Exogenous Shocks and Business Process Management

Disciplines such as disaster risk science, supply chain management, finance, and economics have already discussed exogenous shocks as well as various related terms. Shi (2019), for example, introduces a framework for studying hazards, disasters, and risks that incorporates a temporal and a process perspective, providing a comprehensive classification of natural or human-induced hazards (i.e., processes or phenomena that may have negative impacts on the economy, society, and ecology) based on their causes and intensity. Disasters, which are direct or indirect consequences of hazards, can lead to crises. Doern et al. (2019) characterize crises as extreme, unexpected, and unpredictable events that create challenges for organizations and require urgent responses. Such crises can be differentiated according to their origins, triggers, scale, and impacts. Based on an extensive overview of the crisis literature, Kuipers and Welsh (2017) distinguish various crisis types (e.g., armed conflict, health, terrorism) and associated themes (e.g., risk, preparedness, decision-making). They conclude that the crisis literature is mainly concerned with natural disasters, preparedness as the predominant theme, and managerial actions to mitigate the negative effects of crises. Björck (2016) consolidates existing crisis typologies based on dimensions such as predictability, controllability, and impact. In line with the concepts just introduced, the term “exogenous shock” is also present in the literature in multiple contexts: primarily economic, political, and financial.

Exogenous shocks have been defined by the International Monetary Fund as “sudden event[s] beyond the control of the authorities that [have] a significant negative impact on the economy” (Geithner 2003, p. 4). They conceptualize crises by emphasizing the external origin of the shock-generating event. A similar concept is that of black swans, referring to highly improbable events with high impact (Taleb 2010). To the best of our knowledge, there is no framework or typology unifying the above-mentioned terms. Rather, the concepts used in the literature reflect subtle nuances concerning the exact nature of relevant events and organizational responses.

Since there is no established understanding of exogenous shocks across disciplines, we define them as unanticipated, low-likelihood, potentially high-impact events originating from an organization’s environment (Chakrabarti 2015). Thus, exogenous shocks pose risks (or opportunities) that cannot be fully predicted in advance (Trkman and McCormack 2009). Their occurrence requires substantial organizational reorientation (i.e., simultaneous and discontinuous shifts that transform structures, processes, and control mechanisms (Li and Tallman 2011). Even if organizations account for exogenous shocks, they may de-prioritize them in their risk management strategies, as risks are usually managed based on multiplying their probability with their expected magnitude of impact – and individual exogenous shocks have very low likelihoods (Zsidisin et al. 2004). In the long term, exogenous shocks may force organizations to realign their processes, structures, and strategies to fit the new environment shaped by the exogenous shock.

According to the literature, we posit that exogenous shocks may arise from events of diverse origins (e.g., natural disasters, political crises, healthcare crises, or military conflicts). Importantly, in this research note, we view exogenous shocks from a single organization’s perspective. Thereby, we account for contextual characteristics (Morgeson et al. 2015), meaning that the magnitude and direction of the impact of shock-generating events depend on industry factors and organizational conditions (Li et al. 2017; Li and Tallman 2011). Events that constitute exogenous shocks for one organization or industry may be of marginal or no importance for others. An example is China’s accession to the World Trade Organization in 2001, which specifically led to a significant restructuring of the Portuguese footwear industry and constituted an external shock for related organizations (Corbo et al. 2018). However, the same event may have been of marginal importance for a German restaurant chain.

In terms of impact, events that constitute exogenous shocks according to our definition have been studied in diverse fields (e.g., [macro-]economics, supply chain management, and information systems; (Fedorowicz et al. 2004; Fridgen et al. 2015; Lyytinen and Newman 2008; Singh et al. 2020; Lee 2004). From an economic standpoint, exogenous shocks may entail long- and short-term unfavorable internal conditions, e.g., a loss of human capital causing the unavailability of productive skills or technical knowledge (Noy and Nualsri 2007; Geithner 2003). Some effects of exogenous shocks may be permanent or long-lasting, while others may be temporary. Furthermore, exogenous shocks can substantially impact an organization’s core business or target markets, limiting its access to vital resources or its ability to pursue growth opportunities (Chakrabarti 2015). Most often, an organization’s “old normal” business logic cannot be continued, and a “new normal” must be established (Gersick 1991). Overall, exogenous shocks affect organizations by forcing them to adapt their strategies, business models, structures, and business processes to react to changing conditions and avoid extinction (Martins et al. 2015).

