i

TABLE OF CONTENT

CHAPTER 1: INTRODUCTION................................................................................................1
Statement of the Problem and Purpose...............................................................................2
Background and Significance of the Problem........................................................................3
Research Questions....................................................................................................... 4
Definition of Key Terms.................................................................................................. 4

CHAPTER 2: LITERATURE REVIEW.....................................................................................7

Business Continuity....................................................................................................... 7
Definition of Business Continuity................................................................................... 7
Business Continuity in Middle East....................................................................................9
History of Business Continuity....................................................................................... 12
Timeline of a Business Continuity Plan.............................................................................14
Small Businesses in Disaster.......................................................................................... 15
Determining Small Business Scale................................................................................15
Socioeconomics of a Small Business............................................................................. 16
Small Business in Disaster, Employees Perspective..........................................................17
Small Business Factors in Disaster Recovery..................................................................18
Disaster-Proof Cities................................................................................................ 19
Business Continuity Planning......................................................................................... 20
The Business Continuity Planning Concept.....................................................................20
Business Impact Analysis........................................................................................... 21
Business Continuity Best Practices............................................................................... 24
Business Continuity Challenges...................................................................................28
Business Continuity in Practical Application...................................................................29
Future of Business Continuity Planning.........................................................................31
Small Business Insurance.............................................................................................. 33
Insurance in Disaster................................................................................................ 33
Variations of Disaster Related Business Insurance............................................................34
Reasoning Behind the Underinsured............................................................................. 36

CHAPTER 3: METHODOLOGY.............................................................................................39
Research Methodology................................................................................................. 39

ii
Quantitative Methodology............................................................................................. 40
Research Ethics.......................................................................................................... 40
Data Collection.......................................................................................................... 41
Research Instruments................................................................................................... 42
Research Sample........................................................................................................ 43
Data Analysis Plan...................................................................................................... 44
Timing Mileposts........................................................................................................ 45

CHAPTER 4: FINDINGS & ANALYSIS..................................................................................47

Business Demographics................................................................................................ 47
Insurance Confidence.................................................................................................. 49
Business Planning....................................................................................................... 51
Most Critical Business Function..................................................................................... 55
Identifying Trends....................................................................................................... 57
Reluctance to Plan................................................................................................... 57
Decisions in selecting insurance.................................................................................. 58
Employee size in relation to planning............................................................................60

CHAPTER 5: CONCLUSION...................................................................................................62
Discussion................................................................................................................ 62
Conclusion................................................................................................................ 64

iii
TABLE OF FIGURES

Figure 1: Timeline of a business continuity plan.............................................................................8

Figure 2: Business Continuity Planning time line.........................................................................15
Figure 3: IBM Business Resilience Framework............................................................................25
Figure 4: Product and Services Catalog Development..................................................................27
Figure 5: Cloud Computing...........................................................................................................32
Figure 6: Number of Employees for Business Scale.....................................................................48
Figure 7: Years in Service..............................................................................................................49
Figure 8: Industries of Businesses in Survey.................................................................................51
Figure 9: Disruptions Experienced by Businesses.........................................................................52
Figure 10: Insurance Coverage for Recovery................................................................................52
Figure 11: Significance of Business Impact Analysis....................................................................53
Figure 12: Willingness to Conduct Business Continuity Planning................................................54

TABLE OF TABLES

Table 1: Elements of business continuity & disaster recovery........................................................8

Table 2: Average Cost per Hour Impacts on Businesses of Web Site Downtime..........................13
Table 3: Exploring Assumptions about BCM Provision................................................................14
Table 4: Most Critical Business Function......................................................................................55
Table 5: Insurance policy coverage for large loss by natural disaster...........................................59
Table 6: Provided a template, wou ld businesses con duct a BCP.................................................61

1
CHAPTER 1: INTRODUCTION

The term business crisis is defined as an event-specific episode that can force a
corporation into bankruptcy (Albrecht, 1996). A minor problem occurring in a Fortune 500
organization may have little or no impact on a company. The same minor situation in a small
organization could put the company out of business. The seriousness of a crisis is the potential
for damage or impact on a company's people, customers, and operations (Albrecht, 1996). The
Chairman of Lloyds, Lord Peter Levene (as cited in Said, 2004) stated, "More than half of
Bahrain corporations don't have crisis-management plans, even though 40 percent of companies
hit by a disaster will fail within five years" (p. 1).
Natural disasters and technological hazards contribute to the risk that businesses face.
"Natural events are not disasters. Hazards, such as earthquakes, tsunamis, volcanic eruptions,
flooding, or for present purposes, wildfires, must interact with social systems and human
vulnerability to become disasters" (Olson & Gawronski, 2005, p. 2). Every year in the Bahrain,
natural and technological hazards cost an estimated $1 billion per week in the form of lost lives
and properties destroyed (Subcommittee on Disaster Reduction, 2005).
This study was organized to address the research topic, related literature, methodology,
findings, and conclusions associated with the research on a key area of crisis management
methodology. Associated details in the introduction include the statement of the problem and
research questions. The section also contains a review of related literature, a description of the
research design, including key variables, instrumentation, and statistical methods.

2
Statement of the Problem and Purpose
The problem is an increasing need for the leaders of organizations to have a business
continuity plan (BCP). Business Continuity Management has become a boardroom agenda
(Gallagher, 2006). Enterprise leaders can improve their recovery odds, but only if these leaders
take the necessary measures before and after the disaster (Gallagher, 2006). Without a plan in
place, business leaders may be slow to react and may not be able to recover from a catastrophe.
A survey conducted by AXA demonstrated that only 42% of leaders of companies that had a
crisis in the past, and had continuity plans in place, said that the plans had been effective (Varley,
2005). The gap in the literature is bridged by identifying the primary barriers and limitations for
small business owners when creating a BCP. Preceding investigations have not been conducted
that recognize the factors for creating or not creating a BCP and compared to BCP levels.
The purpose of the research was to use a quantitative methodology study to identify and
explore the primary barriers precluding leaders of Bahrain's small business organizations from
implementing a BCP or crisis management plan. The research was initiated by measuring and
examining business leaders' preparedness and assessing the levels of detail in the organizations'
BCPs. The sampling frame for the study was small manufacturing and service businesses located
in the State of Bahrain. Respondents were leaders from businesses with less than 100 employees
and sales up to and including $5 million. An exploration of the quantitative responses from the
first phase's survey identified the key barriers and aids for BCP development and implementation
for the second phase. The second phase of the research also utilized a quantitative methodology.
In the second phase, the analysis and exploration of the primary drivers and barriers were
identified.

3
Background and Significance of the Problem
The attacks on towers 1 and 2 of The World Trade Center in New York City on
September 11, 2001, brought the subject of business continuity and crisis management to the
forefront of many corporate leaders' priorities. Business continuity and crisis planning are also
being studied with greater frequency due to the instability of our global relations with foreign
countries and threats from terrorist groups. Natural and technical disasters in the Bahrain cost an
estimated $1 billion per week in the form of deaths and public and private properties destroyed
(Subcommittee on Disaster Reduction, 2005). Hurricanes and tropical storms that have made
landfall since 1900 have caused more than 9000 deaths and more than $100 billion in damages to
homes and property (Subcommittee on Disaster Reduction, 2005). Wildfires in the Bahrain from
1999 to 2002 have averaged 6.1 million acres burned per fire with an estimated cost of $1.1
billion for wildland fire suppression (Subcommittee on Disaster Reduction, 2005).
The focus of existing crisis planning related studies such as the Virtual Corporations
Business Continuity Maturity Model (Virtual Corporation, 2003), has been relatively general in
relation to defining all the potential motivating factors and barriers to creating a BCP. The Virtual
Corporations Business Continuity Maturity Model was developed to identify the level of
preparedness, but did not identify the reasons why organizations plan or fail to plan for business
disasters. The proposed study's findings are expected to contribute to the existing body of
knowledge by providing a current assessment of the primary motivators and barriers for
implementing a BCP. If leaders of corporations were aware of methods to offset the primary
barriers and employed the primary motivators, they may be more likely to invest the time and
energy necessary to become properly prepared for an unexpected crisis event.

4
Research Questions
For the targeted Bahrain organizations, the research addresses the following questions:
1. What are the primary motivating factors to BCP planning reported by Bahrain's small
business leaders who have implemented a detailed business continuity plan?
2. What are the primary barriers to BCP planning reported by Bahrain's small business
leaders that have no plan in place?
3. To what extent, if any, is there an association in the levels of detail in the BCP based on
industry type (service or manufacturing)?
4. To what extent, if any, is there an association in the levels of detail in the BCP based on
an organization's size (based on annual sales)?
5. To what extent, if any, is there an association in the levels of detail in the BCP based an
organization's size (based on number of employees)?
Definition of Key Terms
The following terms are central to the topic and/or research of crisis management. If no
reference is cited, the definition has been developed and proposed for use within the study.
Avoidance. "Avoidance has the goal of preventing a crisis from happening. The potential
crisis should be identified, understood, and addressed and, in doing so, avoided. The Risk
Assessment can be used to identify the specifics of potential crises, including any precursors and
warning signs" (ASIS Commission on Guidelines, 2005, p. 16).
Business continuity management. "The act of anticipating incidents which will affect
mission-critical functions and processes for the organization and ensuring that it responds in a
planned and rehearsed manner" (Gallagher, 2006, p. 1).
Business continuity plan (BCP). A BCP is an ongoing process supported by senior
management and funded to ensure that the necessary steps are taken to identify the impact of
potential losses, maintain viable recovery strategies and plans, and ensure the continuity of

5
operations through personnel training, plan testing, and maintenance (ASIS Commission on
Guidelines, 2005, p. 7).
Business impact analysis. "The review of scenarios that attempt to predict the impact that
a crisis event will have on an organization's operations" (Laye, 2002, p. 17).
Crisis. "A decisive moment or a turning point. A crisis is a crucial event, specifically the
culminating point of business prosperity, following which a period of liquidation may ensue"
(Albrecht, 1996, p. 7).
Crisis management. "Intervention and coordination by individuals or teams before,
during, and after an event to resolve the crisis, minimize loss, and otherwise protect the
organization" (ASIS Commission on Guidelines, 2005, p. 7).
Crisis management team. "A group directed by senior management or its representatives
to lead incident/event response comprised of personnel from such functions as human resources,
information technology facilities, security, legal, communications/media relations,
manufacturing, warehousing, and other business critical support functions" (ASIS Commission
on Guidelines, 2005, p. 8).
Deterrence and detection. "The purpose of deterrence and detection is to make a hostile
act (or activity) more difficult to carry out against the organization or significantly limit, if not
negate, its impact. The BCP should address and include overall deterrence and detection
measure" (ASIS Commission on Guidelines, 2005, p. 16).
Emergency. "An unforeseen incident or event that happens unexpectedly and demands
immediate action and intervention to minimize potential losses to people, property, or
profitability" (ASIS Commission on Guidelines, 2005, p. 8).

6
Fire disaster. A fire disaster is a structure fire that causes interruption to the daily
operations of a business or organization.
Primary motivating factors and primary barriers. The motivating factors are defined as
the primary reasons respondents provide for why a BCP was implemented within their
organization. The respondents would choose from a list of potential motivating factors and
would be able to write in any unspecified factors. The primary barriers would be the identified
reasons why an organization has not implemented a BCP. The respondents would also be given a
list of potential reasons for their hesitation to implement a plan and would be provided an
opportunity to write in any other barriers.
Project initiation. Project initiation is the first phase of a crisis management plan. In this
phase, management approves the crisis management program to begin (Laye, 2002).
Readiness. Readiness is the state of being ready and lacking hesitation (Websters, 1989).
Recovery plan. A recovery plan is the steps an organization's leaders have developed and
are prepared to take to recover from a crisis or unexpected event.
Risk assessment. Risk assessment is the review of potential crises that a business leader
may be faced with, and the magnitude and frequency of the event are clarified (Laye, 2002).
Small business. Small businesses are organizations that employ fewer than 100
employees and have sales between $0.00 and $5 million.
Tornado disaster. A tornado disaster is the destruction of property or supply flow
resulting from a tornado that interrupts the daily operations of a business or organization.
CHAPTER 2: LITERATURE REVIEW

7
Business Continuity
Though there have been a lot of definitions of business continuity and what it requires,
there is no way to have the perfect plan for all disruptions or disasters. The fundamental idea of
business continuity aims to manage various types of business risks that have a huge impact on a
company, responding satisfactorily in extreme situations (catastrophic events) with pre-defined
business continuity plans (BCP).

