Business Continuity

Background. Business Continuity Management (BCM) is a response of management practitioners to the risk appearing in a turbulent environment. Recent publications consider BCM in pragmatic categories often deprived of its embedding in management science.
Research aims. The paper enters into a discussion of the essence and status of Business Continuity Management (BCM) in management sciences. It includes considerations of the following constituent subjects: the notion of BCM, Evolution of BCM, formal status of BCM in perspective of management science, directions of current BCM research.
Method. The argumentation presented in this paper is based on the critical analysis of the literature and synthesis. 
Key findings. It is recommended to base the attempt of defining BCM on elements indicating identity of the management domain. Currently, BCM orientation is holistic and its meaning is global and its formal status in management sciences can be specified from the point of view of the content and from the point of view of relations. Due to its crossfunctional character BCM maintains relations with several domains of management.

Learn to implement the ISO 22301:2012 framework, principles and methodologies. Using the PDCA component as spelled out in the ISO Standard, this book provides a clear explanation of the standard and details on the “How-to” aspect in implementing your BCM program and BC Plans and procedures.

El objetivo de todo negocio es la creación de valor, entendida como la generación de productos y servicios que valgan más que su costo. En un mundo cada vez más impredecible son muchos los factores que afectan el desempeño de las empresas y su interacción hace casi imposible predecir los escenarios futuros, por lo tanto, los modelos estratégicos diseñados para entornos estables, donde se supone se puede pronosticar, tener visión de futuro e implementar los planes a placer, tienen poca utilidad.

Most risk management activity in the healthcare sector is retrospective, based on learning from experience. This is feasible where the risks are routine, but emergency operations plans (EOP) guide the response to events that are both high risk and rare. Under these circumstances, it is important to get the response right the first time, but learning from experience is usually not an option. This case study presents the rationale for taking a proactive approach to improving healthcare organizations' EOP. It demonstrates how the Prospective Hazard Analysis (PHA) Toolkit can drive organizational learning and argues that this toolkit may lead to more efficient improvement than drills and exercises.

-----
Wiley's copyright policies do not allow me to post the published version of the paper, but they do allow me to send out individual copies. So if you don't have access to the Journal of Healthcare Risk Management and would like a copy of this article, please email me at:
alan [dot] j [dot] card [at] gmail [dot] com

Computer security incident response teams need to track inc ide ts as they develop. To support day-to-day operations, teams need to be able to generate quick overviews of ongoing incidents, and they mus t be upported in their daily work by automating as much routine work as poss ible. AIRT is a web-based system to provide incident tracking capabili ties to computer security incident response teams. Its design goals include to provide a comprehensive incident management console, ability to quickl y associate external teams with IP addresses, the ability to record an inciden t in 30 seconds after receiving it, provisions for PGP signed mail, and more . This paper presents AIRT, its goals, architecture and its functionali ty.

Defining quality in most institutions are clear and easy to do. However quality management is hard to define in case of services because services do not have such generally common, measureable and comparable features like products. In case of services without exact outcomes are even harder to define quality. Management consulting is such a service. Management consultants help organizations so solve complex, messy problems. It is very hard to define quality in this case. There is no one best way to manage quality in this case. The goal of this paper is to clarify how quality management can work in such circumstances in the management consulting services industry. The paper is based on literature research and the author's own experiences as a certified ISO 9001 auditor. This gives a quality standard view of the paper, however other aspects are discussed as well. Management consulting firms have to build trust. This is an important reason to concentrate on quality. Consulting companies can use several methods to increase their service quality. Mostly soft methods can be used because of the limited availability of possible statistical data. The most typical soft methods are shown in this paper. Many of the consulting firms operate ISO 9001 standard-based quality management systems or TQM in their own organizations. Back in time this was a different story. In the 1980s consulting firms rather worked on their clients' quality concerns not on their own. This has change a lot since that. Nowadays there is so high need of quality operation with reduced costs that the consulting firms themselves also operate quality management systems. These systems can reduce costs as well by making better decisions and decreasing the cost of bad quality such as faulty products and guarantee costs. The features of the ISO 9001 standard are shown in this paper regarding the management consulting sector. Quality is becoming a major issue for consulting companies to get new contracts. This is an industry based mainly on trust because the outcome of the service is not immediate and can hardly be measured. Consulting companies should not only keep the technical standards but have to satisfy the customers' requirements to provide a quality service.

