CRITICAL FUNCTIONS IN ENSURING EFFECTIVE BUSINESS CONTINUITY MANAGEMENT. EVIDENCE FROM ROMANIAN COMPANIES

. The paper explores how business continuity management (BCM) is defined within the professional and academic communities that work in the field or research it. It sets out the framework for the composing elements of a BCM that emerge and considers how these various elements can interact with each other to build a sound business continuity management. Also, the paper aims to examine the organization’s critical functions that ensure an effective BCM. The research relies on a questionnaire-based survey, with data collected by personally interviewing top and middle-level managers from Romanian small and medium-sized companies. The results, which count on the responses of 119 participant companies, show that risk assessment takes a critical role in building the organization’s BCM strategy, while business continuity response planning has the strongest impact on the overall effectiveness of the organization’s BCM. The novelty of this research lies in a first time establishment of the critical functions that are vital for companies to maintain their essential business operations in case of disruptive incidents, to build organizational resilience. Future research should be grounded on testing if the BCM arrangements and business impact analysis influence the BCM strategy as the existing data did not prove that it did.


Introduction
The changes taking place within the global business environment, translated into persistent competition, emphasis on knowledge and appearance of business threats exert a great pressure on organizations and force them to establish key directions of action and essential activities to be performed. Companies that identify and manage risks and vulnerabilities properly and communicate the effectiveness of their efforts to their key stakeholders can boost financial performance and protect the value their businesses create, which can lead in turn to gaining more competitive advantage. Marisa and Oigo (2018) claim that for contemporary organizations it is essential to hold a strategic plan of dealing with unforeseen happenings which can negatively alter their operations. In addition, companies must also be able to understand the way in which any interference can impede the fulfilment of their established objectives, since business success is a function of the organization's power of meeting goals in the long-run and delivering continuous value to their stakeholders (Ferreira Rebelo et al., 2017).
The efficient management of unexpected occurrences requires companies to thoroughly and continuously analyse their internal resources and capabilities to maximize the rendered output. Despite that, companies hardly withstand risks both during their happening course and after they occur, as according to Păunescu, Popescu, and Blid (2018), and as such, a part of the company's resources and functions are hindered, especially after the manifestation of the business threat (Torabi et al., 2014). In a brief manner, it may be stated that such hazardous events negatively impact the business continuity of the organization, meaning the efforts made by the company to safely yield its business processes to its stakeholders. Moreover, business continuity implies processes carried out on a day-to-day-basis to sustain the company's stability and retrievability (Venclova et al., 2013).
The concept of business continuity management (BCM) has only recently emerged in the literature, particularly with regard to small and medium enterprises, and only few relevant studies have been conducted. Thus, the International Organization for Standardization [ISO] has issued in 2012 the ISO 22301 international standard, revised in 2019, to provide guidance to organizations regarding how to ensure the propensity of their essential functions to continue during and after a disaster. A business continuity management developed according to the ISO 22301 standard helps the organization understand how it can protect against disruptive incidents, reduce the likelihood of their occurrence, prepare for, respond to and recover from hazardous disruptions when they arise. The existing literature in the field provides only few empirical research on how a BCM works in practice and generates benefits for the organization (e.g., Bajgoric, 2014;Ghandour, 2014;Gibb & Buchanan, 2006;Kato & Charoenrat, 2018). However, the literature review analysis that has been carried out has not indicated any scholarly research conducted on the critical functions on which organizations should prioritize their efforts, to maintain their essential activities and services during disruptions with different levels of severity. Despite the increased organizational awareness of the benefits and impact of a business continuity management, its adoption and implementation by organizations can still be found at an incipient level. Therefore, there is much to be done for organizations to be supported with developing and building strong business continuity capability (Păunescu et al., 2018;Speight, 2011). In this respect, the main goal of the current paper is to examine the key elements of an effective business continuity management and to determine its critical functions which are vital to maintain the organization's essential business operations. For this purpose, a questionnaire-based survey has been conducted in Romanian small and medium-sized companies and multiple regression has been employed to analyse and discuss the results.
This study attempts to make several contributions to scholarly research on business continuity management. First, it contributes to the literature by introducing a comprehensive framework of interrelated elements which compose a sound business continuity management that is likely to be developed and implemented by organizations, regardless of their size and across all private, public administration or non-governmental sectors. Second, it provides empirical evidence on the critical functions which are vital for organizations to ensure the business continuity of their essential operations and to build organizational resilience. It also contributes to the enlargement of the current business continuity management literature by generating a better understanding of the current practices of BCM by small and medium enterprises (SMEs) in Romania, their implementation of this valuable tool that enhances business competitiveness and their view over its components, but also by organizations from other countries and sectors of activity. As for the findings, the paper provides a clear proof of the fact that companies must apply a balanced outlook and be equally attentive to the internal circumstances that characterize the organization (employees, processes, other types of resources as well as the organizational culture) and the extrinsic context.
The research attention is focused on Romanian SMEs particularly due to the fact that such organizations are currently threatened by a large number of risks, as indicated by literature, and because of that they need a particular research attention to understand their approach of business continuity management. Thus, they do not own the necessary resources and support to encompass BCM practices within their organizational construct and the efficiency of their business endeavours is often minimized by the low managerial abilities of their governing board in the formulation and implementation of the organizational strategy. This drawback strongly requires alleviations so that their business continuity can be properly protected. Moreover, SMEs face strategic management issues that do not fully allow them to quickly accommodate extrinsic business-related changes: technology, knowledge and resource management.
