Paper 5

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 1

Risk Management Practices in the Saudi Business Organizations: A Case Study of the City of Jeddah

Naill M. Momani and Ayman S. Fadil

King Abdul Aziz University, Jeddah, Saudi Arabia

Key words: Business Continuity, risk management in Jeddah, Jeddah business continuity

Abstract This paper discuss business continuity planning (BCP) in City of Jeddah with emphasis on risk sources, causes, and mitigation measures to prevent or reduce monetary losses and improve business competency. During the last two years the city witnessed two floods which caused large human and monetary losses which emphasized the need for having business continuity plans (BCPs) that are based on realistic business impact analysis. It is found that several

risk sources are of importance which need to be considered: Commercial and legal relationships, economic circumstances, human behavior, natural and human caused disasters, government activities, technology and management. There is a lack of awareness of business risks in our sample and there is a need to consider future plans and strategies to prevent and reduce business’ losses through building business’ resilience culture.

Introduction With advances in information technology BC planners look for information systems solutions to develop and execute BCPs. Graphical user interface along with data-base- management systems are used to store and analyze data from different resources to develop BCPs. Erlanger (2006) pointed out that Strohl systems’ LDPRS is one of businesses continuity packages that guide planners step by step through a logical sequences of business continuity planning tasks. Sun Gard’s program is another useful package that could be used in business continuity management. This package uses a central database and guides planners through the business continuity planning process with libraries of questions for business unit survey and numerous plan templates. Another option for BCP could be outsourcing of key processes or services to maximize profits and reduce costs. Walker (2006) and Runyan and Huddleston (2009) provides guidelines to successfully work with outsource providers. Business risks are rapidly increasing due to natural and man-made causes with escalating more human and monetary losses. However, business continuity planning did not follow this trend. A research study for Gartner analyst that was conducted in 2000 “found that only 35% of small and midsize businesses have a comprehensive disaster recovery plan in place and fewer than 10% have implemented crisis management, contingency, business recovery and business resumption plans (Swartz, 2003)”. Mitroff, Pearson, Puchant (1992) suggest that crisis management should take a strategic role within organizations, given that resources and priorities should be considered to save lives and property by top management. Moreover, Herban, Elliot, Swartz (2004) examined the potential of considering the business continuity planning on a strategic level. Moreover, they show general parallels between strategic management and continuity management in terms of: Planning processes,

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 2

capability development and socio-technical approaches, speed, configuration, resilience, obligation and embeddedness. In this research, two UK-based financial firms show that Business Continuity Management (BCM) provision is more aligned towards a mission critical strategic role. Clas (2008) outlined the ten essential elements of BCM which are generally accepted principles of business continuity management from the Institute of Continuity Management (US) and the Business Continuity Institute (UK). They are: Program initiation and management; risk evaluation and control; business impact analysis; business continuity strategies; emergency response and operations; business continuity plan; awareness and training; business continuity plan exercise; audit and maintenance; crises communications; coordinate with external agencies. Additionally, in order for business continuity plans to be implemented effectively and efficiently, as well as be able to prevent and/or reduce human and monetary losses Momani (2010) proposed 11 elements as part of effective continuity plans. They are:

 legal requirements;

 business continuity planning policy;

 business risk analysis;

 objectives and targets;

 BCP;

 structure and responsibility;

 BCP resources;

 training and awareness;

 BCP documentation;

 BCP testing;

 Management review.

Moreover, Claire Lee Reiss, J.D., ARM (2001) released a document for risk identification and analysis through Public Entity Risk Institute (www.riskinstitute.org) which will be used in

this paper.