Over the years, the Federal Response Plan (FRP) and the
National Response Plan (NRP) have reflected policy learning
and changes that result from disasters. Since its initial release
in 1992 the FRP was amended twice then replaced by the NRP
in 2004. In the past, revisions to these plans have occurred in
response to Hurricane Andrew and the September 11 terrorist
attacks. In the aftermath of Hurricane Katrina, the state of
U.S. emergency management has been widely questioned. This
article examines developments in NRP and its implementations
in response to Hurricane Katrina in 2005 from collaboration
and partnership perspectives. Information was collected from
a variety of print and electronic sources for the study.

During recent mega-disasters, such as the 2011 Great East Japan Earthquake and the 2011 Thailand floods, interdependencies in supply chains caused substantial economic damage, often exacerbated by vulnerable small and medium enterprises (SMEs). Therefore, a new global framework in disaster risk reduction, the Sendai Framework for Disaster Risk Reduction 2015– 2030, mentions the role of the private sector in achieving a resilient society. However, the framework’s statements are abstract and they need to be converted into actionable agendas. This paper identifies future directions for private sector resilience to disasters, focusing on business continuity. Even though business continuity has been regarded as a critical factor in conventional disaster planning, Business Continuity Management (BCM), articulated as a holistic management process, tends to be designed and implemented selectively by each organization. To address SMEs and supply chain resilience, this paper proposes a new type of BCM, a regional BCM based on Public-Private Partnership (PPP), and a new role for the insurance industry.

Applied Ethics is society’s response to need to resolve social control problems posed by cultural crisis.  Applied ethics is a term used to describe attempts by non-philosophers, or ethicists, to use philosophical methods to identify morally correct courses of action in human life. Business anthropology is a relatively new subfield of traditional anthropology. Business anthropologists represent a mix of traditional academic researcher, business teachers, private consultant practitioners and technical staff members of business enterprises. We define these as “career anthropologist.” As a group they face a wide variety of ethical conflicts based on their status and role in the business context. In this paper we explore these conflicts and how the anthropological institutional establishment has attempted to address the needs of “career anthropologist.” We do this by applying a structural-functional analysis of the role ethics plays in our understanding of socio-cultural institutions. Then we apply this to a review of the evolution and institutional development of ethical thinking in anthropology for the past 75 years as manifested by the SfAA, AAA and more recently, NAPA. Finally, we propose an applied ethical approach as a solution to the crisis based on a return to core values represented by what we call, The Boasian Code.

This paper explains the concept of business continuity management (BCM) with the specific focus on the BCM planning process and methodology. Before entering into the maintenance phase of any BCM program, the Organization BCM Coordinator needs to ensure that the project phases of the BCM planning methodology are succinctly implemented to meet the organization’s BCM objectives. This paper is an update of an earlier paper written in 1996 incorporating the author’s subsequent experiences and implementation while he is working in the financial regulatory environment. This BCM methodology is aligned with the BCM standard ISO 22301. The intent in the following dialog is to explain the BCM planning process in greater details.