The remainder of the study is organised as follows. The next section introduces the theoretical framework and discusses the knowledge gap in the literature. Then, the subsequent chapter describes the research model and presents the hypotheses which will be tested, including the data, variables, and tests. The next two sections discuss the results. Finally the conclusions, limitations and future research opportunities are offered.

The concept of business continuity management and its composing elements
In the acceptance of the international standard ISO 22301, business continuity (BC) is defined as the capability of the organization to continue the delivery of its products or services at acceptable predefined levels following a disruptive event, either natural or deliberate (ISO, 2019). In essence, business continuity is a process through which the company's essential business functions are not hampered by an unfortunate occurrence and they can be undertaken with a managed degree of interference (Foster & Dye, 2005). To shelter the functioning of their operations and to safeguard themselves from the business threats that might take place, companies make use of a tactical tool entitled business continuity management (Malachová & Oulehlová, 2016;Nienimaa et al., 2019). Fischbacher-Smith (2017) referred to the business continuity management as a holistic management process that identifies the possible risks and threats to an organization and the impact that those disruptions, if materialized, might have upon its business operations. BCM is also perceived by Torabi, Giahi, and Sahebjamnia (2016) as a system for dealing with risks, a tool that contributes to the refinement of companies' flexibility against business hazards. In the view of Bajgoric (2014), BCM is a process that helps organizations to pinpoint risk elements and to develop a certain flexibility and strength degree in reacting to those risks' effects. As for its implementation, it imposes several steps (Mansol et al., 2014): organizational comprehension; diagnosis of BCM strategies; establishment and execution of BCM responses; incorporation of BCM into the organization's culture; utilization and assessment of the BCM system. From a more integrative perspective, BCM can also be depicted as a process reaching multiple levels and blending strategic and operational aspects with the intellectual know-how of the organization's members (Fischbacher-Smith, 2017).
Business continuity management can be used by an organization to increase its confidence degree related to the fact that its business output, meaning goods or services, can reach its destination despite the business risks that might happen (Gibb & Buchanan, 2006). In the view of Svata (2013), BCM is an element occurring within the entire organization and it creates the premises for defending its stakeholders' concerns. Besides enabling a better stakeholder interaction, BCM poses other significant benefits to the organizations that choose to implement it, as indicated by Urbanec and Urbancová (2015): possession of a well-built and well-defined framework for dealing with business risks; identification of the key directions to be taken to shield the essential functions of the company; recognition of possible threats together with the manner in which they might affect the organization; an efficient and clear role assignment within the risk management process; removal of any financial loss in the eventuality of business continuity interferences; obtainment of gains determined by the good business conduct towards customers.
Keeping in mind the numerous advantages that BCM implementation brings to an organization, it must also be acknowledged that this process supposes some weak points, as according to Mansol, Alwi, and Ismail (2016), their frequency in practice being a high one: a deficient assistance from the senior management's part; a scarce amount of financial resources for the enforcement of contingency procedures; an ambiguous understanding of the tasks related to the set up and running of the BCM activities; an unsuitable allocation of responsibility to the specialized team and not to the line management; unsatisfactory training processes as well as inappropriate exercising and testing of the BCM. Ghandour (2014) strengthened this point and claimed that the success or breakdown of BCM is highly determined by an organization's human resources, the participation of people in BCM processes as well as the receival and adoption of BCM at all organizational levels.
Similar to any other business process, BCM is also a sequence of linked activities meant to help the organization withstand unforeseen damages. Venclova et al. (2013) broke down the elements composing the BCM as follows: comprehending the organizational context by evaluating the business impact and the risks to which the organization is exposed; establishing the BCM strategy out of a possible set of strategies whose efficiency degree has been quantified; building and applying the BCM response; undertaking a BCM audit to verify whether it reflects an appropriate quality degree; integrating the BCM philosophy within the company by boosting consciousness on the subject and delivering personnel trainings with respect to BCM. According to Păunescu (2017), the undertaking of the business impact analysis and risk assessment represent essential phases in designing the business continuity management. Business continuity preparedness is, therefore, an important skill that organizations should master to a high extent to adequately manage their business risks and threats. As per Jrad, Morawski, and Spergel (2004), business continuity preparedness encompasses the overall processes implemented by the organization with the scope of getting set for unforeseen business occurrences. Ergo, the success of business continuity preparedness in securing the organization against risks and the functioning of the holistic character of BCM are subject to certain factors, as follows: diffusion of knowledge management, implementation of strategic management, comprehension and evaluation of business risks, planning and documentation of business continuity, provision of training and raising awareness about BCM, and management of the information life cycle (Karim, 2011;Tvrdíková, 2016;Miller & Engemann, 2019).

