In the business continuity management lifecycle, conducting a business impact analysis (BIA) is crucial for understanding the potential impacts of disruptions. However, before diving into the BIA process, one of the key preliminary steps is identifying the right organizational level at which to evaluate business processes, capture relevant data, and engage the right subject matter experts. This can be a common challenge for those new to performing a BIA or after significant changes have been made within the organization. In this blog, we’ll explore how to determine the optimal departmental level for conducting a BIA and how to collect valuable data that drives actionable insights for management.
Defining the Key Elements in the BIA Process
First, let’s define the key elements in the BIA process.
What is a Business Impact Analysis?
A business impact analysis (BIA) is the process of analyzing business processes and assessing the effect that a business disruption might have on them. A BIA helps practitioners identify critical business processes for their organization.
What is a Business Process?
A business process is a set of interrelated or interacting activities that transform inputs into outputs. It describes the work performed to meet specific business requirements for the organization.
What are Critical Business Processes?
Critical business processes are activities or operations that cannot be disrupted or down for more than the tolerable and agreed-upon timeframe. These processes are essential for maintaining business continuity.
What is a Business Unit?
A business unit is a logical, higher segment of a company (such as human resources, finance, research and development, manufacturing) that represents multiple business functions within the organization.
What is a Business Department?
A business department is a specialized functional area within a business unit, such as treasury, tax, accounting, information security, or risk management. These departments focus on specific operational functions within a broader business unit.
The Cons of a Department Level BIA Approach
There is a danger to approach a BIA at a department level, as it can be too high of a level to capture criticality and measure the impact accurately if the department was to be disrupted or lost. With this approach, important data such as critical dependencies might not be captured fully because the subject matter expert for this level can be too high up (such as a manager or above), compared to the subject matter expert who’s performing day-to-day activities. Also, impacts could be incorrectly measured, with no way of knowing what order the processes within that department need to be recovered first, if at all, in case of disruption, as the data could be too vague.
The Risks of a Department Level BIA Approach:
- A department level BIA can be too broad to capture criticality accurately
- Key data, like dependencies, may be missed due to high-level expertise
- Impacts may be mismeasured, making process recovery unclear
- Data at this level is often too vague for actionable insights
The Cons of a Granular BIA Approach
There is also a risk of approaching a BIA in a granular approach, where the process is being broken out to activities or tasks. In this scenario, instead of performing a BIA for one business process, there are 5 activities or tasks captured for a BIA. This approach can lead to capturing too many details which would be repetitive for all 5 activities or tasks, exhausting to the subject matter expert, and feel simply overwhelming, which can lead the interviewee to associate business continuity with a negative experience.
The Risks of a Granular BIA Approach:
- A granular BIA can break processes down into too many tasks or activities
- This results in capturing repetitive details across tasks
- Overwhelming the subject matter experts can create a negative experience
- Too much detail may lead to inefficiency and frustration in the BIA process
It’s Best to Approach a BIA at a Process Level
The above graphic shows the appropriate level to do a BIA, targeting level 3 – business processes – which represents inputs transforming to outputs. For example, in the finance business unit there might be multiple departments such as controller, treasury, financial planning, and analysis, and within each department there might be one or more business processes, and within each process, there will be activities and tasks that process will have to perform to complete its job. For this example, let’s focus on the controller department, within which the business processes that could be included are accounts payable, accounts receivable, indirect purchasing support, accounting, and payroll. A BIA is performed for each of those business processes and not their activities or tasks.
Performing a BIA on the third level provides an opportunity to identify enterprise processes, measure impacts at critical points in time, capture the criticality of the profile, perform an operational risk assessment, and capture all the required resources needed for the recovery of this process, including but not limited to applications, vendors, internal process interdependencies, equipment, and resources.
What are the Key Benefits of BIA Reporting at the Right Level?
BIA reporting at the appropriate level provides valuable data, including:
- Process recovery time objectives (RTOs)
- A ranked list of processes, from most critical to those that can be deferred during a disruption
- A foundation for gap analysis
- A basis for developing effective recovery strategies for each process
When Can Business Processes Be Consolidated?
Occasionally, there is an opportunity to consolidate a few business processes into one business process if those processes are:
- Similar in nature and performed by the same subject matter expert or team
- Interchangeable and have the same impact, RTO, and resource needs (such as equipment or applications)
If these conditions aren’t met, processes should be addressed individually in the BIA.
3 Ways to Identify Processes at the Right Level
Here are three recommendations on how to identify processes at the appropriate level:
- Consult the process excellence group, which may have already started mapping processes
- Collaborate with Human Resources to leverage their organizational chart
- Conduct a process discovery to become the source of enterprise process data
Once the process level at which the BIA will be performed is identified, the next step is to identify actual business processes and carry out a BIA questionnaire with subject matter experts. To improve your data quality and user experience, please reach out to your Fusion Account Manager or request a demo to see how Fusion’s business continuity capabilities can help you streamline and get the most out of your BIA process.
If you would like help with the identification of processes for a BIA or performing BIA activities for this year, Fusion can help you. Learn more about our Fuel consulting services.
Authors
