Enterprise Resilience Assessment—A Quantitative Approach

Enterprise resilience is a key capacity to guarantee enterprises’ long-term continuity. This paper proposes a quantitative approach to enhance enterprise resilience by selecting optimal preventive actions to be activated to cushion the impact of disruptive events and to improve preparedness capability, one of the pillars of the enterprise resilience capacity. The proposed algorithms combine the dynamic programming approach with attenuation formulas to model real improvements when a combined set of preventive actions is activated for the same disruptive event. A numerical example is presented that shows remarkable reductions in the expected annual cost due to potential disruptive events.


Introduction
Every year, both natural and manmade disasters impact the economies of countries all over the world [1]. Enterprises lack a risk culture and they are exposed to a very dynamic environment filled with threats and disruptive events that endanger the continuity of their business [2].
Events like air travel disruptions after the 2010 Eyjafjallajökull eruption in Iceland affected many enterprises since the controlled air space of several European countries was closed, and the transport of components and goods was also interrupted. This had a very negative impact on enterprises as they did not know if goods would arrive on time.
Several authors have analyzed the impact of different disruptive events that have occurred in recent years. Sheffi and Rice [3] explain that after the September 11 terrorist attacks in 2001, the US government closed the country's borders and shut down all incoming and outgoing flights, and how this event affected enterprises worldwide. Another example explains how Nokia and Ericsson, both regular customers of Philips, responded to a fire at Philips Alburquerque's industrial facility. Both companies recovered from this disruptive event in a very different manner. While Nokia started to search for alternatives to replenish the chips that Philips supplied them, Ericsson assumed that chips would be delivered with some delay. However, Philips needed more time than it initially expected to restart its production. Based on this example, Nokia responded in a more efficient way to such a disruptive event, thus Nokia was more resilient [4].
Moreover, the current organizational environment characterized by a high degree of information sharing, an increasing complexity of transactions among supply chain partners [5,6], the fierce competition, the bargaining power of clients, the dependence on suppliers, the constant demand for innovation, changes in the regulatory environment, the new expectations of society [7], the constitutional changes such as UK's planned exit from the European Union (Brexit) [8] make enterprises more vulnerable and consequently, companies should enhance their resilient capacity to efficiently Research on resilience has proliferated in recent years. Numerous definitions, tactics, metrics, and indices have been proposed. However, most of them are formulations with little or no formalized theoretical underpinnings [30]. Polyviou et al. [31] state that firms of all sizes are concerned with avoiding or recovering quickly from disruptions. For this reason, the authors point out that researchers have to respond to this emerging concern and develop frameworks and tools that advance theory and practice in the area of firm and supply chain resilience.
Consequently, the main objective of this paper is to analyze how to cushion the effects of potential disruptive events on an enterprise by implementing preventive actions based on the dynamic programming foundations. This article explains how to (which actions should be implemented) enhance the preparedness capability in order to build resilient enterprises. An analysis of what preventive actions for each disruptive event should be implemented is performed by a dynamic programming approach to solve the problem.
The paper is organized as follows. Section 2 defines a specific problem related to lack of preparedness capability to face production problems and describes the dynamic programming approach used to solve this quantitative problem. Moreover, it presents the special features of the problem characterization when a combined set of preventive actions on the same disruptive event is activated, along with our proposal to deal with this issue and the problem modeling. Section 3 shows and discusses the results of which preventive actions are to be activated to improve the preparedness capability using the dynamic programming approach and summarizes future research lines to improve the resilient capacity of enterprises. Finally, Section 4 offers the main conclusions.

Problem Definition
ER relies on the preparedness capability to deal with disruptive events. In order to assess the ER capacity, Sanchis and Poler [32] developed a framework to categorize disruptions. Within this framework, a disruptive event is considered a foreseeable or unforeseeable event that directly affects an enterprise's usual operation and its stability [33]. Disruptive events are classified into different categories depending on the source from which they originated; e.g., accidental, customer, energy, equipment, financial, technology, infrastructure, man-made, natural, political, product, regulatory, supplier and terrorism. The problem addressed in this study belongs to the "productions" category.
An exhaustive literature review was done to identify the commonest disruptive events related to the production category. The literature review focused mainly on two types of information sources: on the one hand, reports prepared by leading consulting firms, such as Ernst & Young, and specialized entities in risk and ER, such as the Business Continuity Institute, which develops annual reports with rankings of the situations or risks that most concern the business world [34][35][36][37][38][39][40]; on the other hand, scientific publications were also reviewed to find the most frequent and worrisome disruptive events related to production aspects [41][42][43].