Organizational resilience and the efficiency of business continuity management
The business continuity management provides a framework for building organizational resilience and the capability for an effective response in the face of internal or external threats. The end goal of a strong BCM is to make the organization more resilient to potential threats and allow it to resume or continue operations under adverse or abnormal conditions. Nowadays, the continuous changes in their business environment require the organizations to find practical responses to effectively address various issues of security, preparedness, risk, and survivability. In addition, organizations are constrained by the changes operated to business models that create the need for an ongoing efficiency improvement through resource use optimization and waste minimization, to obtain an equilibrium point between efficiency and resilience (Gorzeń-Mitka, 2016). Organizational resilience refers to an organization's proficiency in keeping its capabilities at a stable level despite the challenging business environment in which it activates. Resilience is also associated with the aptitude of the organization of getting reorganized and being self-supported after an unforeseen incident has taken place. Quendler (2017) defined organizational resilience as the organization's ability of identifying, communicating, responding and recuperating itself from a business risk, as well as the ability of being flexible to shifting business conditions. Research of Ruiz-Martin, López-Paredes, and Wainer (2018) claimed that an organization is resilient if it manages to render positive conversion in conditions of risk in order to escape from the threat while becoming more diligent and cleverer. Organizational resilience also helps to distinguish the company's key strong and weak aspects and then to establish essential matters with respect to business continuity planning (Quendler, 2017;Mohammed et al., 2019). Sahebjamnia, Torabi, and Mansouri (2018) recognized that an organization that proves resilience is capable to undertake its essential processes at the minimum degree of its business continuity goals and to comply with the maximum endurable period of disruption.
Likewise, Burnard, Bhamra, and Tsinopoulos (2018) highlighted the fact that resilience makes the organization to better calibrate its performance during the occurrence of foreseen or unforeseen events, and thus it helps to raise its ability of accommodating itself to the shifting external setting. Simultaneously, it also expands other organizational performance variables, namely quality and delivery (Islam et al., 2016). In the view of Bell (2002), organizational resilience is also dependent on internal aspects of the organization, such as leadership, culture, people, systems and settings. Mallak (1998) placed a high degree of importance on shared decision making in the organizational context as a resilience-enabler, due to its power to produce a punctual and effective reaction to risks. A similar perspective on the factors affecting organizational resilience is provided by the research of Gorzeń-Mitka (2016), who stated that elements such as asset defence, performance and strategic leadership, organizational growth and ultimately, a receptive organizational culture, define its functionality.
Nevertheless, the efficiency of business continuity management in the risk mitigation process and in maintaining essential operations is strongly dependent on the way in which the organization understands its business continuity capability, establishes the strategy for implementing business continuity and builds its organizational resilience (Wong, 2019). To make business continuity produce the intended result, meaning to aid the organization in adequately responding to business risks, the organization must properly monitor the implementation of its business continuity strategy through well-defined business continuity metrics. The typology of the measures of an efficient business continuity management is a heterogeneous one and it acts in such a way to preserve the organizational stability and minimize the effect of business losses. Zeng and Zio (2017) underlined the possibility of employing four types of measures for an effective BCM: protection measures, which do not allow threats to cause malfunctions to the organization and thus they foster business continuity; mitigation measures, that come in place if the protective measures did not meet their goal; emergency measures, that are applied in the case when the mitigation procedures do not stop the threat; and recovery measures, whose goal is to restore the ordinary business flow of the organization. Other research (Kirvan, 2014) proposed two types of indicators meant to assess the efficiency of the business continuity programs, namely key performance indicators and key risk indicators. As for the key performance indicators, an organization may monitor the accomplishment of yearly planning exercises, the yearly upgrade of business impact analysis and of all other risk evaluations, a quarterly-basis appraisal of the duties that need to be undertaken by the business continuity teams, the yearly auditing of business continuity plans, the bi-annual supply of training to the business continuity teams, setting up a meeting with the senior management on business continuity tasks and organizing meetings with the employees to raise consciousness on the issue. The next category to be used by the organization is formed of key risk indicators, which imply elements such as the postponement of exercises' completion according to the established terms, the appearance of delays in fulfilling the business impact analysis in the pre-defined time period, the company's incapacity of finalizing trainings for the employees forming the crisis teams or the postponement of the business continuity documents' revision.

Research model and hypotheses development
The composing elements of a business continuity management are summarized in Figure 1. The BCM research model employed in the paper follows the Plan-Do-Check-Act approach of continuous improvement and builds upon the field literature and the ISO 22301 model of business continuity management for organizations to illustrate its key components. As such, the planning phase involves understanding the context of the organization and determining the scope of the BCM and its arrangements.  The BCM scope and arrangements define the context of the organization for building an effective business continuity management system and the BCM scope, objectives and commitment. Precisely, the context of the organization refers to the organization's activities, products or services, supply chains, its risk appetite, as well as the needs and expectations of relevant interested parties and the relationships extended with them. With respect to this, Marisa and Oigo (2018) note that an adequate planning of the key stakeholders' needs and organizational management has a critical impact upon the effectiveness of the business continuity management strategy and it can boost the company's overall performance. The BCM scope and objectives refer to the business continuity policy and objectives and their links to other organization's policies, as well as the applicable regulatory requirements to which the organization subscribes. Moreover, it addresses ongoing commitment to BCM mainly by ensuring that the responsibilities and authorities for the relevant roles are assigned. As according to Urbanec and Urbancová (2015), the assistance provided by the top management is an essential element for the success of BCM. In a similar manner, Kato and Charoenrat (2018) suggest the supply of guidelines and business standards, the communication of information regarding natural threats and legislative aspects as factors that can facilitate the adoption of BCM. Hamid (2018) recognizes the heavy importance of possessing an appropriate organizational knowledge regarding BCM instruments and workflows, preserving the critical resources that facilitate business continuity and setting assessment metrics for quality that are focused on ensuring business continuity. Therefore, the first hypothesis states that: Hypothesis 1: The BCM scope and arrangements positively relate to the organization's business continuity management strategy.
