The article introduces a modern risk management framework, which can serve as a driver for an objective business continuity management, especially in agriculture where disaster recovery issues are of major importance due to the existence of multiple environmental hazards. The method is supported by a user-friendly interface developed by the authors in Visual Basic for Applications and the MS excel software. The impact-weight value of each factor is mathematically calculated while the probability of occurrence for each factor is determined based on a semi-quantitative one-to-five scale.
Business continuity policy is nowadays a crucial issue for the enterprises of the
private sector as well as the public organizations and institutions. However, in the
agricultural sector “the preservation of processes is not dependent solely on information
systems, but on the continuity of all processes that lead to the fulfillment of the
global goal of agriculture”
On the other hand, risk assessment (RA) and business impact analysis (BIA) are
crucial elements for understanding the organization
“Risk management in agriculture is now an essential tool for farmers to anticipate,
avoid and react to shocks. An efficient risk management system for agriculture will
preserve the standard of living of those who depend on farming, strengthen the
viability of farm businesses, and provide an environment which supports investment in
the farming sector
The goal of the current paper is to describe a modern risk management framework for calculating possible time deviations from defined by business continuity or domain experts recovery timeframes for bringing back to their normal state interrupted critical business activities. The framework includes the application of the mathematical risk magnitude formula in order to predict time deviations (in absolute value) from the initially defined by experts recovery time. Moreover, the recovery process is influenced by unexpected factors which, if emerging, they can significantly delay the recovery procedure for a business function, information system or business process. The weights of these factors are mathematically calculated, while the probability of occurrence for each factor is semi-quantitatively determined. Finally the proposed contribution estimates a new recovery time by considering the aforementioned factors. The calculations are implemented via a VBA user friendly interface in MS Excel. Methods and Tools
The current approach is based on a semi-quantitative method for probability
determination regarding the occurrence of factors which can cause a prolonged information
system/business function interruption. The illustrated idea, is based on the
assumption when no past data is available of similar crisis situation in order to determine the
probability with pure quantitative mathematical tools. In such cases,
semiquantitative scales can be defined. According to
RM = Impact * Probability (1)
In the proposed framework, the Risk Magnitude for a number N of specific factors is estimated according to the following equation (Eq. 2):
N RM = ∑W P
i i i=1 (2)
The model’s representation is based on the following steps (Fig. 1). The RTE value is initially determined based on business function recovery tests when unexpected situations are not considered (ideal conditions).
Part of the proposed risk management framework is the decision making process
regarding the impact of the factor which can delay the business function recovery
process. Due to the fact that our model is based on the concept of a non-arbitrary
weight assignment, the selected technique for assigning weights is the Rank Order
Centroid method. In the proposed framework, the weights of the factors are
quantitatively estimated according to the Rank Order Centroid Method (ROC)
Wi = 1 m 1
∑ , and m i=1 n m ∑Wi = 1 i=1 (3)
The Visual Basic for Applications is utilized in Microsoft Office Tools, such as
Microsoft Excel in order to ameliorate and strengthen its future developing functions. It
was developed based on the very popular programming language Visual Basic and
took after its language structure
The weight assignment formula (Eq. 3) prohibits the arbitrary weight assignment of the presence for a given factor during the BF Recovery process. According to the proposed method, if RTE is the time required to recover a business function in ideal conditions, a non-ideal recovery case should estimate the recovery time as follows: RTE1 = RTE + RTE TimeDeviation = RTE
RM
, 100
RM 100 and
RM RTE1 = 2 ± 2
100
1.58Hours(RTO)
where RTE1 is the new Recovery Time. A practical example is illustrated for the
better interpretation of the approach. Example: If RTE= 2Hours, Number of Factors
(N) = 4, WF1= 0.521, WF2= 0.271, WF3= 0.146, WF4= 0.062 and we assume that
semiquantitatively defined probabilities of occurrence for each factor are PF1= 2, PF2= 5,
PF3= 2, PF4= 4 then:
= 2 ± 0.42 = 2.42Hours(MAO)
or
It should be noticed that the RM values are normalized by multiplying the weight
values of each factor with 10 for obtaining more rational results
(w1+w2+w3+w4=10). The business process aspect of the proposed framework is
demonstrated via an ORD Diagram which is part of the Business Object Relation
Model (BORM) (Fig.2), which is used for modeling agricultural and environmental
processes
Moreover, the above delineated risk management framework, is also supported by a VBA Excel tool which is developed by the authors and implements all the above stated calculations (Fig. 3).
The initial form is loaded by the user in order to estimate the time deviation from the estimated in ideal recovery testing conditions by the business continuity experts. The user is prompted to store the input parameters, which are: -Proposed RTE Value or Proposed Recovery Time -Number of Factors, which are unexpected factors which could trigger the extended recovery time for a given business function, -Probability of occurrence for each factor based on the semi-quantitative risk assessment 1-5 scale. The output values are the risk magnitude RM, the ratio RM/100, new RTE1 when hard recovery scenarios are considered, the Time Deviation from the initially expected recovery time and the weights for all the potential factors based on the Rank Order Centroid approach. 3
Even if the proposed risk assessment framework is simple to use, specific issues should be further discussed and clarified. The first issue is the so called semiquantitative probability of occurrence of each unexpected situation (factor). Simple risk management models avoid complex mathematical quantification methods of a given probability. Moreover, quantification is not suggested when past data for similar disasters is not available to experts who implement risk analysis for a more detailed business continuity management.
Another point, which requires further explanation, is the absolute value
determined by for the Time Deviation from the initially defined RTE value. The model
follows the principle that a reasonable recovery time (RTO) can be based on the
negative time deviation, and, respectively, a maximum accepted timeframe (MTD)
The current paper illustrated a risk management framework, which supports an efficient business continuity strategy in organizations. The framework can be successfully implemented within the agricultural domain where automation is highly demanded for precision agriculture, irrigation techniques, gas emissions control and multiple other critical business activities. The framework is supported by a developed by the authors VBA excel standalone software environment. Its adjustment to other agricultural IT systems is currently considered as a future step but has not yet been achieved. Additional future implementation involves the proposed, by the developed framework/VBA Tool, corrective recovery actions and risk mitigation policies for an integrated business continuity strategy.