Goh, M. H. (2015). Business Continuity Management Planning Methodology. International Journal of Disaster Recovery and Business Continuity, 6, 9–16. Retrieved from http://dx.doi.org/10.14257/ijdrbc.2015.6.02

The "Greek crisis" was officially inaugurated on May 2010 with the loan the Greek government took from the IMF-European Union-European Central Bank troika, the largest a country had ever taken (€110 bn). Since then, the social implications of this crisis have been dramatic. The form and the scale of social phenomena observed today in Greece and particularly in Athens--e.g., extreme poverty and inequality, profound police violence, organized racist violence--are unprecedented for the country. Nevertheless, a diachronic examination of some socio-spatial aspects of Athens reveals that the social character of the current crisis has been taking shape for some time. This article aims shed light on the social shape of the crisis by outlining three such socio-spatial dimensions as they materialized in the case of Athens during 1990s and 2000s: first, the emergence of new forms of social exclusion and inequality; second, the vast project of urban (re)development and the new spatialities it produced, and third the emergence of novel forms of political and xenophobic violence.

BACKGROUND: Fishbone diagrams have been widely promoted as a systems-focused hazard analysis tool for use in root cause analysis, but they suffer from a number of structural weaknesses, including a unidirectional structure that only takes into account forces that promote an accident (ignoring those that make the accident less likely or less severe) and a means of displaying these forces that does not convey any difference in strength of influence. In a separate but related issue, many healthcare organizations suffer from a lack of change management expertise.

PROPOSED SOLUTION: To address these concerns, I present a novel technique, the Lovebug diagram, which draws from both Fishbone diagrams and force-field analysis (an approach to analyzing planned change). This new technique adds value to both its progenitor methods, while retaining their key strengths and ease of use. It can be used both prospectively, to assess planned changes, and retrospectively to assess unplanned (accidental) departures from the status quo.

DISCUSSION: The Lovebug diagram is a more powerful analytical tool than its progenitor methods; however, overall adoption of systems-focused tools for root cause analysis remains suboptimal. Additional research is needed to determine how best to promote a truly systems-focused approach to healthcare root cause analysis. Beyond this retrospective use of the technique, it represents a simple tool to assist healthcare organizations with prospective change management.

Available from: http://cri.sagepub.com/content/early/2013/10/25/1356262213510855.abstract

The COVID-19 pandemic is triggering unusual worldwide health and economic crisis with critical circumstances caused many consequences. The continuous COVID19 pandemic has struck every industry, yet the one industry that has tolerated the tremendous shots is the Oil and Gas (O&G) industry. Various lockdowns impacted projects, with some put on hold as the world battled the spread of the disease. This article discusses the effect of COVID-19 pandemic on O&G sector digital transformation (DT). In particular, this article delivers trustworthy thoughts and reflections on whether O&G organizations expedite their DT during COVID-19 outbreak. The aims of this paper could be invaluable to newly created organizations which intend to rely on information systems or get hold of opportunities in transforming their operational process into digital

In today's global and complex business environment, security is a major issue for any organization. All organizations should have the capability to plan and respond to incidents and business disruptions. Business continuity management is part of information security management and the process of Business continuity management (BCM) can meet these needs. Indeed, Business Continuity refers to the ability of a business to continue its operations even if some sort of failure or disaster occurs. Business continuity management (BCM) requires a holistic approach that considers technological and organizational aspects. Besides, Enterprise architecture (EA) is a comprehensive view of organizational architecture, business, and technology architecture and their relationships. EA is also considered by several studies as a foundation for BC and security management. Our research aims at studying how BCM aspect can be embedded into the enterprise architecture. In this sense, this paper proposes a metamodel and an implementation method that considers BC in the design and implementation of EA.

Business continuity is both a management and an asset protection issue. The ability to maintain business continuity, or to regain it in a timely manner is the asset the plan protects. An organization such as Standard Chartered Bank that plans ahead for disaster is investing in its continuity and it is now in a better position to recover and resume operation. That is just good business sense by the management.

This paper explains the concept of business continuity management (BCM) with the specific focus on the BCM planning process and methodology. Before entering into the maintenance phase of any BCM program, the Organization BCM Coordinator needs to ensure that the project phases of the BCM planning methodology are succinctly implemented to meet the organization’s BCM objectives. This paper is an update of an earlier paper written in 1996 incorporating the author’s subsequent experiences and implementation while he is working in the financial regulatory environment. This BCM methodology is aligned with the BCM standard ISO 22301. The intent in the following dialog is to explain the BCM planning process briefly.