Disruptive events, such as damage to machinery/equipment, failure to produce innovative products to satisfy customer needs, disruptive manufacturing technologies/innovation, product quality incident, outage, inaccurate manufacturing planning, among others, were found to be relevant and worrisome events for the business world. In order to test the proposed method, the example problem was simplified by considering only four disruptive events related to potential production problems: (i) Limiting changes in the production capacity; (ii) Breakdown/failure of machines or key equipment; (iii) Production operations that become increasingly complex; and (iv) Production of defective or poor quality products.
Some preventive actions were proposed for all the previous disruptive events. The validation of the suitability and appropriateness of these preventive actions was analyzed by a panel of experts in an iterative process through a Delphi study. After the formulation of the problem (to validate the set of preventive actions proposed for each disruptive event) and the choice of experts, a questionnaire was developed and launched. The questionnaire had a 3-point Likert scale, where experts had to indicate the interest of each of the preventive action proposed (high, medium or low interest) per disruptive event. Moreover, the experts were also invited to add other interesting preventive actions and through an iterative process consisted of two rounds, the most significative ones were selected. The 12 experts who participated in the Delphi study came from research, academia and business/industrial areas from different knowledge domains related to resilience. More information could be found in Sanchis and Poler [44].
All in all, the problem consisted in four potential disruptive events that could occur, plus the proposal of different preventive actions per disruptive event (validated by the Delphi study) to minimize impacts (in terms of the expected annual cost). It is worth mentioning that in this example, the disruptive events are internally originated in the enterprise. However, the potential disruptive events could happen in the supply chain where the enterprise operates or even externally to this supply chain. With regards to the preventive actions, some are also internally managed by the enterprise, but others involve entities of its supply chain. Table 1 shows the four analyzed disruptive events and the proposal of preventive actions. Quantifying the impact of the potential disruptive events is modeled by the expected annual cost of each disruptive event k (Cd k ), the annual cost of the preventive action n (i n ), the expected annual cost of a disruptive event k after activating a preventive action n (Cdp k ), the savings of a disruptive event after implementing a preventive action n (a n ) and the annual investment in ER (Inv).

Dynamic Programming: The Knapsack Approach
The term dynamic programming was originally coined by Richard Bellman in the 1940s to define the problem-solving process in which each problem depended on and necessitated the solution of another problem. The Bellman equation provides modeling according to a recursive relation [45,46].
Due to the synergies that the problem defined in Section 2.1 presents with capital budgeting problems, the literature review which focused on this area revealed that the major contributions and the fundamental primary studies related to dynamic programming and capital allocation were performed by these authors in the 1960s [47][48][49][50].
The basic capital allocation problem considers a firm that has various investment proposals, called projects, each of which requires capital outlays and yielded returns [51]. To solve such problems, the most widely used approach is dynamic programming, specifically the knapsack approach. However, real problems usually entail greater complexity than the basic capital allocation problem. Weingartner [48] stated that the dynamic programming approach has its limitations, such as dependency among projects when a specific project is developed, and it depends on the development of another project or more. As in the dynamic programming solution to the knapsack problem, the time sequence is replaced with the sequence of projects being considered, but the ordering of the projects to be implemented is arbitrary.
Currently, different studies have based their research on previous works, and the present research lines are addressed to solve multidimensional knapsack problems, which combine dynamic programming and branch and bound [51].
The decision problem proposed herein is NP-complete. The literature reveals that dynamic programming algorithms are the most suitable type to solve such optimization problems. Their simplicity, flexibility and rapidness make the dynamic programming approach a powerful solving method. Bhowmik [52] states that it is so powerful that it encourages tremendous growth in research works for solving decision problems. Dynamic programming research has made fundamental advances in theory, numerical methods and econometrics. Thus, dynamic programming can be viewed as a useful "first approach" scheme to human decision making.
The knapsack method appears in real-world decision-making processes in a wide variety of fields. Skiena [53] shows that among 75 algorithmic problems, the knapsack problem was the 18th most widely used and the 4th most needed to solve real problems. In the knapsack problem, a container has a certain capacity, and each item that can go into the container has a size and a benefit. The problem lies in determining what should go into the container to maximize the total benefit.