Case Study: City of Jeddah The city of Jeddah on the west coast of the Kingdom of Saudi Arabia with a total area of 748 square kilometers one of the most important cities in Saudi Arabia, and the gateway to trade, which has gained

great importance the movement of international trade with foreign markets. Jeddah is characterized as a main gate of the Two Holy Mosques, and the first stop for the pilgrims and pilgrims coming to the leading of the Holy Land (Mecca and Medina) enters through Jeddah's King Abdul Aziz International Airport. The numbers could be up to 5 million people annually with the purposes of Hajj, Umrah, work, tourism, and entertainment. Jeddah is directly affected by the climate of their geographical location, with high temperature and humidity during the summer, and temperatures of up to early forties centigrade’s, where the percentage under the influence of seasonal low over a warm air mass, solid and up to the higher humidity in the summer due to rising sea temperatures and lower in winter.

The city of Jeddah, commercial gate to the Kingdom of Saudi Arabia, including an estimated population of 14% of the population of Saudi Arabia, seen in 25 / 11/2009 what is known as a disaster of Black Wednesday, where a heavy rain for a period of six continuous hours lead to the deaths of more than 121 people with monetary losses in the rise. For the monetary losses amounted to about three billion riyals, long installations and government facilities and compensation for those affected is estimated at 5. 1 billion riyals. As for the number of deaths it has

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 3

reached 121, and other sources, 122 cases with number of missing of 30 people. The number of sheltered was includes 26,711 people in furnished apartments and also pay subsistence for the families of 7821 people. An estimated of 11849 damaged properties and 10913 damaged cars. Commercial traffic was paralyzed and sales fell to about 60% in some shops and the fear of the spread of epidemics and diseases (dengue fever). What is more, it led to the destruction of farms along the road in length of about 100 kilometers. Some buildings get cracks such as residential buildings, shops, which led to the collapse of some houses. In addition, some main and branch roads had washed away a number of cars and high water levels in residential neighborhoods. Floods also led to the displacement of hundreds of families during the crisis and the evacuation of homes in the affected districts and neighborhoods close to them during the crisis and then to avoid the rain later. As for the side effects of the disaster mental disorders have emerged, especially among children who lived through the suffering and frequent theft because thieves are waiting for what will be drawn by them as floods increased theft of equipment and cars and many more. (Momani and Fadil, 2010). After about 15 months, another flood in 26th 2011 impacted the city of Jeddah which resulted in ten

fatalities and billions in monetary losses. The Jeddah Flood of January 26th 2011 damaged about five thousand stores and incurred large economic losses in billion riyals. The Wholesale Food and Beverage Committee at Jeddah Chamber of Commerce reported that about 20 per cent of the owners of these shops hold a comprehensive insurance and the remaining did not get the insurance and they have to pay for their own losses1. Moreover, the Tourism Committee of the Jeddah Chamber of Commerce revealed that the rate of occupancy in apartments and hotels in Jeddah rose by 200 per cent as a result of influx of victims of the flood2. In a report of Jeddah Flood for the director general and chief economist at Banque Saudi Fransi, Dr. John said that 13 billion riyals (3.4 billion dollars) will be paid through the insurance sector, while there are losses of about 4 billion riyals ($ 1.1 billion) is not covered by the insurance system. These losses in addition to the ones resulted from the destruction of public places, roads, bridges and public buildings that require maintenance3. The industrialists and traders in Jeddah bear huge losses due to Jeddah flood since they suffered after stopping their production in the factories and their raw materials subjected to damage as a result of the floods that swept the city industrial and warehouse in addition to the extensive damage, which affected the infrastructure in the industrial area and the disruption of many machines from the factories there.

Business Risk Management As the economy evolves, business continues to meet a market need and recognizes and responds effectively and efficiently to changes in its internal and external environment. Risks in such environment could retreat not prepared businesses while progress other ones. The presence of risk is not essentially harmful: risk is simply a measurement of the potential for deviation from an expected outcome, and the consequences of this deviation may be either good (resulting in opportunity) or bad (resulting in threat).

