Back in February, Minneapolis, Minnesota was the host of Super Bowl 52. We previously discussed preparing for a major event like a Super Bowl in an earlier episode of the Managing Uncertainty Podcast.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba take a look back at Super Bowl 52 and discuss what worked – and what didn’t. Topics discussed include major event planning, private sector information sharing, remote work strategies, physical security, and related topics.

Episode Transcript

Bryan Strawser:            I really did not like Super Bowl 52. I did not like Super Bowl 52.

Jen Otremba:               No, he did not, and he’s wearing his shirt right now.

Bryan Strawser:            Yeah. It’s ironic that we’re recording this today, because when I was getting dressed this morning, I did not have any in-person client meetings, so I am in jeans and a New England Patriots polo shirt. But I did not like Super Bowl 52.

Jen Otremba:               Yeah. Who won the Super Bowl, Bryan?

Bryan Strawser:            Not the New England Patriots.

Jen Otremba:               Yeah, sad to say.

Bryan Strawser:            Our podcast is not about the football game, but we are gonna talk about what we learned during Super Bowl 52, and I don’t mean during the game. What we learned in terms of being involved, for two years, in the preparedness efforts around Super Bowl 52, and what I think we all took away from that experience that would be valuable to you as you think about planning major events.

Jen Otremba:               Yup, and what some of our peers learned as well, so all of us collectively, together.

Bryan Strawser:            We’ll start off with the fact that you can’t argue, which is that Tom Brady is the greatest quarterback of all time.

Jen Otremba:               Okay, Bryan.

Bryan Strawser:            No. So, Super Bowl 52. Let me paint the picture for you if you’re not familiar with the Twin Cities. But Super Bowl 52 was held at U.S. Bank Stadium, which is the home of the Minnesota Vikings. Unlike a lot of NFL stadiums, U.S. Bank Stadium is built right in the central business district of Minneapolis. It is literally a few blocks from about 15 Fortune 500 headquarters.

Jen Otremba:               Right. It was built on the same footprint as the Metrodome.

Bryan Strawser:            As the Metrodome. So right downtown you have some really big Fortune 500 firms, like U.S. Bank, General Mills has a large facility there, Ameriprise Financial, Target, Wells Fargo, Valspar, and the list just kind of goes on.

Jen Otremba:               On and on. Yeah, that’s right.

Bryan Strawser:            On and on from there. So, it’s not like the last Super Bowl, down in … I think the last one was in Houston, or Dallas, where the stadium is out in the middle of a huge parking lot, off the side of the highway with nothing around it. This is right smack in the middle of the city, so it posed a very different risk situation for companies, because everything was right there.

The game itself, of course, was at the stadium. The stadium doesn’t have parking. It has a very limited amount of parking, so there is really no standoff distance. So, you had to block … To kind of illustrate this … You had to block city streets for quite some distance around, in order to get the kind of security perimeter to protect from blasts, and do adequate security screening and that kind of thing.

Jen Otremba:               Right. In addition to that, there was events held at the Minneapolis Convention Center, which is also right downtown,

Following a difficult, traumatic, or violent incident, there are a lot of challenges to work through. But when planning and thinking through how to handle these situations, we often focus almost wholly on the response and tend to ignore the short and long-term recovery challenges.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through their own experiences in the aftermath of major crisis situations. Topics discussed include grief counseling, post-traumatic stress, managing the press, post-disaster payroll policies, and more.

 

Episode Transcript

Jen:

I read this article where there was a grief counselor that was interviewed and taking specifically around the aftermath of a situation and how its managed and how its handled. This grief counselor actually would get called onsite for various different high-level incidents, much like the shooting in Florida, 9-11, things like that. The grief counselor would come onsite and they would help the people involved through the situation. We saw that at our previous employer where if there was a big incident that happened we would have counselors that were onsite.

 

Bryan:

It was part of our SOP really.

 

Jen:

Absolutely, and help out. I just thought this would be a great topic to talk about to kind of educate those around what it’s like to go through an aftermath. Bryan and I have both gone through many situations-

 

Bryan:

Numerous.

 

Jen:

Where we dealt with an aftermath of a traumatic incident so we thought it would be a good idea to talk about what that looks like.