Next to the impact of exogenous shocks, there is ample research on preparing for, responding to, and recovering from unfavorable conditions brought about by exogenous shocks. As the umbrella term, crisis (or disaster) management reflects a continuous process that deals with decision-making, operational activities, actors, and technologies along the three phases of a crisis/disaster (i.e., pre-crisis, crisis, and post-crisis) (Lettieri et al. 2009; Khan et al. 2008; Pearson and Mitroff 1993). Thereby, mitigation and preparedness are the main topics in the pre-crisis stage, disaster response in the crisis phase, and recovery as well as organizational learning in the post-crisis phase (Lettieri et al. 2009; Bundy et al. 2017). In terms of preparedness, organizations strive for resilience, which is a key concept referring to the maintenance of positive adjustments under challenging conditions such that organizations emerge from those conditions strengthened and more resourceful (Vogus and Sutcliffe 2007). Organizational resilience has been extensively studied from multiple perspectives (i.e., capability, process, functional, results) (Chen et al. 2021; Hillmann and Guenther 2021). Examples include investigations on the relationship of resilience to concepts such as flexibility and coping capacity (Karman 2020), defining resilience as an organizational meta-capability (Duchek 2020), and creating conceptual frameworks for the establishment of resilience (Tasic et al. 2020; Kantur and İşeri-Say 2012). As another key concept, high-reliability organizations have emerged as a research stream that examines organizations successfully operating almost error-free even in hostile environments (Roberts 1990; Sutcliffe 2011). In this regard, the idea of collective mindfulness has emerged as heightened alertness to changes/surprises which prioritizes safety over efficiency (Salovaara et al. 2019; Weick et al. 1999). In terms of responding to disasters, business continuity management has been proposed as an approach to identifying, managing, and mitigating risks that may disrupt essential processes and services (Gibb and Buchanan 2006). Moreover, a disaster contingency plan is an essential part of a business continuity plan and includes procedures to perform when disasters occur (Cerullo and Cerullo 2004). Crisis response has also been studied from a human resource viewpoint, with strategic human resource development (HRD) being proposed to enhance the operational capabilities during and capacity to learn after a crisis (Wang et al. 2009). In the post-crisis phase, organizational learning has been investigated in terms of organizations’ ability to derive insights from tackling disasters/crises (Broekema et al. 2017). Thereby, promoting organizational learning also prior to and during crises has been shown to generate favorable effects in all stages of crisis management (Wang 2008).

While the mentioned approaches do not fully cover the multi-faceted nature of research on crisis management and related approaches, they provide an overview of important research streams related to organizations’ preparedness, response, and recovery from crises/disasters. Thus, they are also highly relevant in the context of exogenous shocks as a specific form of crisis. We revisit the topics listed above in Sect. 6 when discussing the implications of our results for BPM and related research areas.

BPM is the science and practice of overseeing how work is performed to ensure consistent outcomes and capitalize on improvement opportunities (Dumas et al. 2018; van der Aalst 2013). It “consolidates how to best manage the (re-)design of individual business processes and how to develop a foundational capability in organizations catering for a variety of purposes and contexts” (vom Brocke and Rosemann 2015, p. viii). BPM is commonly structured through capability frameworks that include capability areas conducive to establishing process orientation in organizations (Poeppelbuss et al. 2015; Rosemann and vom Brocke 2015; Van Looy 2020). One of the most widely adopted BPM capability frameworks is that of de Bruin and Rosemann (2007), which groups capability areas according to six core elements of BPM – strategic alignment, governance, methods, information technology (IT), people, and culture – that have been extensively used in BPM research (Van Looy et al. 2017; Kerpedzhiev et al. 2020; vom Brocke and Mendling 2018). Table 1 provides brief definitions of these core elements, which we use to structure the challenges and opportunities of exogenous shocks for BPM.

