by Don Hughey, Strohl Systems Senior Consultant

In his last issue Don presented the process for initiating a business impact analysis.  He took you through the selection of the proper participants and creation of the survey questionnaire.  This article picks up with the assumption that you were successful in distribution and eventual receipt of the completed questionnaires.(Click here to review previous article)

If you were diligent in the design and creation of the questionnaire, you now have all the information you need to analyze the requirements of the business units, select the proper recovery strategies, develop the plans, and start the training programs.  Simple isn't it?

Well there are a couple steps still to be done in the business impact phase.  At this point in your project, participants should have provided such information as the following: description of the service(s) performed by each operating unit, business process, and business function.

• operational controls affected by potential disruptions
• financial implications of disruptions
• staffing levels currently supporting the business function(s) of the operating unit (both employees and contractors)
• minimum staffing levels to operate under emergency conditions including special contracted skills

Resources required by the operating unit in normal conditions and over time during emergencies such as the following:

• work area space
• office equipment
• communications (both voice and data)
• computing platforms and application systems
• vital records and supplies
• most critical time periods for the business function
• backlogs of work in normal course of business and backlog accumulation during downtime
• any historical data relating to previous disruptions
• special skills or licensing required for staffing the business function
• dependencies on other internal or external sources for the workflow of business function
• reliance by other internal or external functions on the information or service(s) supplied by the business unit

If you elected to use the Strohl Systems BIA Professional tool for your project, you should already have the formats necessary to print the associated reports and graphs for your questionnaire.  If you did not use the BIA Professional tool, you should create a database and the necessary reports to analyze your information.

Begin your analysis with a summary review of each category of data as well as the detailed information for each business process and business function.  One of the primary concerns should be to assure that the total financial exposure approximates the actual revenues of the business.  This is the first sanity check.  It is not unusual to find that several survey respondents have taken the credit for identical revenue streams.  Similar review will determine if the reported resources approximate actual resources.

Where variances can be identified, you should begin to create your interview scripts.  Each respondent to your survey questionnaire should be scheduled for a follow-up interview.  Be courteous and brief yourself on the contents of each survey prior to meeting with the respondent.  These interviews should not require more than forty-five (45) minutes to an hour each.

The advantage of this approach is that you are able to speak to specific issues with your participants about the information they have previously had the opportunity to consider. There should be no "cold" interviews.  Frequently, you will find that you are able to validate, edit, and improve the respondent's initial answers.  Update your database with the revisions and recreate your summary and detailed reports and graphs.

It is not unusual to have workpapers at this point that may include several hundred pages of data.  Obviously, all the data will be entered into the planning process; however, determine which issues are truly significant enough to report.  The executive committee that will provide your funding will probably want to see no more than a 10 to 15 minute presentation of summary data, which is key to the funding approval process.  Keep the executive summary report to a few graphs and no more than one or two pages.

Create a detailed report for distribution to the participants.  But again, remember to include only pertinent information since you have all your detailed graphs, charts, and reports to back up your report. 

I frequently provide the detailed report only after determining the recovery strategies and associated costs to be recommended for implementation.  You can then publish a combined document containing the recommended strategies, their costs, and your logic supported by the appropriate survey details.

Knowing how to approach your BIA can be just as important as knowing your vulnerabilities. And following simple but necessary steps can make your BIA effort more efficient, thorough, and can save you a lot of headaches later on.