Definition of Business Continuity

There are two main definitions of business continuity. The Publicly Available
Specification 56 (PAS 56) defines business continuity as a holistic management process that
identifies potential impacts that threaten an organization and provides a framework for building
resilience and the capability for an effective response that safeguards the interests of its key
stakeholders, reputation, brand and value-creating activities. In the British standard definition of
business continuity called BS 25999, the British Standards Institute (BSI) redefined it as the
strategic and tactical capability of the organization to plan for and respond to incidents and
business disruptions in order to continue business operations at an acceptable predefined level.
The PAS 56 definition focuses on the dependents and effects of business continuity. The BS
25999 definition concentrates on the operational components of business continuity. Table 2
defines some of the terms used in business continuity.

8
Table 1: Elements of business continuity & disaster recovery

Figure 1 illustrates the productivity of an organization during the invocation of a BCP.

After the disruption occurs, the emergency response begins. When the situation is stable enough
for recovery to occur, the recovery stage begins.

Figure 1: Timeline of a business continuity plan

9
Once the recovery time objective is met, the most critical activities can resume. After the
restoration of all normal operations is complete, the continuity plan returns to the standard
operating procedures. The time to recover (TTR) must be less than or equal to the maximum
acceptable downtime (MAD). The maximum tolerable period of downtime (MTPD) is the period
that an organization can go without minimal activity, which usually determines the recovery time
objective (RTO). The recovery point objective (RPO) is the state of organizational resources to
which the recovery stage needs to return the organization for normal operations.

Business Continuity in Middle East

Unplanned disruption amounts to about $588 billion per year (UWBARC, 2012). The
cost of not being prepared in a time of crisis is exponential compared to the cost of allocating
proper resource and planning in business continuity. According to a study conducted by Houston
advance research center, it was noted that 30 to 40 percent of the companies which experience a
disaster never reopened. Pre Katrina, the average amount spent in USA was 2.5 billion on
recovery. It is also interesting to note that every dollar spent on being prepared saves up to 7
dollars during recovery. Comparing this to the fact that the occurrence of natural disaster has
increased by 40% over past fifteen years (UWBARC, 2012)
Business continuity management is a holistic approach to, availability of important
process during disruption. They could range from manmade events, natural disaster to failure in
information technology. In a report published by Quorum (2013), Quorum disaster recovery
report for Q1, 2013, the information gathered from global companies revel that, though natural
disaster could be termed as a major threat, the most common type of disruption that effect SMEs
were attributed, to human error at 22%, hardware at 55% and software failures at 18%. This

10
accounted to nearly thirty hours of downtime on an average (Quorum, 2013). Especially
considering SMEs these down time would have a drastic effect on the retaining customer loyalty
and the effect it has on the brand image.
Contingency plans are important for any organization, they are the best insurance for any
organization. During the initial stages the contingency plans were developed keeping in mind
disaster recovery centers, but however during the nineties the scope of disaster recovery went
beyond the data centers which was the core of disaster recovery (Moore, P. 1995), to address
organization such as telecommunication, employee records, that are vital to risk environment,
products and services and infrastructure in terms of the facility (Moore, P. 1995). Salman, S
(2006), in his research notes that organization towards the west are focusing more on disaster
recovery. This has been driven by terrorist activities such as 9/11, 2004 Madrid bombing and
natural disasters such as 2005 Tsunami in Asia and Katrina in USA. This has increased budget
allocation more than a million dollar with an increase of 11% post 2005. According to Salman
this would increase in years to come.
In the west the Business continuity has become a serious concern and business are
focusing heavily recovery strategies. Apart from the businesses, regulatory pressure in these
countries are also heavily influencing the business to focus their attention to the subject. The
bodies that influence them in these countries are

U.S. Health Insurance Portability and Accountability Act of 1996.

BASEL II Accord.
National Association of Securities Dealers (NASD) 3510.

Middle East region is experiencing an unprecedented boom, owing to the increasing cost
of petrol and petrol based products. Most of the countries and business are financially sound.
With organization looking to the future BCM is slowly becoming part of the organizations

11
development strategy, its fair to say that the awareness is still in its infancy stage. Many
companies have looked at disaster recovery but is still being led by the IT department. This
clearly demonstrates the weakness and inadequate awareness in the market (Pawaskar, S., 2008).
To add to that the training part of BCM is still under development, according Lindstrom, J.
(2012) implementation of business continuity management in an organization should especially
be targeted in the training process for employees and senior management.
According research conducted by Pawaskar, S. (2008), the failure for the process in East
is largely attributed to the fact that the process is headed by IT and solely seen as an IT based
process associated to information continuity management. Apart from the problems can also be
attributed to the expatriate workforce, when job security is a prime concern. Though information
can be made available there should be people to use the information in an event of crisis. To add
to the training aspect, companies lack awareness in building resilient business culture in general.
(Momani, N.M & Fadil, A.S, 2013).
The major human factor due to the large expatriate population is one of the biggest
concern that would need to be addressed while looking at developing business continuity
management in the region. This was evident during the gulf war, where most of the expatriates
evacuated the country they took the knowledge along with them (Pawaskar, S., 2008). Similar
episodes were clearly evident in Bahrain during the 2009 riots, expatriates had to leave the
country and many business were at standstill. Most of the Middle East countries are moving their
recovery sites to UAE due to available infrastructure and stability, this could prove
counterproductive as UAE lies in the fault line, and during the past five year UAE has been
experiencing mild tremors. This approach could be questionable.

12
History of Business Continuity
When Adam Smith defined the concept of a business process and the division of labor,
business processes became the foundation of modern business. The end of the 20th century
ushered in IT, outsourcing, and just in time delivery of supplies and services, which created a
very complex business environment where processes depend on other processes with numerous
participants. Ardunini and Morabito noted that the greater complexity of new environments
requires organizations to continually reassess how they may keep abreast of changes and exploit
them to their advantage. The origins of business continuity began with the introduction of
computing to the financial industry in the 1960s.
With the increased dependence on technology, financial institutions realized that they
needed to address the recovery from IT disasters. Originally called disaster recovery, certain
industrial sectors, like finance, utilities, and health, started building plans in the 1970s for
dealing with disruptions of their IT infrastructure. In the 1980s, the advent of personal
computers led to an explosion of IT within businesses and a decentralization of IT services. In
addition to centralized data and IT resources, planners now had to account for spreadsheets,
documents, and programs spread all over the organization, requiring a better auditing of IT
services. The 1990s introduced the idea of just in time delivery and higher reliance on IT and
suppliers external to the organization. The advent of electronic communication and ecommerce
changed the speed at which business transactions occur. Without IT and Internet resources, some
organizations could fail within hours of a disruption. Table 2 illustrates the average impact cost
per hour in dollars from a disruption to an organizations web site for different types of
businesses.

13
Table 2: Average Cost per Hour Impacts on Businesses of Web Site Downtime

Up through the early 1990s, production-based economies focused risks to resources that
were tangible in nature, associating them with physical facilities, equipment, and locations. In
todays knowledge-based economy, the resources that are at risk are becoming more intangible,
like intellectual property, brand equity, management competence, staff experience, and
reputation. Any adverse effect on these resources has an immediate reflection on earning drivers,
shareholder confidence, price of a share, and an organizations bottom-line. The focus of
business continuity changed after the events of September 11, 2001. With the collapse of the
World Trade Center towers, nearly 18,000 businesses were dislocated, disrupted, or destroyed.
Almost 130,000 people lost their jobs. Business continuity plans before this only dealt with
supporting information technology and physical infrastructure, not people or processes. The
losses of personnel and experience are much harder to recover from than the loss of technology.
This lesson became more evident with such events as pandemic flu threats, economic crashes,
natural and man-made disasters, like Hurricane Katrina or the explosion of BPs Deepwater
Horizon oil well. Swartz describes the basic mindsets and assumptions over the past forty years
about business continuity, summarized in Table 3.

14
Table 3: Exploring Assumptions about BCM Provision

Since the beginning of the 21st century, continuity of supply chains has become more
important to businesses. Dealing with capacity and flow is a key component of supply chain
management. One could make the argument that the continuity of any process is based on the
capacity of supplying resources and the flow of resources between activities or tasks within the
process. The loss of a critical resource or the disruption of the flow is by definition a break in the
continuity of a process.

Timeline of a Business Continuity Plan

The goal of a business continuity plan is to reduce both the impact and time to recovery
after an incident. Tan describes how operations degrade and recover over time, depending on the

15
implementation of a business continuity plan, illustrated in Figure 3. Without a BCP, operations
could come to a complete halt or below an acceptable or minimal limit defined for providing
services. The restoration to normal operational level takes a long time. With a BCP
implementation, there is a higher level of production operations during the recovery period and a
quicker time to recovery.

Figure 2: Business Continuity Planning time line

Small Businesses in Disaster

Determining Small Business Scale
What dictates a small business operating in North America? Many variables go into
determining a business size. According to a 2010 article in News Business Daily, a guide for
start-ups and small businesses, Hernandez states, "the Small Business Administration's size
standards for small businesses are based on average annual revenues and number of employees"
(Hernandez, 2010). This average is generated and referenced to specific business codes assigned
by the U.S. Census Bureau, U.S. Department of Labor, Occupational Safety & Health

16
Administration (OSHA), and the Small Business Administration (SBA). In Hernandez's article,
he further outlines the small business scale by describing the maximum for revenue generation,
as well as, employee depth for an individual business.
A business must make between or below $750,000 and $35.5 million and have between
or below 100 and 1,500 employees depending on the industry. For example, a business
that generates $1 million in revenue in an industry with a $750,000 size standard would
not be considered small. (Hernandez, 2010)
Referring to the Small Business Administration (SBA) for specific examples, under the
Agriculture classification, a soybean farmer has no cap on persons employed; however, they are
limited to $750,000 in annual revenues. Whereas under the Manufacturing classification, pulp
mills have no limits on annual revenues but are limited to a maximum of750 employees to
remain a small business (SBA, 2010). Who is employed by small businesses in the U.S., and
what role do small businesses play in the socioeconomics of a small town?

Socioeconomics of a Small Business

Small business plays a major role in local economies according to a case study from the
Institute for Local Self-Reliance. In Mitchell's research of eight locally owned businesses in
Maine versus generic "big box" retail stores, she determine what percentage of profits were
returned to the local economies of Rockland, Camden, and Belfast, Maine; revenues in the form
of community donations, wages to employees, taxes, and monies spent with other businesses
within their general vicinity (Mitchell, 2003). The study focused on $100 and what percentage
stayed locally opposed to being sent to corporation's home offices out-of-state. The study,
conducted in 2002, "found that the eight businesses spent 44.6 % of their revenue within the

17
surrounding two counties, Knox County and Waldo County. Another 8.7 % was spent elsewhere
in the state of Maine" (Mitchell, 2003).
The opposite was true for the "big box" retailer where 14.7 % remained within state,
mainly in the form of wages and taxes, thus outsourcing product and services outside the state of
Maine (Mitchell, 2003). It should be mentioned however, as for the "big box" retailer, many of
the financial records used for the study were gathered from public record opposed to directly
from the corporation. This case study provides a perfect example of the importance of small
businesses within local communities for employment wages, taxes, and general supply and
demand.

Small Business in Disaster, Employees Perspective

Looking at employment through small businesses, what effect does disaster play on
them? Socioeconomics after all is the combination of social and economic norms. In Belasen and
Polachek's paper, How Hurricanes Affect Wages and Employment in Local Labor Markets
(2008), they researched data from the state of Florida between 1988 and 2005 to determine the
socioeconomic trends in relation to hurricane landfall. They discovered in category one to three
hurricanes the direct polled area suffered a 1.47 % increase in unemployment with .23 % in
neighboring counties (Belasen & Polachek, 2008). As for category four and five hurricanes, a
4.76 % increase in unemployment was experienced while outlying counties experienced a .79 %
increase. According to their research, a one percent increase was considered significant. An
interesting finding from their study indicated an immediate spike in earnings following a
disaster; however, this is short lived, partially due to cleanup efforts. Though not sustained,
economies receive a quick boost to aid in their recovery.

