Business Continuity and Sustainability in Government Organisations

Abstract

This study aimed to investigate the effects of business continuity management (BCM) practices on the organisational performance of government organizations in the Kingdom of Saudi Arabia. The study considered a set of variables, with BCM practices as the dependent variable and planned resilience and adaptive resilience as independent variables of organisational performance. The sample comprised 200 individuals from Saudi Arabia. Data collection was facilitated through an electronic questionnaire, using Google Docs as the platform. Questionnaires were distributed to 211 individuals, with 200 responses obtained, resulting in a 94% response rate. Distribution was carried out in Arabic and English through various channels, including social media platforms, email, WhatsApp, and LinkedIn. The study revealed a significant link between organisational performance, using BCM practices, and planned and adaptive resilience. These findings contribute to the understanding of the impact of BCM practices on organisational performance within the context of Saudi Arabia.

1. Introduction

The purpose of this section is to provide a brief overview of this research topic, including the study’s importance and problem, the aim, objectives and research questions.

The Business Continuity Institute (BCI) defines business continuity management (BCM) as “the act of predicting catastrophes that could impact the company’s important operations and procedures and guaranteeing that it reacts to any catastrophe in an organised and choreographed fashion” [1]. BCM aims to ensure the continuation of essential business operations and services critical to a company at an appropriate level. The business continuity criterion has been in place in America for a while now. For example, in 1997, the adoption of the US Foreign Corrupt Practices Act (FCPA) launched a sequence of measures that would imply or expressly demand the implementation of Disaster Recovery Planning (DRP) and (BCM) programs in firms [2]. The FCPA is also recognised as an earlier item of law that demands corporations develop particular safeguards to protect critical company data after a disaster. According to Lodge [3], following the 11 September catastrophe, BCM’s strategy and processes were modified substantially, including evaluating the public impact of risk. A significant increase in the production of new laws and standards in the banking sector, stock exchanges, utilities and public agencies marks the post-9/11 environment. Notable instances include the directions for strengthening the resilience of the US financial system from the Federal Reserve Board (FRB), the Office of Comptroller of the Currency and the Securities and Exchange Commission (SEC), the National Institute of Standards and Technology’s Special Publications 800 Series, Security Directions for the Power Industry and New York Stock Exchange Rule 446 [2].

According to Wong [4], companies that apply BCM to their strategic management can gain a competitive advantage in terms of operational resiliency, involving the rapid recovery of critical business functions within a predetermined timeframe while minimising negative impacts on the company’s worth and credibility. An organisation’s preparedness to respond to emergencies, such as fire, the bird flu pandemic, terrorist activity, deadly tidal waves, electricity power outages, an earthquake and other disasters, depends on its management’s engagement in adopting BCM [5]. Therefore, the consequence of not having decent BCM practices in place may be threatening. The 2004 Gartner Group report revealed that the average cost of service downtime worldwide was 42,000 USD per hour [6].

BCM is a strategy for defining an organization’s level of exposure to external as well as internal hazards. BCM aims to enable the organisation to fully respond to threats such as ‘real catastrophes’ or data hacking while supporting the organization’s commercial endeavours. Business continuity (BC) is the continuous and undisturbed condition of an organization. The emphasis is on the adaptability of individuals, buildings, operations, channels and producers, as well as the accessibility and security of data. Disruption refers to an interruption that possesses a time component and is thus at an organization level, though it does not involve functional irregularities controlled by established processes [7]. BCM involves catastrophe mitigation, corporate recovery, handling emergencies, event management, problem leadership and emergency preparedness [8]. When an organization wishes to remain profitable, it needs to have defensive measures in place in the case of a business interruption resulting from an unforeseen occurrence, which may be achieved by consistently increasing performance [9]. According to the research of Wong [10], organisations that embrace BCM have the upper hand regarding crisis adaptation. This enables a business to recover from the crisis and restart critical activities with minimal disruption. Nevertheless, BCM has an impact on dealing with crises due to the corporation’s recoveries and crucial duties. This link exposes a vital obstacle to its ability to remain successful in the aftermath of catastrophic events [11].

The paper is organised into several main sections to address the research objectives and findings comprehensively. The introduction sets the stage by presenting the research problem, objectives and importance, focusing on the impact of BCM practices on organisational performance in the Kingdom of Saudi Arabia. The literature review delves into current research on business continuity management, planned resilience and adaptive resilience, providing a theoretical framework for the study. The methodology section specifies the research design, including sample size, data collection methods and tools used, such as an electronic questionnaire distributed across different platforms. The results section presents the findings, highlighting the vital relationship between organisational performance and BCM practices as well as planned and adaptive resilience. The discussion explains these findings and explores their implications for organisations in Saudi Arabia. Finally, the conclusion summarises the study’s contributions, limitations and recommendations for future research.

