Crisis And Risk Management In Organizations Management Essay

Chapter 3 is a literature review to help develop an understanding on the importance of business continuity as a process of counteracting organizational crises, which is at the forefront of this study. The Chapter is structured as follows: Section 3.2 discusses crisis management and risk management in organizations, to present a clearer picture of the terminologies. Next, the chapter provides the reader with background knowledge on business continuity management, its importance, and highlights some organizational approaches used in managing risk and crisis, including scenario planning. Finally, the chapter discusses planning as an effective BCM process, and strategic planning in a turbulent environment with the aim of clearly identifying the significance of business continuity in organizations.

In an attempt to define crisis management, it is imperative that the term ‘crisis’ is first explained. Coombs (1999: 2) define crisis as ‘an event that is unpredictable and a major threat that can have an adverse effect on an organization, industry, or its stakeholders if improperly handled’. Similarly, other authors such as Martinelli and Briggs (1998) conceptualize crisis as a turning point, and argue that it is an opportunity for organizations to show their commitment to responsible behaviour (p. 44).

Regester (1987: 38) also acknowledges that crisis often represents ‘turning points in organizational life as they present opportunities to establish a reputation for competence, to shape the organization and to tackle important issues’. It is an ‘unpredictable major event that is a threat to an organization or its stakeholders’ (Goel, 2009: 25). Other scholars such as Curtin et al., (2005: 3) identify crisis to be of three kinds; those which befalls a company e.g. chemical spillage or plane crash, those that are manufactured, and those that escalate from an accident.

3.2.2 Defining Crisis Management

Crises Management is all about taking charge of a crisis situation before it engulfs the company. As suitable planning is fundamental to corporate survival in the event of a crisis, crisis management involves proper handling of a crisis after it occurs. The theory of crisis management has witnessed a steady evolution in the last twenty years. Early phases of this evolution includes a six step crises model by Littlejohn (1983: 13) (structure design, selection of crisis team, training team members, crisis situation auditing, contingency planning, managing the crisis); Fink’s (1986) seminal four stage model (the prodromal stage, the crisis breakout or acute stage, the chronic stage and resolution stage); Gonzalez-Herrero and Pratt (1995) four phase model for crisis management (planning-prevention, issues management, the actual crisis and the aftermath of the crisis); Augustine (1995) six stage of crisis management (identifying the crisis, avoiding the crises, containing the crisis, preparing to manage the crises, resolving the crisis and benefitting from the crisis). Augustine points out that for every crisis, there are seeds of success and roots of failure embedded within it and the ability to find, cultivate and manage the possible success is the basis of crisis management.

In theory, the debate between scholars of crisis management is mainly about how crisis is defined. Comfort (1988) divides the process of crisis management into preparedness, mitigation, response, and recovery phases. Another interesting crisis management model was formulated by Boin et al., (2005). The authors based their model on four important challenges managers face during the process of crisis management – sense-making, decision making, terminating and learning. In spite of these, many scholars of crisis and disaster management still seem to focus more on the triggers, causes or effects rather than how these incidents are actually managed by stakeholders, decision makers and the organizations (Mitroff and Pauchant, 1990).

3.3 Crisis and Risk Management in Organizations

Organizational crisis have been defined by various scholars even though there is not one universally accepted definition (Simola, 2005). Pearson and Clair (1998) define organizational crisis as a high impact low probability incident that threatens organizational viability. Crises can potentially cause damage to an organization, and if not properly managed, can become disasters. Mistakes can very quickly rise from just a little operational issue to a stage that threatens survival (Mittelstaedt, 2004). Therefore, organizations that properly prepare and plan for the future are more likely to succeed (Regester and Larkin, 2005).

Fink et al., (2005) points out that to survive in a rapidly changing world, many organizations must recognize and forecast their surrounding environment to enable them develop awareness to the risks that may affect their businesses and strategic directions. There’s little chance for organizations to respond and recover when unforeseen events happen. Therefore, in the likely event of a crisis or disaster, an organization’s level of preparedness and capability of resuming its regular business operations are thought to be amongst the major goals of senior management (Hanson, 2006).

In crisis management, organizations play a crucial role (Clarke, 1999). Carley and Harrald (1997:310) note that organizations should react to disasters by reducing the impact of the disaster but in practice, organizations are often the ones that cause crises (Roux-Dufort, 2007). Organizational blueprints fail to balance the possible damaging effects of organizational production (Perrow, 2007) as scholars of organizational management are ‘more often into organizational structure, design and culture, rather than managing and learning from unusual events’ (Pauchant and Mitroff, 1992).

