Business Continuity Management | BCM

Document Your Business Impact Analysis Report and Present Findings

Written by Moh Heng Goh | Jun 13, 2020 3:36:10 PM

This section is part of the BL-B-5 Module 3 Pre-reading List.   This is in preparation of the compilation and presentation of Business Impact Analysis (BIA) report to Executive Management.

When you completed the BL-B-3 Module 2, you have the competency of a BU BCM Coordinator as you have completed the BIA Questionnaires. You have also understood the objectives and challenges of completing the BIA Questionnaires at the business unit level.  In Module 3 and 4, you are assuming the role of an Organization BCM Coordinator and is required to analyse and present the BIA findings as a report to Executive Management for approval.

The content is extracted from the BCM Planning Series: Conducting Your Impact Analysis for Business Continuity Planning (Second Edition).

 

Document and Present Your Business Impact Analysis Document and Present Findings

This is the final stage where you generate a report which describes, in simple “dollars and cents” terms, how bad it would be if a disaster struck.

The BIA report is the document that you and others will refer to as you move on in the development of a comprehensive BC plan. The Organization BCM Coordinator should present the BIA findings, in person, to the Executive Management.

While any significant study of business functions will reveal some surprises, this BIA report should not be a total surprise to anyone who has been involved in the process.
In this respect, it is important to review your findings with Heads of BU prior to the presentation to the Executive Management.

This blog provides suggestions on preparing and presenting the BIA report.

Preparing the BIA Report

The production of the BIA report is the final stage of the BIA process. This report is an executive summary containing the introduction, conclusions and major recommendations.

By this stage, you will be very familiar with the overall operations of the organization. However, others reading your report may not have the benefit of such experience or knowledge, especially those reading it months after the BIA is conducted.

Hence it is important to make sure that the document is sufficiently detailed and that it is sensitive to the passage of time.

While developing your final BIA report, keep these steps in mind:

  • Issue a draft BIA report to participating Heads of BU and request feedback
  • Review the feedback and where appropriate, revise the findings or add on outstanding issues
  • Schedule a workshop or meeting with participating Heads of BU to discuss initial findings, if necessary
  • Update original findings to reflect changes arising from meetings
  • Prepare the final BIA report according to organizational standards
  • Make a formal presentation of the findings to peers and the Executive Management.

Design & Prepare BIA Report Format

The report should include background information to bring all readers towards a common understanding as well as avoid unnecessary and irrelevant questions. The report may be structured as follows:

  • Why was the BIA conducted?
  • What were the objectives set?
  • What was the scope of the exercise?
  • What was the approach that you used?
  • What were the detailed findings?
  • What were the conclusions and recommendations?
 
If you follow this methodology you will undoubtedly produce a large and detailed report, particularly if you use graphs, tables and diagrams. However, very few people need to read the report in its entirety.
 
You should have an executive summary for the Executive Management, individual sections for Heads of BU and proposals for staff members responsible for quality assurance and for BC.

A sample of the Table of Contents for a typical BIA report can be found in Sample BIA Report Format.

Critique and Rationalization of Report

I always recommend that a draft report be submitted to the BCP project team, usually consisting of BU BCM Coordinators and the project sponsor, for their perusal and ratification.

There is nearly always a need for someone to critique and rationalize the business unit content, e.g. the Training business unit may insist on recovery to 50 per cent employee strength within a week but the Executive Management may well feel differently.

As the Organization BCM Coordinator, you can suggest that the requirement seems unrealistic; but if the participant insists, you have to include their input, hence the importance of rationalization.

Once the BIA report is completed, it will highlight what the CBFs are and where the impact of an incident is most important. You will have indicated the current level of preparedness, made recommendations for improvement in normal working practice and in an emergency. Lastly, you will have provided a blueprint for the continuity and recovery of the business functions making up the entire organization.

Obtain Acceptance by Management

In order to manage the Executive Management’s expectations, the report needs to describe the key problem, “what is the current state with respect to the solution?”, and most of all, “what is required from them?”.

The Executive Management Members themselves often do not realize that only they can authorize the use of resources for the BCM planning process.

The Executive Management needs to know:

  • What is required?
  • Why is it required?
  • When is it required?
  • How much will it cost?

I recommend that a typical BIA report be around twenty pages (including appendices). However, this is too long for the Executive Management. Hence there should be an executive summary as well as a concise set of recommendations.
 
If appropriate, the report should also contain a cost implementation plan. For a sample format, refer to Template 4: Sample BIA Report Format.

Presentation & Acceptance of Findings


If possible, the presentation to the Executive Management should be held in the Boardroom, lasting about twenty to thirty minutes. The goals of the presentation are:
  • Provide information about the impacts of disruption to the organization
  • Obtain acceptance of the findings of the BIA report
  • Seek approval on the direction of BC Strategy development for the mitigating of potential impacts
  • Build a case for developing a BC planning program
Should I Use A BC Software?

I am never for or against the use of specialized software as long as it meets 80% of my functional requirement.
 
One important consideration is that it does not create a long term maintenance issue as most software that claim to be user friendly, actually have very steep learning requirement.

Presentation to Executive Management


The presentation should focus on the highest priority business functions and IT applications. The results of the analysis should be presented in a tabular or graphical format. The methodology used, sources of the information, and textual explanations of the results should be presented in a concise format.

After the results are presented, the Organization BCM Coordinator should state the priorities assigned to business units and IT applications as well as the maximum tolerable downtimes or RTOs.
 
At the conclusion of the presentation to the Executive Management, the Organization BCM Coordinator should explain how the BIA results would be used to establish the approved list of critical business functions of an organization, the financial and non-financial impacts, and the minimum resources required to recover these business functions.

I would like to caution that the BIA conclusion, which may seem obvious, is not always valid. Avoid the obvious in a BIA, and seek expertise at various levels to obtain consensus.
 

Alternative Format of Presentation


The BIA report is presented in both written and oral form to the Executive Management. The report should include an overview of the BIA process, summarizing:
  • Data gathering and analysis methodology
  • A summary of your findings
  • Charts and graphs should be used to illustrate financial information, potential market share losses, number of customers that could be lost and other numerical information
  • Recommendations

While you should have already validated business unit information, you will want to review initial drafts of your report to the Executive Management. The Executive Management may have a very different view of recovery priorities from Heads of BU.

 

Seek Approval of Document


The final step of documenting the decision by the Executive Management is often missing. The Organization BCM Coordinator should extract the “minutes of meeting” and file the recorded minutes highlighting the BIA approval. This document is often reviewed by internal and external auditors.

 

 

Find out more about Blended Learning BCM-5000 [BL-B-5]

 
     
 
 
Please feel free to send us a note if you have any of these questions to sales.ap@bcm-institute.org
 
 
 
 
If you would like to continue to know more about your business continuity management learning journey, click on the button below.