1 Jeddah Flood Resulted in more than 5 Billion of Replacement Cost,

http://www.aleqt.com/2011/02/05/article_500294.html 2 Jeddah: 50% loss of tourism... And 100 million for urgent asphalt in the streets affected, http://www.aleqt.com/2011/02/08/article_501623.html 3 $ 4.5 billion loss Jeddah Flood. The insurance covers 75% of which. http://www.alarabiya.net/articles/2011/02/02/135959.html

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 4

The process of dealing with this uncertainty in identifying potential risk consequences, and trying to achieve the best outcome for the business in a changing environment, is the essence of business’ governance. Through effective contingency planning, a business can continue to serve its customers, clients, and suppliers even after an adverse event affecting the business which could affect business competitiveness and make them liable for public and government lawsuits. An essential element of any framework for corporate governance is an effective approach to risk management. Therefore, we investigated the risk management practices in Saudi business organization to identify different drives for risk, causes, effects and mitigations measures. This investigation will augment awareness which could lead to future preparedness and action plans that prevent or reduce future losses for Saudi business organizations.

Research Methodology This paper aims to understand the business continuity planning and disaster recovery planning in the Saudi organizations. The research methodology used pilot study workshop, survey questioner to the Saudi organizations, and a statistical analysis of the survey data. We conducted a training session to pilot our survey questions during Jeddah Commercial 2nd Forum that took place in May 2011. During this workshop we took participants feedback on the main risk contributors which we used to understand the business risk management practices in Jeddah City. The questionnaire consisted of three sections. Section I requested general information about participants. Section II asked participants to chose the risk they might face in their organizations from the seven main risk contributors (Commercial and legal relationships, economic circumstances, human behavior, natural and human caused disasters, government activities, technology and management) as shown in Table 1, below. Section III solicited potential risk effects and management strategies that they could use to prevent or mitigate risks that have been chosen in section II. The survey consists of 80 questions to measure the risk sources for business and different mitigation measures that could be used which is based on comprehensive survey developed by Claire Lee and others (2001). Our sample consists of 70 participants which have been chosen from the industrial, and commercial, as well as services sectors such as banks, factories along with members from Jeddah Chamber of Commerce.

Commercial and Legal Relationships 1. Leases of property. 5. Customer relationships/contracts.

2. Franchise agreements. 6. Employer/employee relationships.

3. Licensing agreements. 7. Contractor/subcontractor. 4. Supplier

relationships/contracts. 8. Insurance program. Economic Circumstances Risk

1. Inflation 7. Unemployment rate 2. Deflation 8. International currency exchange rates

3. Recession 9. Foreign or domestic trade barriers

4. Recovery 10. Competition

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 5

5. Changes in the business'

industry 11. Financial resources available to the business 6. Interest rates 12.Government expenditures

Human Behavior Risk

1. Negligent behavior 4. Positive behavior 2. Intentional behavior 5. Negative behavior 3. Criminal behavior

Natural and Human Caused Disasters

1. Winter Storm (blizzards, ice

storms) 7. Hurricanes 13. Volcanic Eruptions

2. Earthquake 8. Tornadoes 14. Drought 3. Landslide, Mudslide 9. Thunderstorms and Lightning 15.Heat

4. Sinkholes 10.Wildfire 16. Cold 5. Erosion 11.Flood 17.WMD 6. Windstorms 12.Tsunami 18.Terrorist Attack

Government Activities

1. Business, property, or income Taxes. 13. Fair Trade Practice laws.

2. License and permit fees. 14. Government taking of business property.

3. Land use regulations. 15. Business subsidies. 4. Environmental regulations. 16. Ban on or direct regulation of, a product or service.

5. Employee health and safety regulations.

17. Temporary government mandates or exercises of police powers.

6. Employment practices laws. 18. Mandatory product recalls.

7. Employee benefits laws.

19. Legislative or administrative hearings about an industry or a

line of products or services.

8. Discrimination and sexual harassment laws. 20. Enterprise zone creation.

9. Product liability laws. 21.Government contracting requirements.

10.Law of Sales (including warranties).

