Iso standartları temelinde iş sürekliliği yönetim sistemi ve endüstriyel tesislerde uygulanabilirliğinin incelenmesi
An investigation into business continuity management system based on iso standarts and their applicability within industrial facicilities
- Tez No: 1019785
- Danışmanlar: PROF. DR. DİDEM SALOĞLU DERTLİ
- Tez Türü: Yüksek Lisans
- Konular: İşletme, Business Administration
- Anahtar Kelimeler: Afet riski, Afet yönetimi, ISO 22301, İş sürekliliği, Disaster risk, Disaster management, ISO 22301, Business continuity
- Yıl: 2026
- Dil: Türkçe
- Üniversite: İstanbul Teknik Üniversitesi
- Enstitü: Lisansüstü Eğitim Enstitüsü
- Ana Bilim Dalı: Afet ve Acil Durum Yönetimi Ana Bilim Dalı (disiplinlerarası)
- Bilim Dalı: Afet Yönetimi Bilim Dalı
- Sayfa Sayısı: Belirtilmemiş.
Özet
Küresel ölçekte afetlerin sıklığı ve yıkıcılığı artarken, toplumların sosyo-ekonomik iskeletinin bir parçası olan endüstriyel tesislerin kesintiler karşısında varlıklarını sürdürebilmeleri stratejik bir zorunluluk haline gelmiştir. Bu tez çalışması, İş Sürekliliği Yönetim Sistemi yaklaşımını endüstriyel tesisler özelinde sistematik bir çerçevede ele almakta; mevcut uluslararası standartların ve literatürün bu karmaşık yapılar üzerindeki uygulanabilirliğini ve sınırlılıklarını analiz etmektedir. İş sürekliliği disiplini, tarihsel süreç içerisinde 1970'li yıllarda ağırlıklı olarak bilgi teknolojileri ve veri kurtarma faaliyetlerine odaklanan sınırlı bir teknik yaklaşım olarak ortaya çıkmıştır. Ancak zaman içerisinde kapsam ve içerik bakımından genişleyerek gelişen bu alan; günümüzde yalnızca teknik sistemlerin idamesini değil, potansiyel tehditlerin etkilerini önceden belirleyen ve kurumun değer yaratan faaliyetlerini, itibarını ve paydaş çıkarlarını koruyan proaktif ve bütüncül bir yönetim sistemine dönüşmüştür. Günümüzün küreselleşmiş ekonomisinde artan risk çeşitliliği ve operasyonel bağımlılıkların karmaşıklığı, iş sürekliliğinin stratejik yönetim ve kurumsal dayanıklılık bağlamında ele alınmasını zorunlu bir ihtiyaç olarak ortaya çıkarmıştır. Bununla birlikte, etkin bir iş sürekliliği yönetim sisteminin tesisi, sadece teknik planların veya dokümanların hazırlanmasıyla mümkün değildir. Literatürde öne çıkan araştırmalar; üst yönetim desteğinin ve iş sürekliliği uygulamalarının kurum kültürüne tam manasıyla yerleştirilmesinin başarının en belirleyici faktörleri olduğunu göstermektedir. Kuruluşların iş sürekliliğini yalnızca statik bir sertifikasyon projesi olarak görmeyip, her kademede çalışanın bu farkındalığa sahip olduğu, yaşayan ve sürekli test edilen bir kurumsal direnç kültürü olarak inşa etmeleri, sistemin kriz anındaki başarısını doğrudan etkileyen kritik başarı faktörü olarak değerlendirilmektedir. Araştırmanın metodolojik odağını, ISO 22301 standardı ve ilgili teknik rehberler ışığında kurgulanan iş sürekliliği mimarisinin, yüksek varlık yoğunluğuna ve karmaşık üretim hatlarına sahip endüstriyel tesislerdeki etkinliğini sorgulamak oluşturmaktadır. Çalışmada, afetlerin yalnızca operasyonel kesintilere yol açmadığı, aynı zamanda endüstriyel tesisler özelinde fiziksel altyapıya büyük ölçüde zarar verebileceği, standart bir yaklaşımla yürütülecek iş etki analizi ve risk değerlendirmelerine dayanan iş sürekliliği yaklaşımının endüstriyel tesislerde yetersiz kalabileceğine dikkat çekilmektedir. Bu bağlamda, İş Etki Analizi (İEA) ve Risk Değerlendirmesi (RD) süreçlerinin endüstriyel tesislerde birbirinden bağımsız yürütülemeyeceği anlaşılmıştır. Tez kapsamında yapılan değerlendirmeler, afetlerin yalnızca operasyonel değil, fiziksel altyapı üzerinde yarattığı yıkıcı etkiler ve endüstriyel tesislerin sahip olduğu yüksek sermaye yoğunluğu nedeniyle, mevcut iş sürekliliği yaklaşımlarının endüstryel tesislere göre özel olarak yeniden yapılandırılması ihtiyacını göstermektedir. Mevcut literatür ve ISO standartlarının ağırlıklı olarak düşük fiziksel bağımlılığa sahip ofis ve bilgi teknolojileri odaklı stratejiler sunması, ağır sanayi ve karmaşık üretim hatlarına sahip tesislere özgün risk profilini ve süreklilik stratejilerini karşılamakta yetersiz kalmaktadır. Ayrıca, bu tesislerin enerji, su ve lojistik gibi altyapı ağlarına olan mutlak bağımlılığı, süreklilik stratejilerinin kurum özelinde bir çabanın ötesine geçerek; OSB yönetimlerini, yerel otoriteleri ve altyapı sağlayıcılarını kapsayan çok aktörlü bir eşgüdümü gerektirdiğini göstermektedir. Bu nedenle, endüstriyel tesislerin operasyonel sürekliliğinin sağlanması için toparlanma çabalarından önce fiziksel dayanım kavramını merkeze alan, disiplinler arası uzmanlık ihtiyacını yöneten, kapsamlı ve bütünleşik bir endüstriyel iş sürekliliği rehberine ihtiyaç duyulduğu ortaya çıkmaktadır.
Özet (Çeviri)
