The Critical First Steps of Your Business Continuity Plan
by Aaron Nelson on January 13, 2015
Businesses have always existed in an environment that includes changes and unexpected events. In the event of a disaster, a successful business impact analysis (BIA) should identify the critical processes and resources needed for the business to continue to function at different levels. A BIA is the cornerstone of an organization’s disaster recovery (DR) strategy and business continuity plan (BCP) and will identify the processes, systems, and functions that are critical to the survival of your company. The following suggestions will help you create a BIA that works.
Use a BIA questionnaire to survey managers and others within the business. Survey those with detailed knowledge of how the business manufactures its products or provides its services. Ask them to identify the potential impacts if the business function or process that they are responsible for is interrupted.
In addition to the questionnaire, it’s a good idea to conduct interviews in person. The best results are achieved when someone skilled in business continuity performs an interview with the person responsible for a critical activity. That way, a lot of unresolved questions are cleared and well-balanced answers are achieved. If interviews are not feasible, do at least one workshop with all the participants so they can ask everything that is troubling them.
While a BIA questionnaire will invariably contain both qualitative and quantitative questions, veering toward quantitative data will make analysis easy. For instance, documenting the gross revenue and net profits of the business unit help fix upper limits for the potential losses in the event of shutdown. In addition, merging all the data into a spreadsheet or database simplifies data analysis and makes reporting easy. For this step, you may want to consider using data integration, which is a process that standardizes different definitions and structures of data into one common, easily accessible framework.
Look for and identify all threats in a company’s environment. Such threats can include natural disasters, unexpected developments in the supply chain, and strategic moves by competitors. At this stage in the analysis, it is important to list all threats, detail the nature of the threat, and describe why you consider the event a threat.
Risk and Impact
A company may face many threats, but only a few constitute real risk. Evaluate the size of the threat together with its likelihood. BIA evaluates risk in combination with company vulnerabilities. A good tip for the impact analysis is to examine your list of events for those that have a major impact on the company. You can drop the items to which the company is not vulnerable and list the rest in order of importance based on risk and impact on company operations.
Once all that information is pulled together, you will have a view of everything the company does, what impact it would have if the function could not be performed, how quickly that impact would be felt, and how significant the impact will be. This information is the start of what you need to develop the appropriate recovery strategies for each area of your business. Your BIA report should document the potential impacts resulting from disruption of business functions and processes. Scenarios resulting in significant business interruption should be assessed in terms of financial impact, if possible. These costs should be compared with the costs for possible recovery strategies.
Understanding these elements allows you to allocate resources wisely to ensure operations even with unexpected events disrupting normal business. By keeping the above suggestions in mind, you can create a BIA that reveals any vulnerabilities and will allow you to develop strategies for minimizing risk.