A novel approach to selection of resilient measures portfolio under disruption and uncertainty: a case study of e-payment service providers

Abstract

The increasing development of trade activities and the high frequency of destructive events in the business environment have exposed organizations to various disruptions and operational risks that adversely affect their financial and operational performance. Organizations must, therefore, adopt enterprise risk management approaches to manage risks and prevent/mitigate potential losses. This study proposes a novel quantitative risk management framework based on organizational resilience and business continuity planning for service-based organizations. The proposed framework includes a multi-objective model to cope with disruptions by employing optimal preventive and mitigation action plans. The inherent uncertainty of parameters is tackled using a modified version of the light robust approach. This study aims to adopt an optimal portfolio of resilience strategies and business continuity plans to minimize the average loss in the organization’s operational performance and the total post-disruption recovery time and maximize the total recovery capability of the resilience strategies and continuity plans and the number of time intervals with desirable performance based on business continuity management indicators. An e-payment service provider is also examined as a case study to ensure the reliability and applicability of the proposed model. Based on the results, adopting proper resilience strategies and business continuity plans can improve an organization's capability in managing destructive events and help the organization achieve a viable competitive advantage in the turbulent business environment.

Appendix 1

The sets, parameters, and decision variables related to the proposed model for the problem of this research are described in this section.

Sets

D	Set of disruptive incidents (incl. disruption risks and critical operational risks)	dϵD
P	Set of core (critical) organizational processes	pϵP
L	Set of operational levels in the organization	lϵL
R	Set of existing resources	rϵR
N	Set of dynamic (contingent) resilience strategies	nϵN
M	Set of static (preventive) resilience strategies	mϵM
H	Set of BCPs corresponding to each resilience strategy	hϵH
F	Set of fortification levels of organization against crises	fϵF
I	Types of effects risk have on organizational performance	iϵI
T	Set of time periods	tϵT
S	Set of probabilistic scenarios	sϵS

Parameters

$\pi_{s}$	Occurrence probability of scenario s
$\pi_{ds}$	Occurrence probability of critical disruptive incident d under scenario s
$\beta_{p}$	MTPD value of core process p
$\alpha_{pt}$	MBCO value of core process p at period t
$AR_{rt}^{Ex}$	Nominal value of available external resource r at period t
$AR_{rt}^{In}$	Nominal value of available internal resource r at period t
$NR_{rp}^{ls}$	Amount of resource r required to implement core process p at level l under scenario s
$\gamma_{dr}^{ts}$	Impact of critical disruption d on internal resource r at period t under scenario s (%)
$\gamma_{drf}^{{{\prime }ts}}$	Impact of critical disruption d on internal resource r at fortification level f at period t under scenario s (%)
$\chi_{dr}^{ts}$	Impact of critical disruption d on external resource type r at period t under scenario s (%)
$\chi_{drf}^{\prime ts}$	Impact of critical disruption d on external resource r at fortification level f at period t under scenario s (%)
$\kappa_{r}^{st}$	Average recovery rate of disrupted external resource r at period t under scenario s
$\theta_{r}^{st}$	Average recovery rate of disrupted internal resource r at period t under scenario s
$CE_{st}^{r}$	Average cost of using external resource r under disruption at period t under scenario s
$FC_{rft}^{ER}$	Average fortification cost of acquiring external resource r at level f at period t
$FC_{rft}^{org}$	Average fortification cost of organizational processes at level f at period t
$CID_{nt}$	Cost spent to provide appropriate infrastructure for implementing dynamic resilience strategy n at period t
$CIS_{mt}$	Cost spent to provide appropriate infrastructure for implementing static resilience strategy m at period t
$RC_{rts}^{Ex}$	Recovery cost of a disrupted external resource r at period t under scenario s
$RC_{rts}^{In}$	Recovery cost of a disrupted internal resource r at period t under scenario s
$AQS_{md}^{s}$	Expected average quality of recovery from disruption when adopting static resilience strategy m during critical disruption d under scenario s
$AQD_{nd}^{s}$	Expected average quality of organization's recovery from disruption when adopting dynamic resilience strategy n during critical disruption d under scenario s
$ERQ_{d}^{s}$	Expected minimum quality of organization's recovery from critical disruption d under scenario s
$\phi_{p}^{s}$	Relative importance of core process p under scenario s
$POP_{p}^{ts}$	Operational level planned for core process p at period t under scenario s
$OP_{l}$	Operational performance of organization at operational level l (%)
$BU_{t}^{s}$	Available budget at period t under scenario s
$\omega_{hm}$	A binary parameter that equals one if implementation of business plan h leads to implementation of static resilience strategy m; otherwise, it equals zero
$\xi_{hn}$	A binary parameter that equals one if implementation of business plan h leads to implementation of dynamic resilience strategy n; otherwise, it equals zero
$NR_{rhm}^{ts}$	Amount of resource r required to implement BCP h related to static resilience strategy m at period t under scenario s
$NR_{rhn}^{ts}$	Amount of resource r required to implement BCP h in dynamic resilience strategy n at period t under scenario s
$RAS_{hn}^{is}$	A binary parameter that equals 1 if BCP h in static resilience strategy m has impact i associated with disruptions under scenario s; otherwise 0
$RAD_{hn}^{is}$	A binary parameter that equals 1 if BCP h in dynamic resilience strategy n has impact i associated with disruptions under scenario s; otherwise 0
$RES_{m}^{s}$	Organization's ability to recover from impact of disruption using static strategy m under scenario s
$RED_{n}^{s}$	Organization's ability to recover from impact of disruption using dynamic strategy n under scenario s
$\mu_{di}^{s}$	Probability of disruption d having impact i on organization under scenario s
$\upsilon_{ip}^{s}$	Probability of disruption d having impact i on core process p under scenario s
$\delta_{i}^{s}$	Probability of impact i under scenario s during a disruptive incident
$\Gamma_{i}^{s}$	Importance of impact i based on its potential effect on organizational performance under scenario s
$\omega_{n}$	Importance weight of dynamic resilience strategy n
$\omega_{m}$	Importance weight of static resilience strategy m

Decision variables

$\pi_{s}$	A binary variable related to dynamic resilience strategy n at period t under scenario s
$\pi_{ds}$	A binary variable related to static resilience strategy m at period t under scenario s
$\beta_{p}$	A binary variable related to selecting BCP h in dynamic strategy n at period t under scenario s
$\alpha_{pt}$	A binary variable of selecting BCP h in static strategy n at period t under scenario s
$AR_{rt}^{Ex}$	A binary variable related to fortification of organization at level f at period t
$AR_{rt}^{In}$	A binary variable related to fortification of acquisition of external resource r at level f at period t
$NR_{rp}^{ls}$	A binary variable that equals 1 if core process p is implemented at operational level l at period t under scenario s; otherwise 0
$\gamma_{dr}^{ts}$	Amount of external resource r at period t under scenario s
$\gamma_{drf}^{{{\prime }ts}}$	Amount of internal resource r at period t under scenario s
$\chi_{dr}^{ts}$	Recovered operational level of core process p at period t under scenario s
$\chi_{drf}^{\prime ts}$	Time required to recover core process p under scenario s
$\kappa_{r}^{st}$	External resource r recovered from disruptive incident at period t under scenario s
$\theta_{r}^{st}$	Internal resource r recovered from disruptive incident at period t under scenario s