgement
This study was supported by the University of Tehran under the
research grant no. 8109920/1/14. The authors are grateful for this
nancial support.
Appendix A. Applied fuzzy DEMATEL-ANP method
Analytic network process (ANP) is a general form of analytic
hierarchy process (AHP) proposed by Saaty (2001) by which a net-
work of interrelationships between the elements of a decision
problem can be used instead of a linear hierarchy structure. The
rst step of ANP is determining the network structure of the prob-
lem for which this study uses the fuzzy DEMATEL method. DEMA-
TEL is based on graph theory and uses the experts opinions about
the inuence degree of each element on other elements to nd the
casual relationships among them (Tzeng et al., 2007; Chen et al.,
2011). Yang et al. (2008) proposed using DEMATEL for evaluating
the interdependencies between a numbers of criteria. This study
proposes a hybrid approach of fuzzy DEMATEL and ANP for select-
ing key products and their critical functions. Required data are
gathered by using of distributing a questionnaire between decision
makers (DM). After receiving DMs replies, the received data are
analyzed to rank the products and by considering the available
Fig. 8a. Chart of model 2 for k = 0.6.
Fig. 8b. Chart of model 2 for k = 0.7.
Fig. 8c. Chart of model 2 for k = 0.8.
S.A. Torabi et al. / Safety Science 68 (2014) 309323 319
resources and desired maturation level of BCMS, some of them are
selected as organizations key products.
This study uses the fuzzy DEMATEL method for identifying the
network of interrelationship between those criteria used to iden-
tify key products and critical functions. In this way, ve linguistic
terms are used to indicate the inuence degree of each element
Fig. 9. The MTPD and MBCO for key products. (a) MTPD and MBCO for BDP
1
. (b) MTPD and MBCO for BDP
2
. (c) MTPD and MBCO for BDP
3
.
Table 8
Required manpower and cost of recovery based on MTPD algorithm.
Step Sets Functions Manpower Facility Cost Required recovery time (h) MTPD Order of allocation
Step 1 {f
1
, f
2
, f
3
, f
8
} F
1
2 0 200$ 2 1 2
F
2
1 0 100$ 1 1 4
F
3
1 0 100$ 1 1 1
F
8
5 2 6000$ 4 1 3
Step 2 {f
4
, f
7
, f
10
} F
4
1 2 800$ 3 2 3
F
7
3 0 300$ 3 2 2
F
10
1 1 8100$ 2 2 1
Step 3 {f
6
, f
11
} F
6
2 2 4200$ 5 3 2
F
11
1 1 5100$ 3 3 1
Step 4 {f
5
, f
12
, f
13
} F
5
2 1 2100$ 4 4 3
F
12
0 1 3000$ 2 4 1
F
13
1 1 5100$ 2 4 2
Step 5 {f
9
, f
14
} F
9
4 1 800$ 5 5 2
F
14
2 1 6200$ 3 5 1
Table A.1
Linguistic terms used to determine inuence degrees.
Linguistic variable Inuence score Corresponding triangular
fuzzy number (TFN)
No inuence (NO) 0 (0, 0, 0.25)
Very low inuence (VL) 1 (0, 0.25, 0.5)
Low inuence (L) 2 (0.25, 0.5, 0.75)
High inuence (H) 3 (0.5, 0.75, 1)
Very high inuence (VH) 4 (0.75, 1, 1)
0
0.25 0.5 0.75 1
1
VH
H L VL
NO
Fig. A.1. Triangular fuzzy membership functions of linguistic terms.
320 S.A. Torabi et al. / Safety Science 68 (2014) 309323
one another one. Table A.1 and Fig. A.1 show these linguistic terms
along with their equivalent fuzzy membership functions.
The steps of fuzzy DEMATEL are as follow:
Step 1: Calculating the average matrix A
Each member of the experts committee indicates her/his opin-
ion about the inuence degree of criterion i on criterion j denoted
by X
k
ij
from which the matrix provided by kth expert is constructed
as X
k
. Notably, X
k
ij
values are rst determined as linguistic terms
and then transformed to their equivalent TFNs. Then, the average
matrix A is formed by calculating the average of X
k
ij
values.