According to Peterson (2009) [12], one of the primary reasons many firms fail to adopt efficient BCM is the absence of capital backing, since many top executives and board members practise tremendous restraint in spending. This might be because the BCM deployment does not produce an immediate financial advantage or a positive return on expenditure. With the numerous costs relating to the installation of necessary BCM buildings and materials, such as advisory services creating hot site data centres and functioning centres, and the development of extra computer equipment and software, it is crucial that one presents a strong business case in order to gain top management’s buy-in [13]. To effectively save money, BCM experts should collaborate with entrepreneurs to determine the possibility of reduction due to assistance interruptions, detect risk factors, characterise the best recuperation goals and select the cheapest approach and technological advances [9]. Another obstacle is adopting BCM across numerous organization divisions or applying it across the whole business [9]. These instances highlight the significance of senior leadership’s backing and directives to ensure that BCM activities are prioritised across every employee in the organisation. To overcome the issues mentioned earlier, recognising the possible advantages of BCM on organization efficiency is critical to justifying BCM initiatives adequately, attracting, attention and ultimately securing the complete backing of the highest levels of management. According to Sawalha [14], knowing the impact of BCM on organization success is critical, since it is a crucial driving force for improving an organisation’s capacity for resilience and surviving in the face of high internal and external stressors. Previous research on the strategic function of BCM stated that it might provide businesses with a competitive advantage. However, these studies did not detail how it can contribute to organisational performance [15]. Instead, [14] emphasised that the significance of BCM in improving the efficiency of organisations has seldom been discussed or tackled in previous research. Notably, the primary theoretical holes in the current literature identified by this investigation include the lack of studies that have demonstrated the links between BCM variables and business outcomes. As a result, the purpose of this study is to extend the minimal literature on the link between commercial success and long-term viability within public businesses.

This study aims to identify the effect of business continuity and sustainability in government organisations. It seeks to answer the following research questions:

• How do BCM practices impact organisational performance?
• What is the role of planned resilience in organisational performance?
• What is the effect of adaptive resilience on organisational performance?

(1) Organisational Performance Variable Measurement

According to the nature and goals of the research, the investigators relied on determining organisational performance using a tool created by [16] because it is more extensive and has an exceptional level of openness and uniformity, prompting numerous investigators, such as [17], to rely upon it in determining organisational performance. Additionally, it stands out for its uncomplicated nature and honesty in its expressions.

(2) Organisational Performance (Concept and Dimensions)

Abed [17] defined organisational performance as the capacity to manage the utilisation of people, substance and monetary assets in order to achieve their objectives in the most efficient manner while ensuring continuation.

Regarding the business sector in Saudi Arabia, the current research will increase the effectiveness and efficiency of business continuity and sustainability in government organisations while enhancing competitiveness in the entire market. Moreover, the current study will lead the path of the business sector to achieve its sustainable goals and improve its profile. The goals of the current research are as follows:

• Study the effect of BCM practices on organisational performance;
• Acquire knowledge on the effect of planned resilience on organisational performance;
• Examine the effect of adaptive resilience on organisational performance.

Definition of the Study

Organisational performance is the ability of an organisation to reach its goals and optimise results. In today’s workforce, organisational performance can be defined as an organization ’s ability to achieve goals in a state of constant change.

Planned resilience is a process that communities can undertake to identify potential hazards and threats in order to establish adaptation, mitigation and recovery plans.

Adaptive resilience is the ability to capitalise on shifting circumstances quickly.

2. Literature Review

2.1. BCM Practices in Government Organisations

The BCM objective is to enable the organisation to respond appropriately to various risks, whether real disasters or data breaches, supporting the uninterrupted continuity of business activities. BC refers to maintaining a continuous and uninterrupted state of business operations. The focus is on ensuring the resilience of people, facilities, processes, technology platforms and suppliers and protecting information availability and integrity. In this context, an outage is a disruption with a temporary enterprise-wide dimension but does not include anomalies that require standard operating procedures [7].

BCM includes several components: disaster recovery, business resumption, crisis management, incident management, problem management and emergency planning. It aims to enable organisations to deal with disruptions caused by crises effectively and continuously improve their performance to remain competitive in the market, as pointed out by [17]. According to Wong [10], organisations that adopt BCM achieve a competitive advantage in adapting to crises, enabling them to recover quickly and resume critical operations with minimal disruption. However, the impact of BCM on crisis management depends on the organisation’s ability to recover and function in a crisis. This interconnection highlights the vital role that BCM plays in an organisation’s ability to maintain competitiveness in critical circumstances [18].

Following a substantial crisis and emergency experience, the first business continuity management model was established in the United Kingdom in 2006. Consequently, it was determined that structures and strategies were needed to improve BCM requirements. These systems are intended to ensure the availability of key services and facilities, simplify recovery from interruptions and allow for a return to regular operations. Business interruptions can have substantial ramifications for an organization regarding actual financial losses and intangible effects on corporate reputation and consumer trust. As a result, it is necessary to develop an action plan to enable a timely and efficient reaction to any unexpected disruption in critical business processes. Similarly, firms seeking to stay competitive and profitable must have excellent BCM practices to sustain profitability and weather significant business disruptions [19].

When it comes to business disruptions, the emphasis is often on when and how they occur and evaluating their severity. However, infrequent, severe disruptions can impact critical systems that traditional management approaches cannot address effectively. These hazards encompass real and intangible catastrophes, such as natural disasters, epidemics, public service disruptions, financial crises, accidents and reputational issues. BCM examines internal and external risks to efficiently respond to threats such as natural disasters or data breaches while protecting the organisation’s commercial interests [20].

The current global business environment is characterised by continuous change and increasing uncertainty, which leads to escalating risks and their impact on organizations of all sizes. Ref. [17] considers that we live in a new era of risk management, where the concepts of organisational risk and risk management have witnessed significant development as a result of the emergence of new risks, such as cybercrime, threats to corporate reputation and terrorism. The pace of development of these risks is accelerating faster than the solutions being built to mitigate their impact. As a result, organisations need integrated, well-resourced, flexible and easy-to-manage responses to navigate challenges arising from unexpected events, such as terrorist attacks, financial scandals, technological developments and weather pattern changes.