As Corporate Reputation (CR) evolves into an important asset for organizations, crises, disasters and other supply chain disruptive events, stand as threats to the preservation of the reputation capital since they usually result to negative projections to their audiences and to problematic evaluations by their stakeholders. Viewing CR as the accumulated trust and positive evaluations of the stakeholders, this paper proposes a conceptual and normative framework for Reputation Continuity, which enhances the ability of organizations to preserve their reputation, instead of working for its recovery in the post-crisis period. In our approach, we propose a process of maintaining trusted links, instead of restoring them and establishing a reputation resilient organization, instead of one struggling to recover from reputation losses, after the crisis has emerged. Working closely with stakeholders during the crisis, injecting a sense of normality continuity through effective leadership and mitigating image problems are seen as critical concerns, alongside a set of managerial practices to be followed. Ultimately, it is argued that, the value-based and strategically integrated view of Business Continuity must be enhanced and supported by Reputation Continuity activities.

The  number  of  enterprises  implementing
business  continuity  management  (BCM)  is
increasing because organizations need to be able
to  deliver  products  and  services  at  acceptable
predefined levels even in the wake of disruptive
incidents.  However,  it  is  often  difficult  to
implement  BCM  in  a  suitable  manner  in
business continuity risk planning because of the
uncertainty  regarding  the  occurrence  of  such
events.  To  solve  this  problem,  we  have
developed a method for use in combination with
event  tree  analysis  (ETA),  which  is  used  to
secure safety in engineering, and the programevaluation-and-review-technique  (PERT),
which is used in operation research and includes
a function to show the analysis result in an easyto-understand  manner.  In  addition,  we  have
developed a system to support the above method.
We  confirmed  the  systems  usefulness  of  the
developed system by applying the method to a
small example.

This study explores crisis communications in UK higher education institutions between the institution and its students. Using a case study of British universities, data is presented from interviews with university business continuity managers and student focus groups. The paper provides insights into current business continuity management practice in the higher education sector, business continuity managers' attitudes to social media as a communication tool during the incident response phase, and students' declared communication preferences.

This paper discusses the pertinent aspects of pandemic flu business continuity (BC) planning. In the last two years, there is an increase in organizations preparing themselves for possible influenza (flu) pandemic outbreak. The key challenge in the preparatory process is the synchronization of the business continuity plan and procedures with the World Health Organization’s and the local health ministry’s pandemic alert phases. Several possible outbreak situations and several more possible variations in responses to them make the planning process one of the most complicated challenges facing business continuity professionals. The key outcome is the understanding of the scope of implementation of contingency, BC or crisis management plans and the application of the BC execution stages to implement the necessary actions to prepare an organization of the impending pandemic flu outbreak.

Goh, M. H. (2009). Pandemic Flu Business Continuity Planning for Organizations. In Pandemics Preparedness in Asia 13 Jan 2009 Marina Mandarin Hotel (pp. 1–4). Singapore: BCM Institute.

A business continuity plan details how a business will continue operating and serving its customers, even in the face of a dramatic event like a natural disaster, major IT failure or a cyberattack. The end goal is to preserve a company’s financial viability, market position, reputation and customers, even in the face of a crisis. Learn more in a Disaster Recovery and Business Continuity course by Tonex.

In this paper we reflect on a number of IT related challenges during the COVID19 pandemic, primarily from a CIO and IT professionals perspective. We consider three time periods, namely the period before the pandemic, the response to the pandemic and the period after it. For each period we discuss the key challenges that practitioners faced and outline important areas to consider for the future. Hopefully, the lessons learnt and the experiences gained will positively inform future academic research and practice.

Heightened Awareness or Reactive, Backwards Looking?