Step 2: Transforming the average matrix into the initial direct-rela-
tion matrix
In this study, the average matrix A whose elements are in the
form of triangular fuzzy numbers is transformed into the initial
direct relation matrix by the Converting Fuzzy data into Crisp
Scores (CFCS) method (Chang et al., 2011).
Step 3: Calculating the normalized initial direct matrix D
s min
1
max
i
P
n
j1
ja
ij
j
;
1
max
j
P
n
i1
ja
ij
j
2
4
3
5
A1
Table B.1
Initial direct inuence matrix (D).
Initial direct matrix (D) C1 C2 C3 C4 C5 C6 C7 C8 C9 C10
C1 0.000 0.092 0.110 0.151 0.013 0.030 0.151 0.069 0.100 0.044
C2 0.110 0.000 0.110 0.151 0.110 0.030 0.036 0.051 0.100 0.044
C3 0.115 0.089 0.000 0.063 0.110 0.088 0.119 0.030 0.125 0.038
C4 0.110 0.045 0.109 0.000 0.039 0.118 0.038 0.110 0.110 0.024
C5 0.125 0.133 0.097 0.076 0.000 0.124 0.118 0.097 0.133 0.060
C6 0.125 0.119 0.104 0.044 0.124 0.000 0.044 0.024 0.125 0.104
C7 0.107 0.076 0.115 0.030 0.076 0.050 0.000 0.024 0.118 0.151
C8 0.106 0.076 0.038 0.024 0.076 0.047 0.030 0.000 0.118 0.038
C9 0.076 0.076 0.151 0.076 0.115 0.076 0.106 0.071 0.000 0.151
C10 0.076 0.076 0.076 0.076 0.115 0.097 0.097 0.071 0.071 0.000
Table B.2
Total inuence matrix (T).
Total relation matrix (T) C1 C2 C3 C4 C5 C6 C7 C8 C9 C10
C1 0.318 0.346 0.419 0.382 0.278 0.257 0.400 0.257 0.427 0.276
C2 0.421 0.268 0.421 0.389 0.362 0.264 0.307 0.248 0.430 0.269
C3 0.444 0.370 0.344 0.327 0.383 0.323 0.397 0.235 0.472 0.291
C4 0.401 0.298 0.397 0.232 0.288 0.319 0.289 0.280 0.418 0.243
C5 0.519 0.461 0.494 0.387 0.338 0.398 0.446 0.331 0.547 0.356
C6 0.468 0.410 0.452 0.327 0.410 0.255 0.348 0.241 0.487 0.354
C7 0.420 0.345 0.429 0.287 0.344 0.281 0.281 0.221 0.446 0.376
C8 0.340 0.277 0.283 0.220 0.273 0.217 0.239 0.149 0.364 0.217
C9 0.452 0.392 0.512 0.364 0.425 0.346 0.420 0.295 0.402 0.413
C10 0.397 0.346 0.393 0.321 0.375 0.322 0.361 0.262 0.410 0.238
Table B.3
Threshold value calculation.