22. Government legal or regulatory action against the business or the industry.

11.Consumer protection laws. 23. Class actions against the business or the industry.

12.Intellectual property laws 24.Criminal action against business or principals.

Technology

1. Financial investment in technology 5 Employee use of business technology

2. Dependence on technology 6. 6. Dependence on, and system access by, technical support providers (employee, contractor).

3. Published Web site content 7. Technology-centered business model (products, services).

4. Internet use.

Management

1. Business planning 2. Financial oversight 3. Workforce management 4. Quality assurance

5.Contingency management

Table 1 Risk sources in Saudi organizations

Sample Composition The respondents were from commercial, services, and banking sectors in Saudi Arabia. About 50% of our sample have more than 10 years experience and 24.3% were from top management in their organization. More details of the respondent profiles are presented in Table 2. The participants’ diverse work experiences, educational background, and job level shows that they have adequate knowledge of business risk and disaster recovery planning issues. Participants profiles

Categorization and percentage

Job level 1st line Middle Top Management

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 6

Management (14.3%)

Management(61.4%) (24.3%)

Number of years of work experience

Less than 5 years (14.3%)

5-10 years(35.7%) More than 10 years(50%)

Disaster Recovery Planning (DRP) and/or Business Continuity Planning (BCP)

Exist (43%) Not used(35%) Used (65%)

Not exist (57%)

DRP, CBP Staff Qualified (20%) DRP, CBP Staff Not qualified(20%), DRP, CBP Staff not exist (60%)

Background studies

Engineering (27.2%)

Science (10%)

Management (34.3%) Other(28.5%)

Educational Background

BA, BS, M. Eng. (64.3%)

MA, M.Sc., MBA ( 20%)

Ph.D., D.Sc., DBA (1.5%) Other (14.2%)

Table 2 Profiles of the survey participants

Data analysis The survey feedback include three groups of data: the risk sources for Saudi organizations, risk significance, effects and mitigation measures. We ranked the risk sources according to number of times which has been selected. For example, within commercial and legal relationships we will see how many ones have selected leases of property and what was the rank of this risk priority for their organizations, 1 for lowest and 10 for highest. Risks are considered low if the order were 1-3, medium risk level 4-6, high risk level 7-10. As we could see in Table 3 below the percentages for each risk level show the differences of risk importance for commercial and legal relationship risk in Saudi organizations. It is found that contractor/subcontractor and customer relationships are the most contributes toward commercial and legal relationship risk as shown in Figure 1 below.

% of Participants

Total No. Low Medium High Risk Sources

10% 36 13 12 11 Leases Of Property

13% 47 19 18 10 Licensing agreement

15% 56 23 24 9 Supplier relationships/contracts

17% 64 35 17 12 Customer relationships/contracts

15% 56 30 14 12 Employer /employee relationships

17% 63 34 18 11 Contractor/subcontractor

13% 48 13 24 11 Insurance program

370 167 127 76 Total

45% 34% 21% % of Participants

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 7

Table 3 Risk sources and percentages for commercial and legal relationship risk in Saudi organizations

Figure 1 Commercial and legal relationship risks in Saudi organizations

As for other risk sources, table 4 below show the total number of participants who have selected the risk level for each risk sources including the commercial and legal relationship risk which was explained above for illustration.

% of Participants Total No Low Medium High Risk Sources

13% 370 167 127 76 Commercial and Legal Relationships

19% 540 201 165 174 Economics Circumstances

10% 284 167 93 24 Human Behavior

19% 530 208 164 158 Natural and Man-made Disasters

22% 632 170 210 252 Government Activities

13% 359 161 135 63 Technology

5% 147 83 57 7 Management

2862 1157 951 754 Total

40% 33% 26% % of Participants

Table 4 Risk sources and percentages risk sources in Saudi organizations

Figure 2 Risk sources and percentages risk sources in Saudi organizations

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 8

It is clear from Figure 2, above that government activities could contribute to more than 20% of the total risks that could face organizations and has more effect than the changes of economics circumstances given that the government could play role in this risk as well. It is found that management was the least contributors to the total risk level in our study which could be amplified with human behavior and technology risks that management could play role in organizations.

