Towards a framework for business continuity management : an IT governance perspective