Business Impact Analysis

Lootok's focus when conducting a Business Impact Analysis (BIA) is to engage participants in understanding the objectives and end results of the process, and to focus on gathering meaningful data and facilitating discussions around resiliency. Many business continuity programs involve an endless cycle of data collection and planning that becomes frustrating and useless to everyone involved. The formalities of such a process can swallow up the thinking, learning and decision-making that are needed for effective incident response. We broaden the narrow focus on exhaustive documentation by fostering intelligent decision-making and leadership growth of those involved.

The Business Impact Analysis (BIA) is a business continuity process that helps companies do the following:

1. Prioritize business processes and resources by time-sensitivity and criticality
2. Identify gaps in the organization's ability to recover these critical processes
3. Highlight vulnerabilities and inefficiencies in both operations and recovery processes

A quality BIA will help the organization understand its recovery priorities ahead of time, allowing for efficient resource allocation during an incident, and implement strategies necessary to cover any gaps in the ability to recover. BIAs are typically conducted through the following methods: conducting individual interviews with senior management and department heads; facilitating workshops that bring senior management and department heads together for discussion; providing surveys or forms for these managers to complete.

Lootok's recommended way to complete the BIA involves aspects of all three methods. We believe the group discussions that happen in a workshop are critical at both the beginning and conclusion of the BIA, in order to ensure alignment of all parties' priorities and conceptions about the recovery process. Personal interviews with our business continuity experts help ensure quality of information and guidance of managers into considering vulnerabilities and business processes in a new light. Surveys can also be a valuable way to collect straightforward data in an efficient manner.

Unlike that of traditional business continuity firms, Lootok’s methodology is based on the recommendation that a business recovery exercise be conducted prior to the Business Impact Analysis. In our experience, this can often make a compelling case for a business continuity program and highlight areas that require immediate focus. As such, our BIA process follows this general path:

1. 1. Business Recovery/Incident Management exercise with leadership team — this helps to put team members in the mental framework of thinking about business continuity in a "real" light, while highlighting vulnerabilities and weaknesses straight off the bat.
2. 2. Kick-off meeting with senior management and all involved parties to discuss the findings of the exercise, explain how business continuity will help their organization, identify key risks, prioritize business processes, and develop a general outline of the recovery path.
3. 3. Individual interviews with department heads to gain further insight into key products, processes, services, and resources within their departments, as well as their resource requirements.
4. 4. Discussions with IT providers and other suppliers to identify capabilities of meeting recovery requirements.
5. 5. Discussion of findings with senior management/BIA sponsor and follow-up with any changes in priorities driven from the top.
6. 6. Presentation of critical path for recovery to senior management and department heads, and discussion of next steps.

The deliverables from a Business Impact Analysis include a Business Impact Analysis Report, Gap Analysis Report, and Critical Path Report. The data from the BIA can be collected and maintained in an active database system for easy future reference using the BCM Portal. The next steps after the BIA are implemention of business continuity strategies and building business continuity plans.