Conduct a business impact analysis with these tips and tools
A business impact analysis is a fairly standard part of disaster recovery planning, but nuances within your organization may affect your approach to conducting and using a BIA.
For years, the business impact analysis has been an integral part of business continuity and disaster recovery activities. BIAs can be performed simply, using Microsoft Office applications or automated tools that focus specifically on BIAs.
Since the BIA is a thoroughly covered topic, we will assume you know the basics: the information to be captured, the analysis process and how to identify the key business processes, supporting technologies, and financial and operational implications if those processes are disrupted. Our focus here is to examine the different approaches to performing a BIA and offer tips to glean the most value from those approaches.
Below, you'll find a detailed strategy for performing a BIA -- start to finish. The scenario in question is based on an actual case study and will spell out in practical terms the value of the different approaches to conducting a business impact analysis. When deciding on a BIA approach, be mindful that both manual and automated options are currently available.
One organization's BIA process
A financial organization's annual business continuity (BC) schedule called for an update to its BIA, which addressed several dozen business units and hundreds of processes. Due to a limited number of internal staff experienced in performing BIAs, the company retained a consulting firm to take the lead on the BIA activity. As they had performed a BIA two years previously, the initial approach was to reach out to business unit leaders and identify changes that might have occurred since the previous BIA.
When deciding on a BIA approach, be mindful that both manual and automated options are currently available.
This approach was deemed particularly cost-effective by the firm, as it required a minimum investment -- consulting fees only -- and would not require weeks or months to complete.
Copies of the previous BIA results were prepared. The project team planned to send them to the business unit leaders -- or their designees -- ask them to review the notes and update the data where appropriate.
TIP: One of the initial lessons learned was that several of the business unit leaders had left the company or had been moved to different departments over the past two years. The initial approach could have been compromised by the presence of new management who might be unfamiliar with previous business impact analysis results. It's important to make sure people who lead business units are familiar with their unit's operations.
Complicating what had already been done was news that the firm had executed a contract with a third-party BC software firm whose product had a BIA module. Management decided to shift the BIA activities to the new software and the associated vendor. The vendor would supply personnel to help facilitate use of the software by the project team and conduct BIA interviews as needed.
It took a few additional weeks to get the internal project team and the outside consultant up to speed with the new software. A review of the product showed it was comprehensive, was reasonably intuitive when learning how to use it, had the appearance of providing good analyses of operational interdependencies and financial implications, and provided realistic recovery time objectives (RTOs) and recovery point objectives (RPOs).
TIP: When investigating prospective BIA software tools, examine a number of products. Some may be stand-alone, while most today are modules embedded within a full-scale BC plan development tool. Consider also the growing number of cloud-based firms offering managed BC services. If they offer a BIA tool, add it to your list of prospective vendors.
The next challenge was to modify the approach for dealing with business unit managers. Noting that a number of those managers had either left the company or moved to other departments, the goal was to establish a stable database of people to interview. The original approach had been to send copies of the previous BIA to the "right" people and have them update their BIA data. While that may sound simple in theory, in practice, it can be a real challenge, especially if the "right" people are no longer available.
With the new software available, the approach was to first identify the interview candidates and then schedule them for a one-hour interview. As the software was still a bit challenging for the in-house team to grasp, the vendor provided its own staff to conduct the initial interviews.
TIP: If you're working with a software firm and decide to have the vendor conduct BIA interviews, make sure they have people who are familiar with the nuances of your business. This is important for establishing a rapport with the interviewees and also for digging deeper to identify additional issues that could be important.
Owing to its internal staff having limited experience conducting a business impact analysis, the client invited the consultants to serve as "advisers" during the interviews. While the software vendor still had the lead conducting interviews, the consultants had the opportunity to ask additional questions. This was largely discouraged, however, since the software had embedded questions, and it was not easy to add more questions. Consultants were then invited to offer their comments and observations following interviews.
TIP: When using BIA software, be sure to examine outputs from the software upon the completion of interviews. (Not every single interview -- just the first half dozen or so.) This is important to see if the results are usable and provide information regarding interdependencies, RTOs and RPOs, and other data that can help improve BC plans.
After several vendor-conducted interviews, the client began scheduling and conducting its own interviews using the software. The consultants were tapped occasionally to review the data and offer their comments.
Ultimately, the client completed the BIA interviews and used data from the software to update its BIA documents, although the format and appearance of the new reports were quite different from the previous iterations.