The doing phase allows for the business continuity plan to be enacted. It involves business impact analysis, risk assessment, and determining and implementing the business continuity management strategy and response. The business impact analysis activity enables an organization to identify the critical functions that support its key products and services, the interdependencies between functions and the resources required to operate the processes at a minimally-acceptable level. The risk assessment stage enables systematic identification, analysis, and evaluation of the risk generated by disruptive incidents to the organization (Soufi et al., 2019). An organization which is prepared to evaluate risks as well as their disruptive effects and employs efforts before the business threat takes place is more efficient in reacting to its consequences, as according to Ghandour (2014). Păunescu et al. (2018) claim that a specific attention needs to be given to the risks affecting the essential processes of the organization and that the business impact analysis must comprise the entire set of parties that have a certain business stake within the organization. Business continuity strategy and response planning include any arrangements that will enable the organization to either protect its critical activities, or to respond to and recover critical functions based on organizational risk tolerance and within defined recovery time objectives. Kato and Charoenrat (2018) highlight the importance of recognizing the significance of BCM strategy stating that a great part of the surveyed small and medium sized enterprises from Thailand that did not acknowledge its utility have encountered business disruptions. As for the effectiveness of the business continuity strategy, Fitzgerald (1995) states that it is triggered by research activity and accompanied by the intention and preparedness to take action, which imposes the need of applying action plans for business recuperation. Therefore, the following hypotheses are issued: Hypothesis 2: The business impact analysis is positively related to the business continuity management strategy.
Hypothesis 3: The risk assessment is positively related to the business continuity management strategy.
Hypothesis 4: The business continuity management strategy positively influences the business continuity response planning.
The check phase involves the performance evaluation of the business continuity strategy and response plan through exercising, maintaining and reviewing of BCM to increase benefits to the organization and its stakeholders. Exercising and maintaining are the processes of validating the business continuity plans and procedures to ensure the selected strategies are capable of providing response and recovery results within the timeframes agreed by the management team. The efficiency of a BCM can be raised by the proficiency in foreseeing a business risk, spreading the company's resources in such a way to properly manage possible unpleasant events and creating an organization-wide set of response-activities (Păunescu et al., 2018). In order for the process to be an efficient one, the exercising and testing steps must be undertaken for all the elements composing the business continuity plan so as to discover weak points and revive the plan based on the identified information (Moh Heng, 2015). Other key practices to be implemented for the obtainment of an effective BCM are a proactive managerial attitude, the refinement of the company's assets and competences, as well as control procedures, as indicated by Ruiz-Martin et al. (2018). Therefore, the next hypotheses posit that: Hypothesis 5: The business continuity response planning positively influences the overall effectiveness of the business continuity management.
Hypothesis 6: Exercising, maintaining and reviewing of the business continuity plan positively influence the overall effectiveness of the business continuity management.
The act phase involves the continuous learning and improvement of BCM embedded in the organization's culture to bring increased benefits to the organization and its stakeholders. An organization can continually improve the effectiveness of its BCM system through the use of the business continuity policy, objectives, audit results, monitoring activities, corrective and preventive actions, management review, as well as through raising awareness, conducting training and improving communication. In the view of Bakar, Yaacob and Udin (2015), integrating business continuity management into the organization's culture is a process that demands an ongoing exercise expressed in the form of company-level modifications, engagement of the company's staff, business unit collaboration, long-term training and revision of business continuity plans. Similarly, the study of Karim (2011) indicates that there is a significant correlation between training and awareness and the effectiveness of business continuity planning. Despite its effortful character, a high degree of association has been proven to take place between embedding BCM in the organizational culture and the performance of the organization. Additionally, Bakar et al. (2015) state that embedding continuity practices into the current organizational processes helps the organization to face the threats imposed by business risks and also to recuperate itself at a faster pace compared to other market players. Based on the arguments presented, the seventh hypothesis states that ( Figure 2)  Briefly, the business continuity management model, whose validity is to be tested through the current research is a conglomerate of inter-related constituents, from the comprehension of the organizational context up to the performance assessment of BCM, which are assigned to the four main phases of the Plan-Do-Check-Act model: planning, doing, checking and acting. In order to be successful, the BCM needs to be fully encouraged and nurtured from within the organization in its incipient phase and carefully maintained as it is extrapolated to various levels of the organization. Moreover, it must also be checked in an ongoing manner during its implementation phase, to ensure that the economic entity is ready to withstand risks and to properly come back to an equilibrium point with the least amount of harm suffered.
Stated differently, the paper proposes to test, based on the identified literature, whether developing an adequate understanding of the organizational circumstances (the planning stage) can help it create a more coherent organizational BCM strategy. Additionally, another element which is to be assessed is linked to the doing phase and it imposes to verify whether the business impact analysis and the risk assessment can contribute to the creation of a more effective business continuity strategy and ultimately, if the business continuity management strategy can positively alter the business continuity response planning. Finally, the research also intends to verify whether exercising, maintaining and reviewing, which correspond to the checking phase in the PDCA model, can positively affect the BCM effectiveness and if integrating the BCM in the organizational culture, which corresponds to the acting phase, can raise the effectiveness of BCM.

