Analysis of the Level of Adoption of Business Continuity Practices by Brazilian Industries: An Exploratory Study Using Fuzzy TOPSIS

Abstract

The COVID-19 outbreak caused several negative effects in industries of all sizes and in all parts of the world, leading academic and practitioners to ask whether organizations could have been better prepared to face disruptive situations. This paper aims to analyze business continuity practices performed by Brazilian industries. A survey was conducted with academics who work in the field of organizational resilience and business continuity and are familiar with the reality of Brazilian companies in the industrial sector. The participants assessed 16 practices (P) proposed by the ISO 22301:2020, considering two categories: large industries (LI) and small and medium-sized industries (SMI). Data analysis was performed using Hierarchical Cluster Analysis, frequency analysis, Fuzzy TOPSIS and sensitivity analysis. For LIs, P4 (leaders conduct periodic critical analyses of practices) was considered the practice with the best application rate, while for SMIs, P2 (understand stakeholders’ needs and expectations, and use information in business continuity management) was chosen. In all scenarios tested for LIs and SMIs, P8 (well-structured systematic processes to analyze the impact of abnormal situations on their business and the potential risks of a disruption) and P16 (periodic audits of their business continuity management activities to identify opportunities for improvement, and information record) are in the bottom quartile. When compared to LIs in the Brazilian context, SMIs exhibit more profound deficiencies in terms of applying business continuity practices. The findings of this study can be of great value to assist managers in improving organizational resilience. Organizations should be better prepared to face future disruptive events, whether biological, social, technological, or economic.

1. Introduction

The COVID-19 pandemic has disrupted not only people’s daily lives, but also the global economic system [1,2], highlighting the need for companies to pay greater attention to business continuity management [3,4,5]; that is, to their capacity “to continue the delivery of products and services within acceptable time frames at predefined capacity during a disruption” [6]. Such macroeconomic impacts have implied that businesses had to adapt to a new reality, dealing with revenue losses, demand fluctuations, lockdowns, organizational changes, and a variety of other restrictive situations and conditions imposed on their activities as a result of the economic losses and health crisis [6,7,8].

Examples of how the COVID-19 pandemic has negatively impacted various economic sectors abound. The aviation sector was one of the most affected with losses in aviation-supported jobs (reduction from 46 million to 41.7 million) and direct aviation jobs (43% reduction), including airlines, airports, manufacturers and air traffic management [9,10,11]. Another sector directly impacted by the pandemic was healthcare, where organizations faced constant challenges due to a lack of qualified professionals, inputs, resources, working conditions, and growing demand [12]. Although these effects have become more visible, many other industries can be mentioned such as manufacturing [13], energy [14], agriculture [15] and food [16], among others.

The pandemic’s effects on businesses had a number of consequences for both large and small industries, entrepreneurs and employees. The study conducted by Gautam [17], for example, revealed that more than 20 million informal sector workers in Bangladesh were unable to carry out their activities due to the implications caused by the pandemic, triggering significant social and economic disruptions in this country. Even in developed countries such as the United States (US), 76.89% of entrepreneurs and business partners claimed that the pandemic had an impact on their business, with 31.93% forced to close temporarily and 4.20% permanently [9]. Large enterprises such as Brooks Brothers and Virgin Atlantic went bankrupt due to COVID-19 [17,18]. It was also noted that family businesses and startups were especially affected by the pandemic [19,20]. Studies conducted with 5800 small businesses in the US showed a reduction of about 40% of jobs, leading thousands of them to drastic cost cutting, additional bank loans or bankruptcy [21,22,23].

Despite the fact that government responses to the pandemic varied by country, causing more severe effects in some regions, Collins et al. [24] asserted that years of organizational optimization in industries were lost, and critical systems involved in the production of goods and services revealed a lack of resilience, redundancy, investments in diversification, and adaptive capacity. This has disrupted supply chains, which are overly interdependent in today’s globalized world [24,25]. Because countries dealt with the pandemic inequitably, the effects and failures in supply chains were felt throughout the crisis; thus, even if a country has achieved positive results in combating COVID-19, shortages of certain goods and services will still be felt if the pandemic continues to affect economic activities in different parts of the world [26,27].

All of these negative effects felt by industries of all sizes and in all parts of the world led academics and practitioners to ask whether organizations could have been better prepared to face disruptive situations by implementing business continuity and resilience concepts and approaches [4,28]. The debate on this topic has gained traction, and studies have revealed that there is still enormous room for improvement and application of business continuity concepts and practices, and that, in general, organizations and managers around the world have neglected them, which could have mitigated the impacts of the pandemic [29,30].

Given the context presented, ISO 22301:2020 [6] is characterized as an important, globally recognized standard that provides security and organizational resilience guidelines, with the goal of establishing a management system that enables business continuity following a disruption. In this exploratory study, ISO 22301:2020 is used as a framework analysis with the purpose of examining the level of adoption of business continuity principles by Brazilian industries. This study is important for the dissemination of knowledge about this important management tool, as well as for the benefit of managers who can improve organizational resilience; organizations that can be better prepared for future disruptive events; and countries whose economic development is highly dependent on the continuity of their businesses.