Egbuji (1999) introduce risk management as a corporate approach to deal with the security threats facing an organization in an attempt to protect its resources and its assets. There are some advantages of risk management. According to Peart (2006), risk management facilitates future anticipation and improves uncertainty control as it entails carefully analyzing possible future organizational risks, and developing actions to counteract the risks. The Association of Insurance and Risk Managers (2002) lay emphasis on a calculated approach to risk management and state that risk management should be thought of as a value-adding process linked to strategy since it has the possibility to improve decision making and protect assets.

3.3.1 Scenario Planning

In an era of rapid change, scenario planning is the practice of planning for different future alternatives, with the aim of mitigating or reducing the risk of getting bombarded by unforeseen incidents or being unprepared for it (Bishop et al., 2007). Kachaner and Deimler (2008) argue that organizations that implement scenario planning will most likely deal with future uncertainty and risk more efficiently than those that do not make use of it. As Pollard and Hotho (2006) describe, the idea of scenario planning is to make long range flexible plans by figuring out the impact and nature of the most questionable driving forces that affect the world and shapes business environments i.e. economic, political, environmental and technological trends.

According to Barber (2006) scenario planning is used by some leading organizations such as Shell and General Electric to analyse the various trends and forces that may impact the organization. Scenario planning helps create a linkage between the past and the future by addressing scenarios through strategic planning. Barber (2006) note that Shell’s scenario planning teams use scenario planning to identify ‘weak signals’ or ‘signs’ that will likely have an impact on their business. Methods of scenario planning include imagination, multiple perspectives and strategic thinking and in today’s environment, its use in the planning process is an important strategy to deal with numerous uncertainties (Neilson and Stouffer, 2005: 26).

Scenario planning can be developed for any future period. In the 1970s, Shell Group initiated the scenario planning and the corporation builds scenarios every three years for up to a twenty year period; others may project fifteen, ten or a five year period (Scott-Martinet, 2006). In hypothetical situations, scenario planning is useful for planners to see how an event may impact the organization. Planning out a scenario can also show the multiple ways in which various components fit together. Planning for the future in any organization is important, as without planning, resources may not be available when needed (Scott-Martinet, 2006).

Hodgson & Tait (1996: 3) argue that planning has traditionally followed a comparatively linear approach (i.e. projecting future needs based on current activities). For organizations that have a commitment to this ‘default scenario,’ the future is drastically altered when they experience crises, as it becomes difficult to adapt or change. With scenario planning therefore, organizations can recognize future threats and deal with them before crises happen. Scenario planning can also be utilized in other disaster situations and can most likely help with mitigation, preparedness and prevention efforts if appropriate strategies are embraced. After scenario analysis and development, the organization can then implement strategies to steer towards a survivable future (Hodgson & Tait, 1996)

Scenario planning can also be used in emergency management to assist corporations in viewing and understanding itself in a new dimension, and to effectively plan more for the future (Alexander, 2002: 2). Previous crises and best speculations about the future have generally provided evidence for contingency planners to take decisions about the future (Wilkinson, 1994: 5). Nonetheless, by implementing the method of scenario ‘futuring’, planners can discuss or document various likely organizational futures, and by exploring these possible futures, scenario planners may acquire knowledge about fundamental issues, forces and trends (Wilkinson, 1994).

3.4 Business Continuity Management (BCM)

Due to its widespread nature, the manner in which business continuity management is implemented will inevitably depend on the nature, complexity and scale of an organization’s risk profile and the environment in which it operates. It is also safe to presume that as organizations are never in full control of their business surroundings, all organizations will experience a business crisis and continuity event at some point (Shaw, 2004). It is therefore important to explore the various functions and functional areas that support the management of crisis events and continuity of business operations, their inter-dependencies, and the factors that will help co-ordinate these functions and functional areas into a comprehensive and integrated programme.

