The stand­ard prac­tice of con­duct­ing a Busi­ness Impact Ana­lysis (BIA) to determ­ine the basic recov­ery require­ments (Mission Crit­ical Pro­cesses, RTO’s, RPO’s, Crit­ical Applic­a­tions, Sup­pli­ers, and other Resources) is a vital phase of every Busi­ness Con­tinu­ity Man­age­ment program.

The BIA process can be long and dif­fi­cult — no matter what data col­lec­tion method is used. Is the return on your BIA invest­ment (time, man­power and resources) offset by the value of the results?

If a BIA is a fun­da­mental part of BCM, the under­ly­ing cost may simply be a neces­sary evil. But, when a BIA is a one-time ‘project’ — as in many organ­iz­a­tions — is the cost real­ist­ic­ally pro­por­tional to the value?

Some organ­iz­a­tions conduct a BIA expect­ing to repeat the process at regular inter­vals. However, once the initial BIA is com­pleted and the true cost known, such expect­a­tions are often abandoned.

Focus on change

Failure to update a BIA is a leading cause of Recov­ery Plan failure. Change is the only con­stant in busi­ness. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.

Intend­ing to update a BIA is easy; yet the update process often fails.

Con­sider the effort required to com­plete the ori­ginal BIA: ques­tion­naire pre­par­a­tion, dis­tri­bu­tion and col­lec­tion; inter­views to “nor­mal­ize” the results, plus the cost of ana­lysis and report generation.

Often, the ori­ginal BIA process “project”, may take three to eight months. Sig­ni­fic­ant busi­ness changes make the pro­spect of repeat­ing that lengthy process daunt­ing. Post­pon­ing the update may be ration­al­ized. Like most things in life, post­pon­ing dif­fi­cult tasks allows them to grow more unwieldy.

To stream­line the process, the updated BIA must focus on the changes — rather than repeat the entire process. It is likely that much of the inform­a­tion from the earlier BIA is still valid. The update process simply entails drilling down to which busi­ness pro­cesses have changed, and how those changes affect the ori­ginal BIA results. Of course, the method used to conduct the earlier BIA will determ­ine just how easy — or how dif­fi­cult — the update process becomes.

In Inform­a­tion Tech­no­logy, an updat­ing process is gen­er­ally ongoing (Change Man­age­ment) because IT changes have a direct impact on daily oper­a­tions. In busi­ness oper­a­tions, changes occur reg­u­larly, but are seldom, if ever, doc­u­mented. (To be fair, no matter how robust the IT program, not every organ­iz­a­tion con­sist­ently cor­rel­ates its Change Man­age­ment inform­a­tion with its DR Plan.)

The Whole is Greater than the sum of its Parts

Is it suf­fi­cient for indi­vidual busi­ness process “Owners” or func­tion leaders to update their own crit­ical resource require­ments? Yes, if the update method allows for the capture of changes in enterprise-wide depend­en­cies (on other pro­cesses, applic­a­tions, etc.). But no effect­ive update can be con­duc­ted in a vacuum; any change to crit­ical depend­en­cies or resources is likely to have a cor­res­pond­ing affect upon those depend­ent processes.

While it may be effi­cient for a process team to update its own BIA, only by col­lect­ing and integ­rat­ing changes across the enter­prise can the true impact of busi­ness changes emerge.

The Path of Least Resistance

Fre­quently, the cost of updat­ing a BIA (in man­power and time) is per­ceived as unjus­ti­fi­ably high. Not updat­ing a BIA may become an accep­ted risk. BCM man­age­ment may opt to focus on BC/DR Plan updat­ing (assum­ing most process owners under­stand the impacts of change and will modify their Plans appro­pri­ately) without revis­ing the BIA. The more bur­den­some the BIA process, the higher the propensity not to repeat it.

Once made, such a decision often becomes insti­tu­tion­al­ized. Later, the failure to reflect fun­da­mental changes in the organization’s struc­ture may result in flawed Plans and a failed recov­ery. With luck, flaws show up in a test or exer­cise — not a real life incident.

What’s in your Toolbox?

Does your exist­ing BIA format lend itself to manip­u­la­tion? Or do you have to start from scratch? Do you use soft­ware that integ­rates BIA and Plan development?

Does the BIA format lend itself to the use of col­lab­or­at­ive tools? Can busi­ness process owners gain access to the ori­ginal BIA survey? Network– or Web-based col­lab­or­at­ive tools reduce the pain of updat­ing a BIA, while enabling mon­it­or­ing and audit­ing of the process by the BCM leaders or planners.

Assess your options, and pick a BIA updat­ing method that works best for your situ­ation. It may not be free, it may be time-consuming, and it may not be pain­less. But it will pay dividends if you have a dis­rupt­ive event.

An out-of-date BIA expo­nen­tially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA inform­a­tion, the valid­ity of Plans should be ques­tioned, and their suc­cess­ful exe­cu­tion must be suspect.

eBRP Solu­tions, Inc