The remainder of this paper is organized as follows. Section 2 provides the background on security, resilience and business continuity management systems (BCMS) considering the structure of the ISO 22301:2020. In addition, business continuity management is discussed in relation to firm size. Section 3 presents the methods, including the structuring of the survey, Hierarchical Cluster Analysis (HCA), frequency analysis, Fuzzy TOPSIS (Technique for Order Preference by Similarity to Ideal Solution) and sensitivity analysis. Section 4 contains discussions that take into account the results obtained for large, medium and small industries in an integrated manner. Finally, Section 5 presents the conclusions, limitations and suggestions for future studies.

2. Background

2.1. Security and Resilience: BCMS from the Perspective of the ISO 22301:2020

The ISO 22301:2020 standard defines the structure, best practices, and requirements for implementing, maintaining, and improving a BCMS. This management system guides organizations in developing the requirements for supporting in disruption contexts, while also assessing whether the impacts are acceptable or not; in addition, they contribute to reducing the likelihood of negative impacts occurring or making recovery possible when they occur [6].

According to ISO [6], when implementing a BCMS it is important that organizations comprehend the external and internal issues that can contribute to disruptive situations. These issues may differ depending on the organization’s goals, products, services, and the degree and types of risk it is willing to take. As a result, when establishing a BCMS, organizations need to identify the relevant stakeholders and define the requirements to be applied in the interaction with them.

The first requirements described in ISO 22301:2020 for the implementation of a BCMS are legal and regulatory obligations, for which a continuous process to identify them should be put in place, with the goal of ensuring their products and/or services are law-compliant. In addition, when establishing a BCMS, the standard recommends that its scope be defined in accordance with its missions, goals, and obligations, as well as the parts of the organization in which this management system must be applied [6].

ISO 22301:2020 emphasizes that organizations’ top management must demonstrate engagement and leadership in the implementation of the BCMS, establishing policies to ensure commitment to system requirements and providing resources to achieve the defined goals [6]. Thus, when planning the implementation of the BCMS, the organization must identify the risks and opportunities that should be addressed based on its scope of application in order to prevent and reduce unwanted effects and ensure that the intended results are achieved. Furthermore, actions to assess system effectiveness must be defined, including what will be done, what resources will be required, when the actions will be completed, and how the results will be evaluated [6].

According to ISO 22301:2020, it is important that the organization determine what skills, training, and experiences are required for employees to perform the activities associated with business continuity. It is also critical to educate employees on business continuity policies and the BCMS principles [6].

Finally, ISO 22301:2020 recommends that organizations implement and maintain systematic processes for analyzing the impact on business and assessing the risks of disruption to operations. These analyses must be conducted on a regular basis in order to identify and choose business continuity strategies that account for solutions before, during and after a disruption or crisis. Thus, these strategies must comprise one or more actions that meet the requirements to continue, recover and protect the organization’s activities or that reduce the probability and time of disruption, while constantly reassessing the BCMS parameters to achieve continuous improvement [6].

2.2. Business Continuity Management and Firm Size

The COVID-19 pandemic had a wide-ranging impact on businesses of all sizes, sectors and activities. As discussed by Anholon et al. [8], Margherita and Heikkilä [4] and Graham and Loke [31], the lack of structured business continuity management practices and systems at the beginning of this crisis exacerbated these impacts, emphasizing the importance of better preparation in the face of situations characterized by high uncertainty, complexity, and potentially disruptive disruption. Despite the absence of well-established BCMS, organizations were forced to reinvent themselves and consequently apply business continuity management concepts, even if instinctively and remedially, in order to survive the challenges posed by the pandemic [6,32,33].

Kraus et al. [23] investigated how small family businesses in five European countries (Austria, Germany, Italy, Liechtenstein and Switzerland) dealt with the pandemic and what risk mitigation strategies were adopted. As an example, a German appliance manufacturer reduced its own production and working hours to minimum levels in order to deal with logistical problems and low production due to the decrease in the availability of components, thus prioritizing its survival. Another example was an Austrian dairy company, which focused its resources on production to meet the increased demand for cheese during the pandemic, while implementing sanitary measures and reorganizing its production lines, despite potential losses in other product or service markets. These authors conclude that typical characteristics of family business models contributed to the survival of the companies studied, particularly the emphasis on long-term survival over immediate results and shareholder interests [23]. Other studies on small and family businesses support the importance of business continuity and risk mitigation strategies for survival in times of crisis [34,35,36].

Regarding the business continuity strategies used by large and medium-sized industries, authors such as Margherita and Heikkilä [4] and Papadopoulos et al. [33] stated that, in general, they relied on innovation and the use of new technologies, both to establish new forms of work (e.g., home office) and to develop new products and services from the application mainly of artificial intelligence and data science. The application of new technologies by large companies has also extended to the development of new supply chain management strategies [37,38].