 

Bryan:

For me it always … This kind of is just … This issue gets overlooked a lot, but because of what I’ve learned through my experience and our experiences together is that this always seems to be part of the right of boom process. When I talk about left of boom, right of boom, you’ve got the bad thing that happened, the boom, and there’s what you can do before that, the preparation and the training and the exercises and whatever, but then the bad thing happens, you respond to it and then part of your long-term recovery, which what we’re talking about here falls right on getting out of that immediate response stage, is how do you deal with the aftermath of the situation in terms of taking care of the team, taking care of the survivors or the victims and their families and the organization, how do you make sure that people are okay through this.

 

Jen:

Right, and like you said, this should actually be part of your crisis planning.

 

Bryan:

It should be.

 

Jen:

It should be part of the plan.

 

Bryan:

It needs to be one of the first things that you do once you’ve gotten to that immediate response and we’re sure that people are safe and the immediate danger has passed, is how do you start to help people with the immediate and long-term aftermath of the situation that has impacted them.

 

Jen:

Yeah, and understanding some of the things you can expect to see. Some individuals may need to take some time off. They might need to take some time away from where it happened before they can … Yeah.

 

Bryan:

If you’re a multi-facility company they may want to work at a different facility moving forward.

 

Jen:

Yeah. It might be temporary or that might be permanent, but you need to take that in consideration and underst...

We don’t do politics on our podcast, but given last week’s tragedy in Florida, we thought it would be worthwhile to talk about threat management processes in educational institutions. In particular, the threat management environment in a K-12 school is quite different than what we typically encounter in a business or university environment.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through their recommendations on the threat management processes and challenges in a K-12 educational environment. Both Bryan and Jen are members of the Association of Threat Assessment Professionals and have extensive experience in threat management and assessment. Topics discussed include risk criteria, mitigation planning, threat management teams, involvement from law enforcement, and other challenges.

Episode Transcript

Bryan:              We don’t do politics on this podcast.

Jen:                  No. It’s not really the right place.

Bryan:              Not the right place for it. This is our professional lives, and our personal, political affiliations really have nothing to do with what we talk about here. We’re recording this the week after the shooting in Florida that has the country’s attention right now, and we wanted to talk about how this relates to our area of expertise when it comes to threat management.

As we look at the facts of this situation, and we’re going to try to do this in a non-blameful way, because I don’t think we know enough yet to know who might be at fault, or are there agencies that are at fault? I’m not sure that that really matters in terms of blame. But we do know that this individual had a track record of some issues. And in just what we’ve heard so far, there were at least two individuals that thought enough concern to contact the FBI and report some information.

But we’ve learned more about the number of police incidents that occurred at the shooter’s residence over the last several years, a number of encounters with Florida’s social service agencies related to issues. And then apparently, some track record of threatening behavior at the school that led to his expulsion, I believe, is how that has been explained by the school district.

Jen:                  Yeah. Some of which is being reported in the media and we don’t know the truth to all of it yet, of course, as it’s being reported, but we do know that there was a tip, at least, that went all the way to the FBI, and the FBI has come out and made a report on that.

But that’s not necessarily what we want to talk about today exactly. We want to talk about what an appropriate threat management process would look like in an educational institution.

Bryan:              So we’ve talked before about the need to have a robust and appropriate threat management processes within an organization. So let’s just review that and then take maybe the educational context of that.

But when we talk about a threat management system for an organization of any type, Jen, what are we really talking about that needs to be in place.

Jen:                  Yeah, so ultimately we’re looking at a process. A process where individuals can report something that may be a suspicious behavior, it could be a threat that was made, there could have been an assault that was done. But some kind of process that escalates information up to somebody who can evaluate it, who can look at the information as they see, they can look the individuals involved and they can determine, is this a high-risk, low-risk, medium-risk threat, or what is the situation with that?

Last year we provided two free mini-training courses:

* Active Shooter 101

* Crisis Communications 101

On this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser announces the launch of two new mini-courses that round out our free mini-course offerings:

* Crisis Management 101

* Business Continuity 101

Both courses are completely free with lessons delivered via e-mail each day.

We hope you enjoy them!

Episode Transcript

Bryan Strawser:            Everyone, it’s Bryan Strawser here from Bryghtpath. It’s kind of weird for me.

I’m recording by myself for the first time in nearly a year. My normal podcasting partner, Jennifer, here at the Managing Uncertainty Podcast, is on vacation, having camping nights with the best camper accessories and visiting cliffs in the north of Ireland. She is running around and enjoying the many fun things to do in Ireland, like visiting the stunning Cliffs of Moher in County Clare. So far, I’ve received many beautiful pictures of the nature and views and beers in Ireland.