The increasing frequency of disasters worldwide, together with the intensification of their destructive impacts, has rendered the preservation of operational integrity in industrial facilities a strategic imperative. This study examines the Business Continuity Management System (BCMS) approach within the context of the unique structure of industrial facilities and aims to analyze the applicability and methodological limitations of current international standards and generally accepted theoretical frameworks in the literature regarding these complex industrial systems. Since the dawn of human history, disasters have exerted negative effects on social structures. This reality has triggered the birth of the modern disaster management discipline by compelling individuals and societies to minimize their exposure to the consequences of disasters, mitigate their impacts, and optimize response-recovery processes. However, the increasing sensitivity of the global economy to crises, demographic shifts concentrating in risky geographies, the environmental impacts of climate change, and the dynamics of unplanned urbanization have intensified the impact of disasters on societies. Thousands of disaster events occurring over the last half-century have resulted in millions of deaths and trillions of dollars in economic loss. These data necessitate a transformation of the disaster management paradigm from a purely intervention-oriented structure to a resilience-based, proactive approach. This transformation has increased the value of the business continuity concept at the institutional level and has encouraged the development of systematic structures that enable organizations to be prepared for interruptions. The Business Continuity Management System (BCMS) is a holistic management methodology that enables an organization to maintain its critical business functions within pre-defined time and capacity limits in the face of unforeseen interruptions such as natural disasters, technological failures, cyber threats, or pandemics. This system provides an integrated framework that encompasses not only emergency plans to be activated during a crisis but also pre-crisis preparation, crisis management, and post-crisis recovery processes. The foundation of the BCMS consists of the Business Impact Analysis (BIA), which enables the determination of an organization's vital business processes, and the Risk Assessment (RA), which involves the evaluation of internal and external risk factors that may threaten these processes. Strategies developed in light of empirical findings obtained from the Business Impact Analysis and Risk Assessment are implemented via response plans and are verified through periodic tests and exercises to ensure the operational effectiveness of the system. In this capacity, the BCMS is not merely an operational planning tool; it is a strategic management discipline that enhances corporate resilience, protects stakeholder interests, and supports organizational sustainability. From a historical perspective, it is observed that business continuity management has evolved from emergency and disaster recovery planning-based approaches since the 1970s. In the literature, this developmental process is classified under three fundamental mindsets: technology-oriented, audit-oriented, and value-oriented; today, the dominance of a resilience focus is notable. The approach, which initially focused solely on the protection of information systems and data centers, has expanded over time with regulatory pressures and corporate governance requirements, eventually undergoing a paradigm shift wherein business continuity is treated as a strategic element that creates organizational value. Especially the large-scale crises of the 1990s and the September 11, 2001 terrorist attacks revealed that business continuity should no longer be considered a purely technical subject but rather in conjunction with the concept of corporate resilience. In this process, the BCMS transformed from a structure that only responds to operational interruptions into a multi-layered management approach capable of adapting to environmental, social, and economic shocks. The chronological development of business continuity legislation also supports this trajectory: the period between 1970–1990 was shaped by disaster recovery planning approaches aimed at enabling organizations to adapt to new information technologies, laying the foundations of the BCMS; the period between 1990–2001 gained momentum with the emergence of standards designed for implementation in different regions and economic sectors; the post-2001 period witnessed regulatory and standardization efforts accelerated by the impact of the 9/11 attacks; the period between 2005–2010 saw international standards developing and becoming widespread, transcending national frameworks; and in the post-2010 period, with the publication of international reference frameworks such as ISO 22301, business continuity legislation matured further, evolving into a resilience-focused, holistic, and interdisciplinary structure. In this process, business continuity has evolved from an approach responding only to operational