In today’s business environment, taking an innovative and comprehensive approach to minimise the effects of unexpected incidents has become increasingly necessary. Regulatory and risk management concepts have evolved significantly in light of organizations’ diverse challenges, such as cybercrime, corporate reputation risks and terrorism. Large-scale crises, such as Y2K and the 11 September attacks, emphasise the importance of BCM and increase organisational awareness of it.

In recent years, BCM has been revised, resulting in a new update to ISO 22301:2019. This update aims to identify requirements for strengthening the management system to protect against, prepare for, respond to and recover from disruptions. BCM seeks to enhance resilience and effectively respond to various threats, from natural disasters to cyber-attacks, to ensure business operations remain continuous.

By identifying potential risks in advance and developing appropriate response strategies, organisations can minimise disruptions and protect their reputation and customer trust, ensuring financial stability and continuity in a globally competitive market.

2.2. Planned Resilience and Government Organisational Performance

In the current context of the business environment, organisational flexibility is crucial for organizations in order for them to adapt to constant changes and uncertain environments. The concept is understood as an organisation’s ability to adapt and survive in the face of challenges and disruptions. Flexibility provides the ability to maintain a stable organisational structure even in the face of turbulence, which helps preserve the essential resources and capabilities that contribute to achieving sustainable competitiveness in the long term [21]. Instructive mechanisms for the relationship between organisational flexibility and firm performance highlight the importance of building solid relationships with key stakeholders, such as customers, partners and employees, enabling them to adapt to environmental changes and maintain high-performance levels over time [22].

Although the relationship between organisational flexibility and performance is complex and multifaceted, flexibility is known to contribute to organisational performance. However, the nature of this relationship varies and requires extensive study. While, in the past, organisational resilience was associated with the ability to survive and adapt, today, the concept extends to include financial and non-financial aspects [23]. Although the relationship between flexibility and financial performance has been widely studied, the non-financial dimension of organisational performance, including customer engagement and employee commitment, requires more research and detail [24].

Some studies indicate that the flexibility capabilities of a business positively influence overall organisational effectiveness [25], reinforcing the prevailing idea that organisational flexibility should contribute to improved performance [25]. However, it should be noted that research results do not always confirm this relationship [25]. In addition, the relationship between organisational flexibility and performance can be two-way. While flexibility may improve an organisation’s performance, performance factors, such as profitability, customer engagement and employee commitment, can also support an organisation’s ability to prepare for and respond effectively to challenges. Inconsistencies in the literature regarding the relationship between organisational flexibility and performance can be attributed to differences in measurement methods and the specific dimensions of flexibility and performance studied. This underscores the importance of further research to understand the precise dynamics between these two constructs better.

The Government Sector Resilience Planning Strategy is a multifaceted approach that seeks to achieve two main objectives:

First, this program focuses on ensuring that a community’s need for basic services and capital is met after disaster strikes and works to strengthen emergency response and the implementation of recovery measures. This includes addressing immediate challenges and facilitating the restoration of services essential to community well-being [26].

Second, resilience planning aims to reduce long-term risks posed by natural and anthropogenic hazards, reduce the likelihood of recurring disasters and mitigate their cumulative impact on communities. This includes implementing strategies to enhance infrastructure resilience, adapt land use practices and enhance community empowerment to address emerging environmental and social challenges [27].

Furthermore, resilience planning recognises that maintaining the status quo may not be sufficient, especially in the face of increasing economic challenges resulting from natural disasters and unsustainable land use patterns. Thus, it calls for fundamental changes, such as improving access to resources and reallocating rights and power, primarily to support marginalised communities who face disproportionate risks.

Various policy investments and actions are required to achieve resilience planning goals, including developing new infrastructure, formulating robust emergency response plans and effective stakeholder engagement in preparedness efforts. These initiatives aim to build resilience at the community level, enhance adaptive capacity and prepare the community to withstand and recover from adverse events.

Regarding planned resilience, it has been clearly shown that external disturbances, such as crises, can significantly impact organisational processes and routines. However, organisations possess inherent capabilities that enable them to recover and adapt positively in response to such challenges. For example, a shooting crisis case study showed that resilience can be activated unexpectedly during crises [28].

Pauli’s conceptualisation of resilience is that “it is a latent capacity within organisations, which develops gradually through ongoing social interactions and relationships, and that resilience becomes evident when organisations face setbacks. Hence, several mechanisms, such as crisis management plans, organisational risk culture, stress testing plans, risk awareness and risk governance, play pivotal roles in enhancing organisational resilience” [29].

These ideas significantly impact business continuity and organisational resilience in crises [2]. They emphasise the importance of developing strong social ties and relationships within organisations while implementing robust crisis management strategies and risk management frameworks. By actively developing these capabilities, small businesses can enhance their ability to withstand and recover from adverse events, thus enhancing their ability to address crises and changes.

2.3. Adaptive Resilience and Government Organisational Performance

Adaptive resilience in organisations reflects their ability to respond, adapt and thrive dynamically in uncertainty, complexity and change. This resilience includes not only the ability to withstand shocks and disruptions but also to learn, innovate and transform in order to sustain long-term success [30]. This concept emphasises the importance of organisational flexibility, agility and adaptability in navigating turbulent environments and exploiting emerging opportunities.

At the core of adaptive flexibility is the idea of organisational learning and evolution. Organisations require continuous information collection, processing and use to adapt to changing circumstances and stakeholder requirements. This process includes not only the acquisition of new knowledge and skills but also the elimination of old practices and beliefs that may hinder progress [30]. Adaptive flexibility also requires a culture of experimentation and risk-taking, where failure is a valuable source of learning rather than a cause for blame or punishment.