Steps Calculation
Step 1: the ordered triplets set T

{(0.5476, 5, 9), (0.5187, 5, 1), (0.5119, 9, 3), (0.4939, 5, 3), (0.4866, 6, 9), (0.4682, 6, 1), (0.4720, 3, 9), (0.4682, 6, 1),
(0.4521, 6, 3), (0.4520, 9, 1), (0.4463, 7, 9), (0.4458, 5, 7), (0.4444, 3, 1), (0.42961, 2, 9), . . . , (0.1492, 8, 8),}
Step 2: dispatch-node set T
Di
{5, 5, 9, 5, 6, 6, 3, 6, 6, 9, 7, 5, 3, 2, 7, 1, 9, 2, 2, 7, 9, 1, 4, 9, 6, 6, . . .. . . , 8}
Step 3.1: T
t
Di
set and MDE
t
Di
values T1 = {5}, MDE1 = 0; T2 = {5}, MDE2 = 0;T3 = {5, 5, 9}, MDE3 = 0.0283; T4 = {5, 5, 9, 5},
MDE4 = 0.0654; T5 = {5, 5, 9, 5, 6}, MDE5 = 0.0494; T6 = {5, 5, 9, 5, 6, 6}, MDE6 = 0.0290, MDE100 = 0
Step 3.2: set of 100 MDE
t
Di
{0, 0, 0.0283, 0.0654, 0.0494, 0.0290, 0.0273, 0.0327, 0.0428, 0.0266, 0.0283, 0.0503, . . .. . ... , 0.0013, 0}
Step 4.1: maximum MDE
t
Di
0.0654
Step 4.2: dispath-node set of maximum MDE
t
Di
T4 = {5, 5, 9, 5} = {5, 9}
Step 5: receive-node set, T
Re
{9, 1, 3, 3, 9, 9, 1, 2, 3, 1, 9, 7, 1, 9, 3, 9, 5, 1, 3, 7, 7, 3, 9, 10, 2, 5, . . .. . .. , 8}
Step 6.1: T
t
Re
set and MDE
t
Re
values T1 = {9}, MDE1 = 0; T2 = {9, 1}, MDE2 = 0; T3 = {9, 1, 3}, MDE3 = 0; T4 = {9, 1, 3, 3},
MDE4 = 0.0196; T5 = {9, 1, 3, 3, 9}, MDE5 = 0.0145; T6 = {9, 1, 3, 3, 9, 9}, MDE6 = 0.029;
T7 = {9, 1, 3, 3, 9, 9, 1}, MDE7 = 0.0065; T8 = {9, 1, 3, 3, 9, 9, 1, 2}, MDE8 = 0.0163, . . . , MDE100 = 0
Step 6.2: Set of 100 MDE
t
Re
{0, 0, 0, 0.0196, 0.0145, 0.029, 0.0065, 0.0163, 0.0189, 0.0181, 0.0229, 0.0272, 0.0302, 0.0551, 0.0354,
0.0404, 0.0405, 0.0423, 0.0433, 0.0345, . . .. . .. . .. . .. . .. . .. . . , 0.0013, 0}
Step 7.1: maximum MDE
t
Re
0.0551
Step 7.2: dispath-node set of maximum MDE
t
Re
T14 = {9, 1, 3, 3, 9, 9, 1, 2, 3, 1, 9, 7, 1, 9} = {9, 1, 3, 2, 7}
Step 8.1: T
Di
max
{(0.5476, 5, 9), (0.5187, 5, 1), (0.5119, 9, 3), (0.4939, 5, 3)}
Step 8.2: T
Re
max
{(0.5476, 5, 9), (0.5187, 5, 1), (0.5119, 9, 3), (0.4939, 5, 3), (0.4866, 6, 9), (0.4682, 6, 1), (0.4720, 3, 9),
(0.4682, 6, 1), (0.4521, 6, 3), (0.4520, 9, 1), (0.4463, 7, 9), (0.4458, 5, 7), (0.4444, 3, 1), (0.42961, 2, 9)}
Step 8.3: T
Th
{(0.5476, 5, 9), (0.5187, 5, 1), (0.5119, 9, 3), (0.4939, 5, 3), (0.4520, 9, 1), (0.4458, 5, 7)}
Step 8.4: threshold value 0.4458
S.A. Torabi et al. / Safety Science 68 (2014) 309323 321
D s:A A2
Step 4: Calculating the total relation matrix T
The direct matrix D just account for direct inuence ows
between criteria. However, there will be innite sequence of indi-
rect effects between criteria which should be considered. In this
manner, the total inuence matrix denoted by T, reects the total
inuence degree among criteria whose elements are denoted by
t
ij
which indicates the total direct and indirect inuence of crite-
rion i on criterion j. The Eq. (A3) calculates the matrix T.
T DI D
1
A3
Table B.4
Initial direct inuence matrix (D).