Margherita and Heikkilä [4] have structured the business resilience responses and measures of various large and medium-sized industries into five categories: Operations and Value Systems, Customer Experience and Support, Human Resources and Workforce, Leadership and Change Management, and Community and Social Engagement. The main measures in the category of ‘Operations and Value Systems’ were directed at dealing with supply chain and logistics issues, with a focus on improving connectivity and digital integration not only within the company but also with suppliers and key business partners, as well as actions to prioritize essential inputs and restructure the business model. The Customer Experience and Support actions focused on rearranging store and office space, reducing human contact in the purchasing and sales processes, and increasing investment in digital marketing. Measures to make work more flexible, adapt the work environment and implement remote work were included in the category Human Resources and Workforce. Finally, Leadership and Change Management actions focused on creating positive scenarios to maintain customer and stakeholder trust in the organization, whereas Community and Social Engagement actions included campaigns, donations and investments in COVID-19 mitigation [4].

It is important to note that the literature concurs that logistical disruption was one of the most common problems faced by industries worldwide during the pandemic [4,22,32]. The reasons for this, according to Sharma et al. [7], are the high interdependence of supply chains in a globalized world and the low capacity for resilience and organizational flexibility. These authors mentioned Samsung as an example of a company that had diversified its industrial parks in several countries and, as a result, was able to more effectively cope with production interruptions and the differences of each country in the COVID-19 confrontation, adjusting production to the constraints and determinations of each location [7].

Overall, the pandemic has made researchers, managers and businesses all over the world aware of the importance of BCMS. Even when business continuity concepts and practices were used in an unplanned and unstructured manner, and they proved to be critical for survival and recovery during the pandemic. In a context of growing complexity and uncertainty [39], it is certain that new disruptive events will emerge, whether biological, social, technological, or economic [40]. In this sense, regardless of the geographical region, economic sector, or size of the company, advancing knowledge about the structuring and implementation of BCMS is required [7,30,32].

3. Materials and Methods

3.1. Survey Structuring and Research Instrument Development

With the purpose of examining the level of adoption of business continuity principles by Brazilian industries, a survey was conducted with academics who work in the field of organizational resilience and business continuity and are familiar with the reality of Brazilian companies in the industrial sector. It is important to mention that this study was approved by the Research Ethics Committee of the university (CAEE: 50579021.8.0000.5404).

The survey addressed 16 practices related to the BCMS proposed by ISO 56002:2020 (

Table 1. The business continuity management practices that comprised the survey.

Code	Description
P1	Organizations analyze internal and external issues that may jeopardize business continuity management results on a regular basis
P2	Organizations seek to understand stakeholders’ needs and expectations, and then use that information in activities and decisions related to business continuity management
P3	Organizations define the clear scope related to the activities to be performed within the business continuity management
P4	Organizations’ top management conduct periodic critical analyses in relation to activities associated with business continuity management and ensure the necessary resources so that they occur in the best possible way
P5	Organizations define the roles and responsibilities associated with business continuity management correctly and ensure that employees understand them
P6	Organizations have employees qualified to work on business continuity management activities; to that end, they must strive to develop such competencies through education, training, and/or experience
P7	Organizations define the goals associated with business continuity management in a consistent, measurable manner and communicate them to all parties involved; they also develop strategies for achieving those goals, including what will be done, what resources will be needed, who will be involved, how long the plan will be, and how the results will be analyzed
P8	Organizations have well-structured systematic processes in place to analyze the impact of abnormal situations on their business and the potential risks of a disruption, including a pre-defined maximum period during which non-resumption of activities will become unacceptable and the minimum capacity required for recovery
P9	Organizations have structured risk assessment and intervention processes in place to help them make decisions concerning business continuity management
P10	Organizations have well-structured documentation control systems to support business continuity management
P11	Organizations define strategies and solutions for business continuity in a way that is appropriate to their reality, taking into account size and financial capacity, protecting priority activities, reducing the likelihood of disruption, and ensuring the provision of necessary resources in disruptive situations
P12	Concerning operational plans to manage the organization during disruption, organizations define the purpose, scope, objectives, roles and responsibilities of employees, as well as the operation and coordination of each team, allowing for a structured and well-defined response during disruption
P13	Organizations have structured plans to assess the appropriate moment for the resumption of their operations
P14	Organizations conduct periodic tests to assess efficiency and validate their business continuity strategies and solutions, reflecting on existing improvement opportunities; they also assess the ability of suppliers and partners to maintain operations during disruptions, as well as compliance with legal and regulatory requirements and industry best practices
P15	Organizations are clear about how they measure business continuity management performance, taking into account key factors such as relevant indicators, monitoring frequency and responsible employees
P16	Organizations conduct periodic audits of their business continuity management activities to identify opportunities for improvement; they also record information in any format so that it can assist decision making and be used as a lesson learned in the future

Source: Elaborated by the authors based on ISO 22301:2020 [6].