In addition, adaptive resilience requires the ability to anticipate and proactively respond to emerging threats and opportunities. Organisations must develop their forward-looking capabilities to identify potential disruptions and trends early, allowing them to take preventive measures and strategically position themselves in the market. This requires a deep understanding of industry dynamics, competitor behaviours, technological advances and a willingness to challenge existing assumptions and models.

Building strong networks and partnerships is essential to an organisation’s ability to adapt to environmental challenges and changes. These partnerships provide support, resources and knowledge-sharing opportunities in times of crisis or change. Collaboration with suppliers, customers, government agencies and other stakeholders can enhance an organisation’s ability to mobilise teamwork and leverage complementary strengths [31]. Fostering a diverse and inclusive workforce can bring new perspectives and innovative ideas to enhance organisational resilience.

Organisations must invest in dynamic capabilities that enable them to sense, seize and transform opportunities and threats to enhance adaptive resilience. This includes developing intelligent decision-making processes, flexible resource allocation mechanisms and adaptive management structures that can facilitate rapid responses to changing market conditions. Investing in technology and digital infrastructure can also enhance organisational flexibility and efficiency, enabling faster communication, collaboration and decision-making.

Adaptive resilience in an organisation is intricately linked to its ability to respond, adapt and thrive in the face of environmental changes and disturbances. Volk et al.’s [32] adaptation can be defined as the process by which organisations respond to events in their environment, whether incremental, evolutionary or disruptive, to maintain themselves in their operational context. This concept emphasises the dynamic nature of organisational responses to external influences, highlighting the importance of flexibility and agility in navigating turbulent environments.

Ultimately, governments need to be able to adapt quickly and effectively to the increasing challenges they face, from economic transformations to social and environmental crises. This requires embracing change rather than resisting it, focusing on anticipating changes, enhancing flexibility and making quick decisions.

2.4. Business Continuity and Sustainability Practices and Government Organisational Performance

Achieving productivity and competitiveness in the global market poses a major challenge for organisations, and this also requires attention to societal and environmental issues. Hence, business sustainability becomes vital, as it aims to achieve added value for stakeholders in the short, medium and long term while reducing negative impacts on society and the environment.

Continuous improvement (CI) methodologies are recognised methods for achieving sustainability and excellence in manufacturing. Vital elements of CI implementation include improvement systems and active employee participation through work teams. These methodologies aim to improve processes or systems with minimal investment and in a relatively short time.

CI is based on the Japanese concept of Kaizen, which aims to enhance organisational performance in a systematic and planned way. CI includes a variety of methodologies such as lean production, Six Sigma and others, all of which seek to improve processes at the lowest possible cost.

The success of CI depends on an improvement system, which provides the structure necessary to systematically implement proposed actions and provide active employee participation through work teams. These teams consist of small groups of employees working to solve specific problems or implement improvements within the organization.

It is essential to understand the relationship between CI and a sustainable business environment, as implementing CI can enhance sustainability by improving processes, reducing waste and using resources more efficiently. An employee community committed to implementing CI can be instrumental in improving organization performance and achieving strategic goals sustainably.

Effectiveness in implementing CI depends largely on the involvement of employees across all hierarchical levels of the organisation and the effectiveness of the systems in place. Previous research identifies several critical factors for promoting employee engagement, such as top management commitment, employee dedication, engagement across work teams, availability of key performance indicators to monitor engagement activities, organisational structures that support engagement, methodologies for managing employee proposals, ongoing communication, middle management commitment, union support, specific training to develop participation systems, availability of resources and the adoption of recognition or reward systems for participants.

Business sustainability (BS) originated in the concept of business social responsibility, first articulated by Howard Bowen [21]. This idea has evolved into the concept of sustainable development. The ‘social’ dimension of BS relates to the impact of business activities on the workforce and surrounding communities. In contrast, the ‘environmental’ dimension focuses on keeping consumption levels below nature’s ability to regenerate, and the ‘economic’ dimension aims to ensure ongoing financial returns.

Some approaches suggest balancing stakeholder needs across social, environmental and economic dimensions, a concept known as the triple bottom line. This approach aims to meet current needs without compromising the ability of future generations to meet their own needs.

Despite the increasing reliance on sustainability standards, environmental degradation continues due to the lack of a strong concept focusing on environmental concerns at the micro and macro levels. Thus, BS research highlights the importance of applying effective processes and resource management at the enterprise level. It adds value to stakeholders, ensures long-term market participation, promotes social development, supports environmental stewardship and provides economic benefits for investors.

2.5. Research Hypotheses & Model

Figure 1 illustrates research’s hypotheses and their relation shop to the organization performance though:

Hypothesis 1 (H1):

Implementing BCM practices in organizations positively influences organisational performance.

Hypothesis 2 (H2):

Planned resilience positively contributes to organisational performance.

Hypothesis 3 (H3):

Adaptive resilience positively influences organisational performance.

3. Methodology

3.1. Research Methodology

A research methodology is a theory about conducting scientific research, explaining its philosophical assumptions and the selected methodology for this process. It aims to identify and justify the methodology used, including data collection, validity and reliability of the data, the population and sample size and the statistical procedures to conduct the study.

3.2. Research Design

The research design is the general plan for the researcher to integrate the diverse study components logically and coherently, ensuring the research problem is addressed effectively. The research establishes a prototype for measuring, collecting and analysing data. The present study will be experimental research that strictly follows the scientific investigation method. There will be a hypothesis, a variable the investigator can edit or change and aspects that can be compared, measured or calculated. The experiment will be completed in a controlled environment.

