IT Management Reference Guide

As mentioned in Part One, an important pre-requisite of an effective business continuity program is a thorough business impact analysis (BIA). But BIAs often fall short in delivering meaningful analyses that IT managers need to develop responsive recovery strategies. There are a variety of reasons that can cause this to happen, and I have listed the 12 most common of these in Figure 1. In Part One I discussed the first three of these common mistakes.

But did you ever wonder what role interviews play in a BIA? Or what steps should be taken to adequately prepare for these meetings? And how important is the design of BIA survey forms? In this second part, I provide answers to these questions in discussing the next three of common BIA mistakes, and how to best address them.

4. Poorly designed survey forms. An important step of any BIA is the collection of data from business units. The manner in which this data is asked for often spells the difference between a full, timely and meaningful collection of data, and that which is delayed and complete. One of the best ways to avoid this situation is to develop survey forms that are thorough enough to capture all relevant information and simple enough for business users to complete quickly and easily.

   Two areas that are sometimes overlooked when creating BIA data gathering forms are process dependencies and past outages. Process dependencies should include all input (upstream) and output (downstream) dependencies from and to other departments, keeping in mind that the same department may have both input and output dependencies with a single process. Participants in the survey should also respond to questions concerning any sustained outages to critical processes during the past few years. This information can help confirm or refute estimates about necessary recovery times.

   1. Lack of clearly defined scope. 2. No agreement on level of details. 3. Marginal executive support at kickoff. 4. Poorly designed survey forms. 5. Inadequate preparation for interviews. 6. Over-emphasis on value rather than urgency. 7. Too much focus on tools instead of process. 8. Ineffective interviewing techniques. 9. Little thought of risk assessment. 10. Insufficient analysis of results. 11. Tedious presentation of results. 12. No timely follow-up of results.

   Figure 1 The 12 Common Mistakes that Cause BIAs To Fail

5. Inadequate preparation for interviews. Interviews are the cornerstone of a successful BIA, yet few planners prepare adequately for them to ensure their effectiveness. Interviewers need to learn as much as they can about a given business unit prior to the meeting, including a thorough review of the respondent's survey. Interviewers not only need to do their homework concerning the information that will be discussed, but should be mindful of the logistics involved as well.

   Logistical issues consist of selecting the best time of day, and day of the week to ensure the interviewee is free of distractions, is unlikely to cancel or be interrupted, and has had adequate time and reminders to be fully prepared themselves for the interview. Some BIA analysts feel it is not responsibility to ensure interviewees are suitably prepared for the interview, but those who consistently conduct successful BIA interviews have done as much as they can to ensure the respondent is ready, willing and able to participate in an effective interview.

6. Over-emphasis on value rather than urgency. Analysts frequently make the mistake of asking business users 'what are the most important business processes within their department?' The reason this is a mistake is because virtually all critical business processes have a large degree of importance and value - otherwise they would not be designated as critical – resulting in less likelihood of it being easy to prioritize processes according to value or importance. A much better question to ask is 'how long can a business process be idle before major impact is felt? A key objective of a BIA is to prioritize business processes according to their urgency, according to how quickly impact will be felt.

   For example, in mortgage banking the processing of incoming loan payments may be viewed as an extremely important process from a financial standpoint, but it would likely be able to be delayed for a day or two in the event of a disaster. Wiring funds to close on a loan, on the other hand, may not generate immediate direct revenue but is far more urgent when not completed within a few hours because of the possibility of penalties, regulatory problems, potential loss of customers, and damage to the company's reputation. Identifying non-direct cost impact criteria such as image, stock price, penalties or loss of customers can help distinguish the differences between the value of business process and that of its urgency.

This concludes the second segment of this four part series on the 12 Common Mistakes That Cause BIAs To Fail. In the upcoming third part I will discuss the next three of these mistakes involving:

• focusing too much on tools instead of process
• failing to use effective interviewing techniques
• not including risk assessments in the BIA

Part four will cover the final three causes of BIA failures.