Initial direct matrix (D) C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13
C1 0.000 0.098 0.022 0.016 0.027 0.008 0.010 0.064 0.016 0.016 0.010 0.040 0.027
C2 0.104 0.000 0.040 0.016 0.008 0.042 0.047 0.045 0.008 0.045 0.057 0.034 0.027
C3 0.096 0.100 0.000 0.022 0.010 0.041 0.081 0.107 0.010 0.040 0.082 0.082 0.114
C4 0.057 0.068 0.064 0.000 0.045 0.042 0.068 0.016 0.040 0.064 0.064 0.026 0.022
C5 0.042 0.120 0.008 0.010 0.000 0.064 0.068 0.097 0.026 0.047 0.057 0.040 0.022
C6 0.022 0.022 0.034 0.041 0.010 0.000 0.112 0.040 0.034 0.068 0.063 0.040 0.045
C7 0.040 0.027 0.042 0.022 0.016 0.034 0.000 0.008 0.022 0.010 0.027 0.016 0.034
C8 0.120 0.137 0.008 0.010 0.040 0.045 0.068 0.000 0.088 0.026 0.022 0.114 0.100
C9 0.104 0.114 0.120 0.016 0.022 0.040 0.067 0.088 0.000 0.022 0.016 0.040 0.079
C10 0.067 0.068 0.040 0.034 0.045 0.079 0.107 0.100 0.042 0.000 0.120 0.026 0.068
C11 0.079 0.045 0.012 0.067 0.026 0.068 0.079 0.088 0.016 0.114 0.000 0.079 0.034
C12 0.088 0.120 0.034 0.022 0.016 0.045 0.068 0.079 0.040 0.088 0.100 0.000 0.040
C13 0.040 0.079 0.100 0.026 0.040 0.057 0.079 0.067 0.114 0.068 0.088 0.108 0.000
Table B.5
Total inuence matrix (T).
Total relation matrix (T) C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13
C1 0.070 0.168 0.058 0.038 0.049 0.050 0.069 0.118 0.051 0.060 0.061 0.089 0.073
C2 0.180 0.091 0.083 0.047 0.038 0.092 0.120 0.117 0.051 0.099 0.118 0.096 0.085
C3 0.231 0.247 0.080 0.072 0.059 0.128 0.203 0.221 0.088 0.135 0.186 0.188 0.203
C4 0.155 0.173 0.119 0.038 0.078 0.106 0.160 0.108 0.087 0.130 0.141 0.099 0.092
C5 0.148 0.225 0.066 0.047 0.036 0.128 0.162 0.180 0.080 0.115 0.134 0.116 0.094
C6 0.115 0.122 0.090 0.075 0.044 0.062 0.196 0.120 0.083 0.130 0.135 0.108 0.110
C7 0.092 0.086 0.074 0.041 0.035 0.067 0.051 0.058 0.049 0.048 0.069 0.058 0.071
C8 0.248 0.279 0.092 0.055 0.084 0.126 0.184 0.118 0.154 0.115 0.125 0.206 0.184
C9 0.230 0.251 0.188 0.059 0.065 0.117 0.179 0.195 0.068 0.104 0.115 0.140 0.170
C10 0.202 0.214 0.117 0.085 0.092 0.164 0.231 0.214 0.115 0.096 0.217 0.133 0.162
C11 0.198 0.180 0.083 0.109 0.071 0.145 0.193 0.189 0.084 0.191 0.100 0.165 0.120
C12 0.215 0.252 0.105 0.069 0.062 0.126 0.184 0.189 0.104 0.171 0.194 0.097 0.129
C13 0.200 0.250 0.188 0.082 0.091 0.155 0.223 0.206 0.187 0.173 0.206 0.220 0.115
Table B.6
Calculation of threshold value.