The research design is the general plan that integrates diverse study components logically and coherently, ensuring the research problem is addressed effectively. This study employs an experimental research design, strictly following the scientific investigation method. It includes formulating a hypothesis, manipulating a variable and comparing, measuring or calculating various aspects within a controlled environment. The experimental research design offers a higher level of control and specific conclusions and enables the determination of cause-and-effect relationships between variables. The researcher can identify causal relationships and present causal outcomes through precise empirical control and measurement.

This study utilises a quantitative approach, which involves collecting and analysing data that can be measured and observed. Quantitative research generates objective facts and figures, which can be expressed numerically and statistically. This approach is beneficial for obtaining in-depth survey results and comprehensively understanding the research issue. The quantitative method enhances accuracy, objectivity and efficiency in terms of time and resources [33].

3.3. Quantitative Approach

The proposed study uses a quantitative approach. Quantitative research uses measured and observed data to evaluate literature connected to a phenomenon such as building customer loyalty. The goal of using quantitative research is to gather in-depth results from the survey. This method is useful for generating objective facts and figures that can be stated numerically and statistically. The advantage of employing a quantitative method is that the researcher may gain a more comprehensive understanding of the issue under discussion. Therefore, there will be greater accuracy, objectivity and time and resource savings [34].

3.4. Population and Sampling

The present research uses purposive sampling. Purposive sampling is also called selective, judgmental and subjective sampling. It is a non-probability sampling method wherein researchers rely on their judgment when choosing population members to participate in the survey. The benefit of using purposive sampling is that it helps the researcher make the most out of a small population and obtain valuable investigation outcomes. Responses collected from the population interested in the topic under consideration will help gather better insights and more accurate research results [35]. The population of this research includes some customers, consisting of 200 participants.

3.5. Questionnaire Design and Research Measures

In this study, which has 200 participants, a sample was selected to ensure accurate data collection. Surveys were employed to gather responses, a method defined as collecting data from selected individuals through their answers to questions. This approach allows for various data collection methods and instrumentation, enhancing statistical power, information volume and access to validated models. A larger sample size is crucial as it provides a more accurate statistical value, helps identify outliers that might distort results in smaller samples and reduces the margin of error [36].

Regarding the research measures, all scales are adopted form previous studies, as shown in

Table 1. Measurement scales.

Variable: BCM practices	Reference: Păunescu, C., & Argatu, R. (2020) [37]
Item Description
In large or complex organizations, a fully scoped business continuity plan may take many months to complete. The use of project management methodology enables the organization to build and maintain effective business continuity management Business Continuity Management program complies with other programs in the center. The center is vulnerable to disruption. Management during disaster or crisis is more complicated. Business continuity-related roles and responsibilities should be included in job descriptions and performance plans. It is important to be registered (certified) in any recognized Business Continuity Standard to work in the crisis management field. The principle of Business Continuity Management has contributed to developing an efficient response to disruption in your department. Maximum tolerable periods of disruption and recovery time objectives are well-known terms in your department. The department is currently engaged with Business Continuity Management. A documented strategy for Business Continuity Management is available at the center/department.
Variable: Planned resilience	Reference: Păunescu, C., & Argatu, R. (2020) [37]
Item Description
All staff members in your department have been assigned to roles and within Business Continuity Management. All critical data in your department are backed up and readily available offsite. There are effective Service Level Agreements (SLA) with vendors and suppliers that define their obligations. There is an assigned person for Business Continuity Management within each department. There is a well-established communication plan among staff in case of disruption. There is an effective IT Continuity Plan irrespective of the workplace. The majority of employees have been trained for business continuity and incident management.
Variable:Adaptive resilience	Reference: Păunescu, C., & Argatu, R. (2020) [37]
Item Description
Products/services of your department are prioritized according to their importance. Activities that are essential for the delivery of the center’s products/services are defined. An analysis/review is carried out for each activity that had been affected by a disruption. The maximum tolerable period of disruption (MTPD) is defined for all products and services. Recovery time objective (RTO) is defined for all products and services. There is always a compromise between cost and speed of recovery. There is a risk register for your department. Mitigation measures are identified and implemented to reduce the impact of a disruption to your department responsibilities.
Variable: Organization performance	Reference: Giauque et al., 2013 [38]
Item Description
In my organization, we work by simplifying the working processes. During the past 2 years, productivity of my organization increased. In my organization, there are clear objectives that aim to answer and satisfy the expectations of the citizens or customers.

.

3.6. Methods of Data Analysis

This study includes a quantitative research analysis with 200 respondents from different cities in Saudi Arabia. This survey was conducted online with targeted respondents. This research was conducted with organisational performance as the dependent variable and BCM practices, and planned resilience and adaptive resilience as independent variables. The collected data was analysed using AMOS, and research findings were critically evaluated to determine the reasons behind customer loyalty.

3.7. Data Collection

Quantitative data was acquired through an online questionnaire. The study illustrates the link between one variable and another via the research aspects. The researcher created a questionnaire and a series of questions for the targeted individuals to answer. A descriptive analysis was performed using Excel and AMOS. After completing the questionnaire, each item was assessed and scored independently and used as part of a set of items.

The analysis and comparison results are offered in the form of published research. Last, a conclusion is provided based on the findings and hypotheses proposed, as well as recommendations and ideas.

3.8. Validity and Reliability

The reliability and validity of the research instruments were assessed using Cronbach’s alpha coefficient. This statistical measure was applied separately to each group and section within the questionnaire, followed by its application to the entire questionnaire. The results were satisfactory, indicating the robustness and consistency of the research instruments across different sections. The results are summarised in

Table 2. Validity and reliability of the questionnaire.