In the BPM context, exogenous shocks represent a specific form of process change. According to the BPM literature, various types of process change can be distinguished based on dimensions such as intentionality, frequency, scope, degree of change, duration, or performance effects (Grisold et al. 2019; König et al. 2018). To differentiate exogenous shocks from other types of process change and to specify its effects on processes, we focus on the intentionality and degree of change dimensions, perceiving process change as either intentional or unintentional and as incremental or radical. Table 2 combines both dimensions and lists examples, which have been studied to a varying extent in the literature.

Beginning with intentional change, business process reengineering is an example of radical change (Hammer and Champy 2006), whereas continuous process improvement (e.g., lean management) implies incremental change (Davenport 1997). The distinction between radical and incremental process change is also considered in the literature on ambidextrous BPM in terms of process exploration (opportunity-driven, radical change) and exploitation (problem-driven, incremental change) (Rosemann 2014; Grisold et al. 2019). Process drift, which is related to the gradual change of processes (van der Aalst et al. 2012; Pentland et al. 2020; Beverungen 2014), is an example of unintentional, incremental process change.

In contrast to the other types of process change, unintentional radical process change, which could result from an exogenous shock, has received little attention in BPM research. However, two important related concepts established in BPM research are process resilience and agility (Chen et al. 2014; Antunes and Mourão 2011; Rosemann 2020; Gilbert et al. 2012). Process resilience relates to flexibility-by-design (i.e., the ability to incorporate alternative execution paths and fast change ad-hoc at design time; Schonenberg et al. 2008) and, thus, facilitates the organizations’ preparedness to address exogenous shocks. In contrast, process agility is associated with flexibility-by-deviation, allowing organizations to quickly react to environmental changes by deviating from prescribed process execution paths at runtime. Thus, both concepts directly relate to the pre-shock and in-shock phase and are cognate with the concepts mentioned in Sect. 2.1. Further, BPM research has also addressed organizational learning and knowledge management (Shelagowski 2015; Jung et al. 2007; Choi et al. 2004). Despite their potential to support and enrich the knowledge base regarding the handling of exogenous shocks throughout all phases, the mentioned concepts from the BPM literature have not been investigated in relation to exogenous shocks yet. Therefore, we set out to explore the intersection of BPM and exogenous shocks as a form of radical, unintentional process change against the background of relevant concepts from related disciplines. While we do not claim exhaustiveness, Table 3 provides a simplified overview of the discussed BPM concepts and those from Sect. 2.1 regarding their primary relevance prior to, during, and in the aftermath of exogenous shocks. Thereby, an unambiguous mapping of the concepts is unfeasible since they cover a wide spectrum of ideas, which normally has implications for all phases.

Owing to exogenous shocks, the alignment between business processes and BPM capability, on the one hand, and organizational strategy, on the other, becomes strained. Exogenous shocks can render existing strategies obsolete and enforce an adaptation of business models and processes; for instance, the COVID-19 pandemic has caused educational institutions to quickly adopt online platforms and come up with new educational offerings (Seetharaman 2020). Organizations have different priorities regarding their objectives in the pre-shock (I), in-shock (III), and post-shock (V) phases, but existing processes typically no longer meet the right business objectives. Moreover, since exogenous shocks can render organizational strategy obsolete, both process and BPM objectives must be scrutinized. Building on these observations, we propose two challenges and opportunities for BPM.

After an exogenous shock (i.e., beginning with the pre-shock–in-shock transition [II]), existing decision-making processes and authorities are confronted with highly uncertain and volatile environmental conditions, which nevertheless require fast and concerted action. An extreme example is the Fukushima nuclear disaster in 2011, which required urgent decisions with enormous consequences in a highly uncertain environment (Travadel 2017). In such situations, established roles change due to the need for rapid process adaption, and process performance indicators lose their relevance or become ineffective in the in-shock phase (III). This poses challenges and opportunities for BPM practitioners.