Research objective and data
The paper aims to examine the organization's critical activities and functions that ensure an effective BCM and are vital to maintain its essential business operations, as well as to assess the synergy and interrelationships taking place in between the elements helping to construct BCM. Furthermore, the paper intends to deliver both a conceptual and empirical framework, which emphasizes the critical need of organizations to apply BCM in order to better manage business risks which have the ability of hindering their normal functioning. The research has relied on a questionnaire-based survey, with data collected by personally interviewing top and middle level managers from Romanian small and medium-sized companies, using a fully structured questionnaire. 136 face-to-face interviews have been conducted in companies located in the capital city of Romania from October 2017 to January 2018, out of which 119 responses from an alike number of companies have been further interpreted in the paper, after removing incomplete questionnaires. The respondents' set that has participated in the survey has been composed of 53% general managers, 33% functional managers and 14% specialists, and when approaching their gender distribution, it has reflected a division of 52% males and 48% females (Figure 3). The average seniority of respondents in the company has been of nine years.
It is worth to mention that all of the respondents who participated in the face-to-face interview have been selected based on their good understanding of the BCM in their organization and their key role in the BCM system implementation, regardless of the position they hold in the organization. Also, the respondents had to demonstrate a good understanding of the business operations in their organization. The average distribution of the participants' responses among the eight research variables is displayed in Figure 4.
A multiple linear regression model has been employed to determine the overall fit (variance explained) of the model, whether the variables selected are significant predictors of an effective business continuity management, and the relative contribution of each of the pre-dictors in the total variance explained. As according to Uyanık and Güler (2013), multiple linear regression is a model composed of one dependent variable and many independent variables and its aim is to identify the variability produced by the independent variables to the dependent one. The construction of the multiple linear regression model is performed by taking into account a set of pre-defined assumptions, which are highlighted by Casson and Farmer (2014): the variables of the model display a linear correlation; the dependent variable is a continuous one, which means that it may reach one of the values contained in the interval determined by the measurement precision; the independent variables do not have any measurement error attached to them; the model has no mean error; the model error holds a steady variance, which takes place when the residuals scatter plot displays a random distribution of the points; the data points are not correlated to each other, meaning that they cannot deliver any kind of information or to exert any impact upon each other.
Breaking down the structure of the methodology, it is to be acknowledged that the conceptual framework systematizes the delineation of business continuity management and its structure, together with the notion of organizational resilience and the efficiency of BCM. On the other hand, the empirical foundation of the paper wishes to understand the prac-  tices performed by Romanian SMEs with respect to business continuity management, by utilizing a questionnaire-based survey directed to top and middle managers of SMEs based in the capital city of Romania. It also evaluates the validity of seven research hypotheses constructed by building on the scientific literature previously presented and on a Plan-Do-Check-Act approach of continuous improvement. As for the tools used, they imply multiple linear regression elements: Pearson correlation coefficient, R Square and the Durbin Watson coefficient, through which the extent of the correlation between the variables has been established, and Significance F, which defines the significance of the econometric model. The research hypotheses have been constructed by firstly defining a set of variables based on the identified literature (BCM scope and arrangements; business impact analysis; risk assessment; BCM strategy; BC response planning; BCM exercise, maintain, review; BCM culture; BCM effectiveness) and identifying the causality relationships that stemmed from the collected specialty literature. The choice of residing only on small and medium sized enterprises from Romania, as research participants, has been generated by the existing literature in the field. It brings supportive evidence on the fact that both at the Romanian and European Union scale, SMEs are impacted by a wide range of operational risks but however, they do not have well-established BCM systems to fight against these unforeseen risks. Providing evidence on this issue, Lobel (2015) indicates that a share of only 27% of the SMEs in the United Kingdom own a business continuity plan, as opposite to a larger share of 68% of the business entities that are middle-sized and 75% of large-scale organizations. Additionally, out of the small-sized entities that own a business continuity plan, quite a considerable share of 73% did not perform a testing of this plan within the last year. Hence, it may be concluded on the basis of this data that for this group of organizations, preparing and mitigating business risks is not a matter of strong concern and due to this, it needs appropriate research to further understand the motivating background. Furthermore, besides the internalized protocols of managing possible business interruptions, SMEs also need external support to better adapt to unforeseen damages. Despite not owning the same amount of resources as large corporations, SMEs can still be competitive since by comparison with large-scale organizations, they are burdened to a smaller extent by bureaucratic processes and they can apply quicker decisional activities and short-scale procedures. Additionally, SMEs have a consistent ability of displaying flexibility in spite of the higher degree of uncertainty that they are exposed to, as according to Dahlberg and Guay (2015).
Small and medium-sized enterprises constitute an important actor of the economy, whose performance needs to be carefully assessed, given the other significant barriers that they encounter. Raşcă and Deaconu (2007) have drawn attention over the SME's vulnerability towards non-success soon after their launching phase, which is accelerated by the absence of managerial capabilities with regards to activities such as preparing, organizing, empowering, implementing and evaluating the organizational strategy. The business continuity of these entities is also hindered by strategic management problems, illustrated by the research of Moraru and Popa (2018), which impede the calibration of the companies' mission and their interaction with the surrounding business conditions: technological shifts, recognizing the critical degree of importance held by knowledge for an organization, the balanced usage of non-material resources, and last but not least, the enlargement of big organizations.
In Romania, SMEs encounter a various range of operational threats therefore there is a high need for exploring the context and providing insights on their BCM application. With this respect, a study carried out by Mironescu, Turcu, and Ceocea (2015) to assess the risks impacting the activity of 120 SMEs located in the North Eastern region of Romania, as displayed by their top managers, revealed that the business discontinuity risk reached a score of 80%. This percentage value further gives clues on the critical character of encompassing business continuity plans in the activity of SMEs, so that they can be able to improve their scarce current efficiency degree, which is also blocked by the following elements: fluctuating business conditions and poor preparation in dealing with business threats. Due to these impediments, the Romanian SME field does not constitute a competitive and defining element of the country's economic system. To enable this, procedures of managing business interruptions need to be enacted, as at the current point, they lack a consistent risk mitigation background.