Variables	Number of Items	Reliability of Cronbach’s	$\mathbf{Validity}=\sqrt{\mathbf{R}\mathbf{e}\mathbf{l}\mathbf{i}\mathbf{a}\mathbf{b}\mathbf{i}\mathbf{l}\mathbf{i}\mathbf{t}\mathbf{y} }$
Organisational performance	3	0.795	0.891
BCM practices	9	0.544	0.737
Planned resilience	7	0.852	0.923
Adaptive resilience	7	0.914	0.956
All	26	0.916	0.957

.

3.9. Population and Sample Size

The sample size was determined using a formula to ensure adequate respondents in each subgroup. The following formula was employed to estimate the population sample size: [Minimum Sample Size ($n$) = ${\displaystyle \frac{t^{2}p\left(1-p\right)}{m^2}}$].

This calculation method was chosen to ensure the reliability and representativeness of the study’s findings across different subgroups within the population:

Top of Form

Minimum Sample Size ($n$) = ${\displaystyle \frac{t^{2}p\left(1-p\right)}{m^2}}$

The given calculation yields the needed sample size of 200. The questionnaire was created using the Google Docs app. The survey questionnaires were given to over 210 people, and 200 replies were obtained, accounting for a response rate of 94.98%. The survey was sent to participants in both Arabic and English through social media, email, WhatsApp, Twitter and Facebook.

3.10. Descriptive Analysis

This section conducted descriptive and deductive analyses to examine the collected data and provide a comprehensive understanding of the research findings. First, a descriptive analysis was employed to present a detailed overview of the study participants based on various characteristics. This involved summarising demographic information, such as age, gender, education level, occupation and other relevant variables collected from the participants.

Table 3. Demographic characteristics of the study sample.

Variable	Variable Classes	Frequency	Percentage (%)
Country	Saudi Arabia	194	97.0
	Others	6	3.0
Total		200	100.0
City	Others	53	26.5
	Riyadh	147	73.5
Total		200	100.0
Age	20–29	48	24.0
	30–39	100	50.0
	40–49	44	22.0
	50–59	8	4.0
Total		200	100.0
Sector	Private Sector	81	40.5
	Semi-Government Sector	38	19.0
	Government Sector	81	40.5
Total		200	100.0
Qualification	Bachelor’s Degree	125	62.5
	Master’s Degree	71	35.5
	Doctoral Degree	4	2.0
Total		200	100.0
Administration	BCM managers and employees	100	50.0
	Others	100	50.0
Total		200	100.0

shows the distribution of participants by age: 50.0% were aged 30–39 years, while 24.0% were 20–29 years, 22.0% were 40–49 years and 4.0% were 50–59 years. Table 3 also shows the distribution of participants by qualification: 62.5% of participants hold a bachelor’s degree, 35.5% have a master’s degree and 2.0% hold a doctoral degree.

Table 3 also shows the distribution of participants by country: 97.0% of the participants were from Saudi Arabia, while 3.0% originated from other countries.

The table shows the distribution of participants by country: 73.5% of the participants lived in Riyadh, while 26.5% lived in other cities.

Table 3 also shows the distribution of participants by sector: 40.5% of the participants worked in the private sector, and the same percentage worked in the government sector. In comparison, 19.0% of the participants worked in the semi-government sector.

Finally, Table 3 shows the distribution of participants by administration: 50.0% were BCM managers and employees, while the same percentage were others.

Based on

Table 4. Descriptive statistics for business continuity and sustainability in government organisations.

Clause	Mean	Std. Deviation	Level Order
Organisational performance	4.0833	0.76666	High
BCM practices	4.0791	0.42135	High
Planned resilience	3.8345	0.76396	High
Adaptive resilience	4.0357	0.78517	High

below, the mean and standard deviation for each variable from 200 valid answers were analysed. The results were derived from the highest mean score of the organisational performance variable. Based on the participants’ answers, there were no low or moderate mean scores, indicating that BCM practices positively impact organisational performance in the Kingdom of Saudi Arabia.

The correlation analysis in

Table 5. Pearson correlation for independent variables and dependent variables.

	Organisational Performance	BCM Practices	Planned Resilience	Adaptive Resilience
Organisational performance	1
BCM practices	0.427 **	1
Planned resilience	0.596 **	0.482 **	1
Adaptive resilience	0.614 **	0.493 **	0.804 **	1

** Correlation is significant at the 0.01 level (two-tailed).

refers to the strength and direction of the linear relationship between two factors. The degree of correlation denotes the strength and relevance of a link between them. A bivariate association was performed to achieve this correlation, calculating the Pearson correlation coefficient with the degree of relevance. A number of 1 or −1 implies that the components may be reliably determined interchangeably, whereas a value of 0 indicates no relationship between them. Finally, the results of the analysis are presented in Table 5. The bivariate Pearson correlation test suggested that there was a positive significant correlation (i.e., association) between organisational performance, and all reasons where $r$ ranged (0.427–0.804), $p$ < 0.010.

The (CMIN/DF) which shown in

Table 6. CMIN.

Model	NPAR	CMIN	DF	P	CMIN/DF
Default model	17	176.550	4	0.000	42.788
Saturated model	21	0.000	0
Independence model	6	1414.781	15	0.000	94.319

is 42.788 with a p-value of 0.00 > 0.05, which indicates this model is free from a bad fit index.