).

Respondents were asked about the adoption of each practice considering two categories: large industries (LI) and small and medium-sized industries (SMI). Respondents should rate each practice for each category using the following scale: Not applied (NA); Applied superficially (AS); Applied reasonably (AR); Applied properly (AP); or Applied in a well-structured way (AW).

The first section of the survey consisted of questions aiming at characterizing the sample, including the respondent’s research area, whether he/she conducted master/doctoral student supervision activities in the area of organizational resilience and business continuity management, and academic experience in the field. In the second part of the survey, the 16 practices elaborated based on the ISO 22301:2020 were presented, and the respondents assessed their level of adoption by Brazilian LIs and SMIs.

Considering the research purpose, the recommendations of Apostolopoulos and Liargovas [41] were followed for sampling, in which a non-probabilistic and judgmental procedure was adopted to select participants with conceptual and practical knowledge qualified to participate in the research. The respondents were selected based on the analysis of their curriculums registered on the main professional platform for researchers in Brazil, i.e., the Lattes platform, which is validated by the National Council for Scientific and Technological Development. Only those with experience in the field were invited to participate in the survey, based on their professional background.

3.2. Data Analysis

The data analysis was performed using Hierarchical Cluster Analysis (HCA), frequency analysis, Fuzzy TOPSIS (Technique for Order Preference by Similarity to Ideal Solution), and sensitivity analysis.

The HCA enabled classifying data into groups that are most similar to each other. According to Nielsen [42], the HCA works by progressively grouping the data in order to obtain a class in which the data can be grouped based on their similarity at each step of the algorithm. A binary tree of clusters or dendrogram is generated as a result of this calculation, with its “root” containing all of the data to be treated and each partition allowing for a new classification, with the option to truncate this process at each new partition iteration. In this study, the HCA was used to ascertain how respondents were classified based on their educational level, experience, and knowledge on organizational resilience and business continuity management. The percentage indicated by respondents for each of the 16 business continuity management practices evaluated in each category (i.e., LI and SMI) was analyzed using frequency analysis.

The Fuzzy TOPSIS application was based on the adapted version proposed by Chen [43], which is a method widely used in a variety of academic researches [44]. The Fuzzy TOPSIS is performed by combining the TOPSIS developed by Hwang and Yoon [45], which was initially used to support multi-criteria decision making [46,47], and fuzzy logic, through which Chen [43] proposed the application of fuzzy numbers for representing linguistic variables. The use of fuzzy logic in conjunction with TOPSIS allowed for the consideration of uncertainties presented in the answers of the respondents and their classification, as well as the generation of a ranking of the analyzed business continuity practices.

In this study, the Fuzzy TOPSIS was used to rank the business continuity practices presented in Table 1 based on expert opinions about the level of adoption in Brazilian LIs and SMIs. According to Chen’s [43] methodological procedures, the practices served as alternatives and the respondents as criteria with weights based on their educational background, professional experience, and subject-matter expertise. As in Chen’s [43] application, this study used the triangular fuzzy numbers. As explained by Pedrycz [48] and Klir and Yuan [49], despite its simplicity, it can be useful in cases where variations in shape have little impact on the analysis.

The fuzzy version of (a) the scales used (Figure 1a) and the levels for grouping respondents (Figure 1b) are shown in Figure 1.

Following Chen [43], based on the fuzzy numbers the responses were organized in a matrix $\tilde{G}$ (1) containing the scores in their fuzzy triangular form. In the sequence, the vector $\tilde{E}$ (2) was formed, where $w_j$ is the respondent’s level (based on education, experience, and knowledge) in its fuzzy triangular form, representing the fuzzy weights of the respondents.

$$\tilde{G}=\left[\begin{array}{ccc}{\tilde{x}}_{11}& \cdots & {\tilde{x}}_{1m}\\ ⋮& \ddots & ⋮\\ {\tilde{x}}_{n1}& \cdots & {\tilde{x}}_{nm}\end{array}\right]; {\tilde{x}}_{ij}=\left[\begin{array}{ccc}{a}_{ij,}& b_{ij},& c_{ij}\end{array}\right]$$

(1)

$$\tilde{E}=\left[{\tilde{w}}_1 , {\tilde{w}}_2,\dots {\tilde{w}}_n\right];{\tilde{w}}_j=\left[w_1,w_2,w_3\right]$$

(2)

In the next step, the matrix $\tilde{G}$ was normalized based on the highest score value, obtaining the matrix $ℛ$ (3) as follows:

$$ℛ={\left[{\tilde{r}}_{ij}\right]}_{mxn} ; {\tilde{r}}_{ij}=\left[\frac{a_{ij}}{C_j^{*}},\frac{b_{ij}}{C_j^{*}}, \frac{c_{ij}}{C_j^{*}}\right]\underset{ }{\to }{C}_j^{*}=\max \left(i\right)c_{ij}$$