Business Continuity Management (BCM) has been described in many ways. However, there is not a generally accepted definition (Smit, 2005). BCM is defined by the Business Continuity Institute as the act of predicting events that will affect the organization’s mission-critical processes and functions, and ensure that it reacts to any event in a rehearsed and planned way (Gallagher, 2003). The goals of BCM also include making sure there is continuity of critical functions and business operations in all circumstances, foreseeing organizational risks, crises and disasters before they occur, and ensuring fast and efficient response to crises

Figure 3: Framework for Business Continuity Management

Source: The British Standard for Business Continuity Management, 2006

According to Herbane et al., (2004) and Gibb and Buchanan (2006), BCM involves identifying with an organization’s needs, recognizing and managing risks that may interrupt the critical functions of a business, and ensuring effective recovery and business continuity in the event of unanticipated occurrences. BCM assists an organization in mapping out future worst case scenarios and how promptly the organization can restore its normal operations in the aftermath of a crisis. (Hayes, 2004) is of the opinion that BCM should be a major responsibility of top management as BCM aims to ensure lasting survival of the entire organization.

Several authors including Gallagher (2003), Herbane et al., (2004), Pitt and Goyal (2004), and Elliott et al., (2010), have debated on the evolution of BCM. In the 1970s, the primary focus of business continuity was on information technology (IT) and recovering computing systems, also disruptions caused by disasters such as fires, earthquakes and flooding. In the 1980s, business continuity still included IT but shifted to include other systems and facilities at both business and corporate unit levels. During the 1970s and 1980s, IT focus still played a huge part in business continuity and explains why a big fraction of existing literature on BCM relates to IT continuity (Elliott et al., 2010). However, business continuity was introduced as ‘Business Continuity Management’ in the late 1990s and early 2000s, and became a process of corporate competitive advantage to contribute to the sustainability and development of diverse business areas (Gill, 2006).

Figure 4: Typology of Continuity Approaches

Source: Herbane et al., (2004)

Figure 4 above shows that BCM is embedded within crisis management (Herbane et al., 2004). It also shows that disaster recovery planning and business continuity planning are two components of BCM; these two components are to assist an organization in effectively dealing with crises and disasters before, during and after they occur (Herbane et al., 2004). Herbane et al., (2004) also point out that BCM must influence the whole organization and so, in order to succeed, there is need for participation and cross-functional involvement from various departments in the organization.

3.4.1 Importance of Business Continuity Management

As previously mentioned, the 21st century has witnessed dramatic transformations in the global business environment. Kubitscheck (2001), Dawes (2004) and Richardson (2009) note that as new risks have emerged, organizational risk theory have also advanced at the start of the new millennium, but these newly emerging risks surpass the pace at which solutions are being devised to counteract them (Kubitscheck, 2001). Therefore, with new terrorist attacks, hi-tech and changing weather patterns, and corporate financial scandals, organizations need a well-resourced, coherent response, integrated and predetermined, but also manageable and flexible (Herbane et al., 2004).

Organizations are faced with difficulties in risky and uncertain times and this can only be excellently managed by preparation and proactive planning (Gage and Reinoso, 2002). An innovative approach is necessary to help organizations in mitigating or reducing the impacts of crises and disasters, by appropriately preparing for, responding to and recovering from unexpected events to ensure business continuity and also to manage security programs proactively (Hinde, 2002).

The interest in BCM increased significantly in the early 2000s (Borodzicz, 2005; Smit, 2005) Wong (2009) argues that the growing interest is as a result of natural and man-made disasters such as the September 11 terrorist attacks in the US, which emphasized the importance of BCM in sustaining critical functions of businesses. BCM encompasses corrective and preventive systems to risk management through recovery planning and continuity, and through the constant testing, training, maintenance and updating of continuity plans. In a global business environment full of insecurities, the long-term survival of businesses very much depends on guaranteed continuity of business operations. BCM is significant to be able to achieve this (Morwood, 1998). Pitt (2010) also argues that when organizations have BCM, they are most likely to suffer less from the immediate impact of crises, and can pull through more quickly.

According to Brazeau (2008), the BCM profile has noticeably increased in both private and public business organizations as a study conducted by FM Global showed that out of 600 financial executives, about 95% identified BCM to be of moderate to high priority in relation to other managerial functions within their organizations. BCM is gaining increasing acceptance amongst many businesses as organizations now understand BCM’s present operational value and are beginning to focus more on its enterprise-wide advantage and strategic significance (Marsh, 2008).

3.4.2 Planning as an Effective BCM Process

Since the start of research on strategic planning, there has been a general consensus that strategic planning is a ‘process’ that decides when, how, who will plan and how results will be enforced (Gibb and Buchanan (2006). Elliott et al., (2010) however mentions that there is a disagreement between authors regarding the exact structure and components of the process.