Moreover,

Table 7. RMR and GFI.

Model	RMR	GFI	AGFI	PGFI
Default model	0.080	0.894	0.441	0.170
Saturated model	0.000	1.000
Independence model	0.441	0.423	0.192	0.302

presents a comparative analysis of key goodness-of-fit indices, including the Root Mean Square Residual (RMR), Goodness of Fit Index (GFI), Adjusted Goodness of Fit Index (AGFI), and Parsimony Goodness of Fit Index (PGFI), providing insights into the overall fit and complexity of the models.

Consequently,

Table 8. RMSEA.

Model	RMSEA	LO 90	HI 90	PCLOSE
Default model	0.328	0.287	0.372	0.000
Independence model	0.496	0.475	0.518	0.000

, which presents the Root Mean Square Error of Approximation (RMSEA), indicates a value of 0.000. This indicates the model is free from a bad fit index.

Figure 2 represents the structural model as the model fit summary.

3.11. Hypothesis Testing

H1: 

The implementation of BCM practices in organizations positively influences organisational performance.

H1 examines the strength and nature of the relationship between BCM practices and an organization ’s organisational performance. The findings showed that BCM practices significantly influence organisational performance (β = −0.353, t = 7.804, p = 0.000). H1 was therefore supported.

H2: 

Planned resilience positively contributes to organisational performance.

H2 examines whether there is a connection between planned resilience and organisational performance. The findings showed that planned resilience significantly affects organisational performance (β = 0.319, t = 6.254, p = 0.000). H2 was therefore supported.

H3: 

Adaptive resilience positively influences organisational performance.

H3 assesses whether there is a connection between adaptive resilience and organisational performance in the Kingdom of Saudi Arabia. The findings showed that adaptive resilience had a positive effect (β = 0.141, t = 2.603, p = 0.010); however, since the p-value was lower than the acceptable p-value of < 0.05, the relationship between adaptive resilience and organisational performance was significant, and H3 was supported.

BCM practices in organizations positively influence organisational performance.

Furthermore, the results shown in

Table 9. Direct relationships.

Hypotheses	Independent Variable	Dependent Variables	Standardised Co-Efficient	t-Values	Results
H1: BCM -> performance	performance	performance	−0.315	3.760 *	Supported
H2: planned resilience > performance	planned resilience	performance	−0.260	2.899 *	Supported
H3: adaptive resilience > performance	adaptive	performance	0.141	2.603	Supported

Note: * represents when the p-value is less than 0.05 (p < 0.05).

summarize hypotheses and their relationships.

4. Discussion

Although BCM’s image has recently increased, and the concept of business continuity was not restored as a method of leadership until the start of the 2000s, the data revealed that 77% of the assessed firms used BCM. It also shows that businesses are reasonably aware of its importance. The use of BCM seems to differ by country. In some nations, it is in its early stages, while in others, BCM is widely employed in enterprises. Furthermore, [39] stated that, notwithstanding its importance, the degree of knowledge and implementation of BCM in Malaysia is still in its early stages across numerous businesses. In other nations, BCM is more widely used. Other studies in the UK, including research by [40], found that 60% of responding firms used BCM. A study conducted by George Washington University and the Corporate Response Group Corporation of Fortune 1000 companies in the United States discovered that a good number of corporations are changing their perspective and practice of crisis management to include BCM-related activities, such as performing a business impact analysis, developing business continuity and creating disaster recovery plans [41]. The investigation results also revealed that BCM is employed by enterprises in many industries.

Nevertheless, the application of BCM varies across different domains. This conclusion is similar to the results of other research on BCM, such as [42,43] and [40], who discovered that the usage of BCM varies significantly among industries. The research results suggested that customer service businesses make substantial use of BCM. This statistic varies with Woodman’s [42] survey, which indicated that 89% of leaders in the financial and insurance industries said that their businesses used BCM, with utilities and central government at 83% and local government at 69%. Conversely, business services (43%) and information technology (33%) received lower scores. These results also contrasted with the survey in [42], which indicated that 80% of managers in the financial and insurance industries claimed that their businesses used BCM, with the utility industry ranking third at 70%. Construction and education were the lowest-ranking sectors.

Furthermore, a survey conducted by ZAWYA highlighted a significant gap in robust BCM practices among Middle Eastern businesses, encompassing the UAE, Saudi Arabia, Bahrain, Qatar, Oman and Kuwait. The survey revealed that 70% of these businesses lack robust BCM measures. Interestingly, 38% of respondents claimed over 20 years of experience in dealing with business continuity planning in some capacity [44]. The findings also indicated no discernible correlation between the presence of BCM and the level of risk associated with a particular organisation’s business type. Similarly, the effectiveness of BCM approaches does not seem to correlate with the risk level inherent in the organisation’s business activities. These trends were consistent across all BCM-related activities. This lack of correlation is a common issue in the Middle East, as highlighted by the ZAWYA study, which underscores that, despite the increasing frequency of major disruptions and disasters affecting businesses in the region, 70% of organisations in the UAE, Saudi Arabia, Bahrain, Qatar, Oman and Kuwait have yet to establish an effective and robust BCM program [44].

4.1. Limitations

Several constraints were encountered during this research. Initially, there was a scarcity of sufficient sources on the topic, which impacted the depth of the literature review. Additionally, opposing viewpoints and potential biases among the study population may have led to selecting results and information that reinforced their main arguments rather than providing a balanced perspective.

The challenge of reaching all professionals within the given timeframe necessitated using an electronic survey, which may have impacted the quality and depth of responses. The time constraints also posed challenges, potentially affecting the study’s outcomes and overall findings.