Steps Calculation
Step 1: the ordered triplets set T

{(0.2786, 8, 2), (0.2521, 12, 2), (0.2514, 9, 2), (0.2501, 13, 2), (0.2482, 8, 1), (0.2474, 3, 2), (0.2306, 3, 1),
(0.2305, 10, 7), (0.2297, 9, 1), (0.2253, 5, 2), (0.2229, 13, 7), (0.2208, 3, 8), (0.2197, 13, 12),
(0.2174, 10, 11), (0.2146, 12, 1), (0.2145, 10, 2), (0.2140, 10, 8), (0.2063, 13, 8), . . . , (0.0348, 7, 5),}
Step 2: dispatch-node set T
Di
{8, 12, 9, 13, 8, 3, 3, 10, 9, 5, 13, 3, 13, 10, 12, 10, 10, 13, 13, 8, 3, 3, 10, 13, 11, 6, 9, . . . , 7}
Step 3.1: T
t
Di
set and MDE
t
Di
values T1 = {8}, MDE1 = 0; T2 = {8, 12}, MDE2 = 0; T3 = {8, 12, 9}, MDE3 = 0; T4 = {8, 12, 9, 13},
MDE4 = 0; T5 = {8, 12, 9, 13, 8}, MDE5 = 0.0135; T6 = {8, 12, 9, 13, 8, 3}, MDE6 = 0.0097, . . .. . .. . .. , MDE169 = 0
Step 3.2: set of 169 MDE
t
Di
{0, 0, 0, 0, 0.0135, 0.0097, 0.0119, 0.0098, 0.0094, 0.0084, 0.0074, 0.0117, 0.0145, 0.0107,
0.0067, 0.0073, 0.0102, 0.0122, 0.0156, 0.0140, 0.0145, 0.0163, 0.0177, 0.0199, 0.0221, 0.0228, 0.0212, . . .. . ... , 0.0001, 0}
Step 4.1: maximum MDE
t
Di
0.0228
Step 4.2: dispath-node set of maximum MDE
t
Di
T26 = {8, 12, 9, 13, 8, 3, 3, 10, 9, 5, 13, 3, 13, 10, 12, 10, 10, 13, 13, 8, 3, 3, 10, 13, 11, 6} = {8, 12, 9, 13, 3, 10, 5, 11, 6}
Step 5: receive-node set, T
Re
{2, 2, 2, 2, 1, 2, 1, 7, 1, 2, 7, 8, 12, 11, 1, 2, 8, 8, 11, 12, 13, 7, 1, 1, 1, 7, 8, . . .. . .. , 5}
Step 6.1: T
t
Re
set and MDE
t
Re
values T1 = {2}, MDE1 = 0; T2 = {2, 2}, MDE2 = 0; T3 = {2, 2, 2}, MDE3 = 0;T4 = {2, 2, 2, 2},
MDE4 = 0; T5 = {2, 2, 2, 2, 1}, MDE5 = 0.0963; T6 = {2, 2, 2, 2, 1, 2}, MDE6 = 0.1213, . . .. . .. . .. , MDE169 = 0
Step 6.2: set of 169MDE
t
Re
{0, 0, 0, 0, 0.0963, 0.1213, 0.0474, 0.0661, 0.0539, 0.0669, 0.0345, 0.0468, 0.0463,
0.0425, 0.0437, 0.0506, 0.0415, 0.0377, 0.0292, 0.0212, 0.0241, . . . , 0.0001, 0}
Step 7.1: maximum MDE
t
Re
0.1213
Step 7.2: dispath-node set of maximum MDE
t
Re
T6 = {2, 2, 2, 2, 1, 2} = {2, 1}
Step 8.1: T
Di
max
{(0.2786, 8, 2), (0.2521, 12, 2), (0.2514, 9, 2), (0.2501, 13, 2), (0.2482, 8, 1), (0.2474, 3, 2),
(0.2306, 3, 1), (0.2305, 10, 7), (0.2297, 9, 1), (0.2253, 5, 2), (0.2229, 13, 7), (0.2208, 3, 8),
(0.2197, 13, 12), (0.2174, 10, 11), (0.2146, 12, 1), (0.2145, 10, 2), (0.2140, 10, 8), (0.2063, 13, 8),
(0.2061, 13, 11), (0.2056, 8, 12), (0.2033, 3, 13), (0.2032, 3, 7), (0.2016, 10, 1), (0.2005, 13, 1), (0.1975, 11, 1), (0.1958, 6, 7)}
Step 8.2: T
Re
max
{(0.2786, 8, 2), (0.2521, 12, 2), (0.2514, 9, 2), (0.2501, 13, 2), (0.2482, 8, 1), (0.2474, 3, 2)}
Step 8.3: T
Th
{(0.2786, 8, 2), (0.2521, 12, 2), (0.2514, 9, 2), (0.2501, 13, 2), (0.2482, 8, 1), (0.2474, 3, 2), (0.2306, 3, 1),
(0.2297, 9, 1), (0.2253, 5, 2), (0.2146, 12, 1), (0.2145, 10, 2), (0.2016, 10, 1), (0.2005, 13, 1), (0.1975, 11, 1)}
Step 8.4: threshold value 0.1975
322 S.A. Torabi et al. / Safety Science 68 (2014) 309323
Step 5: Dening a threshold value to create impact relation map
To nd the nal network of inuence ows among criteria, a
threshold value is used to discriminate between considerable and
negligible inuence ows. The threshold value can be chosen by
decision makers through discussions with experts. However, this
method is not appropriate at all. Hence, this study uses the maxi-
mum mean de-entropy (MMDE) algorithm developed by Li and
Tzeng (2009) to determine a good threshold value.
