Business Impact Analysis – a concept that is both integral to a successful business continuity program and something that strikes fear in the heart of many practitioners. A lot of organizations update their business impact analysis (BIA) grudgingly and once every year or two because it seems so onerous a task, even though the speed of business moves faster and faster and requires frequent updates if it is to be accurate.
One of the biggest barriers to having current BIA data is that we know that we have to ask business partners to give their valuable time to provide answers to a lot of questions, some of which are easier to answer than others. So, it may be time to ask yourself, how many questions does it take to get the data that you really need and will use? Through work with many clients, we have given a lot of thought to this concept and recommend that you consider a non-traditional approach.
Conventionally, we ask the business to define impact over several points in time so that we know how it escalates as a crisis continues. You might need all of this information in order to effectively plan for crisis and, if you do, you should definitely ask for it. However, if what you really want to know is the worst-case scenario for expected impacts so that you can rank your processes for order of recovery or tiering, there is probably a better way. One of the BIA System Library Configurations that the Fusion Framework offers asks only what the worst potential impact is and at what point in time it will occur (velocity of impact). To understand the data that you “lose” by not asking for impacts over time, consider the following graphic:
In this example, the dotted line represents the worst potential impact at the point-in-time where it is expected to occur (catastrophic at 1 to 2 weeks) where the solid line shows every impact at each point-in-time. As you can see, the difference in data collected is negligible, but you have only asked two questions of your business partner, rather than ten. When you multiply these numbers to represent the traditional four areas of impact (financial, operational, compliance/legal and reputational), it’s easy to see how this approach makes for a much shorter BIA interview process. Of course, to refresh your BIA as business needs change, as with all information in the Fusion Framework, you only need to update the data in subsequent years – in this case, eight total impact questions, rather than 40.
Asking fewer questions results in better answers and improved customer experience for many of our clients. So, before you launch your next BIA, ask yourself what you need to know and the most efficient way to get there. You may be surprised at how much you can simplify your approach and lessen the workload for your team and enterprise.
To learn even more about simplifying your approach with Fusion, contact us today.
Authors
