Skip navigation

Tag Archives: Business Impact Analysis

What is your organisation’s Business Continuity planning horizon? By that, I mean what time-scale after an incident that causes disruption  do your Business Continuity Plans cover? A day, a week, a month, longer?

Every organisation that I’ve ever come across determines some kind of time limit, which is linked to the level of service that it plans to recover to. Without such a planning horizon, recovery plans would cover the complete resumption of the organisation back to its original state – which would be far too detailed and complex, and assume that nothing would change after the incident.

This planning horizon needs to be agreed at an early stage of the Business Continuity Management (BCM) process, before the Business Impact Analysis (BIA) is undertaken. This is because the BIA needs to concentrate on those activities that need to be recovered within the planning horizon. If this boundary hasn’t been put on the BIA, then a lot of time and effort will be wasted analysing every single activity.

So what? If everyone has a planning horizon then why mention it in a blog? Because it’s something that the Business Continuity industry chooses to keep secret. Try finding it is the ISO standard or the BCI’s Good Practice Guidelines. The idea of concentrating on the urgent activities in the BIA is there, but you won’t find anything about top management deciding on a planning horizon in the BCM Programme management sections. What’s everyone being so coy about?

I was attending a local Business Continuity Institute (BCI) forum the other day when someone mentioned the fact that there had been a ‘flu pandemic the other year. From a technical world health view this is correct, but from a Business Continuity (BC) perspective in the UK, I believe that this is dangerously misleading. As a consequence, I stated the view that as far as BC professionals are concerned, there was no ‘flu pandemic.

Why do I hold this view? Well, quite simply, the ‘flu pandemic did not cause any more disruption to UK organisations than the ‘flu normally does in any year. In other words, it was a “business as usual” type of disruption, which could be treated by local management as just one of those day to day issues that need to be handled. Yes, I know that lots of organisations, particularly in the public sector, convened weekly meetings of managers to monitor the situation, just in case they needed to invoke their Business Continuity plans (or special’Flu Pandemic plans), but the impact of the incident was very small.

It’s a bit like saying that an organisation suffered from a fire just because someone burnt the toast. Yes, technically there was a fire, but it would have been quickly put out, there would have been very little business disruption, and no Business Continuity plans would be invoked. It would be dealt with as a  “business as usual” type of disruption.

Does this matter? Well, yes, I think that it does. To talk about ‘flu pandemic in the way that it was being talked about at the BCI meeting implies that there had been a business disruption and  that Business Continuity plans had been successfully invoked. There was no significant business disruption , and although ‘flu pandemic teams met,  no Business Continuity plans were invoked. In other words, the threat of the ‘flu pandemic was not realised, even though there was, technically, a ‘flu pandemic.

My message is simple. Don’t fool yourself into thinking that your plans dealt with the threat. It didn’t happen.

 

 

In undertaking a Business Impact Analysis (BIA), the analyst is required to estimate the impact on the organisation of a disruption to a product, services, process, or activity. If you read the literature about undertaking a BIA, you will often find lists of types of impact that can be considered, such as financial or reputational, and in many instances you will see something such as “Damage to the Environment” listed as an impact. This is incorrect, and in a common misconception.

It is incorrect because something such as “Damage to the Environment” is not an impact on the organisation. It is an impact that a disruptive event can have, but the impact on the organisation is what happens as a result. Including such things as a direct impact on the organisation confuses cause with effect. A well known example will illustrate what I mean.

The Deep Water Horizon oil spill has a major impact on the environment of the Gulf of Mexico, but the impact on BP was not environmental. The impact on BP was the reputational damage, the cost of cleaning up the oil spill, the compensation claims, and the fall in share price. Yes, “Damage to the Environment” is an impact, but only in so much as it is the cause of real impacts on the organisation.

Confusing cause and effect is, in my opinion, one of the common causes of poor BIA’s in the public sector. This is because analysts naturally look at the wider effects on society of a disruption to services, rather than the impact on the public sector organisation itself.

 

How often have you wished that you could undertake a Business Impact Analysis (BIA) quickly, with all the relevant people and decision makers available in one place? For most people, undertaking a BIA is a bit like having a tooth removed very slowly over a period of weeks or months. Very painful.

I’ve been reminded this week of how it doesn’t need to be like this, particularly for a small or medium sized organisation. One of my latest clien’s is a small manufacturing and service company, and I was able to undertake a BIA workshop for the top management in an afternoon. This didn’t just cover the strategic level, but went all the way down to the operational detail of which activities needed to be recovered by when, and what resources were needed to recover each activity. We even spent time on discussing strategy and tactical options for recovery.

What made this possible was not just the size of the company, but that the senior management were willing to put in the time and effort and that they knew the operational detail in their area of responsibility. Such a refreshing change. It would be wonderful if all BIAs were like this, but they’re not. Obviously this is not possible with a large organisation, but the main reasons why it is not possible in most small to medium sized organisations is that the senior team won’t spare the time, and more importantly, they don’t seem to know the operational details! Personally, I call that a failure of management.