Critical Success Factors Of Effective Business Continuity Management: A Malaysian Case Study

Business Continuity Management

BCM is “a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.”(ISO, 2012).

Woodman and Hutchings (2010) suggest that all organizations must incorporate BCM in their business plan regardless of its size. Similarly, Gallagher (2002) asserts that business resiliency should not only be a subject of concern to large corporations, but also to the medium and small size enterprises as both entities are constantly pressured by their key stakeholders i.e. shareholders and the consumers to deliver uninterruptable services. In addition, Gallagher (2002) also highlights that there are many glitches that can be caused by human errors or process failures in the small and medium size organizations. Hence, the implication of not establishing a comprehensive BCM practice in place may be threatening. Besides, the elements of BCM could be applied to any categories of organizations, in the private and public sectors. It is widely embraced in various industries such as financial institution, manufacturing, transportation, services, local authorities, telecommunication, healthcare, education and government agencies.

Previous researchers have identified several critical success factors which contribute to effective BCM implementation in different setting. However, some of these factors are overlaps in term of definition and usage of different terminology to represent the same factor. This issue arises as there is no standard terminology adopted by the researchers. Hence, this study will focus on four factors that are more dominant based on the previous studies. The following sections discuss in more details of each factors.

Management Support (MS)

The senior management commitment in ensuring business functions and services operating at an acceptable condition under crisis situation and managing an organization's risk exposure to service disruptions are crucial elements of the overall corporate strategy (Laurent, 2007). Several researchers posited that it is essential that business continuity program to be initiated, sponsored and authorized by senior management from the preliminary phase of its implementation (Arend, 1994; Chow, 2000; Yen, Chou, & Hawkins, 2000). In the context of BCM, it is a long term commitment that necessitates a substantial financial investment by an organization (Cerullo & McDuffie, 1994; Chow, 2000). Hence, only strong engagement by the senior management can warrant the on-going provision of monetary support and other critical resources for developing and maintaining a BCM program. Recognizing the potential paybacks of BCM on the operational performance is crucial to give proper merits to BCM initiatives and gaining top management support (Abu Bakar, Yaacob, & Udin, 2015).

External Requirement (ER)

In today’s competitive environments, BCM is no longer an optional task in large organizations in public and private sectors. The value preservation within an organization is increasingly becoming a matter of concern of external interested parties such as the legislators and regulators, who consequently oblige organizations under their purview to comply with business continuity provisions. The regulatory requirements enforced by the government authorities and sometime even by the customers will motivate the management to further enhance the service continuity of their Information Technology and systems (Herbane et al., 2004).

Organization Preparedness (OP)

Organization Preparedness refers to familiarity with various recovery approaches and avoidance of risks, such as maintaining a business continuity plans, establishing crisis management teams, and developing key personnel redundancy (Hägerfors, Samuelsson, & Lindström, 2010; Ruighaver, Ahmad, & Hadgkiss, 2012). The business continuity plans should be regularly updated, tested and improvised, even after the occurrence of major incidents (Gibb & Buchanan, 2006). Herbane et al. (2004) added that the swiftness of recovery is the surface exposure of a more profound capability in the form of Organizational Preparedness, which includes readiness of alternative sites, well-executed recovery plans and redundancy of critical resources.

Embeddedness of Continuity Practices (ECP)

Embedding BCM in the culture of an organization might be time consuming (Michael Gallagher, 2003). The effort necessitates corporate changes, enterprise-wide participation, and the involvement of all employees, as well as a variety of business units to work in teams that are capable of acting effectively during a crisis situation. Furthermore, it entails continuous training and awareness program, as well as updating and maintaining the business continuity plans and procedures (Elliott et al., 2010). Past empirical studies reveal that there was a substantial degree of cross-functional effort in BCM and show different roles of almost all organization members to support BCM which include business units, including IT, operation, quality assurance, and facilities management (Pitt & Goyal, 2004; Woodman, 2007, 2008).