Organizations do not normally rely on dedicated methods when reacting to exogenous shocks. Rather, they try to find ad-hoc solutions for upcoming problems. This was partially the case in several of the major space shuttle disasters NASA faced, in the wake of which the agency embraced some new safety procedures (Donahue and O'Leary 2012). However, ad-hoc solutions are not the product of properly managed projects but of taskforces solely focused on an organization’s survival (e.g., aimed at reducing the initial drop in performance brought about by the shock [II]). Thus, exogenous shocks present challenges and opportunities for organizations from a BPM methods perspective.

Information technology (IT) that supports process execution can contribute to or impede process agility and resilience; for example, GeoWeb technologies have been used by various organizations to help deploy emergency-related Web applications for visualizing the impact of natural disasters such as hurricanes and widespread fires (Roche et al. 2013). Process change implies changes in information systems, which can be achieved through process-aware technology or large-scale IT change. BPM-related information systems commonly used to support the design, modeling, or monitoring are only partially useful in the in-shock phase (III); therefore, BPM is facing the following challenges and opportunities.

Exogenous shocks are not only a challenge to organizations at large but also to process participants (including process managers); for instance, human resources managers of companies affected by the attacks of September 11, 2001, had to make potentially existence-threatening decisions regarding moving work locations and/or hiring additional staff to ensure stable operations (Sayegh et al. 2004). In such cases, people need to rapidly find and sustain new ways of working, which places employees under pressure, since training for and during exogenous shocks is often not possible. Thus, exogenous shocks present BPM with challenges and opportunities from a people-oriented perspective.

Organizational and BPM culture becomes strained by an exogenous shock. For instance, the fundamental shift in the smartphone market due to the introduction of the iPhone in 2007 caused widespread fear and a disconnect between top and middle management at Nokia (Vuori and Huy 2016). A culture of high commitment to existing but obsolete objectives may cause problems if an exogenous shock occurs, while commitment to measures for coping with the shock is important; hence, BPM practitioners face challenges and opportunities regarding BPM culture.

As for the core element strategic alignment, BPM has the potential to complement organizational resilience through a process-based approach (O2). Some research initiatives already aim at investigating the connection between resilience and information systems in general (Müller et al. 2013) with the intersection of BPM and resilience also being explored (Zahoransky et al. 2015; Antunes and Mourão 2011). BPM research should build on such works to establish guidance regarding the identification and assessment of critical processes in line with corporate strategy, which should be resilient to sustain essential organizational functions in the event of exogenous shocks. In this regard, examining established approaches related to process prioritization can be very valuable in determining processes’ criticality both individually and based on their interconnectedness (Lehnert et al. 2018; Kreuzer et al. 2020).

In the wake of exogenous shocks, established business strategies and processes can become obsolete (C1). Hence, organizations may need to re-evaluate the maturity of their BPM capabilities. Building upon prior publications (e.g., Poeppelbuss et al. 2015), BPM research should guide organizations in developing capabilities to achieve a new BPM/strategy fit. Moreover, organizations experience dysfunctional processes and must balance between a swift recovery of core processes and the development of long-term process improvement strategies to address the medium- and long-term impact of shocks. The magnitude of shock effects across all phases is an important context factor for prioritizing process improvement initiatives (C2). Therefore, research on process performance metrics should be geared toward exogenous shocks and reflect strategic priorities (Van Looy and Shafagatova 2016; Estrada-Torres et al. 2019). Moreover, BPM research should help organizations explore value propositions that fit the “new normal” (O1) in the post-shock phase. Related approaches may build on existing process-led value propositions (e.g., Johannsen 2018) as well as on findings from explorative BPM to guide the derivation of new value propositions (Grisold et al. 2021).