Discussion As for commercial and legal relationship risk the ones which were of concern in order were: employer/subcontractor relationships, customer relationships/contracts, supplier relationship/contracts. These risk sources could cause tangible assets and financial losses. For example, a business could be financially responsible for damages arising from the acts of its employees or agents in the scope of their work. Also, it could lose investment if the leased property is damaged or destroyed, or the lease was canceled. Moreover, a business may incur additional contractual liability for failure to purchase insurance as required by a contract term. Customers could cause business losses since if supplier’s breach of contract it will prevents the business from meeting its contractual commitments and eng up with losing more customers. In order to prevent or reduce such losses due to commercial and legal relationship it is important to plan in advance to deal with events that may disrupt transactions with suppliers and customers and to invest in multiple ordering systems to enable business continue taking orders if one system temporary failed. In addition, there is a need to diversify supply stream to avoid dependence on one source of essential suppliers or services and to make advance arrangements for back-up sources of essential supplies and services that the organization provides and support. Due to time urgency in crises and there is a need to return to normal operations it is needed that an organization to identify critical operations and priorities them to receive supplies in the event of disruption in the supply stream. Economic circumstances could cause financial and operational risk for organizations. Among the most sources of risk in order are: Recession, inflation, change in interest rates, foreign or domestic trade barriers. Recession may impair a business’ access to investment capital and inflation may erode the value of a business’ financial assets. These could impair business’ ability to respond effectively to changes in its industry which could affect its reputation and market share. Moreover, a high unemployment rate may enable the business to hire skilled workers for lower pay and benefits and may affect the cost of hiring an adequate number of skilled workers. As for customers, economic circumstances could changes in consumer loan interest rates or lender credit requirements which may affect customer purchases of major items that require loan financing. In order to deal with such risk sources it is important to maintain a strong relationship and a good credit history with the business’ bank and stay aware of developments in the national and local economies, and make advance plans for buffering the effects of recession, or seizing opportunities during a recovery. Human behavior could contribute to overall business losses. For instance, a business may be liable for bodily injury and property damage caused by the business owner, the business' employees, or its agents. Also, members of the public may vandalize the business' premises. In addition, employees may sabotage the business' computer system and a business can incur substantial legal fees and costs to either defend or pursue claims arising from human behavior. Therefore, it is important to maintain safe business premises to identify and immediately remedy unsafe conditions and to identify important business safety issues and train employees how to address them. Also, business need to establish strong internal controls to discourage

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 9

and detect employee embezzlement and fraud such as separation of invoice approval and check writing and implanting internal financial controls that will provide an audit trial to ensure employee accountability, and detect employee embezzlement. As for natural and human caused disasters floods were considered the only risk that business could face in the City of Jeddah. Due to previous experience with floods as we discussed above in the city there are vast interest in adopting a written emergency action plan for each of disaster the business may expect and is based on business impact analysis. Such plans should assign responsibilities to specific employee. The business’ assets such as buildings, plants, equipments, vehicles, and computers may be physically damaged or destroyed due to disasters. If not damaged it might be not accessible or usable due to loss of utilities among which are electricity, water and sewage. Such things will force businesses to suspend operations which may have contractual liability for failure to make contracted deliveries to customers such as what happened after Kobe Earthquake in 1995. After the earthquake, some companies’ activities were disrupted even if their infrastructure were intact, since they lost some of their employees. Also, looking for lost relatives or securing shelters after they lost their homes might occupy the workers and affect their performance. Mitsubishi temporarily shut down operations of it is plants because it was missing about 50 employees (Cataldo, 1995) Government activities could have both positive and negative impact on business. Therefore, most of our sample decides to not consider that government activities could cause financial or monetary losses to their business. For instance, upon the arrival of the King Abdulla Bin Abdul Aziz from his long trip recovery in end of February 2011 he issued number of decisions to improve social and economic situations of citizens which will be reflected on business’ investments. Technology and management risk were considered not controllable and could be biased in favor of responders to our structured interviews. Given that the industry rely on external technology and any changes with this technology will not have impact on local competition and it only will impact the ones who have external investments. We think these sources of risk could have devastating consequences in terms of monetary losses and they need to be understood before we could advice proper prevention and mitigation measures.