(3)

The matrix $ℛ$ was then weighted by the vector $\tilde{E}$, generating the matrix $Ʋ$ (4):

$$Ʋ={\left[{\tilde{v}}_{ij}\right]}_{mxn}\to i=1,2, \dots , m;j=1, 2 , \dots ,n\to {\tilde{v}}_{ij}={\tilde{r}}_{ij} (.) {\tilde{w}}_j$$

(4)

Next, the Positive Ideal Solution (unit vector) (5) and Negative Ideal Solution (null vector) (6) were used to calculate the distances $d(\tilde{a}, \tilde{b})$ (7) related to each element of the matrix $Ʋ$ using the following equations:

$$A^{*}=\left[{\tilde{v}}_1^{*}, {\tilde{v}}_2^{*},{\tilde{v}}_3^{*}\right] , \mathrm{where} {\tilde{v}}_j^{*}=\left[1,1,1\right]$$

(5)

$$A^{-}=\left[{\tilde{v}}_1^{-}, {\tilde{v}}_2^{-},{\tilde{v}}_3^{-}\right] , \mathrm{where} {\tilde{v}}_j^{*}=\left[0,0,0\right]$$

(6)

$$d\left(\tilde{a}, \tilde{b}\right)=\sqrt{\frac{1}{3}\left[{\left(a_1-b_1\right)}^2+{\left(a_2-b_2\right)}^2+{\left(a_3-b_3\right)}^2\right]}$$

(7)

The total positive ($d_i^{*}$) (8) and negative ($d_i^{-}$) (9) distances in relation to each alternative were obtained through the sum of the partial distances as follows:

$$d_i^{*}={\displaystyle \sum }_{j=1}^{n}d\left({\tilde{v}}_{ij},{\tilde{v}}_j^{*}\right)$$

(8)

$$d_i^{-}={\displaystyle \sum }_{j=1}^{n}d\left({\tilde{v}}_{ij},{\tilde{v}}_j^{-}\right)$$

(9)

Then, the last step of the method was calculating the proximity coefficient ($C{C}_i$) (10), which allowed the structuring of the ranking of the alternatives (practices).

$$C{C}_i=\frac{d_i^{-}}{d_i^{*}+d_i^{-}}$$

(10)

Finally, in order to conduct the sensitivity analysis, various scenarios were examined, each one adjusting for the exclusion of a group of respondents as defined by the HCA and evaluating how each one influenced the ordering of the business continuity management practices.

4. Results and Discussion

4.1. Hierarchical Cluster Analysis

The following criteria were used to assess the respondents’ educational level, experience and knowledge; years of experience in the field of innovation; conducting research directly related to innovation management; and teaching, training, and supervision activities for qualified human resources in the field. These criteria were applied to each of the 22 respondents, and the HCA allowed them to be classified into seven groups, as shown in the dendrogram (Figure 2).

The experts were then assigned to levels 1 (Groups 3 and 6), 2 (Groups 2, 4 and 5) and 3 (Group 1) (

Table 2. Allocation of the respondents based on educational level, experience and knowledge.

Level	Respondents
N1	R5, R10, R11, R16, R19 and R20
N2	R1, R3, R4, R6, R7, R8, R9, R14, R15, R18 and R22
N3	R2, R12, R13, R17 and R21

). This classification was based on the analysis of experts’ characteristics in each group. The experts were graded as 1 or 2 based on their data about years of experience, research area in which they work and whether or not they supervise master’s and doctorate students. For respondents with up to 15 years of experience, a grade of 1 was assigned, and a grade of 2 was assigned to those with more than 15 years of experience. For those who did not emphasize research directly related to business continuity, a grade of 1 was assigned, and a grade of 2 was assigned to those who did. In terms of graduate student supervision, those who did not perform it received a grade of 1, while those who did received a grade of 2. All of the N3 respondents were graded 2 in all the indicators. N2 respondents were graded 2 in two of the three indicators. N1 respondents presented at least two indicators with a grade of 1.

4.2. Observed Frequency Analysis

For each of the 16 practices evaluated (P1 to P16), which illustrate essential topics of BCMS proposed by the ISO 22301:2020, the frequency of responses was calculated corresponding to the scale options: Not applied (NA); Applied superficially (AS); Applied reasonably (AR); Applied properly (AP); and Applied in a well-structured way (AW). This procedure was performed for the categories of large industries (LI) and small and medium-sized industries (SMI). Following an overview of data frequencies, specific considerations by level (N1, N2, N3) are presented.

4.2.1. Data Analysis for Large Industries (LI)

The global frequency of data referring to LIs is presented in

Table 3. Global frequency on the application of each practice in LIs.

