If you want to hit a home run within your organization with your business continuity program, then you need to prepare by conducting a proper business impact analysis and learning how to avoid costly BIA mistakes.
When done right, the business impact analysis (BIA) process is straightforward, concise, and adds value to your organization on multiple fronts. When done wrong, your Business Continuity program loses credibility, leaders and their teams are frustrated, and the process ends up wasting people’s time.
To help you avoid this drastic outcome and ensure you know how to properly conduct a BIA, I’ve listed the top three BIA mistakes we have commonly seen in our engagements here at Bryghtpath.
- Not challenging recovery time objectives (RTOs)
- Not validating your BIA results
- Making BIA a “black box”
What is a Business Impact Analysis, and why should my organization have one?
A Business Impact Analysis (BIA) helps your organization understand what critical parts of your business will be impacted if there is some disruption like a hurricane, losing a key manufacturing supplier, reputational damage, a technology outage, or even experiencing a global pandemic like COVID-19.
These disruptions can negatively impact your organization’s revenue, expenses, operations, and reputation. A properly scoped Business Impact Analysis can help your organization understand the impact of a disruption on your critical business processes and guide your planning process.
A good BIA will allow your organization to efficiently prioritize your business continuity plan and help you identify potential systems and processes that may be overlooked.
Without a BIA, you will not have a solid foundation for your business continuity program and plans to rest upon, like going on a cross-country trip without a map or GPS navigation app on your phone.
How to Conduct a Business Impact Analysis
Anytime we conduct a Business Impact Analysis for our clients, we follow four simple steps:
- Scope the Need. A non-profit will have different resiliency needs than a major utility or healthcare network. The first step is to scope the need specific to the organization so we know which areas to focus on and what data should be collected.
- Prepare Your Stakeholders. The organization’s stakeholders must be prepared in advance to make the most of the BIA interview process. We also need to make sure that the right stakeholders participate in the process so we can craft plans that are responsive to the organization’s most critical risks and needs.
- Conduct the Business Impact Analysis Interviews. This is the meat of the business impact analysis, where we dig into systems, their impacts on the business, dependencies, and more to uncover their strengths and weaknesses.
- Validate and Report. We aggregate our interview learnings into a concise report that identifies key systems and business processes, recovery time objectives for each area, and important interdependencies within the organization. Then we validate it with senior leaders before it is published.
Our full guide to how to conduct a business impact analysis covers each step, including the interview questions and the impact-over-time grid.
Three BIA Mistakes Organizations Make
Not Challenging Recovery Time Objectives (RTO)
Our definition for an RTO is the overall length of time a business process can be disrupted before that disruption becomes unacceptable to the organization. In other words, how long could an organization go with payroll being down, an online product not working, or a critical system being hacked before a toll is taken on the organization? Is it minutes, hours, days, or weeks? Those are questions that need to be asked when establishing RTOs.
We have often seen businesses that don’t correctly prioritize their processes because RTOs were not challenged appropriately through the BIA process. Proposed Recovery Time Objectives that seem out of line to the impact of a disruption to the business process should be challenged and discussed during the BIA process to ensure their accuracy.
Here is the warning sign: every application is critical, every RTO is four hours or less, and nobody can rank the top 10. When you protect everything equally, you protect nothing well. Unchallenged RTOs also flow straight into IT recovery plans, which is how the gap between business needs and IT capability opens up. We cover that in Closing the Gap Between Business Continuity and IT Disaster Recovery.
Not Validating your BIA Results
We wrote an article about the process of validating your BIA but to summarize- validation is the process of meeting with key leaders to ensure that BIAs across the organization align with the most critical areas of the business. This allows your BIA to be as effective as possible.
When validating your BIA results, you will typically work with a senior leader who represents a broad business area – like a Vice President or a direct report of the CEO.
Together you will:
- Prepare what you want to share with leadership about your BIA results.
- Approach your executives about validating your BIA.
- Consider other leaders that you need to share results with.
An unvalidated BIA is the business continuity team’s opinion. Your executives will override it during the event, so get their input before the event.
Making BIA a “Black Box”
The “black box” — when the flight goes down, investigators glean through the rubble to mine this secret source of truth. Your business impact analysis should not be treated like a black box — tightly controlled, released sparingly, and only in case of emergency.
Unfortunately this is often the case. Business Continuity teams sometimes employ complex BIA formulas that are not easily explainable to business leaders or that don’t make sense in determining the criticality of a business function. Or they decide not to share the results or any other information about the BIA with others in the organization, even if the business leaders aren’t in alignment with the BIA calculations, such as the defined Recovery Time Objective for their business area.
The inputs and calculations, like recovery time objectives, impacts, and other important information used to create your BIA need to be clear, transparent, and visible among your stakeholders.
This creates a transparent and credible process that your business partners can understand, gaining additional credibility for your program.
Avoid the Mistakes, Keep the Credibility
All three mistakes cost you the same thing: credibility with the business leaders you need on your side. Challenge the RTOs, validate with your executives, and show your work.
I walked through the full BIA process on Managing Uncertainty, Episode 112: The Business Impact Analysis (BIA).
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Get help with your BIA. Our Business Continuity services include BIA facilitation, from scoping through executive validation.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