In the case presented in this paper in Section 2.1, capacity is related to the investment that the enterprise is willing to make to improve its ER capacity. Items are the different preventive actions that could be activated to reduce the expected annual cost of disruptive events. Size is the cost of each preventive action and profit is the savings that the enterprise notices after implementing the preventive actions. In this case and based on the definition of the general knapsack problem goal, the enterprise's objective is to maximize total savings.
A dynamic programming problem can be divided into different decision stages. Each stage has an input state (e n ) and, depending on the decision made (x n ), an output state (e n+1 ) is obtained. This output state generates a profit (c n ), which depends on both the decision and input state (see Figure 1). Sustainability 2019, 11, x FOR PEER REVIEW 5 of 13 development of another project or more. As in the dynamic programming solution to the knapsack problem, the time sequence is replaced with the sequence of projects being considered, but the ordering of the projects to be implemented is arbitrary. Currently, different studies have based their research on previous works, and the present research lines are addressed to solve multidimensional knapsack problems, which combine dynamic programming and branch and bound [51].
The decision problem proposed herein is NP-complete. The literature reveals that dynamic programming algorithms are the most suitable type to solve such optimization problems. Their simplicity, flexibility and rapidness make the dynamic programming approach a powerful solving method. Bhowmik [52] states that it is so powerful that it encourages tremendous growth in research works for solving decision problems. Dynamic programming research has made fundamental advances in theory, numerical methods and econometrics. Thus, dynamic programming can be viewed as a useful "first approach" scheme to human decision making.
The knapsack method appears in real-world decision-making processes in a wide variety of fields. Skiena [53] shows that among 75 algorithmic problems, the knapsack problem was the 18th most widely used and the 4th most needed to solve real problems. In the knapsack problem, a container has a certain capacity, and each item that can go into the container has a size and a benefit. The problem lies in determining what should go into the container to maximize the total benefit.
In the case presented in this paper in Section 2.1, capacity is related to the investment that the enterprise is willing to make to improve its ER capacity. Items are the different preventive actions that could be activated to reduce the expected annual cost of disruptive events. Size is the cost of each preventive action and profit is the savings that the enterprise notices after implementing the preventive actions. In this case and based on the definition of the general knapsack problem goal, the enterprise's objective is to maximize total savings.
A dynamic programming problem can be divided into different decision stages. Each stage has an input state (en) and, depending on the decision made (xn), an output state (en+1) is obtained. This output state generates a profit (cn), which depends on both the decision and input state (see Figure  1).  Table 2 shows the common nomenclature used in the proposed dynamic programming model, a general description from a knapsack problem point of view and the description of the decision problem defined in Section 2.1.   Table 2 shows the common nomenclature used in the proposed dynamic programming model, a general description from a knapsack problem point of view and the description of the decision problem defined in Section 2.1.  Total optimum saving of the best activation strategy for the preventive actions from stage n to stage N given an input state e n .
f n (e n , x n ) = f * n+1 (e n+1 ) + v n ·x n Recursive relation Total saving made with an activation strategy for the preventive actions from stage n to stage N given an input state e n and taking the decision x n . e n+1 = e n − i n ·x n The following input state ER investment available after deciding about activating preventive action n. The following input state is equal to the investment available before minus preventive action n activated (if x n = 1), multiplied by its unitary cost (i n ).
The optimal profits in each stage, as well as the optimal decisions, are calculated as follows: fn * (e n ) = opt {c n (e n ,x n ) ⊗... ⊗ c 1 (e 1 ,x 1 )}: total optimal profit in stage n (with x *).

Special Features in Activating Preventive Actions
The problem defined in Section 2.1 presents special features as to the activation of a combined set of preventive actions that affect the same disruptive event. When this occurs, improvements in savings terms are not necessarily the sum of the savings provided by all the activated preventive actions. This characteristic presents synergies with the pharmacology science studies of Chou et al., which focus on analyzing combined drug effects [54,55]. Belen'kii and Schinazi [56] analyze the antagonism, synergy or additivism for drug combinations. From these concepts, antagonism is in line with the present study. Antagonism (or depotentiation, negative interaction, negative synergy, etc.) is defined as the joint effect of two drugs or more, in such a way that the combined effect is less than the sum of the effects produced by each agent separately [57,58].
The ER capacity enhancement problem presents a kind of antagonism in that the joint savings from the different preventive actions activated to mitigate the effects of the same disruptive event are less than the sum of all the preventive actions savings that address such a disruptive event.
