Business Continuity versus Business Model Risk

Business Continuity versus Business Model Risk

Business Continuity and Business Model Risk are concepts related to Disruption Risk. The former indicates the disruption of business operations, typically as a result of various forms of Operational Risk, the later suggesting a more permanent disruption, e.g. by market developments, new inventions etc. This entry explores similarities and differences between the two concepts.

Examples

• Examples of business disruption in financial services: Utility outage, Online system failure, Failure of payments infrastructure, IT system failure
• Examples of business model risk in financial services: Shadow banking versus traditional banking, Alternative Fintech business models (Platforms, Peer-to-peer etc)

Position in the Risk Taxonomy

• A Business Disruption event (the opposite of continuity) and a Business Model disruption are both placed in the Business Risk branch of the Risk Taxonomy tree. This reflects the fact that the realization of the respective risk events is linked to the general operation of a business rather than any specific Contractual Risks rising from specific contracts the organization is involved in (of course in both cases contracts can be implicitly involved, e.g. if an insurance business model gets disrupted it will mean the business will not be able to underwrite more contracts)
• Business Model disruption is part of the broader range Franchise Risk whereas Business Continuity fits within the Operational Risk branch.

Scope, Risk Factors, Stylized Facts

• The scope of Business Model Risk is, in principle much broader than business contunuity. Of the many elements that define a business model, business continuity concerns primarily threats to the Key Activities (operations) of the firm. In contrast, one of the most fundamental aspects of business model risk are threats to the Value Proposition of the firms products or services. Generating this value proposition is, in general a fundamental part of a business that links to every aspect of its organization, operation and placement within a market / economy
• Both types of disruption may have internal or external causes.
• Business disruptions are, in general, contained / manageable events, potentially repeating. Business model disruption (of an existing mature business model) is less frequent and potentially with far wider consequences
• Business continuity is, in general, more under the control of the firm (See risk mitigation section)

Inter-relations

• Major or frequent business disruptions may hint at more structural business model weaknesses (e.g. reliance for the delivery of products or services on unproven technologies), an unstable environment in relation to Key Resources or Key Partnerships.
• An unproven, struggling business model may put increasing pressure on operational aspects (poor maintainance or otherwise inadequate resources)

Risk Mitigation

Ensuring business continuity is the subject of Business Continuity Management. This is a fairly well developed practice with detailed Business Continuity Guidelines. | Business Continuity Management. In summary the guidelines recommend:

• Business Impact Analysis to assess risk (likelihood and impact) of a Major Operational Disruption to the operations of the organization
• having a formal, agreed, documented, implemented, tested and regularly reviewed and audited Business Continuity Plan
• setting out a recovery objectives
• pursuing testing activities that aim to assess the suitability of a Business Continuity Plan and associated Business Recovery Strategy
• Increasing organizational awareness on all relevant aspects of the Business Continuity Plan
• Ensuring effective communications within the organization and with its key stakeholders both internally and externally

In contrast the mitigation of business model risk is much less developed as a practical framework.

Regulatory Status

• In the context of financial services regulation, business disruption is a recognized risk category in regulatory frameworks worldwide (Basel II standards), with a further subclassification as hardware, software, telecomms or utility outage / disruption.
• In contrast business model risk is not a formal regulatory risk category (in particular it is not capitalized) but it is currently frequently analysed by regulators, e.g., in the context of assessing the resilience of a bank,