Results
As provided by literature, the SMEs from Romania do not hold the safeguarding of business continuity among their top-level concerns, this making them vulnerable to business uncertainties. When performing internal control operations, the 119 small and medium-sized enterprises which have been part of the undertaken research have diagnosed the fact that their business continuity management is performed in a deficient way. This deficiency has been expressed in a lack of consistent business continuity strategies to shield them against probable business risks, as they comprised a short-term perspective and they have been oriented only on some categories of risk factors. Additionally, the creation of awareness among employees with respect to the need for an efficient business continuity management has been carried out by the SMEs involved in the research in an irregular manner, the meetings with them not being held on a constant basis. Hence, the top and middle level managers acknowledged the need to prove commitment to ensuring business continuity and allocating a greater degree of preoccupation for such endeavours. The following sections present the results of the regression analysis.

Regression analysis of the business continuity management strategy
Business continuity management strategy includes the actions taken by the organization to maintain its critical activities that underpin the delivery of the organisation's products and services. This is a composite variable computed as a simple average of all items concerning actions adopted by the organization to protect people, premises, technology and information, suppliers, partners and other stakeholders. The Pearson's correlation (Table 1) findings show that all of the variables are significantly correlated. The mean scores, which surpass the middle point (2.5), point out that all variables highly account for enforcing the BCM strategy. The predictor variables that account for a stronger significant correlation with the BCM strategy are risk assessment (r = 0.594, p < 0.001) followed by business impact analysis (r = 0.309, p < 0.001). The regression analysis has been performed by using the Enter method of regression. The model summary is presented in Table 2. Checking the R 2 value in the third column, it may be observed that the model, meaning BCM scope and arrangements, risk assessment and business impact analysis, explains 37.0% of the variance in the BCM strategy. This is a statistically significant contribution, as indicated by the Sig. F Change value for this line (0.001). The Durbin-Watson d = 1.962 indicates that there is no first-order linear autocorrelation in the multiple linear regression data and the model has a good fit. The ANOVA results show that all the variables are significant predictors of the BCM strategy (F = 22.482, p < 0.001), and that the model has a good fit. To find how well each of the variables predicts the dependent variable, the coefficients are studied. The coefficients (Table 3) show that only risk assessment (b = 0.632, p < 0.001) is a significant positive predictor of the BCM strategy. The BCM scope and arrangements and business impact analysis seem not to be significant predictors of the BCM strategy (significance values are higher than the 0.05 threshold for significance). In addition, the model of regression shows that a 1-unit increase in risk assessment will result in a 0.632 unit increase in BCM strategy. Therefore, any effort made by the organization to identify, assess and analyse the risks associated to its operations will result in the improvement of the organization's BCM strategy. The standardized beta values indicate that risk assessment (β = 0.581, t(119) = 6.901) has a significant impact on the BCM strategy. The values of VIF (variance inflation factor) close to 1 indicate that there is no collinearity found between the independent variables and, as such, in the regression model all predictor variables can independently predict the value of the dependent variable. Therefore, based on the obtained results, hypothesis H3 has been confirmed, hypotheses H1 and H2 could not be proven based on the existing data analysed in the paper and therefore they have been rejected.
The first model, which corresponds to the BCM strategy, proves to have aligned with the validity conditions imposed by the regression analysis. Thus, the model reflects a significant correlation manifested between BCM arrangements, business impact analysis, risk assessment and the BCM strategy. However, only the risk assessment and the business impact analysis indicate a stronger correlation with the BCM strategy. Additionally, 37.0% of the variation in the BCM strategy is produced by the formulated model, this share being a statistically significant one. Finally, the model manifests a good fit, since it passes the Durbin-Watson test and the analysis of the ANOVA output. When determining which variable can significantly predict the dependent one (BCM strategy), the risk assessment is the overarching one. Hence, the more the organization takes action towards evaluating risks, the more qualitative its BCM strategy will be. In brief, the first regression model has validated only the third hypothesis (H3), this fact not holding true for the first and the second ones, which have been discarded.

Regression analysis of the business continuity response planning
Business continuity response planning refers to the development and implementation of appropriate plans and arrangements to ensure the management of an incident and the continuity and recovery of critical activities that support key products and services. This is a composite variable computed as a simple average of the items concerning the incident management plan and the business recovery plan. The Pearson's correlation (Table 4) shows a significant positive strong correlation between the two variables. Notes: N = 119. **. Correlation is significant at the 0.01 level (2-tailed). The value of R 2 in the model of regression (Table 5) signals that BCM strategy explains 35.3% of the variance in the BC response planning. This is a statistically significant contribution, as indicated by the Sig. F Change value for this line (0.001). The value of Durbin-Watson coefficient (d = 2.186) emphasizes that the model has a good fit. Moreover, the ANOVA results show that BCM strategy is a significant predictor of the BC response planning (F = 63.831, p < 0.001), and that the model has a good fit.