Practices	Level of Application *
	NA	AS	AR	AP	AW
P1	0.000	0.000	0.318	0.500	0.182
P2	0.000	0.000	0.409	0.455	0.136
P3	0.000	0.000	0.227	0.591	0.182
P4	0.000	0.045	0.318	0.500	0.136
P5	0.000	0.091	0.409	0.409	0.091
P6	0.000	0.136	0.409	0.318	0.136
P7	0.000	0.091	0.318	0.545	0.045
P8	0.000	0.227	0.455	0.273	0.045
P9	0.000	0.136	0.455	0.364	0.045
P10	0.000	0.136	0.409	0.227	0.227
P11	0.000	0.136	0.227	0.500	0.136
P12	0.000	0.136	0.409	0.318	0.136
P13	0.000	0.182	0.455	0.318	0.045
P14	0.091	0.409	0.182	0.273	0.045
P15	0.000	0.273	0.318	0.364	0.045
P16	0.045	0.273	0.273	0.273	0.136

* Source: Not applied (NA); Applied superficially (AS); Applied reasonably (AR); Applied properly (AP); Applied in a well-structured way (AW).

.

In the scenario of LIs in Brazil, it is worth noting that none of the respondents selected the option Not applied (NA) for 14 out of the 16 practices presented (from P1 to P13, and P15). Furthermore, none of the respondents selected the option Applied superficially (AS) for P1 (analyze internal and external issues that may jeopardize business continuity management results on a regular basis), P2 (understand stakeholders’ needs and expectations, and use information in business continuity management) and P3 (define a clear scope for BCMS), indicating that these three practices are at least reasonably applied in the Brazilian LIs according to the experts’ perceptions.

With the exception of P14 (periodic tests to assess the business continuity strategies and the ability of suppliers and partners to maintain operations and comply with the law during disruptions), it is possible to notice that most of the answers were concentrated in the options ‘Applied reasonably’ (AR) and ‘Applied properly’ (AP). P14 was the worst rated practice at the two lowest adoption levels, i.e., not applied (9.1%) and applied superficially (40.9%).

It is worth noting that P1, P4 (leaders conduct periodic critical analyses of practices) and P11 (define strategies and solutions for business continuity taking into account their reality) reached 50% agreement in the “Applied properly” option. The only cases that showed more than 50% agreement in the responses were P3 and P7 (define the goals associated with the BCMS in a consistent, measurable manner and communicate them to all parties involved), considered properly applied by 59.1% and 54.5% of the participants, respectively.

Finally, P10 (organizations have well-structured documentation control systems to support business continuity management) was the only practice considered to be applied in a well-structured way by at least 20% of the participants.

4.2.2. Data Analysis for Small and Medium-Sized Industries (SMI)

The global frequency of data referring to SMIs is presented in

Table 4. Global frequency on the application of each practice in SMIs.

Practices	Level of Application *
	NA	AS	AR	AP	AW
P1	0.045	0.636	0.318	0.000	0.000
P2	0.045	0.682	0.227	0.045	0.000
P3	0.091	0.455	0.318	0.136	0.000
P4	0.182	0.545	0.227	0.045	0.000
P5	0.182	0.591	0.136	0.091	0.000
P6	0.273	0.409	0.273	0.045	0.000
P7	0.091	0.727	0.182	0.000	0.000
P8	0.364	0.545	0.091	0.000	0.000
P9	0.409	0.409	0.182	0.000	0.000
P10	0.409	0.364	0.227	0.000	0.000
P11	0.227	0.409	0.318	0.045	0.000
P12	0.182	0.545	0.227	0.045	0.000
P13	0.273	0.455	0.273	0.000	0.000
P14	0.455	0.409	0.136	0.000	0.000
P15	0.318	0.500	0.182	0.000	0.000
P16	0.591	0.273	0.136	0.000	0.000

* Source: Not applied (NA); Applied superficially (AS); Applied reasonably (AR); Applied properly (AP); Applied in a well-structured way (AW).

.

In the scenario of SMIs in Brazil, none of the practices was considered to be applied in a well-structured way. Furthermore, 9 out of the 16 practices presented (P1, P7–10, P13–16) were not evaluated as properly applied by none of the respondents, and only P3 (define a clear scope for BCMS) reached more than 10% in this level of adoption.

It is possible to observe that most of the answers were concentrated in the option Applied superficially (AS), with only three exceptions, that is P10 (organizations have well-structured documentation control systems to support business continuity management), P14 (periodic tests to assess the business continuity strategies and the ability of suppliers and partners to maintain operations and comply with the law during disruptions) and P16 (periodic audits of their business continuity management activities to identify opportunities for improvement, and information record), which presented the highest frequency in the lowest level of adoption (Not applied) with 40.9%, 45.5% and 59.1%, respectively.

The highest levels of agreement were observed for P1 (analyze internal and external issues that may jeopardize business continuity management results on a regular basis), P2 (understand stakeholders’ needs and expectations, and use information in business continuity management) and P7 (define the goals associated with the BCMS in a consistent, measurable manner and communicate them to all parties involved), all on the option Applied superficially (AS), reaching 63.6%, 68.2% and 72.7%, respectively.