Now according to the calculated threshold value, we can elim-
inate minor effects and dene the nal matrix T
p
whose elements
are as follows:
t
p
ij

0 if t
ij
< p
t
ij
if t
ij
Pp

A4
At last, according to the network constructed from the mean-
ingful inuences, products are ranked by ANP method. The inter-
ested reader is referred to Chung et al. (2005) for details of ANP
method.
Appendix B. Initial direct and total inuence matrices
The initial direct inuence matrix and total inuence matrix
which denoted by matrix D and T, respectively for key products
are shown in Tables B.1 and B.2. To calculate the proper threshold
value, MMDE method is used, and the exact value is calculated as
0.4458. The implementation process of MMDE method for key
products is shown in Table B.3.
Similar to key products selection procedure, the details of D
and T matrices and implementing the MMDE algorithm for critical
functions are shown in Tables B.4B.6, respectively.
References
Abdel-Razek, R.H., 1997. How construction managers would like their performance
to be evaluated. J. Constr. Eng. Manage. 123 (3), 208213.
Akkiraju, R., Bhattacharjya, D., Gupta, S., 2012. Towards effective business process
availability management. J. Serv. Sci. Res. 4 (2), 319351.
Bhamra, R., Dani, S., Burnard, K., 2011. Resilience: the concept, a literature review
and future directions. Int. J. Prod. Res. 49 (18), 53755393.
Black, S.A., Porter, L.J., 1996. Identication of the critical factors of TQM. Decis. Sci.
27 (1), 121.
British Standard Institute, 2006. BS 25999-1. Business continuity management Code
of practice. United Kingdom: BSI Knowledge Centre.
Business continuity management, Keeping the wheels in motion, 2000. Australian
Business Continuity Management Institute.
Cha, S.-C., Juo, P.-W., Liu, L.-T., Chen, W.-N., 2008. Riskpatrol: a risk management
system considering the integration risk management with business continuity
processes. IEEE Int. Conf. Intell. Secur. Inform., 110115.
Chang, B., Chang, C.-W., Wu, C.-H., 2011. Fuzzy DEMATEL method for developing
supplier selection criteria. Exp. Syst. Appl. 38 (3), 18501858.
Chen, F.-H., Hsu, T.-S., Tzeng, G.-H., 2011. A balanced scorecard approach to
establish a performance evaluation and relationship model for hot spring hotels
based on a hybrid mcdm model combining dematel and anp. Int. J. Hospital.
Manage. 30 (4), 908932.
Cheng, T., Gupta, M., 1989. Survey of scheduling research involving due date
determination decisions. Eur. J. Oper. Res. 38 (2), 156166.
Chung, S.-H., Lee, A.H., Pearn, W.-L., 2005. Analytic network process approach for
product mix planning in semiconductor fabricator. Int. J. Prod. Econ. 96 (1), 15
36.
Cooper, R.G., Kleinschmidt, E.J., 1987. New products: what separates winners from
losers? J. Prod. Innov. Manage 4 (3), 169184.
Ernest-Jones, T., 2005. Business continuity strategy the life line. Network Secur.
2005 (8), 59.
Geelen-Baass, B.N., Johnstone, J.M., 2008. Building resiliency: ensuring business
continuity is on the health care agenda. Austral. Health Rev. 32 (1), 161173.
Gibb, F., Buchanan, S., 2006. A framework for business continuity management. Int.
J. Inf. Manage. 26 (2), 128141.
Globerson, S., 1994. Impact of various work-breakdown structures on project
conceptualization. Int. J. Project Manage. 12 (3), 165171.
Hashemi Golpayegani, S.A., Emamizadeh, B., 2007. Designing work breakdown
structures using modular neural networks. Decis. Support Syst. 44 (1), 202222.
