BIA 8: Step 2: Verify and Analyze Information

Review of Submission

After the business units return the BIA Questionnaires and the Organization BCM Coordinator completes an initial analysis, interviews should be conducted to verify the completeness and accuracy of the information. These interviews are intended to identify any discrepancies in the information collected.

Conduct Face-to-face Interviews

Face-to-face interviews with the BU BCM Coordinators are strongly recommended in a BIA. In addition to interviewing key participants, the Organization BCM Coordinator should also meet other supporting staff members and experts in their area of work.

The results should be provided to Heads of BU for their review. It is important that the relevant Executive Management Members or Heads of BU are willing to defend the results if required.

Planning the Interview

The Organization BCM Coordinator should plan to spend at least one to two hours with each interviewee. Group interviews of personnel with related positions can expedite the interview process and may provide a less threatening environment than one-on-one interviews. Issues raised by one team member may jog the memory of another interviewee, thereby uncovering a critical issue that would otherwise have been overlooked.

The interviews should follow the same format. The Organization BCM Coordinator should attempt to verify the impact of tangible and intangible losses.

I often find the scheduling of meetings well in advance to be beneficial. A sample interview schedule is shown below:

The Timetable for BIA Interview

I strongly recommend that the interviewees be notified four to six weeks in advance. This is to ensure that the interviews are “booked” on their personal calendar and there would be little or no excuse to miss the interview sessions. As a good practice, an average interview should not exceed forty-five to sixty minutes, leaving 30 minutes to document the key interview observations and findings of the BIA interview.

Interview Questions

You have to ask the right questions to generate relevant answers. The following are possible questions that the Organization BCM Coordinator can ask:

• Explain the business function you consider to be critical
• What is the time criticality for this business function?
• What is the impact if this business function is disrupted?
• What would happen if you cannot perform this business function for an hour, four hours, a day, a week, a month?
• What makes this business function so important?
• Are there legal or statutory implications?
• What are the financial implications?
• Is customer confidence at risk?
• Is there any impact on other parts of the business?
• How long can we realistically survive without this business function?

Analyze Information

Setting Priorities on Processes and Operations

It is observed that after a serious disaster, all or most functions that were initially suspended are gradually resumed. To facilitate restoration of operations, the Executive Management should assign a “rank” to various business functions, based on how long the organization can survive without each one. Once you understand the risk profile you can define the business function into one of three categories of activities:

Critical Activities

A disruption in service not exceeding four hours would jeopardize seriously the operations of the organization. This business function must be recovered within four hours following the disaster.

Essential Activities

A disruption of service exceeding one day would seriously jeopardize the operation of the organization. This business function must be recovered within one day after the disaster.

Non-critical Activities

This function would be convenient to have but would not seriously detract from the operating capabilities if it were missing. This business function must be recovered with one week after the disaster.

Setting Criticality Based on Key Planning Scenario

Another approach is to define the criticality of those business functions that can and those that cannot tolerate the maximum “duration of outage” as spelled out in the Key Planning Scenario.

Conclusion

Upon completion of this step, you would have a list of business functions categorized according to criticality. With this, the Executive Management would then have a meaningful and objective basis to decide on the sequence and time-frame for recovery.

Reference

Goh, M. H. (2021). Conducting Your Impact Analysis for Business Continuity Planning. Business Continuity Management Planning Series (3rd ed.). Singapore: GMH Pte Ltd.

Extracted from "Chapter 8: Step 2: Verify and Analyze Information"

More Information About Blended Learning BCM-5000 [BL-B-5]

To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org.  They are the BL-B-3 Blended Learning BCM-300 ISO22301 BCMS Implementer and the BL-B-5 Blended Learning BCM-5000 ISO22301 BCMS Expert Implementer.

Please feel free to send us a note if you have any of these questions to sales.ap@bcm-institute.org