From financial crises to energy catastrophes to earthquakes and threats of terrorism, we hear a lot about events that challenge our ability to identify and manage risk.  Unfortunately some of the things that emerge from many of these events are reactive regulatory rules and requirements.

What this means is that businesses and governments need to be even more vigilant in their prosecution of enterprise risk management initiatives.  Private and Public Sector operations are complex and becoming more complex as more entrants to the global marketplace compete for fewer and fewer available resources at an ever quickening pace.

So, is society, as we know it, on the verge of collapse, destruction, another stone-age?  Seems that you cannot turn on a television, radio or the plethora of personal communication devices available without headlines screaming at you about people with Molotov cocktails, car bombs, murders, floods, fires, car crashes, riots and, celebrities gone wrong.  Sovereign nations are going bankrupt, sabers are being rattled; how you might ask, is it all going to end?

Unpredictability is the new normal.

The surveillance annual report shows the number and type of incidents CIRS has been responding to in 2002. The difference between active and passive surveillance is discussed.
Content:
A. a description of the development of data collection methods at CIRS;
B. feedback on 2002 data from the current CIRS surveillance system;
C. a report on active surveillance in Wiltshire ;
D. why and how surveillance of chemicals should be conducted;
E. what can be done better?

The Health Protection Agency will expand on how we document and share surveillance data.

Since a few years, companies that runs business critical applications are increasing their focus on their support infrastructures. Indeed, it is clearly useless to pursue higher systems reliability, when the infrastructure is vulnerable. Aim of this paper is to explore the value of business continuity within the scope of the design of resilient system. The publication of the fifth revision of ANSI/TIA/EIA 942 standard provides operation managers and risk managers with a framework to plan and design resilient infrastructures. It will be shown how to use the aforementioned standard to analyse the gap between the current and the desired resilience level of a system, and suggest the proper steps to reach it, accordingly to the business continuity requirements. This approach was adopted on the case of the power system infrastructure of a primary Italian Application Service Provider, granting 24/7 mission critical services to its customers.

A reliable energy supply is critical to every aspect of modern society, and so the U.S. Department of Homeland Security, along with the North American Energy Reliability Corporation and the U.S. Federal Energy Regulatory Commission, has established emergency management and business continuity standards for the nation’s energy producers and distributors. Because of these compliance standards, and to conform to accepted business practices, Seattle City Light instituted an information technology business continuity program as part of their strategic planning. As with most industries, energy production and distribution is heavily reliant on information technology for both the core functions as well as for the associated daily business. It is of particular importance for the monitoring of the power grid; remote sensing and control of production and distribution facilities; sale of excess power and purchase of power during high demand; operation and maintenance of the consumer power system; dispatching and safety of power crews; and for sundry business operations, such as human resources, billing, communications, etc. These operational and business information technology functions may be interrupted by damage to communications systems from winter ii
storms or earthquakes, vandalism, terrorism, hacking or, ironically, loss of power. This case study examines the Seattle City Light Information Technology Business Continuity and Disaster Recovery Program and describes the historical narratives of the decision-making process for, and design and implementation of, the program. The study utilizes qualitative description of the process, as well as lessons learned and best practices, and will quantitatively analyze the costs of the program implementation vs. the costs of non-compliance and interruption of supply. The program will be compared to available literature, with discussion, conclusions, and suggestions for the industry as a whole and for other industries facing similar compliance and business requirements.

This study analyzes the evolution of interorganizational response networks over time. The study aims to investigate an organization’s position and role as a result of the dynamic changes that occur through the evolution of interorganizational response networks. Social network analysis measures are applied in order to evaluate not only network structure and specifications but also an organizations focal structure and role changes over time. Using Hurricane Charley’s coordination data of the activities of several organizations involved in the response process over time, the study evaluates networks and the organizations’ network structural changes over a period of time. The results show that analyzing static networks does not reflect how the network evolves and how different organizations change their role as the incident emerges. This study takes these criticisms into consideration and adds time dimension to the analysis of response networks. It is the first step in investigating the emerging structure of interorganizational response dynamics during emerging disasters and its effect on improving coordination output. In addition, the study proposes indicators for identifying real, lead or coordinating organizations in interorganizational networks.