She will then go south to the Canary Islands off the coast of Africa, with her husband on a motorcycle trip. Probably one of the coolest vacations that I’ve heard of. Although the photos I’ve seen so far have mostly involved wine and some really nice looking steak.

But I’m recording today by myself and I want to talk a little bit about two major announcements that we just made this week here at Bryghtpath.

The first one is we have launched a new Business Continuity 101 mini-course. Our mini-courses, some of you might remember, are completely free. They’re email based courses, meaning that you signup on line. You enter your email and we send you a new lesson every day for a period of time.

The Business Continuity course has seven lessons, comprehensive lessons and they’re really aimed at helping you develop strategies to build a more resilient organization. Our mini-courses do a pretty good job of explaining the basics around a topic and then giving you, more and more expertise, more in depth knowledge of that topic over the course of five to 15 days depending upon the course.

The Business Continuity 101 course is seven days long, seven lessons long. They’ll take you about five or 10 minutes at a time to read. We aimed these really so that you would have time to make a cup of coffee or tea or get a drink of water and then sit down and read through the lesson. We always encourage folks to take the time to write some notes as they read through it and think about how can I really apply some of these lessons to what I’m doing day to day.

One course really gets into that whole idea of business continuity, walks you through what it is. How to … Comes to a business continuity program and then really talks about how do you … What are some things you should think about when it comes to your program in terms of choosing a consultant to work with. If that’s something that you need, or you need expertise, we really give you the hints and the tricks to look at to really evaluate a consultant’s or a consulting company’s experiences and their services and how you can bring them to the table to really come to bat for your team within your organization.

Again, this is the Business Continuity 101 mini-course. It is completely free. You can access it right not at Bryghtpath.com/bc101. That’s Bryghtpath.com slash, the letter B, the letter C, 101.

The second course that we’re announcing, we announced this week,

At Bryghtpath, we’re often asked about risks and threats faced by Senior Executives of major corporations and non-profits – and how to best go about planning for those risks.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through our experiences with protecting senior executives. Topics discussed include executive protection, travel security, office security, security at an executive’s home, and events/appearances that may pose an additional risk.

Episode Transcript

Bryan Strawser:            We’ve been asked recently about executive services or executive protection. How does a company or organization go about protecting their senior executives? What do other companies do? We get asked that a lot. Like, compare us to other organizations in our industry. Or it’s just the question that I think we got early November was, look, our CEO is speaking at this big event. We don’t really ever do anything for their personal protection. Should we be doing something?

Jen Otremba:               The answer is yes.

Bryan Strawser:            The answer is probably yes.

Jen Otremba:               If you’re asking the question, the answer is probably yes.

Bryan Strawser:            So let’s lay some background before we get into the solution to this challenge. Corporate executives, nonprofit executives, public sector commissioners and others that run big agencies, they have varying levels of risk, but their risk is not like the risk of a typical employee, as much as they might want to make themselves out to be everyday Joe or Jane. They’re representing their organization. There’s a certain level of risk that goes with that leadership job that they’re in.

Jen Otremba:               They’re the public face of the organization.

Bryan Strawser:            They’re the public face.

Jen Otremba:               When people have a beef with the organization, chances are your face, senior leader, is the one that they’re going to have the beef with.

Bryan Strawser:            In all of this, and you’re going to hear us say this several times, there’s a very difficult balance to achieve that’s a little unique to the culture of the organization that we’re talking about, but I don’t know many CEOs that want to isolate themselves from the world or their employees. At the same time, none of them want to be in any personal danger, or if they think about this. A lot of them don’t think about this at all, but none of them wants to be in a place where there could be harm brought to them or their families or that other people they work with could be in harm’s way because of them. And so there has to be a balance struck, as there always is on security issues, between how we protect the organization and the people and still run the business and let the CEO and other C-suite executives be available to employees and the public and others as appropriate.

Jen Otremba:               Right and manage the way they want to manage or they choose to manage.

Bryan Strawser:            So there’s interesting risks that goes with executives. We’re kind of using the generic term executives here. We’re generally talking about the CEO, but depending upon your organization and the size of your organization and its prevalence in society, we might really be talking about many others in your company. It could be the CFO. It could be your general counsel. It could be the head of a division. It just depends on your organization’s unique place in the community and how well-known that executive is.

