Document Your Business Impact Analysis Report and Present Findings

This section is part of the BL-B-5 Module 3 Pre-reading List.   This is in preparation of the compilation and presentation of Business Impact Analysis (BIA) report to Executive Management.

When you completed the BL-B-3 Module 2, you have the competency of a BU BCM Coordinator as you have completed the BIA Questionnaires. You have also understood the objectives and challenges of completing the BIA Questionnaires at the business unit level.  In Module 3 and 4, you are assuming the role of an Organization BCM Coordinator and is required to analyse and present the BIA findings as a report to Executive Management for approval.

The content is extracted from the BCM Planning Series: Conducting Your Impact Analysis for Business Continuity Planning (Second Edition).

 

Document and Present Your Business Impact Analysis Document and Present Findings

This is the final stage where you generate a report which describes, in simple “dollars and cents” terms, how bad it would be if a disaster struck.

The BIA report is the document that you and others will refer to as you move on in the development of a comprehensive BC plan. The Organization BCM Coordinator should present the BIA findings, in person, to the Executive Management.

While any significant study of business functions will reveal some surprises, this BIA report should not be a total surprise to anyone who has been involved in the process.
In this respect, it is important to review your findings with Heads of BU prior to the presentation to the Executive Management.

This blog provides suggestions on preparing and presenting the BIA report.

Preparing the BIA Report

The production of the BIA report is the final stage of the BIA process. This report is an executive summary containing the introduction, conclusions and major recommendations.

By this stage, you will be very familiar with the overall operations of the organization. However, others reading your report may not have the benefit of such experience or knowledge, especially those reading it months after the BIA is conducted.

Hence it is important to make sure that the document is sufficiently detailed and that it is sensitive to the passage of time.

While developing your final BIA report, keep these steps in mind:

• Issue a draft BIA report to participating Heads of BU and request feedback
• Review the feedback and where appropriate, revise the findings or add on outstanding issues
• Schedule a workshop or meeting with participating Heads of BU to discuss initial findings, if necessary
• Update original findings to reflect changes arising from meetings
• Prepare the final BIA report according to organizational standards
• Make a formal presentation of the findings to peers and the Executive Management.

Design & Prepare BIA Report Format

The report should include background information to bring all readers towards a common understanding as well as avoid unnecessary and irrelevant questions. The report may be structured as follows:

• Why was the BIA conducted?
• What were the objectives set?
• What was the scope of the exercise?
• What was the approach that you used?
• What were the detailed findings?
• What were the conclusions and recommendations?

 

If you follow this methodology you will undoubtedly produce a large and detailed report, particularly if you use graphs, tables and diagrams. However, very few people need to read the report in its entirety.

 

You should have an executive summary for the Executive Management, individual sections for Heads of BU and proposals for staff members responsible for quality assurance and for BC.

A sample of the Table of Contents for a typical BIA report can be found in Sample BIA Report Format.

Critique and Rationalization of Report

I always recommend that a draft report be submitted to the BCP project team, usually consisting of BU BCM Coordinators and the project sponsor, for their perusal and ratification.

There is nearly always a need for someone to critique and rationalize the business unit content, e.g. the Training business unit may insist on recovery to 50 per cent employee strength within a week but the Executive Management may well feel differently.

As the Organization BCM Coordinator, you can suggest that the requirement seems unrealistic; but if the participant insists, you have to include their input, hence the importance of rationalization.

Once the BIA report is completed, it will highlight what the CBFs are and where the impact of an incident is most important. You will have indicated the current level of preparedness, made recommendations for improvement in normal working practice and in an emergency. Lastly, you will have provided a blueprint for the continuity and recovery of the business functions making up the entire organization.

Obtain Acceptance by Management

In order to manage the Executive Management’s expectations, the report needs to describe the key problem, “what is the current state with respect to the solution?”, and most of all, “what is required from them?”.

The Executive Management Members themselves often do not realize that only they can authorize the use of resources for the BCM planning process.

The Executive Management needs to know:

• What is required?
• Why is it required?
• When is it required?
• How much will it cost?

I recommend that a typical BIA report be around twenty pages (including appendices). However, this is too long for the Executive Management. Hence there should be an executive summary as well as a concise set of recommendations.

 

If appropriate, the report should also contain a cost implementation plan. For a sample format, refer to Template 4: Sample BIA Report Format.

If possible, the presentation to the Executive Management should be held in the Boardroom, lasting about twenty to thirty minutes. The goals of the presentation are:

I am never for or against the use of specialized software as long as it meets 80% of my functional requirement.

 

One important consideration is that it does not create a long term maintenance issue as most software that claim to be user friendly, actually have very steep learning requirement.

The presentation should focus on the highest priority business functions and IT applications. The results of the analysis should be presented in a tabular or graphical format. The methodology used, sources of the information, and textual explanations of the results should be presented in a concise format.

After the results are presented, the Organization BCM Coordinator should state the priorities assigned to business units and IT applications as well as the maximum tolerable downtimes or RTOs.

 

At the conclusion of the presentation to the Executive Management, the Organization BCM Coordinator should explain how the BIA results would be used to establish the approved list of critical business functions of an organization, the financial and non-financial impacts, and the minimum resources required to recover these business functions.

I would like to caution that the BIA conclusion, which may seem obvious, is not always valid. Avoid the obvious in a BIA, and seek expertise at various levels to obtain consensus.

 

The BIA report is presented in both written and oral form to the Executive Management. The report should include an overview of the BIA process, summarizing:

The final step of documenting the decision by the Executive Management is often missing. The Organization BCM Coordinator should extract the “minutes of meeting” and file the recorded minutes highlighting the BIA approval. This document is often reviewed by internal and external auditors.