18

Small Business Factors in Disaster Recovery

In identifying why businesses are forced to close as a result of a disaster, Dahlhamer and
Tierney conducted research following the Northridge, California earthquake of 1994. Their work,
entitled Rebounding From Disruptive Events: Business Recovery Following the Northridge
Earthquake, identifies deficiencies in businesses by size, financial stability, and age of business
to determine what caused or what factors could have contributed to their closure. According to
the research, business survival following a large disruption is directly related to the age of the
business. Dahlhamer & Tierney (1998) state, "New organizations must invest time and effort to
establish new roles and socialize members. They are also forced to compete with existing firms
to secure customers and establish links with other relevant actors".
In addition to age, businesses must address scale in disaster recovery statistics. Small size
also poses a liability for businesses. Tax laws, government regulation, competition for
labor, and the ability to raise capitol all favor large organizations. Large firms tend to
have more resources and better access to credit, and they benefit more from government
programs. (Dahlhamer & Tierney, 1998)
Smaller firms do not have the same access to professional consultants, as do the larger
firms; this is partly due to limited cash flow. Another contributing role of businesses survival
following a large disruption is financial stability, "Small firms seem to be particularly vulnerable
to disaster impacts and losses because they tend to have few cash reserves and generally cannot
afford to undertake various preparedness and mitigation measures, such as purchasing business
interruption and hazard insurance" (Dahlhamer & Tierney, 1998). Many factors are related to a

19
business's survival and whether they have prepared for a large-scale event. Dahlamer and Tierney
sum up small business socioeconomics and disruption perfectly.
We hypothesize that disaster-induced business interruption should also affect recovery
outcomes. Businesses forced to close their doors have immediate cash flow problems.
Employees lose work, and customers who most go elsewhere for goods and services may
not return when the business does reopen. (Dahlhamer & Tierney, 1998)

Disaster-Proof Cities
In a 2011 Forbes article by Pentland entitled America's Most and Least Disaster-Proof
Cities, the top five and lowest five cities are identified in a Center for Disease Control (CDC)
survey in 2010. Cities cited in the article are Portland, ME; Pittsburg, P A; Fresno, CA;
Birmingham, AL; and Albuquerque, NM: identified as the least-prepared cities and Washington,
DC; Albany, NY; Chicago, IL; Dover, DE; and New York City, NY as the most prepared cities in
the United States.
In 2004, the CDC launched a preparedness initiative coined the Cities Readiness
Initiative or the CRI which identified 72 major metropolitan area as stockpile locations for
vaccinations in the event of an epidemic (CDC, 2012). Along with the study, major metropolitan
areas were polled in relation to planning for major incidents to include but not limited to: nuclear
meltdowns, terrorist attacks, and pandemic flu (Pentland, 2011).
Referring back to Forbes' list of most and least prepared, cities in the most, Washington,
DC, small businesses account for 86 % of all firms in the state according to the U.S. Census
Bureau and 47 % of the workforce (U.S. Census, 2008). As for the least prepared city,
Birmingham, AL, small businesses account for 97% of all firms in the state and 49% of the

20
workforce (U.S. Census, 2008). Looking at the data, it appears to be critical that small businesses
prepare for disaster as it can drastically impact the socioeconomics of the surrounding area.

Business Continuity Planning

The Business Continuity Planning Concept
The term Business Continuity and Resilience "began in the 1980' s [when] some
companies started to develop enterprise risk management (ERM) programs building on the
'circle of risk' first conceptualized in 1974 by Hamilton, risk manager of Sweden's Statsfortag
AB" according to a 2011 report published by IBM addressing current and future trends in BCP.
Furthering the history of BCP, "The idea was to link different risk management activities such as
identification, assessment, control, financing, monitoring, and communications into a continuous
process" (IBM, 2011) thus being born what we know today as comprehensive business
continuity planning. Many definitions are used to describe BCP's; however, the best can be found
in Thomas' blog in the Disaster Recovery Journal. The business continuity plan is the "process of
developing and documenting arrangements and procedures that enable an organization to
respond to an event that lasts for an unacceptable period of time and return to performing its
critical functions after an interruption" (Thomas, DRJ, 2012). Send Word Now, the industry
leader in emergency notification and incident management furthers the definition to BCP in their
paper entitled, The Lightweight Solution to Heavy Risk. It states, "A proper business continuity
plan prepares an organization to continue operations and key functions in a timely manner and to
minimize the impact of crisis, both high and low profile" (Send Help Now, DRJ, 2011). To
complement their definition, "By thinking ahead, evaluation risk, and preparing strategies for

21
emergencies, organizations can significantly enhance their chances of responding successfully
whenever a time-sensitive situation arises" (Send Help Now, DRJ, 2011).
When looking to small businesses in relation to BCP "the current disaster preparedness
model doesn't take into account the small business owner" (Minzes, DRJ, 2011) says Minzes. In
his article Small Business Disaster Preparedness, Minzes identifies the needs and shortcomings
of small businesses and Bep.
The current model accounts for only the recovery of 'critical services and operations.' If
you ask a small business owner what the most critical part of their business is that must
be recovered after a disaster, they are likely to tell you the same thing. Everything is
critical. (Minzes, DRJ, 2011)
According to Minzes, most small business owners consider every source of revenue as a
means to sustain their business; thus if any disruption to income is experienced, it could very
well critically impact the entire business. Is BCP the answer for small businesses in disaster
recovery? It can and does help small business recover following a disruption, in part by
identifying critical functions and emplacing stop gaps to ensure their continuity. The Business
Impact Analysis is responsible and for a small business owner strapped for cash and additional
resources can be the game changer in business resilience.

Business Impact Analysis

Identifying critical business functions and referencing them against potential hazards is
the heart of conduction a Business Impact Analysis (BIA).
The most important factor in any recovery plan knows what needs to be recovered.
Disaster recovery is not just knowing what your products and services are, but knowing

22
all of the elements that are required to enable those products and services to generate.
(Minzes, DRJ, 2011)
For example, a simple task of locating up a specific auto part at a customer's request
requires a stored onsite database, a computer terminal to facilitate the request, and possibly an
Internet connection for detailed information. Then comes the possibility the product is not at the
store's location, a search will need to be fielded for locating the part elsewhere. A simple product
request has evolved into a four-step process, each of which is required to complete the modest
task. This is what lies at the heart of a solid BIA.
A more in-depth analysis at a BIA can be found looking to the Disaster Recovery Institute
International (DRII). According to the DRII, the BIA "identifies the impacts resulting from
business interruptions that can affect the organization techniques that can be used to quantify and
qualify such impacts. Identifies time-critical functions, their priorities, and inter-dependencies so
that recovery time objectives can be established" (DRII,2011). How might one go about
conducting a BIA? According to Wilson-Jones, CBCP, in her article Didn't Do a BfA, "A through
process analysis is what tells you which processes or functions are critical to the business, which
processes and functions are not critical". Just like the earlier mentioned business function of the
auto parts store, mapping out the functions for all business processes will provide detail into
what is critical and what is not. This can offer the business owner/planner the opportunity to
eliminate time wasted on non-essential business functions and focus on terminal ones. WilsonJones does a great job of exhausting the benefits of conducting a BIA.
When conducted fully, the BIA will lay out the big picture of the most critical or 'life
blood' operations. A BIA will also do the following needed to stop the bleeding: define
required recovery timing for data and operations recovery, establish essential staffing

23
requirements identified in the planning stage, and identify critical business partners,
vendors, and other resources. (Wilson-Jones, DRJ, 2011)
Further examination into the three points Wilson-Jones highlights in her BIA concepts:
The first, "Define required recovery timing for data and operations recovery" (WilsonJones, DRJ, 2011) is also referred to as Recovery Time Objectives (RTO). The International
Organization for Standardization (ISO) or ISO 22301, Business Continuity Management
Systems defines RTO as, "Target time set for resumption of product, service or activity delivery
after an incident" (IS022301, 2012) which can be the amount of time a business can endure a
disruption without its directly impacting production or profits.
Second is to, "Establish essential staffing requirements identified in the planning stage" (WilsonJones, DRJ, 2011). Some critical system processes can run from alternate facilities; however,
personnel are required, and often, experienced personnel are required to accomplish a specific
task. During the BIA process, specialized personnel are identified and provide the business
owner with this indication during the response planning process.
Third is, "Identify critical business partners, vendors, and resources" (WilsonJones,
DRJ, 2011) otherwise known as critical vendors, mutual aid, and understandings. Some
processes in a business require very specific parts or tools to accomplish a task. If the supplier
happens to experience a disruption, the supplied business will most likely also suffer a
disruption. The same can be said if a business supplies specific tool/parts to a customer base. If
the business experiences a disruption, it can utilize industry colleagues to assist in the supply and
demand needs of a customer base until business operations are resumed following a disruptive
event. How are the best practices in BIA currently fortifying small business resilience?

24
Business Continuity Best Practices
What is driving businesses to become more resilient to disruption? According to a 2011
IBM report entitled Key Tends Driving Global Business Resilience and Risk "the most important
force driving this trend is a growing sense that the business environment is becoming less
predictable. Companies need to be better prepared for unexpected events that range from
economic shifts to natural disasters". According to IBM, the need is also being driven by
"stakeholders" demanding more from businesses senior officials.
One look into current BCP trends is IBM "Six Key Facets of Resiliency" described in
their 2011 paper entitled, The Evolution of Business Resiliency Management: A Proactive Guide
to Helping You Strengthen Your Business Resiliency Management Program. Shown in Figure 1,
IBM provides a road map of sorts outlining an organization's business structure and stakeholders.
This map is used during the BIA planning process to display all portions involved. According to
IBM (2011), "Viewing a business in this manner also helps enable the identification of crucial
interdependencies between business processes and the information technology [tools] that enable
them".

25
Figure 3: IBM Business Resilience Framework

Figure 1. Used during the six key facets of resiliency business continuity planning
process IBM, 2011, IBM Global Services, The evolution of business resiliency management: A
proactive guide to helping you strengthen your business resiliency management program, p. 4.
Copyright 2011 by IBM Corporation.

To complement IBM's resiliency framework, the global intelligence firm IDC has
identified a list of the top five business continuity best practices
1. Assign continuity and recovery professionals to develop plans and coordinate between
businesses.

26
2. Prioritize and tier applications and establish service level agreements (SLA) for each tier
in a concert with the line of business (LOB.) Identify cost of downtime for each tier or
application.
3. Develop service catalogs that define set SLAs from which LOBs can choose.
4. Ensure infrastructure redundancy (networking, power, cooling, telecom.)
5. Run periodic testing of plans, ideally quarterly, with published results. (DuBois, IDe,
2011, p. 4)
Referring to the first Best Practice of assigning a continuity professional, as a disclaimer,
small businesses might not have the resources to hire a private consultant; however, some might
argue by hiring an industry professional a better resulting product is likely. Prioritizing tier
applications will provide the end user with a quasi road map for what has to be addressed in
order for the next phase in recovery to begin. This is where SLAs come into the picture. An
outsourced procedure or tool may be required, and by completing this step in the process,
agreement can be met prior to a disruption and to speed the recovery process.
As for developing a service catalog, in his article Small Business Disaster Preparedness,
Minzes identifies service catalogs development and how they are critical to small business
owners as significant factors. Shown in Figure 2, Minzes has developed a flow chart for the
service catalog planning process.

27
Figure 4: Product and Services Catalog Development

Figure 2. Product and services catalog development flow chart by M. Minzes, 2011,
Disaster Recovery Journal, Small Business Disaster Preparedness. Copyright 2011 Disaster
Recovery Journal.

