Business Impact Analysis (BIA) is a key part of the Disaster Recovery Planning process. Good judgment is a part of the whole DR planning, but the specific challenge of identifying possible risks and their impact in the first place is part of the BIA. You’ll need to ask the people who know about the vulnerabilities that could affect their jobs, teams or departments. You’ll also need to do that in ways that allow you to be reasonably sure that you’ve spotted all the impacts that count and the basis that need to be covered.
Heads of department and managers are the natural place to start for BIA input. Tactics with pros and cons for getting the business impact analysis information from them include:
- Online surveys. Good for letting managers respond asynchronously to questions about business impact, i.e. according to their management agenda and other tasks. However, online surveys on their own often suffer from incomplete returns (you need a 100% return rate) and may require chasing.
- Workshops. Bring people together, can foster positive emulation and discussions. On the other hand, get strong senior management backing if you want to be avoid empty seats because of ‘other priorities’.
- Brainstorming. With a small group of people from different parts of the organisation, brainstorming sessions can help identify possible impacts that don’t always surface in either online or workshop sessions. For brainstorming to work well everybody must understand and respect the principles; and the facilitator (you or somebody else) must have the skill necessary to manage the brainstorming session correctly.
- Have Your Own List. While avoiding any idea of putting words into the mouths of others, knowing something about which main areas should be covered helps you to ask relevant questions after your contacts have given you a first ‘brain dump’. FEMA (US Federal Emergency Management Agency) suggests keeping the following potential business impacts in mind: loss or delay of sales and income, expenses, fines, contractual losses, dissatisfaction or loss of customers, and delay of new business projects.
While just doing one of the above may not be sufficient, a combination of some or all of them may well get you the business impact analysis coverage that you need.