Risk assessment in fuzzy decision making environment: Business continuity perspective

Introduced by Lotfi Aliasker Zadeh in 1965 to model the uncertainty arising from the vagueness and imprecision in real systems, fuzzy set theory (FST) resembles human reasoning in its use of approximate information and uncertainty to generate and deliver decisions. In this study, a risk assessment approach in fuzzy decision-making environment is proposed from a business continuity perspective. Business continuity is the capability of the organization to sustain delivery of products and services at acceptable levels following a disruptive incident. All organizations, public or commercial, profit-driven, for-not-profit or non-profit, are faced with losing their compotence and capacity in telecommunications, transportation-logistics, information technologies, operational infrastructure, own and customer assets, human resources; therefore their customers, reputation, market share and value-added to the society because of the threats and incidents that could disrupt their services, products, functions and activities. Organizations should ensure their functionality be sustained or, in other terms, their continuity be maintained without incurring high costs. In this regard, it is required to exercise business continuity management (BCM) programmes in order to control, limit and mitigate the impacts and losses that arise because of the risks being exposed and as unfavourable outcomes of the incidents, namely disruptions, emergencies, crises or disasters. BCM programmes ensures that the business continuity domains of the organization are managed and overseen properly, and its effectiveness and maturity progress is maintained. Furthermore, as the interest of the practitioners and studies related to business continuity have increased, international standards "ISO 22301, Societal security – Business continuity management systems – Requirements" and "ISO 22313, Societal security – Business continuity management systems – Guidance" are published by International Organization for Standardization. Risk is the most important parameter in BCM. So, it should not be a surprise that BCM programmes, which have been established to mitigate the risks and recover processes of the organization, are focused on the concept of risk. The common characterictics of the risks that are to be supervised by BCM programmes are low probabilities, significant impacts, rather limited historical data and experience how to handle. Therefore, traditional risk assessment approaches that are based on quantitative probabilities, or qualitative/semi-quantitavive consequence/probability matrices and catagories of control effectiveness are not sufficient in BCM programmes. This research aims to introduce a risk assessment approach that can handle vague and imprecise risk information by the help of a fuzzy decision-making environment. Another inherent problem in conventional risk assessment techniques is the lack of taking interactions among risks into account and failing to assess total risk. This necessity is obvious for BCM programmes, because strong interactions exist among business continuity risks and processes. Business continuity risks are interconnected and pose complex interrelationships. Multi criteria decision-making (MCDM) methods are quoted as a robust risk assessment technique in "ISO/IEC 31010:2009, Risk management – Risk assessment techniques" standard. This research has aimed at defining business continuity risks comprehensively to generate an exhaustive risk reservoire and assess those risks on an interactional level in a fuzzy decision-making environment by MCDM and eliciting expert judgments. Within this study, an discussion about the importance of business continuity for organizations and society is presented. Then a detailed literature search is realised regarding business continuity, risk assessment, risk assessment based on business continuity, risk assessment techniques, applications of MCDM on risk assessment and business continuity related areas of interest, global standards of ISO 22301 and ISO 22313. As a result of the literature survey, it is found that there is no crisp or fuzzy study that defines all business continuity risks along with sub-risks, realises a business continuity risk assessment that takes interactions among risks into account, and integrates these components as a decision-making tool that supports BCM decision-makers. Methodological flow diagram is formed and methods to be exercised are examined in full. This research aims to present a decision support approach to BCM problems based on a methodological background that includes FST, risk assessment and MCDM. Risk and sub-risks are determined as criteria, and two MCDM methods, fuzzy analytical network process (ANP) ve fuzzy Choquet integral are chosen because of the methods' suitability to capture the interactions among risk criteria. ANP is a generalization of analytical hierarchy process (AHP), and developed by Thomas L. Saaty in 1996. ANP is similar to AHP as both use pairwise comparisons. But, the criteria are not assumed to be independent of each other in ANP. Likewise, the Choquet integral is a useful multi-criteria method for problems with interactions. In order to define business continuity risks, a comprehensive reservoir of main risks and sub-risks of business continuity that the organization may be exposed to is created by the help of literature search and the experts. The research has been applied to a current and eminent BCM systems problem of recovery site location selection. Structure and network representing the problem is formed, then fuzzy Choquet integral and fuzzy ANP is applied using quantified linguistic terms that are obtained by surveying experts. Linguistics terms for the degree of importance or comparison matrices are surveyed and triangular or trapezoidal fuzzy numbers are used to quantify linguistic terms. The proposed approach can be easily customised for various kinds of organizations and corporations with respect to their risk profile and appetite. Proposed approach enables the BCM decision support system to assess the contribution of each alternative to the overall business continuity risk, pursue the trend of the changing risk after mitigaton. Approach can be customised to support BCM decision making processes in a rapid and effective fashion, for example, when the organization starts operations in a new region, develops a new product or service, outsource a process, change operational processes, migrates to a new information technology architecture. The approach detailed in this study enables business continuity-related main risks and sub-risks to be defined, examined and assessed in an fuzzy environment and on an interactional level by MCDM methods. To the best of our knowledge, this aspect of our research is the first attempt in business continuity and risk assessment literature. Another original contribution to the literature is the aspect of our research to be able to meet the requirements of risk definitions and assessment in the operations clauses of ISO 22301 domains. Taking the missing parts in literature and the results achieved by the application of the proposed approach into account, it is believed that this study will contribute to the business continuity practitioners by suggesting an effective risk assessment approach in fuzzy MCDM environment under business continuity perspective.