interruptions into a strategic management field that provides sustainability and resilience within a broad corporate framework extending from governance to organizational culture. When the literature on the effective implementation of the Business Continuity Management System is examined, although it is emphasized that numerous technical and operational factors influence success, the support of top management and the integration of continuity practices into the corporate culture emerge as two decisive and critical elements. The involvement of top management in the process, not as a passive actor providing mere formal approval, but as an active stakeholder that leads, directs, and allocates resources, is seen as a fundamental requirement for the adoption of the BCMS at the institutional level and for the sustainability of the system. Furthermore, the integration of the BCMS into organizational culture and the dissemination of continuity awareness to all hierarchical layers are of vital importance. Empirical findings show that embedding continuity practices into the corporate culture strengthens organizational reflexes during a crisis and increases the functionality of the system. One of the most effective approaches in the integration of business continuity management into corporate structures is ensuring systematic integration into critical processes through internationally accepted standards and frameworks. In this context, the ISO 22301 standard, developed based on established best practices in the field of business continuity, offers a flexible and comprehensive management system framework applicable to organizations of different scales and sectors. The standard treats business continuity not only as the maintenance of activities after interruptions but also as a process of pre-defining risks, mitigating impacts, and increasing corporate resilience. In this aspect, the BCMS enables organizations to adopt a proactive and systematic management approach rather than reactive ones. The Plan-Do-Check-Act (PDCA) cycle, which forms the basis of ISO 22301, allows business continuity management to be constructed as a dynamic and continuously improving structure. Within the scope of this cycle, organizations determine their policies and objectives, implement their processes, monitor and evaluate their performance, and realize improvement activities in line with the findings obtained. ISO 22301 positions business continuity not merely as a technical requirement but as a management discipline that must be integrated with corporate governance, strategic planning, and organizational culture. The alignment of ISO 22301 with the United Nations Sustainable Development Goals demonstrates that business continuity management is not limited to operational continuity; rather, it offers a holistic approach contributing to social, economic, and environmental sustainability. In this context, the BCMS is evaluated as a strategic management tool that increases the capacity of organizations to adapt to changing internal-external conditions, develop resilience against crises, and achieve long-term sustainability goals. The setup of the BCMS begins with the analysis of the organization's internal and external context, stakeholder expectations, and risk environment; the effectiveness of the system is shaped based on top management leadership, resource allocation, and the clear definition of roles and responsibilities. At the operational level, critical activities and interruption impacts are determined through tools such as Business Impact Analysis and Risk Assessment; accordingly, business continuity strategies, plans, and procedures are developed and verified through regular tests. The system is continuously improved through performance evaluation mechanisms such as monitoring, internal audits, and management reviews; thus, it transcends being a structure that only activates during crises and creates a dynamic resilience architecture that supports organizational learning and adapts to changing conditions. However, while various theoretical approaches and conceptual frameworks exist in the literature for ensuring business continuity, the lack of studies demonstrating the applicability of business continuity management systems outside of Information and Communication Technology (ICT)-oriented sectors is noteworthy. Particularly in facilities based on physical production processes, this gap in the academic literature regarding how operational continuity should be structured beyond standard models reveals the necessity of addressing the discipline with a broader sectoral perspective. When the applicability of a business continuity management system, operational resilience, and resilience architecture—to be structured based on ISO standards—is analyzed specifically for industrial facilities; it is observed that while the Business Impact Analysis (BIA) and Risk Assessment (RA) processes are