Untuk menghadapi resiko yang mungkin terjadi terhadap keamanan informasi, maka resiko tersebut perlu untuk dimanajemen. Salah satu tindakan yang diperlukan dalam memanajemen resiko adalah menganalisa resiko yang mungkin terjadi. Beberapa perangkat yang dapat digunakan untuk menganalisa resiko

Currently volatility is inherent a supply chain. A business entity within the supply chain faces with demand fluctuations and many other problem situations that cause disruptions. Despite this supply chain should deliver goods or services at acceptable predefined levels of customer value, not decreasing the value of organization. It concerns issues of operating system's scalability. Operating systems are the main components of supply chain structure. Managers have to define and align business processes through the adjusting these systems in accordance with changes inside and outside the supply chain. They make decisions in the context of different methodological perspectives, primarily agile and lean supply chain management based on collaboration among its business entities. The concepts and components of the business finance system must be also defined. The features of the implementation of financial instruments and financial resources to ensure the goals and objectives of the ...

Business resiliency is the big picture of arrangement; integration and practice to conduct business operation and provide satisfactory level of service to its customer consistently even in the critical time also by safeguarding business resources, assets and relevant people. Critical time refers to the period when business suffers from natural disaster, technical failure, pandemic and other insurgencies.
In such difficult time employee or business user should be able to conduct their regular operation and provide service to the customer either by accessing business Information system, software, apps or other infrastructure and ultimate customer should be able to obtain acceptable level of service without any disruption, losses and damage.

The constantly increasing need for security has been established as one of the main features of modern society. Regardless of whether it is personal, financial, operational, corporate, environmental, national or any other type and scale, the pursuit for security underlines much of the decision-making process. Security is a world-wide cornerstone process for governments, businesses, organizations and individuals, both in separate and collective level.
During the recent decades, there has been a stronger demand for increased capabilities of organizations and societies in effective security management and crisis management, in order to be able to cope with the pressure caused by changing and emerging risks. Scientific and technological progress has created new and complex forms of risk, while the growing influence of globalization has exacerbated many already familiar risks, significantly increasing both their range and scale.
Organizations worldwide, in order to respond towards these increased security requirements, set up and operate situation/operation centers, which by their tasks and services offer a number of advantages, for the effectiveness of the strategic implementation of security, crisis and disaster management. Despite the diversity of situation/operations centers, which is mainly defined by their tasks, their case-by-case jurisdiction and the specific needs, size and resources of the organization, an investment on them, creates the demand to deliver results that define as common component, the holistic increase of the organization's capabilities for security and crisis management

