BIA: Analysis of the inputs received to implement BIA

In any process, analysis is critical because you generate a lot of data and all data is not actionable. The analysis of the data is where the action and the mitigation take place. How do you identify patterns? How do you develop high level views? The analysis and its presentation are very crucial part of the entire effort. The information collected throughout this extensive process will be subject to evaluation and review, though the project team looks deeper into the impacts and their implications. The review is done to accomplish the following four objectives:

1. Identify impact categories – types of impacts and the analysis of those implications
2. Generate a prioritized list of business functions or processes, with the crucial ones/most impacted ones on the top of the list
3. Identify the human and technology resources required to maintain optimal levels of operations
4. Establish a recovery time frame

The next step after analysing the BIA is, coming up with areas of implications to address. Below are a few examples of the identified types of implications and its analysis:

Presenting the BIA – BIA Report

This is the last step of the BIA process. The BIA report essentially includes an Executive summary, objective & scope of the BIA, methodologies used for data gathering & analysis, detailed findings on various businesses and functions, charts to illustrate number like potential losses, and recommendations. The report prioritizes the impact of business interruptions, stipulates the legal or regulatory requirements, and details out the acceptable levels of losses and downtime, supporting documents as annexure with brief narratives and recommendation for recovery.

Here are a few recommendations that can be included while presenting the BIA report:

1. Executive summary: This should include areas/gaps identified and high-level recommendations 
2. Summary by impact areas: Each impact area needs to be discussed and presented individually. It is better to include graphs, charts, dashboard snapshots and fact sheets

Stakeholder group: Present the BIA by grouping stakeholders so that the impacts and risks identified can be categorized properly.

Conclusion:

To get maximum ROI on conducting business impact analyses, consultants must take care of a few aspects:

• When to do a BIA: Generally, we do it in the design phase, as elaborated in the introduction part of the paper, however; as the project progress sometimes the change requests demand an ongoing BIA before entering the pilot phase. However, one must be careful to figure out the availability of the SMEs/Function heads at the time of conducting the BIA else it will not help. This helps in making the necessary checks in order to avoid spill-offs.
• Use comprehensive questionnaire that is reviewed and validated well ahead of time. It is always advisable to go for a one-on-one meeting to conduct BIAs.
• Identify critical functions or processes rather than considering everything as a critical one.
• Use a standard spreadsheet to capture responses so that generating the analysis will be better and displaying results will be easier.
• To get the buy-in from the management, show them the benefits of a BIA upfront. Top management plays a very active role to help significantly reduce the organization resistance that could hinder the performance of the business impact analysis process.
• Regulations: New regulations like the General Data Protection Regulation (GDPR) may limit the usage of personal data and privacy in a few geographies. Approval from the work council is required to record the conversations on paper. One needs to be mindful while dealing with data protection across geographies.