In order to overcome this issue and based on the fact that enterprises are those that provide the information about disruptive events, preventive actions, costs and savings, one of the alternatives would be to ask the enterprise for this piece of information. The enterprise should provide data about the savings that some preventive actions generate when activated in an isolated manner for a specific disruptive event.
Moreover, the enterprise should provide data on the savings generated when different combinations of such preventive actions are activated for the same disruptive event. However, this exercise is very complex and exhausting for enterprises, and the information they provide might not be truthful. In order to overcome this, and by considering that the savings effect of multiple preventive actions on the same disruptive event is less than its sum, an attenuation formula is proposed. This formula (1) slows down savings when two preventive actions or more on the same disruptive event are activated in the optimal solution by calculating an attenuation parameter: where, α: Parameter related to the magnitude of the attenuation (0 ≤ α ≤1). n_act k : Number of preventative actions activated in the optimal solution for the same disruptive event.
The proposed attenuation parameter follows logarithmic reduction, which is based on different studies that have focused on analyzing the effects of a drugs combination from other diverse research areas; e.g., pharmacology, medicine, etc. [59,60]. The definition of value α depends on the degree that enterprises wish to be attenuated when multiple preventive actions are activated for the same disruptive event. It is worth mentioning that the higher parameter α, the less marked the attenuation becomes.
Among the preventive actions activated for the same disruptive event, the preventive action with the highest saving is not attenuated because, although several preventive actions are activated, it is presumed that the savings of the disruptive event is, at least, the maximum saving of all the preventive actions activated. Therefore, the attenuation parameter is applied only to those savings that are lower than the maximum, as it can be seen in the description of Algorithm 1. Algorithm 1 calculates for all the disruptive events (K) and for all the preventive actions activated (N i ), if such preventive actions have not been attenuated in previous iterations (m kn = false). It also calculates which savings are lower than the maximum saving per disruptive event, which is attenuated by the proposed parameter µ n , while the status of the attenuated preventive actions is set to true (m kn = true). The algorithm also registers if any attenuation has been performed (at least one preventive action has been attenuated) and establishes that a t is also set to true.
The Algorithm 2 is the main algorithm loop that launches dynamic programming optimization and the attenuation. The loop ends when no attenuation is performed.

Problem Modeling
The problem presented in Section 2.1 was quantified with realistic data to show a calculation example. Table 3 shows the quantification for parameters Cd k , i n , Cdp k and a n after taking into account that the savings of a disruptive event k after implementing a preventive action n are defined by Equation (2): a n = Cd k − Cdp k By way of example, for disruptive event "P1: Limiting changes in the capacity of production", the expected annual cost is €10,000. However, the enterprise could implement three different preventive actions to be better prepared to face the negative effects of this event when it occurs and, in turn, to be more resilient. These preventive actions are P1.1, P1.2 and P1.3 (described in Table 3). The enterprise estimates that preventive action P1.1 has an annual cost of €2000, and the expected annual cost of P1 will lower to €6000 if this preventive action is finally activated. Therefore, the savings (without considering the cost of the preventive action) will be the difference between the initial expected annual cost and the cost after activating the preventive action (e.g., €10,000 − €6000 = €4000), as indicated in Equation (2). This difference is because the enterprise, by activating preventive actions, has an enhanced preparedness capability to endure the negative effects of the disruptive event. Then it is assumed that the cost of the disruptive event after activating a preventive action will always be lower than before. The cost of the preventive action should also be lower than the saving because otherwise it would be better not to activate such a preventive action, but to allow the disruptive event to occur as it is more costly to enhance preparedness capability than allowing the disruptive event to take place.
Moreover, enterprises should decide how much money they should invest to implement the most adequate preventive actions in order to enhance their ER capacity. Depending on the value of this input data, the solution of the problem will differ according to the resources used to enhance this capability. In this example, the annual investment in ER is Inv = €22,000.
Parameter α used in the attenuation process is 0.95. As shown in Table 3, the event that presents the highest expected annual cost is disruptive event P4, followed by P2. The expected annual costs of disruptive events P1 and P3 have almost the same order of magnitude. Therefore, it is expected that efforts will be made to activate preventive actions to face the negative effects of the disruptive event that presents the highest expected annual cost.

Results and Discussion
Three iterations are needed to compute the problem described in this paper to obtain the optimum solution, and the attenuation parameter needs to be taken into account when more than one preventive action is activated for the same disruptive event (Table 4). In the first iteration, 8 of the 12 proposed preventive actions were activated (x n = 1), taking into account that the annual investment is respected, which was established as €22,000.
