Risk Management and Business Continuity in Organizations
This paper examines the interconnected roles of risk, crisis, and security management within organizational contexts, with particular attention to business continuity management (BCM) as a strategic framework for reducing organizational risk. Drawing on foundational texts by Adams, Borodzicz, Labib, and several articles by Herbane, the paper traces the concept of risk from individual development through organizational practice. It discusses failures in risk management — illustrated by real-world examples such as BP and an India-based industrial case — and highlights how crises typically precede meaningful change. The paper also considers how BCM's three phases (pre-event preparation, event management, and post-event continuity) can provide structured, proactive approaches to organizational resilience, especially in small and medium enterprises.
- Introduction to Risk, Crisis, and Security Management: Overview of risk, crisis, and security in organizations
- The Origins and Development of Risk Awareness: Adams on individual risk development from childhood
- Failures in Organizational Risk Management: Real-world examples of poor risk and safety practices
- Business Continuity Management as a Strategic Framework: BCM as a tool for organizational resilience and strategy
- The Evolution and Phases of BCM: History and three-phase structure of BCM practice
- Crisis Management in Small and Medium Enterprises: Crisis research findings from UK small businesses
- Conclusion: Summary of risk management lessons and BCM importance
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Grounds abstract theory in concrete real-world examples, such as the India-based industrial facility and the BP oil spill, making the argument accessible and persuasive.
- Synthesizes multiple scholarly sources cohesively, weaving together Adams, Herbane, Labib, and others to build a cumulative argument rather than simply summarizing each source in isolation.
- Moves logically from individual risk awareness to organizational risk management to the specialized framework of BCM, creating a clear conceptual arc throughout the paper.
Key academic technique demonstrated
The paper demonstrates effective use of evidence-based argumentation: each claim about risk or BCM is supported directly by a quotation or finding from a peer-reviewed source, followed by the author's own analytical commentary. This show-then-explain pattern is a core undergraduate academic writing skill that keeps analysis grounded and credible.
Structure breakdown
The paper opens by establishing the theoretical landscape of risk, crisis, and security management. It then moves through individual risk development (Adams), to organizational failures (Labib, Button), to the BCM framework (Herbane, Tammineedi), and finally narrows to small business crisis management before concluding with a hypothetical scenario illustrating the real-world consequences of neglected risk management. The references follow APA format throughout.
Introduction to Risk, Crisis, and Security Management
Crisis, risk, and security all play a role and are linked within an organizational context. It is also important to examine the role gaming and simulation play within this phenomenon. In the past, risk was established as an idea that generated academic interest not just in the social sciences but in the pure sciences as well. It has also become subject to overzealous social and political controversy. Risk management has since become the main source of debate as well as theory development (Borodzicz, 2005). As risk can appear within anything from public safety to transportation and health, businesses must learn effective ways to manage it. Security management, however, has less developed theories and debates but still plays a vital role in lessening risk and increasing proper risk management. It is therefore crucial to understand how both play roles in the stability and safety of any organization.
The Origins and Development of Risk Awareness
In John Adams's Risk, at the beginning of Chapter 1, he discusses the development of a person's expertise as it concerns coping with the unknown. "The development of our expertise in coping with uncertainty begins in infancy. The trial and error processes by which we first learn to crawl, and then walk and talk, involve decision-making in the face of uncertainty" (Adams, 1995). The origins of calculating and preventing risk thus start in a person's earliest stages of life. It is here, Adams notes, that one learns to assess and predict. Through this beginning stage, one can derive the seeds needed to start understanding what it takes to lessen risk and, most importantly, manage it.
Adams also suggests, on the same page, that there is a sort of balancing act that happens during childhood and is carried on into adulthood. "In our development to maturity we progressively refine our risk-taking skills; we learn how to handle sharp things and hot things, how to ride a bicycle and cross the street, how to communicate our needs and wants, how to read the mood of others" (Adams, 1995). As this refinement continues, so it runs parallel to a business or organization. Within its formative stage, a business has just begun to understand risk. As the company grows and its employees gain experience, the efficacy of risk management rises accordingly. It then becomes more likely that such risk management can be implemented than was initially possible.
Failures in Organizational Risk Management
Because risk management is so imperative in maintaining the continuity of a business, it is important to understand how to execute it properly. In a book by Labib, the writer discusses bad management in India and the perils of forgoing a risk management strategy. "The Indian Government, although keen to attract foreign investment, needed to factor in basic safety requirements for its citizens. During future MNC projects, designs of installations need to be peer reviewed and more stringent environmental, health, and safety measures adopted" (Labib, 2014, p. 60). Not only did the company lack basic safety requirements — greatly increasing risk — it also failed to assess any additional safety measures. Needless to say, the business experienced several serious issues due to its negligence.
Another deficiency was the absence of segregation of dangerous processes. "Governments also need to be aware of the requirement for segregation of hazardous operations from other industrial facilities and from adjacent populations" (Labib, 2014, p. 60). This means that any accidents that occur are in proximity to other facilities, posing a risk to more workers than would be the case if operations were located separately. Errors like these become extremely costly in the event of an accident.
A lack of training with respect to security managers also increases risk. "This also requires security managers to demonstrate generic business skills, engage in their lexicon and be able to exert influence on other members of management and the board. This also means that security specialists should be represented on the board and in some organizations..." (Button, 2008, p. 207). These risks, coupled with a low overall level of safety, mean danger not just for the business but also for its employees. Essentially, this India-based company failed to do anything to minimize risk. Instead, it increased risk in ways that could lead to major problems, including employee deaths and costly lawsuits.
Conclusion
In order to better comprehend how serious a situation can become, it is important to understand what can go wrong and how, historically, such disasters have arisen. Risk management is an important process to undertake effectively; however, it most commonly occurs only after a crisis has already taken place. This essay has helped illuminate what risk management is and how to lessen risk through BCM implementation. It has also revealed how a disaster can arise through specific, neglectful actions that often lead to expensive and deadly consequences.
References
Adams, J. (1995). Risk (1st ed.). London, England: UCL Press.
Borodzicz, E. (2005). Risk, crisis and security management (1st ed.). West Sussex, England: J. Wiley & Sons.
Button, M. (2008). Doing security (1st ed.). Basingstoke, England: Palgrave Macmillan.
Cavanagh, T., & Whiting, M. (2003). Corporate security management (1st ed.). New York: Conference Board.
Devargas, M. (1999). Survival is not compulsory: An introduction to business continuity planning. Computers & Security, 18(1), 35–46.
Herbane, B., Elliott, D., & Swartz, E. (2004). Business continuity management: Time for a strategic role? Long-Range Planning, 37(5), 435–457.
Herbane, B. (2010). Small business research: Time for a crisis-based view. International Small Business Journal, 28(1), 43–64.
Herbane, B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History, 52(6), 978–1002.
Herbane, B. (2013). Exploring crisis management in UK small- and medium-sized enterprises. Journal of Contingencies and Crisis Management, 21(2), 82–95.
Labib, A. (2014). Learning from failures (1st ed.). Burlington: Elsevier Science.
Tammineedi, R. (2010). Business continuity management: A standards-based approach. Information Security Journal: A Global Perspective, 19(1), 36–50.
Tjoa, S., Jakoubi, S., Goluch, G., Kitzler, G., Goluch, S., & Quirchmayr, G. (2011). A formal approach enabling risk-aware business process modeling and simulation. IEEE Transactions on Services Computing, 4(2), 153–166.
Always verify citation format against your institution’s current style guide requirements.