Figure 4: Structure and Process of Strategic Planning

Source: Elliott et al., (2010)

Elliott et al., (2010) structure and process of strategic planning (Figure 4) illustrates planning as a systematic process. Most significantly, it identifies the three main areas of the process: hypothesis, formulation of plans, implementation of plans, and evaluation. The structure of strategic planning introduces a conceptual model for small, medium and large organization for outstanding strategic planning. The authors state that the three major types of plans; short-range budgets, medium-range programmes and master strategies are all linked and so, organizations must know exactly what their strategic plan should entail (Elliott et al., (2010). Although planning is not an everyday phenomenon, it must be a continuous process and plans need to be amended and/or reviewed regularly so organizations can respond to changes in the environment (Elliott et al., (2010). The process of strategic planning should therefore start with establishing organizational objectives, mapping out strategies for implementation and then refining the strategies with thorough action plans.

3.5 Strategic Planning in a Turbulent Environment

In most of the early writings on the planning process, a common characteristic is the role the external environment plays on the organization. Economic forecasts were initially used for future planning but with fierce competition amongst firms, and the growing complexities of globalization, the role of the environment becomes an essential feature in strategic planning (Brews and Hunt, 1999).

In 1988, Arie De Geus, head of Shell Oil Company’s Strategic Planning Group published a study of the planning processes of Shell. At the time, Shell was known to be one of the most successful oil corporations (and arguably still is today). De Geus mention that the key to the corporations’ success was its ability to switch from a much slower pace in stagnant times, to a survival-mode in turbulent times. He concludes that ‘planning simply means changing minds’ (De Gues, 1988).

Grant (2003) point out that strategic planning in the oil sector is characterized by an unstable business environment. The author’s study explores how and if strategic planning methods can be put to effective use in an uncertain environment. Grant’s analysis of six major oil companies (BP, Chevron, Exxon, Mobil, Shell and Texaco) affirms that over the last decade and a half, these major oil companies recognized key amendments in their strategic planning practices. (Grant, 2003: 502) asserts that while the basic framework (cycle and key phases) of strategic planning changed very little, planning roles, the content of strategic plans, and the process of strategic planning within the companies’ management systems changed significantly. In spite of little variations in interpretation, Grant (2003) note that similarities in each of the oil companies’ planning processes were sufficient to create a generic strategic planning cycle as seen in Figure 5.

Figure 5: The Generic Planning Cycle among the Oil Majors

Source: Grant (2003)

Planning provides a ‘mechanism for the formulation of decentralised strategy’ and has now become a process of ‘planned emergence’ (Grant, 2003: 491). In recent years, the processes of strategic planning have become more informal and decentralised, while planning strategies have changed considerably in line with the fast changing environments organizations operate in. Today’s business environment is becoming more volatile due to political instability, natural disasters and economic-slowdown and requires leaders and organizations to be more proactively prepared and resilient to face the unexpected (Grant, 2003).

Ramirez et al., (2008) discuss that with the diversified nature of many big firms and the growing rate of environmental changes, predictability and stability can no longer guarantee the success of businesses, but the ability to implement decisions under uncertain circumstances and the flexibility of adjusting to varying competitive conditions becomes critical factors of success (p. 264). The authors propose that in a crisis turbulent environment, management executives can increase strategic and organizational capabilities by establishing strategic visions, creating strategic unity and successive adaptation, encouraging transformational leadership, modifying organizational practices, and increasing organizational capacity for change.

3.6 Chapter Summary

Chapter 3 is a review of relevant literature to provide the reader with an overview of crisis management and business continuity management in organizations. In the literature, various approaches to organizational crisis management exist that have been discussed i.e. risk management, scenario planning, and business continuity management. The literature presents a background to the fundamentals of strategic planning and scenario ‘futuring’, and discusses business continuity, a management process that is becoming more and more recognized by many organizations, as a new approach to crisis management.

Business continuity management provides corrective and preventive measures to organizations to improve their response and recovery capabilities against disasters and unexpected crises. Using existing literature and a number of empirical studies, the author provides evidence to support the discussion on BCM as an organizational strategy that challenges senior managers and top level management to foster the art of strategic planning, in anticipation of some of the unexpected eventualities of an increasingly chaotic and turbulent business environment.