Hawkins, S.M., Yen, D.C., Chou, D.C., 2000. Disaster recovery planning: a strategy for
data security. Inform. Manage. Comput. Secur. 8 (5), 222230.
Hung, Y.-C., Huang, S.-M., Lin, Q.-P., 2005. Critical factors in adopting a knowledge
management system for the pharmaceutical industry. Indus. Manage. Data Syst.
105 (2), 164183.
ISO 22301, 2012. Societal security Business continuity management systems -
Requirements. Switzerland: International Organization for Standardization.
ISO 22313, 2012. Societal security. Business continuity management systems
requirements. Terms and denitions. Terms and denitions. Switzerland:
International Organization for Standardization.
Kepenach, R.J., 2007. Business continuity plan design. IEEE Int. Conf. Internet
Monitor. Protect., ICIMP 2007, 27.
Li, C.-W., Tzeng, G.-H., 2009. Identication of a threshold value for the dematel
method using the maximum mean de-entropy algorithm to nd critical services
provided by a semiconductor intellectual property mall. Exp. Syst. Appl. 36 (6),
98919898.
Mbugua, L.M., Harris, P., Holt, G.D., Olomolaiye, P.O., 1999. A framework for
determining critical success factors inuencing construction business
performance. In: Proceedings of the Association of Researchers in
Construction Management, 15th Annual ARCOM Conference, pp. 255264.
Niazi, M., Wilson, D., Zowghi, D., 2006. Critical success factors for software process
improvement implementation: an empirical study. Software Process: Improve
Pract. 11 (2), 193211.
Nosworthy, J.D., 2000. A practical risk analysis approach: managing BCM risk.
Comput. Secur. 19 (7), 596614.
Randeree, K., Mahal, A., Narwani, A., 2012. A business continuity management
maturity model for the UAE banking sector. Business Process Manage. J. 18 (3),
472492.
Ranjan, P., Kumar, P., Abhishek, K., 2012. Business continuity planning in Indian
perspective. J. Adv. Comput. Res.: Int. J. 1 (12).
Saaty, T.L., 1990. How to make a decision: the analytic hierarchy process. Eur. J.
Oper. Res. 48 (1), 926.
Saaty, T.L., 2001. The Analytic Network Process: Decision Making with Dependence
and Feedback. RWS Publication.
Sambasivan, M., Fei, N.Y., 2008. Evaluation of critical success factors of
implementation of ISO 14001 using analytic hierarchy process (AHP): a case
study from Malaysia. J. Clean. Prod. 16 (13), 14241433.
Sayal, M., 2006. Business Impact Analysis Using Time Correlations, DEECS, LNCS
4055, pp. 167 181.
Sikdar, P., 2011. Alternate approaches to business impact analysis. Inform. Secur. J,:
A Global Perspect. 20 (3), 128134.
The Federal Financial Institutions Examination Council (FFIEC), 2008. Business
Continuity Planning Booklet.
Tjoa, S., Jakoubi, S., Quirchmayr, G., 2008. Enhancing Business Impact Analysis and
Risk Assessment applying a Risk-Aware Business Process Modeling and
Simulation Methodology. In: The Third International Conference on
Availability, Reliability and Security.
Tzeng, G.-H., Chiang, C.-H., Li, C.-W., 2007. Evaluating intertwined effects in e-
learning programs: a novel hybrid mcdm model based on factor analysis and
dematel. Exp. Syst. Appl. 32 (4), 10281044.
Western Australian Government, 2009. Business continuity management:
Guidelines. Second ed.
Yang, Y.-P.O., Shieh, H.-M., Leu, J.-D., Tzeng, G.-H., 2008. A novel hybrid MCDM
model combined with DEMATEL and ANP with applications. Int. J. Operat. Res. 5
(3), 160168.
Zsidisin, G.A., Melnyk, S.A., Ragatz, G.L., 2005. An institutional theory perspective of
business continuity planning for purchasing and supply management. Int. J.
Prod. Res. 43 (16), 34013420.
Zobel, C.W., Khansa, L., 2014. Characterizing multi-event disaster resilience.
Comput. Oper. Res. 42, 8394.
S.A. Torabi et al. / Safety Science 68 (2014) 309323 323