Super Bowl 52 will be held in Minneapolis, Minnesota, just down the road from our offices in Shoreview, on Sunday, February 4th, 2018. It will be on one of the largest events hosted in Minnesota in decades.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through our experiences with planning for major events like the Super Bowl.  Topics discussed include private sector planning for major events, threats and risks, getting connected to intelligence and law enforcement resources, contingency planning, physical security, and how to handle the general disruption in downtown Minneapolis during the week of the game.

 

Episode Transcript

Bryan Strawser:            Super Bowl 52.

Jen Otremba:               Super Bowl.

Bryan Strawser:            Coming soon to Minneapolis’ US Bank Stadium.

Jen Otremba:               Yeah, this is a really big deal for us.

Bryan Strawser:            This is a huge deal.

Jen Otremba:               Minnesota, huge.

Bryan Strawser:            For the state.

Jen Otremba:               Absolutely.

Bryan Strawser:            Huge.

Jen Otremba:               Yep.

Bryan Strawser:            Not only that, but there’s crazy excitement here because the Minnesota Vikings are actually favored to win the NFC and represent in the Super Bowl, and that would be crazy.

Jen Otremba:               That would be crazy, and we’ll see.

Bryan Strawser:            Yeah, we’ll see.

Jen Otremba:               I’m a little pessimistic about that thought, but we’ll see.

Bryan Strawser:            So is my wife, who is a lifelong Minnesota Vikings fan. It’s weird for me living here in Minnesota, because I am a New England Patriots fan.

Jen Otremba:               He is, it’s ridiculous.

Bryan Strawser:            Yes, so, I have had, as a Boston sports fan, I’ve had a pretty good decade and a half. We’ve won everything in all four major sports.

Jen Otremba:               Yeah, I know.

Bryan Strawser:            And five Super Bowl titles.

Jen Otremba:               I know.

Bryan Strawser:            I’d like to point out.

Jen Otremba:               I want you to know I hear about this, endlessly, and I’m not really even a football fan, really. I shouldn’t even say that out loud here in Minnesota, surrounded by Vikings people, but, I do watch the Super Bowl every year, and I think that that is a really fun and exciting event to have, so.

Bryan Strawser:            If it’s New England against Minnesota, my marriage may not survive the night.

Jen Otremba:               Oh, gosh.

Bryan Strawser:            My wife has told me I may have to go watch the game at the office.

Jen Otremba:               Well, I think we all should be watching the game at the office anyway.

Bryan Strawser:            Yes, because we have clients that we were protecting that day in many ways.

Jen Otremba:               I know.

Bryan Strawser:            But, we’re not here to talk about the Vikings or the Patriots, we’re here to talk about how do you deal with a major event like the Super Bowl? I mean, we’ve done an earlier podcast episode where we talked about major event planning, but we’re going to drill in to just the Super Bowl here in the Twin Cities, and what that means.

Jen Otremba:               Yep, and this is specifically a big deal because we have clients that are right down town.

Bryan Strawser:            We have clients that are next to the stadium.

Jen Otremba:               Right next to the stadium,

Today, we’re announcing the launch of a new product – The Twin Cities Weekly Intelligence & Threat Briefing.

Leaders and small business owners are constantly confronted with challenges from many different directions.

Protests. Terrorism threats. Road construction. Riots. Super Bowl 52. New legislation. Crime in your neighborhood.

It creates an ever-uncertain environment that surrounds your business.

We’ve talked in previous episodes of our podcast about the need to have a “radar screen” that helps your organization understand, categorize, and respond to inbound threats to your organization – for companies, non-profits, and political campaigns operating in the Twin Cities, the Twin Cities Weekly Briefing is intended to be that radar screen.

In this special episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser, along with Senior Consultant Jennifer Otremba, talk about the background, context, and launch of the Twin Cities Weekly Briefing.

To make the briefing happen, our team of experts filters through hundreds of local, national, and global news sources – along with proprietary, government, and open-source intelligence resources – to assemble a 10-12 page weekly briefing that arrives in your in-box as a PDF attachment.

In the Weekly Briefing you’ll find information about urgent, emerging threats locally, large local protests, recent significant criminal or threat incidents, planned road construction & traffic issues, upcoming major events, and national / global risks or threats that have a local connection.