Organizational Performance

For the purpose of measuring the effectiveness of the BCM, the study uses the overall organizational performance (OOP) as the indicators. BCM is a holistic risk management process that the extent to which these BCM implementations are effective is considered as part of the overall assessment of organisational performance (Fischbacher-Smith, 2017). Instead of relying on a single dimensional measure of performance, this study considers a multidimensional approach that includes both financial performance (FP) and non-financial performance (NFP) measures is more appropriate, especially when measuring practices and performance (Ketokivi & Schroeder, 2004). The performance indicators include revenue, market share, cost reduction, operational stability, competitive advantage, reputation, customer satisfaction, employee morale and productivity.

Theoretically, the research framework is supported by the Resource Base View (RBV) theory, which postulates that organizations’ competitiveness and performance are influenced by the organizational resources such as intangible resources and competency (Barney, 1991; Grant, 1991). The study is also supported by the Stakeholder Theory which recognizes the stakeholders, in this context, the external requirements by the regulatory bodies and customers that may influence the achievement of superior performance.

Respondents

The target population of study is 147 organizations that have obtained the ISO 27001 and ISO 22301 certifications from SIRIM. The organizations are selected to participate in this study as they are deemed to possess considerably high sense of commitment towards embracing BCM’s best practices to enhance their business resilience. The unit of analysis for this study is organization, whereas the managers or executive positions that involve directly in the implementation and operational of BCM within the organizations were chosen as the respondent of the survey.

Data Collection

For the purpose of data collection, a set of questionnaires is used. It is adapted from previous studies and all responses pertaining to dependent and independent variables are measured using 7-points Likert scales. The content and face validity assessments were carried out, in which selected academicians and industry professionals involved by reviewing the questionnaires to obtain their expert opinions on the relevancy of the questions to support the research objectives.

This study had employed multiple methods of data collection including conventional and electronic mails. At the end of data collection period, 77 usable responses have been obtained which represent 55 percent of effective response rate.

In summary, the study managed to gather almost equal balance of respondents from both public and private sectors. In total, there are 38 (49.4%) organizations representing the public sector while 39 (50.6%) organizations representing the private sector. Within the private sector, the highest percentage of the respondents are from the technology industry (13.0%) followed by telecommunication (9.10%), utilities (7.8%), and financial services (7.8%).

Validity Analysis

Factor analysis was conducted to test the construct validity of the measurement instruments. Construct validity for each factor was conducted using principal component analysis (PCA) approach. In summary, the factor solutions indicate that all items recorded loading of greater than 0.60, ranging from 0.675 and 0.956 using the Varimax rotation method. These factor loadings indicate good correlation between the items and the factor grouping they belong to. On the other hand, this study also removed several items due to low communalities value and loading less than 0.60. Those items have indicated failure to fit well with other items in their components. By removing the items, the total variance explained has increased significantly.

Reliability Analysis

A reliability analysis has been conducted on the scale to ascertain the applicability of the instrument. In regards to that, Nunally (1978) recommends 0.70 as the minimum acceptable Cronbach’s Alpha value. Based on the recommendation, this study has reliable constructs because the Cronbach’s Alpha values generated by reliability analysis as seen in Table 01 between 0.851 and 0.944. Hence, no item was deleted during reliability analysis.

Correlation Analysis

In order to determine the association between the critical success factors and firm performance, correlation analysis was performed where the correlation coefficient explains the relationship between the independent, and dependent variables.

The correlation procedure comprise of two-tailed statistical analysis that significant at p<0.01 and p<0.05 level. All of the BCM critical success factors’ dimensions indicate significant positive relationship with dimensions of organizational performance. Particularly, the strength of the correlations between Management Support and Organizational Performance is medium to strong (0.405 ≤ r ≤ 0.523), strong (0.678 ≤ r ≤ 0.742) between External Requirement and Organizational Performance, medium (0.442 ≤ r ≤ 0.472) between organizational preparedness and Organizational Performance, and medium to strong range (0.482 ≤ r ≤ 0.638) between Embeddedness of Continuity Practices and Organizational Performance. In general, the outcomes signify that all of the associations between the critical success factors and dimensions of organizational performance are significant at p<0.01. In comparison of the strength of the relationships, the strongest positive correlation lies in the linkage between the External Requirement and Overall Organizational Performance (r=0.742, p<0.01), where higher level of External Requirement is correlated with a high level of Overall Organizational Performance. The subsequent strongest positive association is between External Requirement and Financial Performance (r=0.720, p<0.01), followed by External Requirement and Non-Financial Performance (r=0.678, p<0.01). The result signifies that a higher level of External Requirement on BCM implementation is correlated with a higher achievement of Organizational Performance.