Conclusion and Recommendation It is apparent that business risks are not considered in most business except banking and oil and gas industries. Banking sector are prepared due to fear of financial losses and the strong auditing by the governmental body. Oil and gas industries understand the potential human and monetary losses for their investments. Some interviewers thought that we are very pessimistic in discussing several risk factors that could never happened. Therefore, we recommend building awareness culture in terms of business continuity planning for business’ stakeholders such as owners, managers, suppliers, and customers.

References Clas, E. (2008) ‘Business continuity plans key to being prepared for disaster’. J. Am. Soc. Safe.

Eng. http://www.asse.org/professionalsafety/indexes/2008.php Cataldo, A. (1995) ‘ Japan industry weighing Kobe earthquake impact: Infrastructure damage

may pose problem’. CBS Interactive Inc. http://findarticles.com/p/articles/mi_m0EKF/is_n2 049_v41/ai_16811994/ Clas, E., 2008.

Business continuity

Journal of Business and Retail Management Research (JBRMR) Vol. 7 Issue 2 April 2013

A Journal of the Academy of Business and Retail Management (ABRM) 10

Erlanger, L. (2006) ‘ In case of emergency activate business continuity plan’. InfoWorld Inc. http://www.infoworld.com/t/business/in-caseemergency-activate-business- continuity-plan-774

Herban, B., D. Elliot and E.M. Swartz (2004) ‘Business continuity management: Time for strategic role’. Long Range Planning, 37: 435-457.

Mitroff, I.I., C. Pearson and T.C. Puchant (1992) ‘ Crisis management and strategic management: Similarities, differences and challenges’. Adv. Strat. Manage., 8: 235- 260.

Momani, Naill and Ayman S. Fadil (2010) ‘Changing Public Policy Due to Saudi City of Jeddah Flood Disaster’. Journal of Social Sciences, 6 (3): 424-428

Momani, Naill (2010) ‘Business Continuity Planning: Are We Prepared for Future Disasters’. American Journal of Economics and Business Administration, 2 (3): 272-279

Claire Lee Reiss, J.D., ARM (2001) ’Public Entity Risk Institute’ (www.riskinstitute.org) Jeddah Flood Resulted in more than 5 Billion of Replacement Cost,

http://www.aleqt.com/2011/02/05/article_500294.html Jeddah: 50% loss of tourism .. And 100 million for urgent asphalt in the streets affected,

http://www.aleqt.com/2011/02/08/article_501623.html $ 4.5 billion loss Jeddah Flood .. The insurance covers 75% of which. http://www.alarabiya.net/articles/2011/02/02/135959.html Runyan, R.C. and P. Huddleston (2009) ‘ Small business recovery from a natural disaster:

Lessons from Katrina’. Law and Recovery from Disaster: Hurricane Katrina, Malloy, R.P. (Ed.). Ashgate, Burlington, VT., ISBN: 10: 0754675009, pp: 127-140.

Swartz, N. (2003) ‘Few organizations have effective continuity plans’. Information Management Journal , 37: 1-7

Walker, A. (2006) ‘Business continuity and outsourcing moves to take out the risk’. Network Security, 15-17. DOI: 10.1016/S1353-4858(06)70388-9

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.