Despite the considerable work carried out in risk management, vulnerability indexes and aggregative assessments remain a serious issue. The main challenges facing vulnerability assessment are the collection, integration, and synthesis of large quantities of heterogeneous data to provide reliable estimations. This situation has led to the neglect of all significant interactions between the considered indicators, despite their being essential to vulnerability analysis. The scope of the article is to show that most obstacles to vulnerability assessment can be overcome by shifting the focus from absolute vulnerability assessment (i.e., the attempt to quantify an absolute level of weakness or resilience) to relative vulnerability assessment (i.e., the attempt to find out which populations and places are vulnerable and why). We propose a first attempt to assess relative vulnerability. The spectroscopy of urban vulnerability reveals the heterogeneity of vulnerability by focusing on the locally convergent specific characteristics and processes reinforcing (or reducing) vulnerability to inform the implementation of more targeted mitigation policies. This is a two-step approach, first focusing on the vulnerability underlying factors and establishing vulnerability profiles; the second step is to focus on their spatial distribution to confront each vulnerability profile to its multithreat exposure. The Lyon, France, and Bucharest, Romania, case studies reveal the risk transfers induced by some risk management policies and they highlight that vulnerability is a multidimensional phenomenon almost impossible to assess by using a single index. The two case studies also permit local multithreat comparisons as well as international comparisons. A pesar del considerable trabajo llevado a cabo sobre manejo de riesgos, los índices de vulnerabilidad y evaluaciones agregadas siguen siendo asunto serio. Los principales retos que se enfrentan en la evaluación de vulnerabilidad son la recolección, integración y síntesis de grandes cantidades de datos heterogéneos para generar cálculos confiables. Esta situación ha llevado a que se desechen todas las interacciones significativas entre los indicadores considerados, a pesar de ser esenciales para el análisis de la vulnerabilidad. El ámbito del artículo busca mostrar que la mayoría de los obstáculos a la evaluación de la vulnerabilidad pueden obviarse cambiando el foco de evaluación absoluta de la vulnerabilidad (es decir, el intento de cuantificar un nivel absoluto de debilidad o resiliencia) a uno de evaluación de la vulnerabilidad relativa (o sea, el intento de descubrir qué poblaciones y lugares son vulnerables, y por qué lo son). Formulamos una primera propuesta para evaluar la vulnerabilidad relativa. La espectroscopia de la vulnerabilidad urbana revela la heterogeneidad de vulnerabilidad al enfocarse en las características y procesos específicos localmente convergentes que refuerzan (o reducen) la vulnerabilidad para informar la implementación de políticas de mitigación más definidas. Se trata de un enfoque de dos etapas, que primero se enfoca en los factores ocultos de la vulnerabilidad y en establecer perfiles de vulnerabilidad; la segunda etapa consiste en concentrarse en su distribución espacial para confrontar cada perfil de vulnerabilidad con su exposición de amenaza múltiple. Los estudios de caso de Lyon, Francia y Bucarest, Rumania, revelan las transferencias de riesgo inducidos por algunas políticas de manejo de riesgos, a la vez que destacan que la vulnerabilidad es un fenómeno multidimensional casi imposible de evaluar utilizando un solo índice. Los dos estudios de caso permiten también hacer comparaciones locales de amenaza múltiple, lo mismo que comparaciones internacionales.

Boards have traditionally innovated and consciously and proactively introduced changes for positive reasons such as benefiting customers, attracting talent, gaining a competitive edge, cutting costs or increasing revenue, efficiency and/or profitability. More recently, inter-related challenges and related opportunities have arisen that in some cases could impact upon many or most activities of almost all companies and the communities and countries within which they operate. They affect business models, the context and environment within which companies operate, and the expectations of various stakeholders. For some people, they call into question the rationale and purpose of enterprise. Often they cannot be addressed in isolation. Effective responses may require collective and collaborative action while windows of opportunity still exist. Where the negative consequences of inaction rise exponentially with additional delay, continuity and ‘business as usual’ may cease to be viable longer-term options. There are a variety of questions directors and boards need to address in relation to the changing business context, sustainability and change, change and continuity, a global requirement for action, corporate governance for sustainability and future prospects. Published as: Coulson-Thomas, Colin (2019), Change, Continuity and Sustainability, Director Today, Vol. V Issue IX, pp 45-49

Purpose -This study aims to conceptualise the ever-evolving model in enterprise resilience. Design/methodology/approach -This paper will review the literature, and justify the call for research to be conducted on the evolving building blocks that is shaping modern approach to enterprise resilience. Potential Findings -This new stream of research in management theory is likely to bring about convergence in the fields of enterprise risk, crisis and emergency management, business continuity and disaster recovery planning resulting in a new theoretical framework on how organisations can achieve enterprise resilience more effectively. Research limitations/implications -This research is limited to studying organisational or enterprise resilience with respect to their corporate governance, risk and resource management, crisis and emergency planning, business continuity and disaster recovery models. Originality/value -This paper calls for research on the topics of ever-evolving enterprise resilience model.