How to Maximize Your Business Impact Analysis (BIA)

We recently helped a client of ours discover that they could save a boatload of money (imagine a very big boat) by downsizing their on-premise data centers and moving their data to a cloud-based storage service.  As an added bonus, this discovery also helped them avoid a significant expense in updating their on-site legacy systems, as moving their data to the cloud allowed them to utilize out-of-the-box cloud-based software solutions instead.

How did we do it?

By helping them complete their first comprehensive business impact analysis, or BIA.

A lot of organizations think that the business impact analysis process is an overcomplicated, time-consuming, and unnecessary exercise in business continuity planning bureaucracy.  But this couldn’t be further from the truth.

When done right, the BIA process is straightforward, concise, and valuable to the organization on multiple fronts.

In the case of our example client, the business impact analysis process has helped them uncover the data they need to inform their technology dependencies at a very strategic level so they can start thinking differently about their availability and recovery strategies. And as a secondary benefit, they discovered they could save a lot of money in the process while also architecting new solutions that would drastically improve system availability in the face of potential disruptions.

In today’s economic environment, finding more margin in your budget is never a bad thing.

Here, we talk more about the what and why of the business impact analysis process and some of its less-recognized benefits to help you get the most out of your business continuity planning efforts.

What is a Business Impact Analysis, and Why is It Important?

A business impact analysis is a thorough examination that exposes the likely impact a business disruption will have on your company’s revenue, expenses, operations, and reputation.

On a practical level, it forms the foundation of your business continuity planning process—without the right data points, your business continuity and crisis management plans run the risk of being ill-tailored, leaving you flat-footed when the next disruption hits.

What are the steps to building a Business Impact Analysis?

When we conduct a business impact analysis for our clients, we follow a simple 4-step process.

1. Scope the Need—A non-profit will have different resiliency needs than a major utility or healthcare network. The first step is to scope the need specific to the organization so we know which areas to focus on.
2. Prepare for Interviews—The organization’s stakeholders must be prepared in advance to make the most of the BIA interview process. We also need to make sure that the right stakeholders participate in the process so we can craft plans that are responsive to the organization’s most critical risks and needs.
3. Conduct the Business Impact Analysis Interviews—This is the meat of the business impact analysis, where we dig into the systems, their impacts on the business, dependencies, and more to uncover their strengths and weaknesses.
4. Prepare and Present the BIA Report—We aggregate our interview learnings into a concise report that identifies key systems and business processes, recovery time objectives for each area, and important interdependencies within the organization.

Why is a good Business Impact Analysis so important?

Without a BIA, you’ll lack the data you need to prioritize your business continuity plan properly. At worst, you may even be overlooking critical systems and processes you never thought to include.

A great example of this is IT disaster recovery requirements.  Many business continuity and IT teams often architect inadequate solutions to their IT disaster recovery needs because they don’t work together to uncover the right data.  As a result, their projected recovery time objectives (RTO) and recovery point objectives (RPO) fall far short of what their actual needs are. When the next disruption occurs, that gap can cause significant problems in hits to reputation, revenue, and recovery expenses.

A good BIA helps you understand the full impact of a potential disruption on your organization so you can architect a plan that prioritizes your most critical systems and creates a lock-step process for their recovery.

5 Unexpected Ways a Business Impact Analysis Can Help Your Business

1.    Bridges the gap between business continuity and IT

To go into more detail on our above point, many business continuity programs don’t have a good relationship with their IT stakeholders. As a result, they don’t provide IT with the data, in both form and frequency, that it needs to accurately plan its availability and disaster recovery strategies.

Consequently, IT is often pressed to come up with their own answers to critical system requirements, such as availability, acceptable downtime, or RTO and RPO objectives. This often results in a canyon-sized gap between the recovery solutions they have and what they need. This was what happened to one of our clients whose IT disaster recovery plans for several critical systems required to support a recovery time objective of 24 hours but were built for seven days.

A good BIA process can help bridge this disconnect. It ensures that all important stakeholders, and especially IT, have a seat at the table and that the BIA process is designed to capture the data that IT needs to design an effective IT disaster recovery plan.

2.   Informs new technology dependencies

A lot of people are now working from home. But the redundancies responsive to distributed employees working from consumer-grade internet are nowhere as good as those available in a centralized office environment. The relative risks from an IT disaster recovery standpoint are vastly different in our new work-from-home and hybrid realities. The BIA process is critical to understanding how these dependencies have changed, how we diffuse new risks, and how we measure our progress over time.

On the flip side, how many people are actually using that software application that’s coming to the end of its lifecycle and will soon need to be replaced with a spendy alternative? Having visibility into how technology is being used within your organization can also improve efficiencies and your bottom line.

3.   Uncovers real estate redundancies

Similarly to how the pandemic drove the work-from-home revolution and changed how we look at IT dependencies and redundancies, it also changed our redundancies around real estate. In the past, we used to think about “If I lose a facility, what do I do with the people that worked in that facility?” Today, the most likely answer is that they just go home. This begs the question, do you even need those facilities in the first place? Data gleaned from the BIA process can help inform these decisions to help organizations re-evaluate their real estate needs and improve their efficiencies.

4.   Better identifies vendor risk

Are your business continuity plans tailored to your biggest vendors or the ones that pose the most risk? For example, while Proctor and Gamble might represent 50% of your suppliers by volume, the strength of their continuity plans is probably not a risk that you need to be worried about. The vendor you need to focus on in your continuity planning is Joe’s Trucking, who runs all of the trucks out of your Little Rock distribution center and who, incidentally, is also $8 million in debt and defending an ugly lawsuit.

Volume is not always the best proxy for risk when considering the relative risk and dependencies that third-party vendors introduce into your business continuity and crisis management planning.  It’s a common mistake that a lot of companies make. And one that can easily be avoided with a thoughtful and thorough business impact analysis.

5.   Provides insight into critical roles and staffing

When minimum viable staffing requirements for a particular function are uncovered during the business impact analysis process, it can result in some surprising insights.  Like one of our clients who discovered that 80% of the critical work carried about by a 7-person team was being mostly done by one person.

This is an important insight for two reasons:

(1) The proverbial “getting hit by a bus” problem was a big one. They needed to restructure their team to build redundancies into their function.

(2) Cost savings–If one person is doing all the work, maybe it’s time to find a place for the rest of your team to be more productive or perhaps sever them from the organization altogether.

Conclusion

Putting your BIA in place is a critical part of the business continuity planning process.  It sets the foundation for a successful crisis or disaster recovery response. It can also help solve some of the puzzles that others in your organization didn’t even know they were facing.

Want to work with us or learn more about Business Continuity?

• Our proprietary Resiliency Diagnosis process is the perfect way to advance your business continuity program. Our thorough standards-based review culminates in a full report, maturity model scoring, and a clear set of recommendations for improvement.
• Our Business Continuity services help you rapidly grow and mature your program to ensure your organization is prepared for the storms that lie ahead.
• Our Ultimate Guide to Business Continuity contains everything you need to know about Business Continuity.
• Our free Business Continuity 101 Introductory Course may help you with an introduction to the world of business continuity – and help prepare your organization for your next disruption.
• Learn about our Free Resources, including articles, a resource library, white papers, reports, free introductory courses, webinars, and more.
• Set up an initial call with us to chat further about how we might be able to work together.