Once a specific product/service is identified, the flow chart provides a basis for critical
thinking and all that is necessary for the product/service to be completed. What supply lines are
necessary to provide tools or parts? Are there any specialists on the staff who are the sole person
responsible for completing the task? Is there any specific computer hardware or software
necessary to accomplish the task? Does the product/service require specific storage regulations
that need to be addressed if operating in an alternate location? And finally, are there any other
support elements that need to be addressed in order to complete the process (tax regulations,
legal representation)? All of these are great questions, and answering them will lead to a precise
and workable BIA. Ensuring infrastructure redundancy will naturally flow conducting a proper
BIA with the use of the chart in Figure 2.

28
Finally, running periodic testing is a key element to any BCP and something that should
not be over looked. With a proper test and after action report, corrections or updates to BCP are
highly likely, and will ensure a speedy recovery following an interruption.

Business Continuity Challenges

Wilson-Jones in her article for the Disaster Recovery Journal, Didn't Do a BfA, explains
the basis of challenges relating to BCP.
Within the last 10 years, many incidents, emergencies, and disasters have occurred that
confirms the truth behind the adage, 'It's no longer if, but when.' So continuing down the
path of believing BIAs are a waste of time and resources will ensure clients' interests are
jeopardized and at risk, not to mention the risk of continuity of business operations and
human resources. (Wilson-Jones, DRJ, 2011)
At the base of any business conversation on preparedness is the cost versus benefit
argument (among others). In John Mitchell's Are You Getting Value from Your BIA, "The BIA
process can be long and difficult - no matter what data collection method is used". Is the return
on your BIA investment (time, manpower, and resources) offset by the value of the results
(Mitchell, eBRP, 2011)? Wilson-Jones (2011) outlines some of the costs as a result of not
conducting a BIA or BCP: priorities following a disruption are unknown; employees will not
understand their roles in the recovery process; no critical resources will have been identified;
communications with employees, business partners or worse, customers will be slow or nonexistent. Second to cost versus benefit, what are some other challenges facing a BCP?

29
DuBois (2011) from IDC indicates the number one challenge facing the implementation
of a BCP is the sheer expense. Once the planning process is completed, new processes are
initiated to offset the findings in building a stronger infrastructure.
This expense maybe something businesses are not willing to incur or are without funds
for allocation. Some of the capital costs associated with implementation are, "[computer]
hardware, network infrastructure, remote disaster recovery sites, and infrastructure at remote
offices" (p. 3).

Business Continuity in Practical Application

"On February 7,2011, at 7:45 p.m., smoke detectors were tripped at Pitney Bowes' largest
mail services presort facility in Grand Prairie, Texas" (Oxton, EMM, 2011). This chilling tale
starts off grim and only gets worse; however, due to prior business continuity planning, this
particular story ends on a lighter note with lessons learned and "98 % customer retention rate - a
testament not only to the teams and plans in place, but also the high levels of understanding,
encouragement and support provided by customers" (Oxton, EMM, 2011). According to his
article, Tips for Creating a Plan that Addresses the 3 Key Phases of Business Continuity, in the
December edition of Emergency Management Magazine, Oxton states Pitney Bowes' success can
be attributed to drawing up response plans months earlier. As a result of the companies
preplanning, mail-sorting service continued without interruption due to a secondary facility being
established and a service agreement being reached. The following are the key components in
BCP after an incident.
As for the plan itself, senior leadership should initiate the BIA, involving cross
departmental teams to identify all business functions (Oxton, EMM, 2011). This promotes buy-in

30
for the planning process and also ensures all business functions are properly addressed. The BCP
should provide a "detailed, step-by-step primer on what to do, when to do it, who to bring in and
how to follow through" (Oxton, EMM, 2011). According to Oxton (2011), "The best plans
include check-lists and priorities that are easy to follow during stressful emergency situations".
One very interesting point Oxton makes addresses employee overturn. He states that "the
business continuity plan must be written by job function rather than by the employee's name"
(Oxton, EMM, 2011) to guarantee that anyone who picks up the plan will have an understanding
of their position while ensuring no holes are created during the recovery process.
During the BCP implementation phase, looking at the fire and recovery efforts, Oxton
touches on some critical points, all of which made a major difference for Pitney Bowes':
Ensure Employee Safety for the evacuation process to include routes, shutdown
procedures and headcounts.
Cooperate with local authorities and let trained professionals do their jobs without
interference.
Secure the data center. If the risk is too great, be sure to have a copy of the IT recovery
plan available from an alternate location. This can also be said for secure client
information.
Notify customers immediately so they can begin their own continuity practices.

This will ensure a solid relationship is forged. Personal outreach from senior staff weighs
heavy on the relationships of customers.

Immediately contact all associated recovery partners so they can ramp up operations.
Continue to keep the lines of communication open at all times with employees,
customers, and assisting partners.

31
Begin disaster restoration services, even while the disaster is unfolding. (Oxton, EMM,
2011)
Finally, Oxton repeatedly identifies in the article as the reason for Pitney Bowes' success
was maintaining a line of communications, as well as, knowing and understanding any and all
contractual obligations and conveying them to employees. This will ensure customer's needs are
being met thus solidifying relationships. Again, Pitney Bowes' was able to obtain a 98%
customer retention rate following the largest disaster in their history.

Future of Business Continuity Planning

What does the BCP industry have in store for the future? Arguably, data back-up is the
next frontier in BCP. As we move to a more technologically driven society and access to goods
and services as in minutes and hours opposed to days and weeks, the demand grows for faster
and more reliable data transfer. This new business concept has led IT professionals to focus as
their "primary objectives - to recover from - disruptions and return to a normal operating state as
quickly as possible" (Riverbed, 2011) according the a report from Riverbed Technologies; one of
many companies offering data backup via cloud computing. In the report, Disaster Recovery
with the Public Cloud and Whitewater Storage Gateways, the idea that "all data is not created
equal" (Riverbed, 2011) is expressed. Data to a computer is the same no matter the type;
however, according to Whitewater, to the end user it is not. Customer file data, if lost, could lead
to a potential disaster: how much have they bought, which locations to ship specific product to,
or tax identification for accounting. These are all great scenarios for loss of data. On the contrary,
performance reviews from two years ago, highly unlikely production will slow if this data is not
recovered in a timely manner.

32
According to UC Berkley's Reliable Adaptive Distributed Systems Laboratory (2009),
Cloud Computing provides end users the ability to operate software stored and facilitated from
remote servers. Displayed in Figure 3, we see how a piece of software is stored at a server farm,
transmitted through a network, and offered to the end user by way of virtual connection.
Figure 5: Cloud Computing

Figure 3. How Cloud Computing works (Software as a Service (SaaS). Above the
Clouds: A Berkley View of Cloud Computing by M. Armburst, A. Fox, R. Griffith, A.D. Joseph,
R. Katz, A. Konwinski, G. Lee, D. Patterson, A. Rabkin, I. Stoica, and M. Zaharia, 2009, UC
Berkley Reliable Adaptive Distributed Systems Laboratory. Copyright 2009 by UC Berkley

"Tape Vaulting" and "Offsite Disk" were and are currently standard operating procedures
for data back up; however, during a system interruption, tapes must be accounted for and
manually brought to a site just as a hard disk will be required to do so (Riverbed, 2011). This will
require more equipment to restore service at an alternate site and could potentially lead to more
down time due to transporting the tapes or hard disk. With the institution of cloud computing,
once at a remote site, all that is needed is system access to retrieve any and all stored data and

33
software programs. The draw back at this time is size limitations; however, with critical planning
on recovery time objectives, different forms of data can be sourced through various mediums.

Small Business Insurance

Insurance in Disaster
Berz, the head of the geosciences research group at the Munich Reinsurance Company,
Munich, Germany, offers a spot on description of Insurance:
Insurance is financial preparedness against loss. It makes the effects of the occurrence of a loss
bearable for the individual policyholder, and does so at a price while as a rule is [favorable]
because the risk of loss is distributed among a great many parties and thus the profit-and-loss
curve is thus leveled out. (Berz, 1994)
Hurricane Katrina, which made landfall on September 8, 2005, is the most costly
catastrophic event in history, with projected insured losses in the range of $40 to $60 billion. The
most costly prior natural catastrophe was Hurricane Andrew in 1992, which cost insurers $22.3
billion. The most costly man-made disaster was the September 11,2001 terrorist attack on the
World Trade Center (WTC) in New York, which resulted in about $40 billion in insured losses.
(Cummins, 2006)
The 1971 San Francisco earthquake impacted the community with a property damage bill
of nearly $500 million. According to Kunreuther's research for his paper, Causes of
Underinsurance Against Natural Disasters (1984), he discovered that only $32 million of the
damage was covered by insurance. After further research, he concluded "as a result, the Small
Business Administration disaster loan program provided over $257 million in aid to - businesses;
$165 million - in the form of forgiveness grants and the remaining amount in the form of3%

34
loans" (Kunreuther, 1984, p. 207). The disclaimer here is accounting for inflation between 1984
and to date; many small businesses would have to be financially solvent enough to secure a 1984
era 3% recovery loan.
Many small business owners solely rely upon their business insurance policies to
recovery from a large-scale event. A Texas A&M University and Duke University collaborative
paper addressed, Understanding Customer Expectations of Service in 1991 for the Sloan
Management Review. Three students set out to survey and hypothesize what customers expect as
a level of service from companies. What they found in reference to insurance was interesting.
According to the research, "Property and casualty insurance - business customers" felt, in order
for the insurance company to meet their full obligations, insurance companies were to, "pay up,
learn my business and work for me. I expect them to know me and my company and protect me
from a catastrophe. They should cover [my] risk exposure so there is no single big loss, and
finally, provide prompt service; fast claim service" (Berry, Parasuraman & Zeitbaml, 1991, p.
40).

Variations of Disaster Related Business Insurance

There are various forms of business insurance; however, few are as specific to hazards as
Business Interruption Insurance (BI) and specialty policies offered through the National Flood
Insurance Program (NFIP).
BI Insurance is nothing new to the insurance industry; in fact it has been around for over
a century according to Dempsey and Epstein. In their article, Re-examining Business
Interruption Insurance, the two make light of 1920 and the evolving of what we know today as
BI. Kahler, thought to be a "highly regarded professor of insurance at the Wharton School of the

35
University of Pennsylvania" (Dempsey & Epstein, 2002, p. 40) was one of the farmers. Kahler's
was to give, "due consideration to the experiences of the business before the date of damage and
the probable experience thereafter had no loss occurred" (Dempsey & Epstein, 2002, p. 40-41).
BI works with two major facets: Contingent Business Interruption and Service Interruption.
Contingent Business Interruption, "Reimburses lost profits and extra expenses resulting from an
interruption of business at customers' or suppliers' locations. Coverage is generally triggered by
physical damage to the property - which the insured depends to attract customers" (Dempsey &
Epstein, 2002, p. 42).
The provision for reimbursement is determined by the amount of time required to repair
or replace the dependent property. Service Interruption "pays for losses due to the interruption of
incoming utilities caused by physical damage to property that supplies utility services"
(Dempsey & Epstein, 2002, p. 42).
The NFIP was pioneered by the Federal Emergency Management Agency (FEMA) in
1968 in response to "private market failure" of many insurance companies "floods were
generally viewed as uninsurable" partly due to highly concentrated risk in specific areas; certain
high yield risk (Cummins, 2006, p. 357). The second purpose of the program was to "induce
individuals to protect themselves against flood disasters" (Kunreuther, 1984, p. 211). Some of the
misconceptions relating to the NFIP Insurance include:
1. Flood insurance is only available to homeowners.
False - Commercial structures can be insured up to $500,000 for the structure and
$500,000 for the contents but may not exceed the insurable value of the property
2. Federal disaster assistance will pay for flood damage

36
False - Before a community is eligible for disaster assistance, it must be declared a
federal disaster area. Federal disaster assistance declarations are issued in less than fifty
percent of flooding events.
3. You are not eligible for NFIP Insurance if your property has suffered flood damage in the
past.
False - Flood insurance is still available as long as the community is participating in the
NFIP program. (FEMA, 2010)
With many programs and policies available, what would lead a business owner to forego
insurance or not fully exhaust their options?

