One of the major challenges for Business Continuity Management (BCM) professionals and organizations is ensuring that their Business Impact Analysis (BIA) is kept current and update to date. The problem with keeping the BIA’s up to date is that there is no process that integrates the BIA into the existing organizational functions. It’s something that is done once a year – a single point in time – and due to competing initiatives, is usually performed quickly by department representatives so they can focus on the activities they are responsible for and have direct impact upon their unit’s functions and direct reports. Ultimately, they focus on the things that impact their year-end performance and BCM isn’t usually one of them.
BCM must meet with an organizations IT Change Management, Organizational Change Management and Project/Program Management Office (PMO) representatives to develop a process that ensure that a Business Impact Analysis (BIA) is incorporated into their processes. This means that for each project in flight completes a BIA which details what the change is, what the impact is upon existing processes and what the end result will be once the change has been implemented. This allows for BCM to review the proposed (and often confirmed) changes to perform an analysis to existing BCP contingencies and strategies, assumptions, resources requirements (people, facility, IT etc.) and any other item that may have an impact upon BCM plans and processes.
Some of the impacts may be negligible to BCM plans and processes, while others could have a substantial impact. Some changes may drastically trigger a required upgrade to BCM plans and processes, especially those projects that have a multi-million dollar budget that impacts multiple teams within an organization. If these changes do identify major changes, then BCM cannot allow the existing restoration & recovery strategy (and BCP strategies, communication strategies etc.) remain stale, as they will not represent the new need. BCM must be able to proactively begin updating their processes so that one a new change has been implemented (either IT or Organizational), the appropriate actions to update the plans are known in advance. If there is no process that proactively identifies changes, then once a change has been implemented, and the change isn’t known by BCM, then the existing BCM strategy won’t reflect the need of the organization or even have an action plan in place to address the change. They simply won’t know about it and will have to go through multiple reviews to understand what that change is and what the impact is; basically, re-doing project work even though after an implementation, the project team involved has been disbanded. This will make it even harder for BCM to understand the impact of the change and could delay any required changes/updates to BCM plans and processes.
Embedding BIA reviews into existing company programs, not just within the BCM program, can help ensure an organization keeps its BCM plans and processes current. By not having the BIA process embedded and integrated into other company processes, the company runs a greater risk of not meeting the need and expectations when a major interruption occurs; be that a natural disaster, power outage or other even that seriously hinders the ability of the company to deliver its service and/or product and protect stakeholders (including employees). The result could mean that BCM plans and processes are up to a year behind schedule depending upon the level of impact the impacted change has.
Don’t be afraid to approach these areas; it’s all a part of your BCM awareness strategy, as awareness isn’t just for those that complete documents; it’s for everyone in the organization. When a disaster occurs, everyone needs to be on the same page and aligned. This includes the various plans and processes and restoration and recovery procedures. Otherwise, the company will experience another disaster when it discovers that what the restoration and recovery procedures represent doesn’t represent the actual need and expectation. Be proactive and identify the change impact before the change impacts you.
© StoneRoad 2016
A.Alex Fullick has over 19 years’ experience working in Business Continuity and is the author of numerous books, including “Watch Your Step”, “BIA: Building the Foundation for a Strong Business Continuity Program.”and “Testing Disaster Recovery and Business Continuity Plans.”