The coefficients (Table 6) show that BCM strategy (b = 0.673, p < 0.001) is a significant and positive predictor of the BC response planning. In addition, the model of regression shows that a 1-unit increase in BCM strategy will result in a 0.673 unit increase in BC response planning. Thus, any improvement of the organization's BCM strategy will lead to an improved BC response planning. The standardized beta value indicates that BCM strategy (β = 0.594, t(119) = 7.989) has a significant impact on the BC response planning. Therefore, the research hypothesis H4 has been successfully confirmed. The second model issued through the current research, centred around the business continuity response planning, indicates a significant correlation that takes place between the BCM strategy and the BC response planning. Moreover, the model is accountable for 35.3% in the variation in the BC response planning. Apart from that, the model fulfils the Durbin-Watson test and depicts a good fit. Last but not least, the model holds true, therefore the fourth hypothesis (H4) is valid: positive modifications concerning the BCM strategy of a company can strengthen its BC response planning.

Regression analysis of the business continuity management effectiveness
Business continuity management effectiveness refers to the organizational performance in terms of managing business continuity. This is a composite variable computed based on the simple average of the composing elements of BCM that determine its efficiency, namely BC response planning, BCM exercising, maintaining and reviewing, and BCM culture. The Pearson's correlation (Table 7) findings show that all of the variables are significantly correlated and there are strong positive correlations between all variables. In addition, the mean scores that exceed the middle point (2.5) prove that all variables highly account for enhancing the BCM effectiveness. The model summary is presented in Table 8. The value of R 2 shows that the model, meaning BC response planning, BCM culture and BCM exercising, maintaining and reviewing, explains 81.9% of the variance in the BCM effectiveness. This is a statistically significant contribution, as indicated by the Sig. F Change value for this line (0.001). The Durbin-Watson d = 2.066 expresses that there is no first-order linear auto-correlation in the multiple linear regression data. The ANOVA results show that all the variables are significant predictors of the BCM effectiveness (F = 172.964, p < 0.001), and that the model has a good fit. The coefficients (Table 9) show that all the variables are significant and positive predictors of the BCM effectiveness (p < 0.001). Thus, a 1-unit increase in BC response planning will result in a 0.270 unit increase in BCM effectiveness, a 1-unit increase in BCM exercising, maintaining and reviewing will result in a 0.235 unit increase in BCM effectiveness and a 1-unit increase in BCM culture will result in a 0.173 unit increase in BCM effectiveness. As such, any effort made by the organization to improve its BC response planning, to exercise, maintain and review its BCM plan and to build a BCM culture throughout the entire organization will result in a more effective BCM system. The standardized beta values indicate that BC response planning (β = 0.371, t(119) = 6.766) has the most significant impact on the BCM effectiveness, followed by BCM exercising, maintaining and reviewing (β = 0.356, t(119) = 5.872). In the regression model, all predictor variables can independently predict the value of the dependent variable. Therefore, based on the results, all of the hypotheses H5, H6 and H7 have been successfully confirmed. The last regression model that is focused on business continuity management effectiveness reveals a strong positive correlation occurring between the four variables of the model: BCM effectiveness, BC response planning, BCM exercising, maintaining and reviewing, and last but not least, BCM culture. In addition, 81.9% of the variation in BCM effectiveness is produced by the specified model. As for the Durbin-Watson test, it pinpoints a good fit of the model. To put in a nutshell, the model illustrates the validity of all hypotheses H5, H6 and H7.

Discussions
The research employed in this paper shows that risk assessment influences the development of the business continuity management strategy to a high extent. The better is the risk assessment, the stronger is the BCM strategy. This is in line with the research carried out by Faertes (2015), which emphasized the urgency of relying on risk assessment procedures for carrying out essential operational activities and physical assets, keeping risks from taking place or restoring the organization to its functional state in case of a disruptive event. The findings of the study also endorse the research of Karakasidis (1997), who recognized the essential role played by the executive management's attempt to identify the negative impact rendered by business threats, either they are deliberated or undeliberated, upon the further successful application of business continuity activities. Moreover, the results also confirm Filipović, Krišto, and Podrug's (2018) findings, which showed that strategic and operational threats exert a higher influence upon BCM. The research also demonstrates that the BCM strategy significantly impacts the business continuity response planning. In order to maintain themselves on an equilibrium line and to minimize the risks posed by the happening of growth-threatening phenomena, organizations must issue solid response plans which demonstrate that they are ready to identify and tackle discontinuing incidents. This is also confirmed by Faertes' (2015) findings, which proved that by implementing risk assessment procedures and response plans, companies become more capable in discovering a possible business danger and thus to shelter the coherence of their business partners' interests and market standing. The need of organizations to practically respond to risks by issuing stable action plans is also proven by the research of Kippenberger (1999), claiming that companies' business continuity processes must be upgraded on an ongoing basis and aspects such as the scenarios put into place and the awareness created at the level of the organization have to be taken into account at this phase.
The research also indicates that BC response planning has the most significant impact on building an effective BCM, followed by BCM exercising, maintaining and reviewing and embedding the BCM in the organization's culture. The findings support Ghandour's (2014) research that highlighted the importance of developing and implementing of a well-built business continuity plan with efficient applicability, as a critical demanding operation in developing the BCM. Other scholars (Malachová & Oulehlová, 2016) demonstrated that business continuity management can render an extraordinary output if company members manifest a fast accumulation of skills, maintain records of the business processes disruptions and implement business continuity plans to minimize the hazardous situations that the organization has faced in the past. Consequently, any threat that can cause disturbances in the normal business course must be ruled out by the managerial team through the exercising of risk assessment procedures and business continuity plans, meant to identify or minimize the business risk. Nevertheless, the number of business threats which can distress the organization's performance and the managerial control processes is a substantial one (Svata, 2013;Kareem & Alameer, 2019;Wong, 2019).