Multiple Regression Analysis (MRA)

Next, the MRA was performed to investigate the linkage between the identified critical success factors and the effectiveness of BCM implementation which is reflected by the overall organizational performance. The result is depicted in Table 03 below.

The results in Table 03 exhibits that the predictors is significant with R = 0.802, R2 = 0.643, R2 adj = 0.623, F (4, 72) = 32.386, P<0.001. The figures indicated that the multiple correlation coefficients between the predictors and outcome variables is 0.802; the critical success factors accounts for 64.3% of the variance in the overall organizational performance and its generalizability in other populations is 0.623. In detail, the R2 value drops to only 0.020 or 2.0% in the adjusted R2 that signifies the acceptable cross validity of this model. The F-test F (4, 72) = 32.386 at P<0.001 signifies significant association between the predictors and the outcome variables.

Among the 4 predictors, External Requirement (β=0.559, t=6.200, p=0.000) recorded highest standardized beta coefficient, which reflects that External Requirement is the most important variable in predicting Overall Organizational Performance. In descending order, the importance follows with Embeddedness of Continuity Practices (β=0.317, t=3.544, p=0.001). In contrast, Management Support (β=0.052, t=0.585, p=0.561) and Organization Preparedness (β=0.014, t=0.162, p=0.872) are not significantly related to Overall Organizational Performance. This implies that a better Overall Organizational Performance can be achieved when the organization has strong External Requirement and Embeddedness of Continuity Practices in place.

Discussion

In this study, the effectiveness of BCM is measured through Overall Organizational Performance which represented by combination of Financial and Non-Financial Performances. Based on the descriptive statistics, this study discovered that the respondents perceive that their organizations have achieved a fairly good level of performance contributed by BCM implementation over the last three years (mean=5.52).

Nonetheless, the multiple regression analysis shows that only two BCM Factors namely External Requirement and Embeddedness of Continuity Practices have significant relationships with Overall Organizational Performance. Meanwhile, the other two BCM Factors namely Management Support and Organizational Preparedness are not significantly related to Overall Organizational Performance.

Firstly, in the Malaysian context, the External Requirements imposed by government authorities such as Bank Negara Malaysia for financial services industry and MAMPU for the government sector have motivated the organization’s top executives in enhancing the resiliency of their information systems and services. Based on the mean score of the descriptive statistics, the respondents perceive that their organizations have a fairly good level of External Requirement (mean=5.44). The result indicates that the External Requirement is related to Overall Organizational Performance. Such results provides is consistent with the past studies on BCM (Bakar, Yaacob, Udin, Hanaysha, & Loon, 2017; Choudhuri, Maguire, & Ojiako, 2009; Herbane et al., 2004; Hoong & Marthandan, 2013; Järveläinen, 2013; Peterson, 2009; Woodman, 2008). Besides the corporate governance, the pressure from the customers who demand for uninterrupted services had also pushed the importance of BCM to a higher level. These findings are also supported by the Stakeholder Theory which recognizes the stakeholders, in this context, the external requirements by the regulatory bodies and customers that may influence the achievement of superior performance.

Secondly, as expected, the result shows that a higher level of Embeddedness of Continuity Practices would reflect higher achievement of Overall Organizational Performance. In addition, based on the mean score of the descriptive statistics, the respondents perceive that their organizations have a fairly good level of Embeddedness of Continuity Practices (mean=5.00). The findings are consistent with outcome of the study conducted by Järveläinen (2013a) on the significant relationship between Embeddedness of Continuity Practices and business performance