4.3. Comparative Ordering Analysis via Fuzzy TOPSIS

Following the procedures proposed by Chen [43] and described in Section 3.2, the proximity coefficients ($C{C}_i$) were calculated and based on them the practices were ordered considering LIs and SMIs. In addition, sensitivity analysis was used to verify the influence of each group of respondents in the ordering of practices.

4.3.1. Data Analysis for Large Industries (LI)

The results of the ordering of practices via Fuzzy TOPSIS and sensitivity analysis for LIs is presented in

Table 5. The ordering of practices via Fuzzy TOPSIS and sensitivity analysis for LIs.

Practices	$\mathit{C}{\mathit{C}}_{\mathit{i}}$	All Groups	Group Excluded for Sensitivity Analysis
			G1	G2	G3	G4	G5	G6
P1	0.4365	2nd	2nd	2nd	2nd	2nd	2nd	2nd
P2	0.4228	4th	3rd	5th	3rd	4th	3rd	4th
P3	0.4453	1st	1st	1st	1st	1st	1st	1st
P4	0.4240	3rd	5th	3rd	4th	3rd	4th	3rd
P5	0.4009	7th	9th	6th	7th	7th	7th	7th
P6	0.3796	10th	6th	14th	12th	9th	11th	10th
P7	0.4145	5th	10th	4th	5th	5th	5th	5th
P8	0.3626	14th	13th	13th	15th	15th	15th	14th
P9	0.3773	11th	8th	12th	11th	12th	14th	11th
P10	0.3914	9th	11th	9th	8th	8th	8th	9th
P11	0.4087	6th	4th	7th	6th	6th	6th	6th
P12	0.3920	8th	7th	8th	9th	10th	9th	8th
P13	0.3712	13th	12th	11th	13th	14th	13th	13th
P14	0.3351	16th	16th	15th	16th	16th	16th	16th
P15	0.3749	12th	15th	10th	10th	11th	10th	12th
P16	0.3624	15th	14th	16th	14th	13th	12th	15th

. The details for calculating the $C{C}_i$ related to LIs for all groups are presented in Supplementary Materials (from Table S1 to Table S7).

For Brazilian LIs, the first place, that is, the business continuity management practice with the highest level of application in the perception of the specialists, was P3 (define a clear scope for BCMS), while the last place was P14 (periodic tests to assess the business continuity strategies and the ability of suppliers and partners to maintain operations and comply with the law during disruptions).

The sensitivity analysis reveals that P3 and P1 (analyze internal and external issues that may jeopardize business continuity management results on a regular basis) were ranked as first and second, respectively, in all scenarios, demonstrating a robustness in the evaluation of these practices in the scenario of the Brazilian LIs.

It is also worth noting that the last place in the ranking changes in the scenario in which G2 is removed from the calculation, causing P16 (periodic audits of their business continuity management activities to identify opportunities for improvement, and information record) to assume this position.

4.3.2. Data Analysis for Small and Medium-Sized Industries (SMI)

Finally, the results of the ordering of practices via Fuzzy TOPSIS and sensitivity analysis for SMIs is presented in

Table 6. The ordering of practices via Fuzzy TOPSIS and sensitivity analysis for SMIs.

Practices	$\mathit{C}{\mathit{C}}_{\mathit{i}}$	All Groups	Group Excluded for Sensitivity Analysis
			G1	G2	G3	G4	G5	G6
P1	0.3660	2nd	2nd	1st	2nd	3rd	3rd	2nd
P2	0.3632	3rd	3rd	3rd	3rd	2nd	2nd	3rd
P3	0.3756	1st	1st	2nd	1st	1st	1st	1st
P4	0.3371	6th	7th	5th	7th	4th	5th	6th
P5	0.3405	4th	4th	6th	5th	5th	8th	4th
P6	0.3296	9th	10th	7th	9th	7th	9th	7th
P7	0.3364	7th	8th	4th	6th	9th	6th	8th
P8	0.2842	14th	12th	13th	14th	15th	14th	14th
P9	0.2762	15th	14th	14th	15th	14th	15th	15th
P10	0.2922	12th	13th	11th	12th	13th	12th	12th
P11	0.3324	8th	6th	9th	8th	6th	7th	9th
P12	0.3393	5th	5th	8th	4th	8th	4th	5th
P13	0.3223	10th	9th	10th	10th	10th	10th	10th
P14	0.2845	13th	15th	15th	13th	12th	13th	13th
P15	0.3042	11th	11th	12th	11th	11th	11th	11th
P16	0.2481	16th	16th	16th	16th	16th	16th	16th

. The details for calculating the $C{C}_i$ related to SMIs for all groups are presented in Supplementary Materials (from Table S8 to Table S14).

When all groups of respondents are considered in the scenario of Brazilian SMIs, once more P3 stands out, being ranked in first place. The same occurs for P1, which takes second place. In turn, P16 appears last.