Dealing with a permanently changing business environment is a task that forces organizations to continuously adapt, review and plan ahead to stay competitive and maintain essential business processes in normal functioning parameters. Braun and Martz (2007) brought evidence in this sense, stating that the achievement of business continuity should be performed by relying on the overall organizational effort. Hémond and Benoît (2012) argued that disaster preparedness must constitute an essential skill for any organization, which has to apply different measures to address the problems discovered since the planning stage. However, the BCM scope and arrangements and business impact analysis seem not to be significant predictors of the BCM strategy. In establishing their business continuity strategy, organizations need to quantify the harms that they can encounter and that might block customers' access to their products and services, together with an assessment of the consequences (financial, legislative, market rank) produced to the operational activities. Organizations also need to make distinction between vital and non-vital organizational processes, a vital process being the one that produces unacceptable consequences for stakeholders or the company or it is considered vital by the legislative context (Svata, 2013). Ergo, with the existing data gathered through research, it cannot be proven that the BCM arrangements nor the results of business impact analysis influence the development of the BCM strategy. These hypotheses would be interesting for future research.
There are several theoretical contributions and practical implications of the current research. First, the study contributes to the literature by introducing a theoretical framework for building organizational resilience and the capability for providing an effective response. It presents a comprehensive framework of interrelated elements which compose a sound busi-ness continuity management that is likely to be considered by organizations while building their BCM, regardless of their size and across all sectors. Second, it provides empirical research on the critical functions which are vital for organizations to ensure business continuity of their essential operations and to build organizational resilience. For the professionals in the field, the study brings new insights meant to contribute to generating a better understanding of the current practices of BCM by small and medium enterprises in Romania, and the priorities they have when planning for business continuity in their organizations.

Conclusions
The paper set out a framework for the composing elements of a BCM and indicated the interactions between these elements meant to ensure the foundations of an effective business continuity management. It also provided empirical evidence on the critical functions that are vital for companies to maintain their essential business activities in case of disruptive incidents and to build organizational resilience. Also, it broadened the existing literature in the field of business continuity management by displaying the situation of Romanian SMEs with regards to the implementation of BCM strategies and their view over their component elements. Additionally, the paper brought practical evidence to the fact that in order for organizations to attain resilience and meet the highest degree of BCM efficiency, they must pay a considerable equal attention both to the internal conditions, meaning people, resources, processes and organizational culture, and to the external circumstances, among which there may be named the risks and threats that can arise at any time point. If the focus is made only on the external aspects and they are not continuously matched with the internal ones, the risk-minimization consistency will be threatened and the company will be permanently exposed to incoming operational perturbations. Also, there is a need to approach BCM in a holistic manner, starting from an understanding of hazardous events and threats, their impact on the organization's activities and planning for the continuation of critical functions when disruptions occur.
Hence, given the findings of the research, two key points that need to be taken care of by Romanian SMEs are briefly summarized. Thus, the authors firstly presume that these economic entities should put a greater and concentrated effort into risk assessment processes, as they can significantly increase the efficiency of the company's BCM strategy. In the second place, the authors assert that the SMEs from Romania should pay attention also to the BC response planning as well as the ongoing review of their BCM strategy and its systematic incorporation in the culture of the company, in such a way to produce a resilient BCM. Additionally, the authors assume that in order for Romanian SMEs to properly respond to possible business threats and to mitigate their effects, they have to be supported from the legislative point of view as well as to be facilitated the needed resources for carrying on their operations in adequate parameters. Similarly, the managers of these entities need to upshift their strategic management processes to rapidly adapt to the current transformations related to technology, resource and knowledge oversight and management.
The research has its limits related to the existing data analysed in this paper, which are restricted to a certain geographic area in Romania. Also, some questionnaires (14%) have been filled in by persons holding different decision-making roles in the company, who might not have a complete understanding of the business continuity management in their organization and, therefore, their responses should be read with caution. Based on the data that were available in this sense, it has been unfortunately unattainable to prove whether the correlations of a good business impact analysis to a strong BCM strategy or a good understanding of BCM scope and arrangements to a strong BCM strategy are true. Given the fact that a part of the hypotheses that have been established to be tested have not been confirmed, the knowledge gap that arises as a consequence of this happening implies the need to further study and understand the reasoning behind their non-validation. More exactly, an extended effort should be put in future research to comprehend the reason for which Romanian SMEs do not believe that a clear understanding of the organizational context (goods or services delivered to customers, activities, processes, and the interactions with business partners and stakeholders) as well as its linkage to the BCM scope (the organizational policy regarding business continuity) can enhance the company's BCM strategy, as claimed by the first hypothesis. Furthermore, it also has to be further identified why the respondents do not acknowledge that a better business impact analysis, meaning the mapping of the company's essential functions and the linkages between them that can render an efficient operational degree, can upshift the organization's BCM strategy, as specified through the second research hypothesis. To analyse these hypotheses in a meaningful way, more companies should be interviewed in future studies. Therefore, it is noteworthy to mention that replicating this study with a larger and a more heterogeneous sample in different organizations, across all public, private and non-governmental sectors and in different countries might increase the generalizability of future research.