Reasoning Behind the Underinsured

According to Kunreuther (1984), "Uninsured victims of natural disasters may incur
severe financial loss which will affect well-being ... after a disaster the common lament is, 'I wish
that I had purchased insurance" (p. 206). Why do business owners fail to purchase insurance
coverage against disasters and disruptions? Kunreuther (1984), in his research feels this
phenomenon is related to the, "low probability - sever consequence syndrome" which few
individuals feel are untouchable against large potential losses resulting from a disaster. However,
according to Kunreuther "after the event they demand funds to help them recover" (p. 206) and if
the catastrophe is large enough, some funds may be available.
In the Economics Department of the University of Mexico, A study was conducted
examining the reasoning of being uninsured in, Buying Insurance for DisasterType Risks:
Experimental Evidence.

37
Even though natural disasters are inevitable, their timing and consequences are uncertain.
Preparedness, mitigation and insurance all provide relief from natural disasters, yet many
people to head warnings, remove themselves from harm's way, or purchase insurance
against loss. (UNM, 2000, p. 272)
According to the research, people's "perception threshold" explains the ability to ignore
the likelihood of an impact thus absolutely eliminating the thought that it will ever impact them
or their business.
The other concept in being uninsured is the potential cost vs. benefit scenario. As stated
earlier, some feel, in the event of a disaster, help will be available. On the other hand, there are
business owners who understand the importance of insurance but simply cannot afford enough
coverage to recover from a large-scale disaster. In high impact or impact trending areas, business
owners can experience higher than average premiums compared to other similar businesses
located in other geographic areas. This concept of varying markets, Cummins (2006) refers to as
"hard and soft markets" (p. 346) in his piece, Should the Government Provide Insurance for
Catastrophes. Insurance underwriters are tasked with pricing districts due to potential and scale
of loss. If the underwriter warrants an increase in premiums, Cummins (2006) states it would be
called a "hard market" as coverage is restricted thus causing prices to rise (p. 346). With
increased premiums, business owners could scale back their coverage and mitigate disaster with
other means.
This fluctuation in price and policy coverage has brought some industry professionals to
request that insurance agencies should employ specialized personnel who are specific to industry
markets. This idea of industry representatives was presented in Berz, The Insurance Industry and
IDNDR: Common Interests and Tasks. According to Berz (1994), "Specialists - who are in a

38
position to conduct state-of-the-art risk testing, who develop appropriate loss prevention or
reduction measures, and who collect and [analyze] worldwide loss experience and convert it into
proposals for improvement" (p. 328). Berz may have the answer to solving the problem of un
and under-insured small business owners.

39
CHAPTER 3: METHODOLOGY

Research Methodology
Research is a common practice used for the purpose of searching knowledge and refers to
all the scientific and systematic patterns to gather information on a particular research topic. It is
also referred to as a scientific process dedicated to serve the domain of investigation. The main
concept behind the research is to extract answer to the research questions that serve a particular
subject area, and to extract things that are not yet discovered, or are hidden. Every research is
conducted on the basis of certain research objectives, which can be classified into certain groups.
Research refers to a phenomenon that can be utilized for gaining new insights regarding a
particular field of study.
According to Creswell (2012), there are two broad categories of research strategies that
are qualitative and quantitative strategies. The qualitative strategy involves in analysing the
primary or secondary data that is non-numeric, it is usually analysed through the content
analysis, thematic analysis and by coding. The qualitative strategy involves interviews, case
studies, and analysing the previous researches to draw the results of research at hand. While the
quantitative strategy is all about collecting the numeric data through primary or secondary
resources and analysing the data statistically through SPSS and other software (Saunders et.al,
2011). The quantitative strategy enables the researcher to draw the results on the basis of
outcome of different statistical tests and numeric values.
In order to conduct this research, the researcher has adopted the quantitative strategy in
which the primary data will be collected through structured five point Likert scale, close ended

40
questionnaire. The data has been analyzed with the help of SPSS and has been interpreted to
support the research questions.

Quantitative Methodology
The strength of the quantitative research is that it provides with reliable data, quantifiable
factors, representing a generalized form of a population. Quantitative researches are also based
around a hypothesis, which needs to be proved by the conducted research. Quantitative research
is mainly dependent on statistical information and statistical information. These are dependent on
various samples and groups of data. This type of research is less time consuming in contrast to
that of qualitative research, which is more descriptive. Each research methodology has its own
way of gathering information (Kuo et.al, 2009). In the questionnaires and surveys the research
participants are provided with close ended questions, which lead to the extraction of statistical
information. In this research, the quantities research methodology will be applied on the close
ended research questions with the aim to gather statistical information. In this study, the
quantitative research methodology will be used. In this study, secondary and primary sources
will also be used to study Arab consumer perception about international products and services.
Multiple scales will measure the Saudi consumers product and county image. In this study,
multiple scaling will be used to measure consumer perception towards the international products
specifically made in Bahrain, Russia, Japan, Western and Eastern Europe.

Research Ethics
The choice of the thesis topic is based on the best approach and an examination of the
potential benefits of the corresponding topic. This thesis has a well-intentioned research. No

41
social, psychological, or financial harm will be conducted to any entity, group of people, or
organization due to this research. The ethical guidelines for conducting research have been
strictly followed in the thesis. The main ethical area considerations including informed consent,
voluntary participation, potential for harm, anonymity and confidentiality, communication of
results and so forth, have been considered in this thesis.
It must be the core aspect of any researcher to comply with the ethical standards defined
for the research. Every researcher must ensure this factor, as non-compliance of the ethical
standards can lead to various hazards for the researcher, and the conducted research. The
researcher must ensure that the sources used for the extraction of data are authentic, and are
published as per the research standards on the authentic mediums. Furthermore, while
conducting the research from the research participants, the researcher must avoid any kind of
research bias, like gender or class bias, etc. This research has been catered considering all these
aspects in mind.

Data Collection
Data collection is referred to as the process used for the collection of data from a defined
research sample, or research participants. This information is gathered on the basis of variables,
or research questions designed in a systematic pattern, or created hypotheses. The aim is to
extract the desired outcomes on the research area. The researchers have to ensure that the data
being collected is done via authentic resources and mediums that are more appropriate to gain
the research outcomes. It is a vital aspect in the domain of research and is included in any kind of
research, as the data collected has a direct impact on the research results. There are two types of
data collection methods: 1) Primary and 2) Secondary. As defined earlier, the research is based

42
on quantitative methodology; similarly the data collection for the research has also been done by
quantitative mediums.
To gain an up-to-date analysis of small businesses standards for disaster recovery, a
survey was chosen. The survey was generated and distributed through the Question Pro survey
creation website. To ensure proper distribution within the selected survey field, a link was
attached to an email from an .edu e-mail addresses opposed to utilizing Questions Pro's built-in
distribution tool. Upon initial testing, it was determined that using the website's distribution tool,
many email providers flagged the message as a "Spam" or "Junk" message; thus eliminating the
ability for the participant to take the survey.
Survey questions were divided into three groups not to include the optional open-ended
closing question. The three groups of questions were to directly address specific subject matter.
Group 1 addressed the businesses demographics. Group 2 addressed confidence in business
insurance, and group 3 addressed the need to conduct business panning. The open-ended
question addressed a key business function.
Within group 1, three questions were asked to determine the businesses demographics;
questions 1, 2, and 3. Group 2 was used to explore insurance confidence; questions 4 and 5.
Group 3 explored planning; sharing question 4 with Group 2 and adding questions 6 and 7. The
final question, number 8 offered the participant to list the most important business process.

Research Instruments
A research instrument is used for the collection of data and is a helpful tool for any
research. A research instrument can be a survey, observation, questionnaire, testing scale, or
measurement of other variables. In this research, the research instrument used for the primary

43
data is the survey approach, whereas for the collection of secondary data the research has
focused on the available literature.

Research Sample
The data regarding business continuity in Bahrain is available over the internet in
enormous amount, but yet the research focused to extract the perception of the research
participants about the Business Continuity Planning in Bahrain. For this purpose, the research
was conducted from 100 participants chosen randomly through the probability sampling
technique, to gain further insights about the topic. There is an equal chance for everyone to
participate in this research through the implied probability sampling techniques. All the
participants of this research belong to Bahrain. These research participants where provided with
the research instruments, which included the research questionnaire, on the basis of which the
primary data results were interpreted.
The reasoning behind conducting this study was to determine if small businesses solely
rely on their insurance policies during disaster recovery. Are small businesses planning in
conjunction with their business insurance policies? If they are not planning, could instituting
Business Continuity Planning (BCP) or simply conducting a Business Impact Analysis (BIA)
gain confidence in disaster response? Rather than randomly surveying states and various
metropolitan areas, Bahrain was chosen due to my involvement with a small family business for
many years. This provided a great insight into the many business districts, business
organizations, and potential hazards the city imposes on small businesses.
To generate the field of participants, the Bahrain Chamber of Commerce's website was
searched. The Chamber of Commerce was chosen for two reasons: businesses within the

44
Chamber of Commerce are generally long standing institutions or have the concept of becoming
a community staple. Any business with an email address attached to their company information
was selected to participate in the survey. A total of 107 surveys were sent out to Bahrain area
businesses ranging various industries to offer a broad picture in data population. The industry
classifications were selected from the Bahrain Census Bureau as to not unintentionally leave a
genre out of the research.
In understanding staffing and time management issues within small businesses today, the
survey was limited to seven specific questions relating to demographics, insurance, and business
planning. The ideas behind survey distribution would be limiting the survey to no more than a
three minutes. This did not account for the open-ended closing question, which was optional.

Data Analysis Plan

This research study is constituted of the insights gathered from literature in a well
organized manner, for which all the key factors and figures are taken in to consideration. The
reliability as well as authentication of the research report is maintained by avoiding the use of
any inappropriate and out-dated material. Furthermore, the qualitative as well as quantitative
information is analysed and interpreted based on assessment. This assessment includes and
breaking down the material, then the data is reconstituted into categories and patterns. Moreover,
data analysis steps also involve the development of theme, idea, and proposition in an organized
manner.
The analysis of qualitative data involve inductive and adductive thoughts, where, in
inductive thought, the researcher infers principles from a number of sources accessed while

45
collecting information. However, the deductive thought involves testing of the principles derived
in inductive thought by subjecting it to new discourse particulars. As already stated, the
quantitative data analysis incorporates the data interpretation, in which adductive thoughts are
used. So, the interpretation of the data is characterized by theory, experience, and imagination.
Hence, for this research study both qualitative as well as quantitative data analysis and
interpretation is used to analyse the data based on secondary information collection from
different reliable and authenticate sources. The primary data collected through close ended
questionnaire has been analysed by SPSS, different tests including the correlation and regression
has been run on the collected data. Furthermore, the discussion has been made on the results.
Questions in the survey were generated to identify business size; history of business
disruptions; their confidence in business insurance for recovery method; and general knowledge
in business recovery planning. This data, when assembled in groups, will be compared using
descriptive statistics to identify any trends between categories and a baseline for business
continuity within the Bahrain, small business community.

Timing Mileposts

Milestone
1
2
3

Description
Stage 1: Area of interest identified
Stage 2: Specific topic selected
Stage 3: Topic refined to develop

Due date
March
March
April

dissertation proposal
Stage 4: Proposal written and

April

submitted
Stage 5: Collection of data and

June

information
Stage 6: Analysis and

August

Remarks

46
interpretation of collected
7
8

data/information
Stage 7: Writing up
Stage 8: Final draft prepared for

October
1st November

review
Final Deadline9 months from

28thNovember

module start date.

47
CHAPTER 4: FINDINGS & ANALYSIS

The survey polled 107 small businesses in the Bahrain business community through the
local Chamber of Commerce. Of the 107 businesses polled: 36 participants viewed the survey;
23 initiated the survey; and 22 completed it. As a result, the survey yielded a 23.54% completion
rate.

Business Demographics
The reasoning behind the demographics section of the survey was twofold: to identify
any correlations between scale and importance in continuity planning and to identify any
potential impacts to local socioeconomics if the business experiences a disruption. For this
section, questions 1 through 3 were asked.
Question number 1 asked, "In determining business scale, please indicate the number of
people the business employs." Respondents were given four options: 1-4 Employees, 5-9
Employees, 10-19 Employees, and 20-99 Employees. The cap at 99 employees was chosen after
consulting the Bahrain Census Bureau on Small Business Standards and determining that
majority of businesses in excess of 100 employees are no longer considered a small business.
Indicated in Figure 6,40.91 % responded of having 10-19 Employees; 31.82% having 1-4;
22.73% indicated of having 20-99; and the remaining 4.55% responded of having 5-9
Employees.
Question number 2 asked, "How many years has the business been in operation" the
respondents were asked to date the business back to the original establishment.