The sensitivity analysis reveals that none of the practices maintains the same position in all scenarios, with the only exception being P16, which was ranked last regardless of the group removed in the calculation. Considering the first position, it is worth noting that G2 is the only group that influences the classification of P3, which moves to second place, giving way to P1.

4.4. Considerations on the Level of Expertise of Participants and Industry Categories

In the case of Brazilian LIs, when considering the allocation of the respondents by level based on educational level, experience and knowledge (N1, N2 and N3) generated by the HCA (see Section 4.1), it was observed that respondents allocated in N3 rarely indicated that a business continuity management practice is applied in a well-structured way. For SMIs, it was noted that the vast majority of responses for most of the practices examined were in the lower ranges of the scale for the three levels of respondents.

The consideration of the level of expertise of participants in the comparative ordering analysis via Fuzzy TOPSIS revealed that, for LIs, the main deficiencies are observed in P14, P16 and P8, whereas the more well-established are P3, P1 and P4; and for SMIs, the main deficiencies are observed in P16, P9 e P8, whereas the more well-established are P3, P1 e P2, although they are applied superficially or reasonably. These findings are summarized in

Table 7. Most deficient and well-established practices comparatively defined for LIs and SMIs.

Categories	Business Continuity Practices
	Most Deficient	Most Well-Established
LI	P14	P4
SMI	P9	P2
Both	P8 and P16	P3 and P1

.

In general, the findings suggest that Brazilian industries, regardless of their size, should pay special attention to business continuity practices related to P8 (well-structured systematic processes to analyze the impact of abnormal situations on their business and the potential risks of a disruption) and P16 (periodic audits of their business continuity management activities to identify opportunities for improvement, and information record). When the categories are differentiated, P14 (periodic tests to assess the business continuity strategies and the ability of suppliers and partners to maintain operations and comply with the law during disruptions) inspires greater attention for LIs and P9 (structured risk assessment and intervention processes to help them make decisions concerning business continuity management) for SMIs.

As documented in the literature [4,8,31], the COVID-19 pandemic evidenced that business continuity management practices are necessary for the survival of companies of all sizes worldwide. In this sense, both LIs and SMIs must improve risks analyses (P8) and audit processes (P16). To support them in this process, besides ISO 22301, other standards of ISO can be useful, more specifically, ISO 31000 [50], which establishes guidelines for risk management, and ISO 19011 [51], which provides guidance for companies to audit their management systems. Regarding the deficiencies, ISO 31000 can also be of great value particularly for SMIs (P9). For LIs (P14), in addition to ISO 22301, the literature presents some useful contributions. An example is the study of Sadeghi et al. [52], in which the authors verified the importance of collaboration and rewards to enhance business continuity management practices throughout the supply chain.

5. Conclusions

The aim of this study was to analyze the level of adoption of business continuity practices by Brazilian industries, based on the structure of the ISO 22301:2020 and the opinion of experts on the subject. For LIs, P4 (leaders conduct periodic critical analyses of practices) was considered the practice with the best application rate, while for SMIs, P2 (understand stakeholders’ needs and expectations, and use information in business continuity management) was chosen. In all scenarios tested for LIs and SMIs, P8 (well-structured systematic processes to analyze the impact of abnormal situations on their business and the potential risks of a disruption) and P16 (periodic audits of their business continuity management activities to identify opportunities for improvement, and information record) are in the bottom quartile.

Despite the recent publication of ISO 22301:2020, the recommended business continuity management practices have had some adherence in the reality of Brazilian LIs, while SMIs remain in more deficient situations. In relation to the practical implications of the presented findings, they may be useful for Brazilian managers who want to develop a structured BCMS and/or consolidate existing practices in their organizations. The most deficient practices evidenced in this research should receive greater attention in the development of such management systems. In this regard, it is critical to highlight the systemic impact that improvements in organizational resilience capacity can have, because industry recovery is a critical factor in the economic development of all countries in a post-pandemic world.

Regarding the theoretical contribution of this study, the main novelty of it is the use of the combination of Hierarchical Cluster Analysis, frequency analysis, Fuzzy TOPSIS and sensitivity analysis to analyze the context of business continuity practices performed by Brazilian industries. These methodological procedures can be used by researchers to evaluate other realities and compare them to the results presented here. Furthermore, the findings of this paper indicate the main deficiencies of SMIs and LIs concerning the analyzed practices, and they can be used as the foundation for future studies aimed at developing guidelines for companies to overcome their weaknesses and become more resilient.

The limitations of the study are related to the specific context studied and the methods utilized. Additional research is needed to delve deeper into business continuity management practices in the Brazilian context, using qualitative methods and expanding the sample of consulted experts. Another avenue for research is to investigate other contexts, including both developing and developed countries. The findings of these studies can be compared, which can be particularly valuable to managers, as well as for the resilience of LIs and SMIs.

Finally, it is worth noting that ISO 22301:2020 serves as an important reference for industries seeking to implement organizational resilience and business continuity practices, and researchers can be excellent partners in better preparing organizations for the emergence of new disruptive events of any nature.