Moreover, disseminating the survey results faced difficulties, particularly in managing the low response rate from participants, which extended the research timeline.

These limitations underscore the need for future research to address these issues. Future studies could benefit from a broader literature search, strategies to mitigate bias and improved methods for reaching and engaging with a wider range of professionals. Additionally, exploring alternative dissemination methods and extending the data collection timeframe could enhance future research outcomes’ robustness.

4.2. Recommendations & Implications

The policy recommendations derived from the study emphasise actionable steps to enhance BCM in organisations across the Kingdom of Saudi Arabia. First, businesses should enhance BCM training and awareness among all employees, which involves implementing comprehensive training programs that focus on the importance of BC and specific practices to be followed. Developing a structured training schedule, incorporating BCM modules into onboarding programs and conducting regular refresher courses will ensure that all employees are well-prepared to handle potential disruptions. Additionally, organisations should establish a standardised BCM framework that is aligned with international best practices, such as ISO 22301, and tailored to the unique needs of Saudi businesses. This framework should include detailed policies for risk assessment, business impact analysis and recovery strategies to ensure a robust and effective BCM plan.

Furthermore, regular BCM audits and reviews are crucial to identifying potential flaws and areas for improvement. Organisations should schedule bi-annual BCM audits and set up a review committee to evaluate audit findings and promptly implement corrective actions. Integrating BCM practices into the strategic planning process is also essential for long-term resilience and sustainability. By embedding continuity considerations into developing organisational strategies, budgets and project plans, businesses can ensure that BCM becomes integral to all major decisions. Last, leveraging technology for BCM, such as using advanced data analytics and automated response systems, can significantly enhance an organisation’s ability to anticipate, respond to and recover from disruptions efficiently. These recommendations aim to proactively address potential issues and ensure continuous organisational performance amidst various challenges.

4.3. Research Contributions

4.3.1. Theoretical Contributions

▪

Expansion of BCM Awareness: The research contributes to the theoretical understanding of BCM by highlighting the variances in its adoption and awareness across different regions and industries. It underscores the evolution of BCM from a niche concept to a widely recognised component of organisational resilience. This expansion in awareness is significant in theoretical models of organisational behaviour and resilience.

▪

Cross-Regional BCM Implementation: The study provides a comparative analysis of BCM implementation across various countries and industries, enriching theoretical frameworks exploring global and regional differences in BCM practices. Identifying differences in BCM maturity between regions, such as the Middle East, compared to Western countries, adds depth to understanding how BCM evolves in different socio-economic and regulatory environments.

▪

Correlation with Risk Levels: The finding of no clear correlation between BCM practices and the level of risk inherent in an organisation’s activities challenges existing theoretical assumptions about risk and BCM. This insight prompts a reevaluation of theoretical models that link BCM effectiveness directly to perceived risk levels, suggesting a need for more nuanced theories that account for varying levels of BCM implementation regardless of risk.

▪

Influence of Industry-Specific Factors: The research highlights industry-specific differences in BCM adoption, contributing to theoretical models that examine how sector-specific characteristics influence BCM practices. This understanding helps refine theories related to industry-specific risk management and continuity planning.

4.3.2. Practical Contributions

▪

Enhanced BCM Training and Awareness: The study recommends comprehensive BCM training programs for employees, emphasising practical steps for organisations to improve BCM awareness and preparedness. This recommendation is crucial for practitioners looking to develop robust BCM practices within their organisations and to integrate BCM more effectively into their organisational culture.

▪

Standardised BCM Framework: By advocating for a standardised BCM framework aligned with international best practices, such as ISO 22301, the study provides practical guidance for organisations in Saudi Arabia and elsewhere. This framework helps organisations implement BCM strategies that are both effective and compliant with global standards, enhancing their ability to manage disruptions.

▪

Regular BCM Audits and Reviews: The recommendation to conduct bi-annual BCM audits and establish a review committee provides practical steps for organisations to assess and improve their BCM practices continuously. Regular audits ensure BCM plans remain practical and relevant, addressing potential flaws and adapting to new challenges.

▪

Integration into Strategic Planning: The study emphasises the importance of integrating BCM into strategic planning processes. This advice encourages organisations to consider continuity planning in their long-term strategies, ensuring that BCM is embedded in organisational decision-making and project planning.

▪

Leverage of Technology: The recommendation to utilise advanced data analytics and automated response systems for BCM highlights the practical application of technology in enhancing BCM capabilities. This guidance is valuable for organisations seeking to modernise their BCM practices and improve their response and recovery processes.

4.4. Conclusion

The research aimed to investigate the effect of BCM practices on the organisational performance of organizations in the Kingdom of Saudi Arabia. The study provided valuable insights into how these elements influence organisational performance by examining BCM practices as the dependent variable and planned resilience and adaptive resilience as independent variables. The study’s findings reveal a significant link between organisational performance and using BCM practices, as well as planned and adaptive resilience. Specifically, implementing BCM practices enhanced organisational performance by fostering both planned and adaptive resilience, enabling businesses to anticipate better and respond to and recover from disruptions. These results underscore the critical importance of integrating BCM practices into the strategic and operational frameworks of organisations in Saudi Arabia. The findings contribute to the academic understanding of BCM and provide practical guidance for business proprietors. By identifying potential flaws in existing practices and offering actionable recommendations, this research equips businesses with the tools needed to proactively improve their continuity strategies and achieve performance goals when projects begin. These insights are also valuable for educational institutions, offering reflections and extending the existing literature on BCM.