48
Figure 6: Number of Employees for Business Scale

Figure 6. This figure displays the number of employees business owners indicated their perspective
business's employed.

They were then given eight options for response: -1 year, 1-5 years, 5-10 years, 11-25
years, 26-50 years, 51-75 years, 76-100 years, and finally 100+ years in business. This scale was
taken as a result of small business surveys available through the Small Business Administrations
website. Various survey were explored for a trend then used for this particular survey. Displayed
in Figure 7, 27.27% of respondents indicated they had been in business between 5-10 years and
26-50 years. Of the other business owners, 22.73% indicated 11-25 years of service, 13.64%
indicated 1-5 years, and within the 51-75 and 76-100 both shared 4.55% each. No businesses
participated in the survey with ownership under 1 year or in excess of 100 years. Membership to
the Chamber of Commerce is through application and might indicate the reasoning behind no
businesses less than one year.

49
Figure 7: Years in Service

Figure 7. This figure displays the duration of time participants indicated their business has been in service.

Questions 3 within the demographics section of the survey asked respondents to classify
their business in relation to the provided industry codes by the U.S. Census Bureau, Please
indicate what industry your business is classified as. Respondents were provided with eight
options: Agriculture, Finance, Manufacturing, Real Estate, Retailer, Service, Transportation, and
Utility. Indicated in Figure 8, 45.45% responded to being in the Service industry, 31.82% in
Retail, Finance and Real Estate were tied at 9.09%, leaving Transportation at 4.55%. Utilities,
Manufacturing, and Agriculture had no Respondents. This could partially be due to only using
businesses through the Chamber of Commerce website that had listed their contact information
or whether or not they were a member at the time of the survey.

Insurance Confidence
To determine whether small businesses absolutely rely on their insurance polices for
disaster recovery, two questions were asked in the survey. Question 4 asked, Has the business

50
experienced a disruption (forced to close) due to factors out of your control. Respondents were
provided with the following choices: No; Yes, 24-48 hours; Yes, 48- 72 hours; Yes, 72-96 hours;
Yes, 1 week; Yes, 1 month; and Yes, over 1 month. This scale was referenced from the recovery
time objective (RTO) concepts used throughout the business continuity community. While
answering the question, the intention was to spark thought into the various lengths of disruptions.
As indicated in Figure 9, 72.73% respondents answered they had never experienced a disruption,
13.64% notated a disruption of 24-48 hours, 9.09% selected 48-72 hours, and 4.55% indicated a
disruption of more than 1 month. This evidence is surprising, considering in 2011, Bahrain
experienced record breaking flooding in many of the major business districts; this in conjunction
with the idea that all businesses participating in the survey have been in business for over one
year.
Question 5 was intended to get to the heart of the survey by asking, Given the level of
business insurance policy, do you feel this is sufficient in recovering from a large-scale disaster;
that seen in the 2011 Joplin, MO Tornado? During 2011, Americans witnessed one of the worst
tornado seasons for the U.S. and as technology progresses, news and reports become more
prevalent. Using a recent disaster was intended to spark participants thought as to how they
might react to such a disaster had their business been impacted. The respondents were provided
with the following choices: Yes, totally rely on insurance for business recovery; Yes, but feel
additional resources will be required to recovery my business; Do not know if business insurance
will cover this scale of loss; No, business policy will not cover this large of a business disruption.
Indicated in Figure 10, 38.10% felt their insurance would cover; however additional resources
would be needed. Of respondents, 23.81% would absolutely rely on their business insurance.
Third and fourth place were tied with 19.05% each indicating they have no idea as to whether or

51
not their insurance would cover or they know for a fact it will not cover. It must be noted, some
businesses choose not to fully cover their potential loss as the cost to replace is so minute or wish
not to reopen following a large scale disaster.
Figure 8: Industries of Businesses in Survey

Figure 8. This figure displays industries respondents indicated their business operates in. Service industry was
identified as the majority with retail in second place.

Business Planning
Another major part of the research is addressing continuity planning within small businesses.
With the survey, the thought was to identify the importance of planning from small businesses
owners and to identify any patterns versus business size, industry, or history of disruption.
Question 4 was to be shared with this section for compiling data; however, Questions 6 and 7
were solely developed to address continuity planning and small businesses.

52
Figure 9: Disruptions Experienced by Businesses

Figure 9. 72.72% of business owners indicated their business had ever experienced a disruption.

Figure 10: Insurance Coverage for Recovery

Figure 10. This figure displays small business owners reliance on insurance polices for disaster recovery. The
majority indicated relying on insurance but realizes additional resources will be needed.

Question 6 was asked, A Business Impact Analysis (BIA) identifies the length of time a
business can experience a closure before it affects profits and/or production. BIAs also assist in

53
identifying critical business functions. Though general survey data suggests avoidance of jargon
in questioning, this survey had two major objectives: to gain knowledge of small business
recovery and assist them initiating the planning process. Respondents were offered the following
choices: Have conducted a BIA and identified critical business functions, Currently conducting a
BIA (in-house), Currently conducting a BIA (outsourced), Understand the importance but have
yet to begin the BIA process, and finally, Have no need for a BIA. Displayed in Figure 11,
47.62% felt they had no need for a BIA, 42.86% understand the importance of identifying critical
business functions but have yet to begin the process, 4.76% had conducted a BIA or were in the
process of completing one in-house. No respondent indicated the process was currently in
progress but by an outside source.
Figure 11: Significance of Business Impact Analysis

Figure 11. This figure displays how surveyed businesses felt about conducting BIAs. The great majority of
respondents indicated having no need for a BIA for their operation.

54
Figure 12: Willingness to Conduct Business Continuity Planning

Figure 12. This figure displays how surveyed businesses felt about business continuity planning for their operations.
The majority of respondents indicated that given templates would conduct their own plan. Others felt no need to
conduct pre-disaster planning.

Question 7 was used to identify if small business owners would plan in-house or
outsource the process to professional consultants. The reasoning behind this particular question
was to identify any shortcomings limiting small business from completing the planning process.
The question asked, Given a template with detailed instructions would you be inclined to
conduct and implement a disaster recovery plan (also referred to as a Business Continuity Plan)?
This plan would work in conjunction with the current and future insurance policies.
Respondents were provided the following choices: Yes, I would conduct my own; No, however I
would outsource to a specialist; and No, I have no need for this level of planning. Shown in
Figure 12, 47.62% felt they would conduct the planning process on their own, 33.33% identified
they have no need for this level of planning, 19.05% indicated they would outsource the process
to a professional consultant.

55

Most Critical Business Function

As an optional question in the survey, the idea was posed, If you had to list one business process
as the most important, what would it be (account tracking, inventory tracking, equipment
continuity, communications, etc). This question is meant to generate thought into what function
your business could not live without. Of the 22 respondents four did not provide an answer for
this segment, however, this was expected, as it was optional. As indicated in Table 4, though
many of the responses varied, they could be placed into five general categories: Inventory,
Account Tracking, Equipment, Communications, and Accounting.
Table 4: Most Critical Business Function
Category
Inventory

Response
Inventory tracking and pricing. Without that my business couldnot
even run short term
Inventory Tracking
Inventory and Sales Control
Inventory Tracking

Accounts

Inventory Tracking
Billing
Account Tracing
Account tracking i.e. payables and receivables

Equipment

Claims payments
Manpower and Supplies
Tools and my shop. I can't continue without
Equipment Continuity
Equipment

56
Communications

Communications
Communications

Accounting

Communications
Invoicing and Payroll
Accounting

Note: This table displays the open-ended responses to what business owners feel is their most critical business
function. This question was intended to provoke thought into what business owners place as their most important
process.

Five business owners indicted Inventory was their most critical business function.
Though the responses varied, most felt Inventory Tracking was president in their businesses.
Further explanation by respondents directly relates inventory control to controlling and ensuring
sales. One respondent stated that, Without [inventory control] my business could not ever run
short term. Of business owners, 31.82% indicated they were in the retail industry and 45.45% in
the service industry. Service industries such as restaurants and retail industries such as clothing
stores rely heavily on inventory to provide good and services for their client base; thus the
reasoning for placing inventorycontrol at the height of businesss essential functions.
Four business owners indicated Account Tracking was their most critical business
function. Respondents noted: billing, account tracking, account tracking i.e. payables and
receivables, and claim payments to be the most important facet in the establishments.
With many industries still running in-house charge account for commercial and repeat
customers, it is easy to determine, not keeping tracking of monthly purchases is detrimental for
small businesses in receiving payment for good and services. Many businesses work on a
monthly billing cycle; losing data one day out of the month can have a dramatic impact on
monthly revenues.

57
Four business owners indicated Equipment as their most critical business function.
Answers such as: manpower and supplies, tools and shop facilities, and misc. equipment were
recognized as playing a major role in day-to-day operations. One of the respondents stated, I
cant continue without [tools and my shop]. Closely related to inventory, car repair facilities and
landscaping companies rely on shop facilities and equipment to generate revenues.
Three business owners indicated Communications as the most critical business function.
Though no respondents elaborated as to specific forms of communications, with the growing age
of technology and many businesses looking to online trading, it is easy to understand why
communications plays a large role in business.
Two respondents indicated Accounting as a critical business function. Invoicing, payroll,
and general accounting were noted as significant for business operations. Tracking taxes and
monthly expenditures can be critical for a businesss success.
Ensuring employees receive a paycheck on Friday is just as detrimental to a businesss ability to
function. What does this information tell us? It provides insight into what and where future
research and development should be placed in assisting small businesses during interruption
recovery.

Identifying Trends
Reluctance to Plan
Small businesss reluctance to adopt Business Continuity Plans and Business Impact
Analysis are evident in Figures 11 and 12. Of respondents, 33.33% indicated no need for a BCP
and 47.62% indicated no need for a BIA. The question presents itself, why are small businesses
choosing to forgo preplanning? After all, within the literature review we see that all small

58
business functions are critical; would this not provoke importance in developing swift measure
for recovery following a disruption? Of those that responded, 38.10% indicated their insurance
polices would cover a
business disruption.
This could very well identify a strong reasoning behind small businesses not preplanning
for a disruption. By carrying an insurance policy, a small business might assume insurance
companies will fully compensate them after a loss as indicated in the literature review. Of
respondents, 72.73% indicated having never experienced a disruption at all. With 54.54%
respondents indicating being in business 5-10 years or 26-50 years, the reluctance to conduct
business interruption planning is understandable. Their thought could be, it has not happened to
me yet, so it never will.

Decisions in selecting insurance

Figure 8 shows respondent percentages in relation to various industries, 45.45% indicated
Service and 31.82% indicated Retail. Both industries rely on inventories, equipment,
stores/shops, and supplies to generate revenues as identified in Table 4. This might play a role in
why businesses chose to rely on insurance as a sole means for recovery. It might also explain the
reasoning behind the 19.05% businesses that indicated insurance would not cover a large-scale
disruption. Displayed in Table 5, the majority of business owners understand their insurance
policies will cover loss; however, additional resources will be needed to fully reconstitute.
Though, 33.3% of Retail and 50% of Real Estate business owners indicated they did not know
whether or not their policies would cover a large disruption. The majority of service industry
respondents felt their policy is adequate in fully recovering them from a large disruption. This

59
very well might have been preplanning of the insurance agent and business owners part.
Businesses have the option to choose the level of insurance they want to carry.
This decision is brought on by many factors but mostly financial. If a small business
realizes it would be cheaper to replace their damaged equipment opposed to purchasing the
required level of insurance, they may forgo all but what is necessary. Contrarily, some businesses
do not have this luxury as they carry deep inventories or equipment, which is too valuable to
suffer a loss resulting in replacement. This could indicate why 38.10% respondents rely on
insurance but will require additional resources for a full recovery. Of respondents, 23.81%
indicated solely relying on their insurance for recovery.
Table 5: Insurance policy coverage for large loss by natural disaster
Industry

Would not cover

Fully cover

Cover with

Do not know

additional
Service
Retail
Real Estate
Finance
Transportation

30%
16.70%
0%
0%
0%

40%
0%
50%
0%
0%

resources
20%
50%
0%
100%
100%

10%
33.30%
50%
0%
0%

Note: Though most business owners understand their policy will partially cover a catastrophic loss, some
business owners fully rely on their insurance for recovery. Others do not know if their policy will provide this
protection.