Our results have several implications from a governance perspective. To begin with, exogenous shocks require switching between context-sensitive governance models that consider external and internal factors (C4, O3). As outlined in Sect. 2, such an approach requires an understanding of different types of exogenous shocks. For example, while shocks such as the Fukushima nuclear disaster had a major impact, the duration and nature of that shock differ greatly from that of the COVID-19 pandemic. In this regard, BPM research can build upon existing typologies of crises, e.g., from Kuipers and Welsh (2017), to distill shock archetypes requiring similar BPM approaches. Moreover, the phase model from Fig. 2 is also context-sensitive, meaning that the magnitude and duration of effects depend on internal and external factors (e.g., an organization already operating in a highly uncertain environment may respond better to shocks). In this regard, context-aware BPM has been recognized as an important topic area and extensively studied (vom Brocke et al. 2015; vom Brocke et al. 2021a; Santoro et al. 2017). BPM research should extend this idea to identify contextual factors relevant for exogenous shocks and investigate their influence on BPM and process governance (Kerpedzhiev et al. 2020). By identifying context-sensitive BPM governance models depending on shock archetypes, BPM can also contribute to extending and operationalizing crisis response according to established disaster taxonomies and typologies (Kuipers and Welsh 2017; Björck 2016).

In terms of the need for new governance setups in the context of exogenous shocks (C3), understanding the relationship between process flexibility and organizational resilience is key. Even though flexibility and resilience are not identical concepts, current research on resilience shows that both concepts are positively linked (Duchek 2020; Karman 2020). In this regard, BPM must clarify the role of workarounds and process deviance, which have received significant attention in recent BPM research (König et al. 2018; Alter 2014; Beerepoot et al. 2019; Weinzierl et al. 2021). One of the identified opportunities relevant to BPM governance is the occurrence of positive deviance, which should be identified and scaled (O10). However, without clear guidance deviance entails risks. Thus, BPM research should develop frameworks that examine appropriate conditions, processes, and levels of deviance in the context of exogenous shocks.

The challenges and opportunities related to the core element methods imply that BPM should extend its methodological base to appropriately cover exogenous shocks. As mentioned, the priority in dealing with exogenous shocks is given to the immediate organizational response and maintaining business continuity. Business continuity research has not only recognized the need to enhance the preparedness for incidents but also to support organizations in responding to them (Niemimaa 2015). Translated to the BPM context, organizations need to take quick actions in the in-shock phase to address nonfunctional processes and critical process performance. This entails the need for agile BPM approaches, methods, and systems that allow for bottom-up design, implementation, and rollout of new processes (C5) as well as to support change management initiatives (C6). Thus, existing research on agile BPM methods should be extended to the use case of short-term handling of exogenous shocks (Thiemich and Puhlmann 2013). In addition, BPM must support organizations in resource allocation and decision-making regarding balancing short-term emergency handling and far-reaching, strategic process change (C2). Thereby, established ideas in BPM research such as process project portfolio management as a means to balance process improvement and BPM capability development (Lehnert et al. 2017) can be adopted to the case of exogenous shocks.

As for the design of resilient processes (O5), actionable process-based mechanisms that enable process resilience are needed (e.g., Antunes 2010). Such mechanisms could build upon existing works regarding process flexibility and enable integrating redundant/alternative process paths for critical processes. Thereby, as mentioned in Sect. 2, flexibility-by-design and flexibility-by-deviation are of interest in enhancing the resilience of business processes at design- and run-time (Schonenberg et al. 2008). By using business processes as the unit of analysis, BPM can contribute to instrumentalizing organizational resilience – a challenge, which has been recognized in the corresponding research stream (Annarelli and Nonino 2016).

Finally, existing approaches in measuring resilience (Chen et al. 2021) can be strengthened through a BPM lens to achieve real-time process resilience monitoring and an appropriate ex-post evaluation (O6). The latter could be supported by process mining methods, which deliver insights into process vulnerabilities based on event log data (Koslowski et al. 2013).

Our results also have implications on IT-related BPM topics. In conjunction with the opportunity regarding process automation (O7), BPM research should address the potential of digital technologies for dealing with sudden and unexpected events. Some research initiatives initiated in the wake of the COVID-19 pandemic show promising results regarding the potential of digital technologies in enhancing organizational resilience (Syed et al. 2020; Marques da Rosa et al. 2021; Marcucci et al. 2021; Kregel et al. 2021). In the context of BPM, digital technologies can help make processes more responsive and potentially more predictive regarding changing external conditions. Therefore, BPM research should build on existing initiatives regarding the exploration of the opportunities offered by digital technologies (Denner et al. 2018), specifically in enhancing real-time monitoring and prediction of disruptions as well as process transparency (C8, O8) (e.g., Ivanov and Dolgui 2021).