In this first iteration, as more than one preventive action was activated for each disruptive event, the attenuation parameter was applied. The return function (savings after activating preventive action n) of the attenuated preventive actions in Iteration 1 are shown in bold as the return function of Iteration 2, based on the description of Algorithm 1. In Iteration 2, seven preventive actions were activated, from which P1.3 and P2.2 were attenuated, as shown in the return function of Iteration 3. In Iteration 3, the same number of preventive actions as in the previous iterations was activated and only one preventive action (P1.2) was attenuated. Finally, in the last iteration, no. 4, the solution shows that when more than one preventive action was activated for the same disruptive event, one preventive action presented the maximum return function value (per disruptive event) and the other activated ones had already been attenuated. Therefore, Algorithm 2 ends at this point as the following iteration offers the same result as the fourth one.
The detailed results of the final solution (Iteration 4) are presented in Table 5.
In the first disruptive event, two preventive actions were activated; in disruptive events P2 and P3, only one preventive action was activated; in the "production of defective or poor quality products" disruptive event (P4), the three proposed preventive actions were activated because this was initially expected since this disruptive event presented the highest expected annual cost. Although disruptive event P4 was that in which more preventive actions were activated, it did not undergo the greatest reduction in the expected annual cost after activating the preventive actions (a reduction of almost 32%). Instead it was P3 (a reduction of 46%), followed by disruptive event P1 with an almost 40% reduction in the expected annual cost of such disruptive event after activating preventive actions P1.1 and P1.2. This could result from the fact that the preventive actions proposed for disruptive events P1 and P3 were more efficient that those proposed for disruptive event P4. Disruptive event P2 obtained the lowest savings with a 16% drop in the expected annual cost after activating preventive action P2.1. Future research directions will be addressed to investigate how to deal with problems in which the activation of the preventive actions defined by a specific disruptive event could affect/benefit other disruptive events. In other words, a preventive action applied to a specific disruptive event could also be linked to other disruptive events. In the case proposed herein, each preventive action is unique and applies to only one disruptive event. However, further research should focus on (i) the relations between a specific preventive action and different disruptive events; and (ii) how the activation of such preventive action could affect the different disruptive events linked to it. Moreover, the proposed algorithm could be further improved to take into account the impact of (de)selecting an action on the attenuation of other actions.
Finally, further research lines aim to define an heuristic algorithm to optimally sequence and prioritize the activated preventive actions to be executed by taking into account factors such as the number of disruptive events that benefit from a preventive action activation, the impact that the activation of a preventive action has in the other disruptive events, the costs for the activation/implementation of such actions, the availability of enterprise resources over time, among others.

Conclusions
Enhancing the ER capacity leads to significant savings in expected annual costs by activating preventive actions that improve the preparedness capability, one of the main pillars of the ER capacity. This article shows a realistic problem in which an enterprise has to analyze four potential production problems and how different preventive actions can improve its preparedness and, in turn, its ER capacity. To do so, the dynamic programming approach, more specifically, the knapsack approach, was used. Its simplicity, flexibility and rapidness make the dynamic programming approach a powerful method for solving problems related to ER capacity enhancement. Moreover, special problem characterization features, e.g., activating a combined set of preventive actions for the same disruptive event, are taken into account by defining an attenuation parameter and algorithms that iterate different attenuations until the optimal solution is achieved.
Finally, it is worth mentioning that this approach could be applied to any set of disruptive events that an enterprise wishes to analyze. Once that the enterprise identifies the disruptive events they are interested in analyzing, a compilation of different preventive actions per disruptive event should be defined and in light of this, the problem should be quantified and solved following the foundations of the example shown in Tables 4 and 5, respectively. In this case, the main objective has been to enhance the preparedness capability in order to build resilient enterprises. However, any enterprise capability such as sustainability, robustness, etc. could be analyzed and, in turn, improved based on this approach.
Author Contributions: This work is part of the research of R.S., supervised by R.P. R.S. defined the conceptual framework based on a set of disruptive events with the potential preventive actions to improve the preparedness capability. She also defined a realistic problem to illustrate the research and modeled such a problem with a dynamic programming (knapsack) approach. R.P. supported the definition of the attenuation parameter and the algorithms to obtain the optimal solution. Likewise, he revised and oversaw all the issues related to this research as well.