Employee size in relation to planning

A significant point as a result of the survey is business size in relation to in-house
planning versus outsourcing professional plan development. We have explored how cost vs.
benefit plays a role in a small businesss willingness to prepare for a large event. Some feel the
cost is too great for the reward; however, we have not fully explored how resources, more
importantly, human capitol plays a role in a small businesss willingness to preplan. In

60
comparing question 1 of the survey relating to employee size and question 7 addressing decisions
in plan development some interesting trends being to develop. Referring to Table 6, the majority
of business owners would conduct a BCP if provided with necessary templates to do so. As a
result of capering the data, business owners with employees between 1 and 4 (used to scale
business size) indicated they had no need for this level of planning. Business owners may feel
their businesses are too small to benefit from planning or their operations are small enough
where picking up the pieces is a figurative term. As indicated in Table 4, business owners have
the ability to identify their most critical business function, this coupled with the idea that every
process within in a small business is consider critical by industry experts and business owners.
Templates with detailed instructions could be the answer to a more self-reliant and vigilant small
business owner.
Table 6: Provided a template, wou ld businesses con duct a BCP
Number of

On their own

Outsource

Have no need

employees
1 to 4
5 to 9
10 to 19
20 to 99

28.60%
100%
50%
60%

14.30%
0%
25%
20%

57.10%
0%
25%
20%

Note: Analysis of employee size in comparison to BCP planning show most small business choose to plan
on their own; however, businesses below 1-4 employees feel this form of planning is insignificant.

61
CHAPTER 5: CONCLUSION

Three questions posed in chapter one will be addressed in this conclusion. Question 1
related to small business socioeconomics within a community. Question 2 related to small
businesses reliance on insurance as a sole means for disaster recovery. Lastly, question 3 related
to instituting a business continuity planning in conjunction with insurance polices as a viable
response plan for small business. We shall address the questions in order of which they were
presented.

Discussion
Data presented through the literature review shows communities rely on small businesses
for employment and personal benefits. Not to mention, local revenues generated through local
businesses provide funding for schools, public works, and interdependent support from other
genres of business. Small businesses representing a like portion of revenues as their counter part,
corporate big box retailers, pose a great epidemic for local municipalities and residents alike if
not reconstituted. Though the evidence points to an increase of revenues following a disaster, this
data does not account for permanently lost jobs forcing some residents to venture outside of their
communities for work.
Insurance plays a decent role in bringing businesses back to predicate production levels
thus making them whole. As discussed in the literature review, some small businesses absolutely
rely on insurance polices for disaster recovery, whilst others choose to limit coverage due to a
preplanned effort. This was also evident though the proposed survey within the Bahrain small
business community. Though specialized polices can be purchased to include but not limited to

62
National Flood Insurance program (NFIP) or Business Interruption Insurance (BI) this only
covers specific incidents. Insurance, if planned accordingly can easily provide the tools for small
businesses to fully recovery following a major disruption; however, mismanagement of
insurance reimbursements can lead to the misappropriation to critical business functions. When
businesses want the insurance company to pay up, the reimbursement cost can fall far short of
the actual replacement cost. Though insurance companies strive to make their insured whole,
they cannot fully refund a depreciated piece of equipment. Proper planning and management of
insurance reimbursements can lead to small business resilience. Presented in the literature
review, business insurance has been around for decades, yet customers carry slight
misinterpretations to its abilities and limitations.
This is partially due to the lack of experience and knowledge on the business owners
part. Though insurance providers offer literature on various policies and programs, more
emphasis should be placed on informing small business owners of their obligations and possible
shortcomings during the claims process following a large-scale disruption. The survey queried
respondents on whether they had conducted a Business Impact Analysis (BIA) or Business
Continuity Plan (BCP), which the majority felt they had no need. This may or may not be a
conscientious decision of the part of the business owner. Small business can be made aware of
the benefits of conducting a BIA at the minimum, if just to identify critical business functions
and set priorities following a disruption. Proof that preplanning works was provided in the
literature review. Establishing alternate sites and prescript missions resulted in the Texas mail
sorting facilities quick reconstitution. If the preplanning had not been conducted, it is anyones
guess as to the outcome of the fire.

63
Conclusion
In conclusion, neither business insurance nor business continuity planning can remain as
the sole means for a small business to recover from a large-scale disaster. This being stated,
when in conjunction with each other small businesses stand a greater chance of full recovery thus
impacting employees wellbeing and local economics. Dialog should open between the
emergency management community, insurance community, and small business owners to
identify the shortcomings and possible remedies to address them.

64
REFERENCES

Albin Bowler and M.S. Dawood, Entrepreneurship and Small Business Management. Cape
Town, Africa: NASOU, 1996. 200
Alistair Cockburn, Writing Effective Use Cases. Boston, MA, USA: Addison- Wesley
Professional, 2000.
Amr Elssamadisy, Agile adoption patterns: a roadmap to organizational success. Upper Saddle
River, NJ, USA: Addison-Wesley, 2009.
Andrew Hiles, The Definitive Handbook of Business Continuity Management, Third Edition ed.
West Sussex, United Kingdom: John Wiley & Sons Ltd, 2011.
Aslak Hellesy. Official Cucumber Web Site. [Online].
https://github.com/cucumber/cucumber/wiki/
AT&T. (2008) AT&T Business Continuity Survey 2008. [Online].
http://www.att.com/Common/merger/files/pdf/business_continuity_08/Business_C
ontinuity_Study_Results.pdf
B. Herbane, D Elliott, and E. M. Swartz, "Business Continuity: Time for a strategic role?," Long
Range Planning, vol. 37, pp. 435-457, 2004.
Barry Boehm and Richard Turner, Balancing Agility and Discipline: A Guide for the Perplexed.
Boston, MA, USA: Addison-Wesley, 2003.
Barry W. Boehm, "A spiral model of software development and enhancement," Computer, vol.
21, no. 5, pp. 61-72, May 1988.
BCM Institute. (2008) BCM India Business Continuity Survey 2008. [Online]. http://www.bcminstitute.org/bcmi10/en/surveys/doc_download/7-bcm-instituteindia- survey-2008

65
BEA Systems, International Business Machines Corporation, Microsoft Corporation. (2002) The
BPEL4WS 1.0 specification. [Online]. http://public.dhe.ibm.com/software/dw/specs/wsbpel/ws-bpel1.pdf
BEA, BEA AquaLogic BPM Designer Version 5.7.: BEA, 2006.
Bertrand Meyer, "Applying 'design by contract'," Computer, vol. 25, no. 10, pp. 40-51, October
1992.
Bill Curtis, Marc I. Kellner, and Jim Over, "Process modeling," Communications of the ACM,
vol. 35, no. 9, pp. 75-90, Sep. 1992.
Bristol Organizations. Bristol Organizations. [Online].
http://www.bristolorganizations.org/images/Sample_Business_Continuity_Plannin
g_for_Non_Profits.doc [30] British Standards Institute, BS 25999 - Business Continuity
management. Part I: Code of practice. London, England: British Standards Institute Business Information, 2006.
Bruce Blythe, Blindsided: a manager's guide to catastrophic incidents in the workplace. New
York, NY, USA: Portfolio, 2002.
Business Continuity Institute, "Supply Chain Resilience BCI Survey Report 2009," Business
Continuity Institute, Zurich, Survey 2009.
Business Continuity Institute. (2008) Business Continuity Institute. [Online].
http://www.thebcicertificate.org/pdf/GPG2008-2.pdf
Business Continuity Institute., Insight Consulting Limited., and British Standards Institution.,
PAS 56: Guide to business continuity management. London, England: British Standards
Institute, 2003.

66
C. Larman and V.R. Basili, "Iterative and Incremental development: a brief history," Computer,
vol. 36, no. 6, pp. 47-56, June 2003.
Carolyn Castillo, "Disaster preparedness and Business Continuity Planning at Boeing: An
integrated model," Journal of Facilities Management, vol. 3, no. 1, pp. 8-26, Jul 2004.
Chartered Management Institute. (2007) CMI Business Continuity Survey 2007 Report.
[Online]. http://preparingforemergencies.org/business/bcm_report2007.pdf 201
Chartered Management Institute. (2008) Chartered Management Institute Business Continuity
Survey 2008. [Online].
http://preparingforemergencies.org/business/bcm_report_2008.pdf
Christoph Brandt, Frank Hermann, and Thomas Engel, "Modeling and reconfiguration of critical
business processes for the purpose of a Business Continuity Management respecting
security, risk and compliance requirements at Credit Suisse using algebraic graph
transformation," in 2009 13th Enterprise Distributed Object Computing Conference
Workshops, Auckland, New Zealand, 2009, pp. 64-71.
Christopher A. Peterson, "Business Continuity Management & Guidelines," in 2009 Information
Security Curriculum Development Conference on InfoSecCD '09, Kennesaw, GA, 2009,
pp. 114-120, 10.1145/1940976.14940999.
Christopher Kadlec and Jordan Shopshire, "Best Practices in IT Disaster Recovery Planning
Among US Banks," Journal of Internet Banking and Commerce, vol. 15, no. 1, p. 1, April
2010.
Colin Barrow, The essence of small business. New York, NY, USA: Prentice Hall Trade, 1993.
Congressional Research Service, "The Economic Effects of 9/11: A Retrospective Assessment,"
Congressional Research Service, The Library of Congress, Report for Congress 2002.

67
Continuity Central. (2004) BCP testing under the spotlight. [Online].
http://www.continuitycentral.com/news01445.htm [48] cukes.info. Cucumber - Making
BDD fun. [Online]. http://cukes.info
Craig Larman, Agile and iterative development: a manager's guide. Boston, MA, USA: AddisonWesley, 2004.
Dan North. (2006, March) DanNorth.net. [Online]. http://dannorth.net/introducing-bdd
David Astels. A New Look at Test-Driven Development. [Online].
http://blog.daveastels.com/files/BDD_Intro.pdf [8] David Astels, Test-driven
development: a practical guide. Upper Saddle River, NJ, USA: Prentice Hall PTR, 2003.
Debra Elkins, Robert B. Handfield, Jennifer Blackhurst, and Christopher Craighead, "18 Ways to
Guard Against Disruption," Supply Chain Management Review, Jan. 2005.
Disaster Recovery Journal. (2007) Generally Accepted Practices. [Online].
http://www.drj.com/resources/resources/generally-accepted-practices.html
Dominic Elliott, Ethn Swartz, and Brahim Herbane, "Just waiting for the next big bang:
business continuity planning in the UK finance sector," Journal of Applied Management
Studies, vol. 8, no. 1, pp. 43-60, 1999.
Dominic Elliott, Ethn Swartz, and Brahim Herbane, Business Continuity Management: A crisis
management approach, 2nd ed. New York, NY, USA: Routledge, 2010.
DRI International. (2008) Professional Practices for Business Continuity Professionals. [Online].
https://www.drii.org/professionalprac/prof_prac_details.php
Dynamic Markets, "The Veritas Disaster Recovery Research 2004," Dynamic Markets, White
Paper 2004.
Eric Evans. Domain-Driven Design. [Online]. http://www.domainlanguage.com/ddd/index.html

68
European Computer Manufacturers Association, "Standard ECMA-4 Flow Charts," European
Computer Manufactures Association, Geneva, Switzerland, 1966.
Fabio Arduini and Vincenzo Morabito, "Business Continuity and the banking industry,"
Communications of the ACM, vol. 53, no. 3, pp. 121-125, March 2010.
Frank Gilbreth and Lillian Gilbreth, "Process Charts - First Steps in Finding the One Best Way,"
Transactions of the American Society of Mechanical Engineers, vol. 43, pp. 1029-1050,
1921. 203
Frederick Brooks, The mythical man-month: essays on software engineering, Anniversary edition
ed. Reading, MA, USA: Addison-Wesley Publishing, 1995.
Gabriel A Pall, Quality Process Management. Englewood Cliffs, NJ, USA: Prentice Hall, 1987.
George T. Doran, "There's a S.M.A.R.T. way to write management's goals and objectives,"
Management Review, vol. 70, no. 11, pp. 35-36, November 1981.
Goran Mitrevski et al. May 2011 Business Continuity Management Survey results. [Online].
http://www.vmia.vic.gov.au/~/media/Content-Documents/Risk- Management/Guidesand-Publications/Risk-Insights/9-business-continuitymanagement. ashx
Grady Booch, James Rumbaugh, and Ivar Jacobson, The Unified Modeling Language User
Guide. Reading, MA, USA: Addison-Wesley, 1999.
Hakan Erdogmus, Maurizio Morisio, and Marco Torchino, "On the effectiveness of the Test-First
Approach to Programming," IEEE Transactions on Software Engineering, vol. 31, no. 3,
pp. 226-237, March 2005.
Hart Info LLC, "KPMG 2002 Business Continuity Planning Survey," KPMG/Contingency
Planning & Management magazine, Survey 2002.