positioned as an analytical foundation, the methodological preference regarding the sequencing and integration of these processes is left to the organizations by ISO 22301. Approaches in the literature suggesting that the BIA be conducted before the RA provide advantages in terms of prioritizing critical activities and the effective allocation of resources; however, they can create a risk of threat blindness, particularly in industrial facilities, due to generating static assumptions independent of threat types. Conversely, while the simultaneous execution of BIA and RA has the potential to produce scenario-based and more realistic analyses, it entails limitations in practice due to high data requirements, methodological complexity, and requirements for corporate maturity. In the process of Business Impact Analysis to be conducted in industrial facilities, focusing only on operational and financial losses during the evaluation of interruption impacts leads to the disregard of physical damage, environmental impacts, and cascading consequences, which can result in the erroneous determination of critical parameters such as MTPD (Maximum Tolerable Period of Disruption), RTO (Recovery Time Objective), and MBCO (Minimum Business Continuity Objective). Especially in heavy industry, petrochemical, or food sectors, it is observed that physical damage costs and environmental/regulatory consequences can pull the total impact to the very moment of interruption; this situation reveals the need to question the applicability of the classical business impact analysis approach. On the other hand, the fact that the business continuity strategies proposed in the literature are largely focused on office and information technologies significantly limits their applicability in industrial facilities with high physical dependency and complex production infrastructure; strategies such as alternative facility usage, production shifting, or outsourcing are considered unsustainable in most cases due to technical, economic, and regulation-based constraints. Furthermore, it is evaluated that the corporate risk management perspective of the ISO 31000 standard does not focus on meeting specific risk analysis needs aimed at business continuity, and this situation may lead to systems being constructed predominantly focused on“resilience”(recovery) while neglecting the“resistance”(pre-event strength) dimension. Consequently, for effective business continuity management in industrial facilities, there arises a need to develop a holistic approach that focuses not only on post-interruption recovery but also on increasing the resistance of physical assets and operational processes to risks, considering interdisciplinary, data-driven, and contextual characteristics. When all these factors are evaluated together, the destructive effects of disasters—affecting not only operations but also physical infrastructure—combined with the high capital intensity of industrial facilities, demonstrate the need to restructure existing business continuity approaches specifically tailored for such industrial environments. The fact that the existing literature and ISO standards predominantly offer strategies oriented towards office and information technologies with low physical dependency remains insufficient to address the unique risk profiles and continuity strategies required for heavy industry and facilities with complex production lines. Furthermore, the absolute dependency of these facilities on infrastructure networks, such as energy, water, and logistics, indicates that continuity strategies must extend beyond institution-specific efforts, necessitating a multi-actor coordination that encompasses Organized Industrial Zone (OIZ) administrations, local authorities, and infrastructure providers. Therefore, it is evident that there is a critical need for a comprehensive and integrated industrial business continuity guide that prioritizes the concept of physical resistance over mere recovery efforts and manages the requirement for interdisciplinary expertise to ensure the operational continuity of industrial facilities.
Benzer Tezler
- 17-26 Yaş grubuna giren genç kızlarda standart vücut ölçülerinin tespiti üzerine bir araştırma
Başlık çevirisi yok
SEVİL KİŞOĞLU
Yüksek Lisans
Türkçe
1987
Tekstil ve Tekstil MühendisliğiGazi ÜniversitesiGiyim Endüstrisi ve Giyim Sanatları Ana Bilim Dalı
PROF. DR. RASİH DEMİRCİ
- Errors in determination of sound pawer of spheroidal bodies under exact tree-field conditions
Başlık çevirisi yok
A.HAKAN ŞERAFETTİNOĞLU
- Edirne civarında yetiştirilen mısırlarda tohumla taşınan fungusların tesbiti ve tanımlanması üzerinde araştırmalar
Başlık çevirisi yok
AHMET ASAN
- Erzurum ve Erzincan yörelerindeki bazı bitkilerde bulunan eriophyoi dea (acarina:actinedida) akarları üzerinde çalışmalar
Studies an eriophyoid mites (eriophyoidea:acarina) on some plants in Erzurum and Erzincan regions
ÖZDEMİR ALAOĞLU