Thirdly, based on previous researches on the critical success factors of BCM posits that Management Support has a significant relationship with Overall Organizational Performance (Chow, 2000; Chow & Ha, 2009; Hoong & Marthandan, 2013; Järveläinen, 2013). The mean score of the descriptive statistics indicates that the respondents perceive that their organizations have a fairly good level of Management Support (mean=5.58). However, this study discovers insignificant relationships between Management Support and Overall Organizational Performance. This finding contradicts with previous studies on the success factors of BCM. With such finding, this study evidences that Management Support does not directly influence Overall Organizational Performance of organizations. One plausible explanation is the fact that 22.1 percent of the respondents indicated that the highest responsibility of BCM program is held by the Head of IT instead of the senior management. The result is also in-line with previous researches that highlighted the lack of commitment by the top management may result in lack of corporate wide support which impedes the effectiveness of a BCM and eventually causing program failures (Payne, 1999; Pitt & Goyal, 2004). Therefore, the senior management should involve themselves in the whole process of crisis management so that their staff would have confidence in their ability to lead them successfully through such critical times (Moore & Lakha, 2006). Another possible reason might be due to weak inter-correlation values between variables. Sekaran (2003) postulates that this situation could cause insignificant result in the multiple regression analysis.

Lastly, the finding indicates insignificant relationship between Organization Preparedness and Overall Organizational Performance, which contradicts the expectation. In other words, any improvement in Organization Preparedness factors, such as business impact analysis, readiness of alternate sites and system, documentation, simulation exercises, communication procedures, and imposing BCM requirement on suppliers do not contribute significant effect on Overall Organizational Performance. Järveläinen (2013a) revealed that Organization Preparedness and alertness failed to yield significant effect on business performance. The study discovered that BCM procedures were not regularly tested in all organizations, which could reduce of the effectiveness of the plans (Gibb & Buchanan, 2006). The finding is in agreement with this study which found insignificant relationship between Organization Preparedness and Overall Organizational Performance. Similarly, upon close examination of the questionnaires’ responses, this study also discovers about 26 percent of the respondents do not fully agree on regular testing of BCM plan may indicate lack of exercise conducted on the BCM plan. Moreover, BCM shall become out-dated if is not updated or regularly tested. Similar with Management Support factor, the insignificant relationship between Organization Preparedness and Overall Organizational Performance in the multiple regression analysis might also be due to weak inter-correlation values between variables (Sekaran, 2003).

Theoretical and Practical Implications

Fundamentally, this study has established new insights for academics and practitioners that contribute to the existing body of knowledge. In response to the theoretical gaps in the current literatures, this study has established empirical evidences on the relationships between the critical success factors and effectiveness of BCM implementation, particularly in the Malaysian context.

The outcomes of this study have also revealed that factors namely External Requirement and Embeddedness of Continuity Practices contribute towards enhancing the effectiveness of BCM that eventually leads to superior organizational performance. Hence, it is essential that every organization, regardless of size and nature of business, to proactively enhance their capability in managing BCM so as to improve their readiness in dealing with disruptions more effectively.

Limitations and Recommendations

Although this study finds several encouraging results, it is acknowledged that the study also have several limitations, which opens-up for future enhancement. The recommendation relates to the methodological approach. As the study is conducted using cross-sectional approach, more efforts need to be carried out to ascertain the impacts of changes over a longer time period. Using a longitudinal approach on the similar group of participants may be better at drawing the BCM effects on organizational performance and perhaps could provide a better analysis on the interrelationships among the organizations under study. In other words, the primary benefit of longitudinal approach is that it allows researchers to observe changes that take place over time. Hair et al. (2007) argues that longitudinal study is a better way to seek the cause and effect relationship among variables at a different period of time. Thus, future researchers are suggested to conduct longitudinal studies to investigate the implementation of BCM and how it influences organizational performance.

Conclusion

The outcomes of this study have considerably contributes to the current literature on BCM and organizational performance particularly Malaysia. Drawing from Research Base View, Crisis Management and Stakeholder theories, the research model has provided a theoretical framework for recognizing the critical success factors that affect the establishment of effective BCM in an organization that eventually lead to superior performance. This study reveals that important BCM critical success factors such as the influence of External Requirement and Embeddedness of Continuity Practices have significant positive causal relationships with Overall Organizational Performance.

With considerations on the impact of the globalization and intense in the business competition nowadays, the outcomes of this study serve a strong basis for managers to invest in enhancing the BCM skills and infrastructure as the benefits are evident. This study believes that by understanding the critical success factors of effective BCM, it may contribute to the betterment of the organizational performance.