Further, rapid process change resulting from exogenous shocks requires flexible IT architectures (C7). In this regard, process-aware information systems have already been researched with a focus on flexibility and the handling of declarative process models (Reichert and Weber 2012; Di Ciccio et al. 2017). Research on such systems could be informed by works on high reliability organizations, which address the “frame problem” concerning the inability of algorithms to adapt to conditions outside their developers’ cognitive frame (Salovaara et al. 2019) and in general have the ability to reduce process agility (Plattfaut and Borghoff 2022). At the same time, exploring the development and validation of process-aware information systems considering existing frameworks for resilient BPM (e.g., Antunes and Mourão 2011) can help better understand the role of IT in crisis management (Sakurai and Murayama 2019).

From a people perspective, BPM research should first evaluate the possibility of transferring skill portfolios as well as communication and training models (C9) from the human resources and emergency management domains. Second, BPM can help structure and sustain organizational learning efforts. In this regard, works on organizational learning in the context of crises (e.g., Antonacopoulou and Sheaffer 2014) can be combined with approaches at the intersection of knowledge management and BPM (e.g., Jung et al. 2007; Choi et al. 2004) to provide guidance for fast organizational learning and knowledge dissemination in the case of exogenous shocks. Thereby, BPM also has the potential to provide a systematic approach to learning and ensure that shock-related knowledge including newly acquired competencies (O9) remain available in the post-shock phase.

Apart from the implications on training and knowledge management, facing non-functional processes may put employees under pressure (C10). In this respect, the pivotal role of HRD has been recognized in guiding organizations through crises (Wang et al. 2009). Therefore, BPM research should evaluate how to adapt results from HRD, such as leadership behavioral patterns and styles, thus contributing to shaping requirements for process leaders in times of exogenous shocks (Dirani et al. 2020; Bowers et al. 2017).

In terms of culture, BPM and crisis management research alike should examine to what extent established BPM cultural values (i.e., customer orientation, excellence, responsibility, and teamwork (Schmiedel et al. 2015)) are neglected, strengthened, or substituted in the event of exogenous shocks (C11). This also holds true for additional more specific values, beliefs, and experiences relevant during and in the aftermath of exogenous shocks (e.g., willingness to innovate, attitude to errors, trust in data, prioritization of employees’ well-being) (O12). BPM research should also investigate the extent to which these values and beliefs are sustained after a shock and deliver insights into their integration into a “new normal” culture to boost post-shock process performance. As an example, exogenous shocks can trigger increased mindfulness about the fit of existing processes in the context of external changes, which in turn boosts an organization’s intrinsic process-related flexibility (Baiyere et al. 2020). Finally, transferring approaches from organizational unlearning can prove useful in shaping a process culture open and willing to drop existing routines (C12) (Tsang and Zahra 2008). Organizational unlearning and similar approaches related to reassessing learned and established routines can also be beneficial in communicating and implementing future radical process changes independent of exogenous shocks (O11), e.g., in light of digital innovation (Mendling et al. 2020).

On top of the afore-mentioned implications regarding the core elements of BPM, we also pose that BPM research should explore specific shock-related capabilities. Current research has shown that transformative phenomena such as digitalization require novel BPM capabilities (Kerpedzhiev et al. 2020). Most likely, this holds true for exogenous shocks as well. Hence, more research is needed to identify which existing and additional BPM capabilities are required to cope with exogenous shocks across all phases successfully. To that end, the phase model presented in Fig. 2, together with the six core elements of BPM, form a matrix-like structure that may guide researchers in identifying new BPM capabilities related to exogenous shocks.

As an overarching insight, it has become evident that BPM and crisis management can considerably benefit from one another in manifold areas. In line with the propositions in the recent call for the establishment of process science (vom Brocke et al. 2021b), we pose that business processes can serve as a reasonable lens for understanding, analyzing, and managing organizational change induced by exogenous shocks. Therefore, we encourage the BPM, crisis management, and related research communities such as organizational resilience and high reliability organizations to evaluate specific opportunities for cross-discipline knowledge transfer but also to leverage corresponding synergies.