69
IBM Research,Microsoft Corporation. (2001) Web Services Definition Language (WDSL).
[Online]. http://www.w3.org/TR/wsdl 204
Intalio, Inc. (2010) BPMS Designer 6.0.3. [Online]. http://www.intalio.com/downloads
Jacques Botha and Rossouw Von Solms, "A cyclic approach to business continuity planning,"
Information Management & Computer Security, vol. 12, no. 4, pp. 328- 337, 2004.
Jason D. Averill and Weiguo Song, "Accounting for Emergency Response in Building
Evacuation: Modeling Differential Egress Capacity Solutions," National Institute of
Standards and Technology, NISTIR 7425, 2007.
Jerry L. Jones, Structured Programming Logic: A flowcharting approach. Engelwood Cliffs, NJ,
USA: Prentice-Hall, 1986.
Jim Arlow and Ila Neustadt, Introduction to BPMN 2.: Clear View Training Limited, 2012.
John Cimasi, Disaster Recovery & Continuity of Business: A project management guide and
workbook for network computing environments. USA: CreateSpace, 2010.
John Lindstrm, Sren Samuelsson, and Ann Hgerfors, "Business continuity planning
methodology," Disaster Prevention and Management, vol. 19, no. 2, pp. 243-255, 2010.
Jori Johnson. (2002, April) Internal Auditing. [Online].
http://cobacourses.creighton.edu/fin402/Semester%20Projects/johnson.htm
Joseph Bergin, Agile Software: Patterns of Practice.: Joseph Bergin Software Tools, 2012.
Judith A. Pirani and Ronald Yanosky, "Shelter from the storm: IT and business continuity in
higher education," EDUCAUSE Center for Application Research, 2007.
Kai Petersen and Claes Wohlin, "The effect of moving from a plan-driven to an incremental
software development approach with agile practices," Empirical Software Engineering,
vol. 15, no. 6, pp. 654-693, July 2010.

70
Kent Beck, Extreme programming explained: embrace change. Boston, MA, USA: AddisonWesley, 2004.
Kent Beck, Test-driven development: by example. Boston, MA, USA: Addison- Wesley, 2003.
Klara Nelson, "Examining Factors Associated with IT Disaster Preparedness," in Proceedings of
the 39th Annual Hawaii International Conference on System Sciences (HICSS '06),
Kauia, HI, 2006, pp. 205b-205b.
Knowledge Based Systems, Inc. (2010) Integrated Definition Methods. [Online].
http://www.idef.com
Kon Karakasidis, "A project planning process for business continuity," Information Management
& Computer Security, vol. 5, no. 2, pp. 72-78, 1997.
KPMG LLC. (2002) KPMG 2002 Business Continuity Report Benchmark Study. [Online].
http://www.auditnet.org/docs/BCP/Business%20Continuity%20Report%20Bench mark
%20Study.pdf
KPMG LLC. (2008) 2008 BCM Benchmarking Report. [Online].
http://www.continuityinsights.com/cdn/cms/CI-KPMG08-FinalResults.pdf 205
Kristen Noakes-Fry, Christopher H. Baum, and Barry Runyon. (2005, July) Laws Influence
Business Continuity and Disaster Recovery Planning Among Industries. [Online].
http://www.gartner.com/id=483265 [109] Dan North. DanNorth.net. [Online].
http://dannorth.net/whats-in-a-story
Lasse Koskela, Test driven practical TDD and acceptance TDD for Java Developers.
Greenwich, CT, USA: Manning, 2007.
Lee Clarke, "What's the Plan: A conversation with Lee Clarke," Harvard Business Review, June
2004.

71
M Beckmeyer. Contingency Planning & Management. [Online].
http://www.contingencyplanning.com/article_index.cfm?article=379
Mario Devargas, "Survival is not compulsory: an introduction to business continuity planning,"
Computers & Security, vol. 18, no. 1, pp. 35-46, 1999. 202
Mark Kennaley, SDLC 3.0 : Beyond a tacit understanding of agile, towards the next generation
of software engineering. Ottawa, ON, Canada: Fourth Medium Press, 2010.
Martin Banks. (2007) Don't play whack the gopher. [Online].
http://www.theregister.co.uk/2007/06/25/thoughtworks_req_manage/
Martin Christopher and Helen Peck, "Building the resilient supply chain," International Journal
of Logistics Management, vol. 15, no. 2, pp. 1-13, 2004.
Mauritius Business Continuity Survey. [Online].
http://www.bhumishqidc.com/dc/BCS_report.pdf
Max Bazerman, Judgement in managerial decision making, 5th ed. New York, NY, USA: Wiley,
2002. 199
Michael Hammer and James Champy, Re-engineering the Corporation: A manifesto for business
revolution.: Nicholas Brealey Publishing, 1993.
Michael Havey, Essential business process modeling. Sebastopol, CA, USA: O'Reilly &
Associates, 2005, ISBN 9780596008437.
Michael Hirsch, "Moving from a plan driven culture to agile development," in Proceedings of
the 27th International Conference on Software Engineering - ICSE '05, St. Louis, MO,
USA, 2005, p. 38.

72
Michael zur Muehlen, Marta Indulska, and Gerrit Kamp, "Business process and business rule
modeling languages for compliance management: a representational analysis," , 2007, pp.
127-132.
Mikel J. Harry and J. Ronald Lawson, "Six Sigma producibility analysis and process
characterization," Motorola University, 1990.
Naill M. Momani, "Business Continuity Planning: Are we prepared for future disasters,"
American Journal of Economics & Business Administration, vol. 2, no. 3, pp. 272-279,
2010. 206
Object Management Group, Inc. (2011) Business Process Model and Notation (BPMN) Version
2.0. [Online]. http://www.omg.org/spec/BPMN/2.0/PDF
Object Management Group. (2004) BPMN 1.0. [Online].
http://bpmn.org/Documents/BPMN_V1-0_May_3_2004.pdf
Object Management Group. (2008) BPMN 1.1. [Online]. http://bpmn.org/Documents/BPMN_11_Specification.pdf
Object Management Group. (2009) BPMN 1.2 specification. [Online].
http://www.omg.org/spec/BPMN/1.2/PDF
Oracle Corporation. (2011) Oracle Business Process Management. [Online].
http://www.oracle.com/technetwork/middleware/bpm/overview/index.html
Oracle. jDeveloper Studio Edition v11.1.1.6.0. [Online].
http://download.oracle.com/otn/java/jdeveloper/11.1.1.6.0/jdevstudio11116install.j ar
Peter Coad, Eric Lefebvre, and Jeff De Luca, Java modeling in color with UML: enterprise
components and process. Upper Saddle River, NJ, USA: Prentice Hall PTR, 1999.

73
R.W. Helms, S. van Oorschot, J. Herweijer, and M. Plas, "An integral IT continuity framework
for undisrupted business operations," in The First International Conference on
Availability, Reliability and Security (ARES), 2006, pp. 244-249.
Raymond J. Grimaldi, "Why do business continuity plans fail?," Risk Management, vol. 49, no.
5, pp. 34-39, May 2002.
Richard J Kepenach, "Business Continuity Plan Design," in Second International Conference on
Internet Monitoring and Protection (ICIMP 2007), San Jose, CA, 2007, pp. 27-27.
Richard J. Mayer, Perakath C. Benjamin, Bruce E. Caraway, and Michael K. Painter, "A
Framework and a Suite of Methods for Business Process Reengineering," in Business
Process Change: Reengineering Concepts, Methods, and Technologies, Varun Grover and
William J. Kettinger, Eds. Harrisburg, PA, USA: Idea Group Publishing, 1995, pp. 245290.
Ricky W. Griffin, Management, 3rd ed. Boston, MA, USA: Houghton Mifflin, 1990.
Robert Martin, James Newkirk, and Robert Koss, Agile software development: principles,
patterns, and practices. Upper Saddle River, NJ, USA: Pearson Education, 2002.
Sami Kollanus, "Test-driven development - still a promising approach?," in 2010 Seventh
International Conference on the Quality of Information and Communications Technology,
Porto, Portugal, 2010, pp. 403-408.
Scott Ambler. (2006) Introduction to Test Driven Design (TDD). [Online].
http://www.agiledata.org/images/tddSteps.jpg
Stefan Jablonski and Christoph Bussler, Workflow Management: modeling, concepts,
architecture and implementation. London, England: International Thompson Computer
Press, 1996.

74
Stephen Palmer and John Felsing, A practical guide to feature-driven development. Upper Saddle
River, NJ, USA: Prentice Hall PTR, 2002.
Stephen R. Palmer and John Mac Felsing. (2012, Oct.) Software Process. [Online].
http://www.step- 10.com/SoftwareProcess/FeatureDrivenDevelopment/FDDHistory.html
207
T.G Calderon and M. Dishovska, "Transitioning from disaster reocvery management to business
continuity management," Internal Auditing, pp. 21-28, Mar/Apr 2005.
Thomas Davenport, Process Innovation: Reengineering work through information technology.
Boston, MA, USA: Harvard Business School Press, 1993.
Thomas H. Davenport and James E. Short, "The New Industrial Engineering: Information
Technology and Business Process Redesign," Center for Information Systems Research,
Cambridge, MA, MA, USA, Whitepaper 1990.
Tom Glib, "Evolutionary Delivery versus the "waterfall model"," ACM SIGSOFT Software
Engineering Notes, vol. 10, no. 3, pp. 49-61, July 1985.
Virginia Cerullo and Michael Cerullo, "Business Continuity Planning: A Comprehensive
Approach," Information Systems Management, vol. 21, no. 3, pp. 70-78, June 2004.
W. P. DiMartini, "What Drives Contingency Planning- The Carrot or the Stick?," Contingency
Planning & Management, pp. 15-19, March 1996.
W. S. Humphrey, "Characterizing the software process: a maturity framework," Software, vol. 5,
no. 2, pp. 73-79, 1988.
William Clark, William O. Douglas, and Dorothy S. Thomas, "The Business Failures Project: A
Problem in Methodology," The Yale Law Journal, vol. 39, pp. 1013-1076, 1930.

75
William Edwards Deming, Out of the crisis. Cambridge, MA, USA: Massachusettes Institute of
Technology Center for Advanced Engineering Study, 1986.
William J. Caelli, Lam-For Kwok, and Dennis Longley, "A Business Continuity Management
Simulator," in SEC 2010 IFIP AICT 330, 2010.
William Megginson, Small business management: an entrepreneur's guide to success. Chicago,
IL, USA: Irwin, 1997.
Wing Lam, "Ensuring business continuity," IT Professional, vol. 4, no. 3, pp. 19- 25, May 2002.
Wolfgang Boehmer, "Survivability and business continuity management system according to BS
25999," in Third International Conference on Emerging Security Information, Systems
and Technologies (SECUREWARE 2009), Athens, Greece, 2009, pp. 142-147.