Learn more by clicking here to see the product page for this exciting new subscription product! You’ll find a sample of the current week’s briefing along with more information and a detailed fact sheet to help you in your evaluation and decision.

Managing Uncertainty fans can get a special 20% off lifetime discount by using the discount code “SAMPLE2018” at checkout.

Episode Transcript

Bryan Strawser:

I don’t like getting up in the morning.

 

Jen Otremba:

No.

 

Bryan Strawser:

No.

 

Jen Otremba:

Not a morning person, are you, Bryan?

 

Bryan Strawser:

Never have been. I slept at odd hours. I don’t sleep a lot even now at 43.

 

Jen Otremba:

I’ve known you for years. I know this to be true.

 

Bryan Strawser:

I used to send work emails at one and 2:00 in the morning and then again at five and 6:00 in morning. I’m a night owl. I honestly do my most creative work at night. I just don’t like to get up in the morning. For almost a decade now, I’ve always gotten up at 5:00 in the morning. At our old employer, I did that because I had to be in the command center for a meeting, which you were a part of …

 

Jen Otremba:

I was …

 

Bryan Strawser:

… Pretty regularly at 7:00 in the morning, which is way to early to have critical thought. I had to be highly caffeinated.

 

Jen Otremba:

Fortunately, I was a morning person so I was there before you making sure the team put something together …

 

Bryan Strawser:

Making sure that …

 

Jen Otremba:

It’s 2018 and we’re back with our first episode of the new year.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through Bryghtpath’s view of the Top 12 Global Risks of 2018. Topics discussed include national security, the global economy, lessons learned from the 2017 hurricane season, cybersecurity, and risk to companies from the ongoing sexual harassment revelations.

 

Episode Transcript

Bryan Strawser:            It’s 2018.

Jen Otremba:               2018, Happy New Year.

Bryan Strawser:            Happy New Year. Welcome back to the Managing Uncertainty Podcast.

Jen Otremba:               We’re excited to be back in the New Year here.

Bryan Strawser:            We are. We actually didn’t record any podcasts for the last three weeks of the year. I think we recorded four or five like that first of December and we used those throughout the months. So this is really our first time back in the studio here at our offices for a month or so.

Jen Otremba:               It’s good. Much like many, it gave us chance to enjoy the holidays.

Bryan Strawser:            It did. So in this episode we’re gonna talk about our view of the top risks of 2018. I think we’re gonna kind of run the gamut here from things that many of you are probably thinking about. Some things that we’ve talked about before and then some things that maybe you’re not thinking about that are gonna have an impact on you in some way, in terms of the global economy. Because that does impact you locally or foreign affairs and national security issues, which will also impact you in ways that you’re probably not thinking about today.

Bryan Strawser:            So the first risk on our list of 12 risks that we’re gonna talk about today is the rise of China and I think we hear a lot about this. I don’t think people really understand the impact of what’s going on but under the current leadership, China’s really taken a different approach to geopolitical affairs and international relations than they have before. And what we’re seeing now with China is really they appear to have started to cooperate with a number of international institutions where and before they really kind of set themselves aside and didn’t do any sort of cooperation like this.

Jen Otremba:               Yeah, they really isolated themselves as far as international trade, discussions, things like that.

Bryan Strawser:            And what’s interesting about that is, that was really a role the United States has played historically. We are beginning to do less of that. China is beginning to fill somewhat of the vacuum or void left behind by our leadership. It’s not really a Republican or Democrat thing, it’s just that the direction that our country has gone over the last decade or so has been a different role Internationally. So China is starting to fill that gap and it’s an interesting comparison I think to think about the rise of China and what many perceive to be the decline of the United States as a geopolitical power for the last 20 – 30 years.

Is very similar to the situation that the United Kingdom found themselves in, in the late 1800’s where they made the strategic choice to hitch themselves through a surging United States as a global power and it has allowed the United Kingdom to bat above their weight in foreign affairs for well over a century. And perhaps we have similar opportunity to coach and guide the Chinese in the same way, but I’m not sure that our current administration or even previous administration is interested in doing that.

In last week’s episode, we discussed the traditional approach to the Business Impact Analysis (BIA), a part of the Business Continuity Lifecycle. This week, we’re going to talk about the trend towards not doing the BIA at all.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through the recent trend of not completing a more traditional business impact analysis, or BIA, process as a part of an organization’s annual business continuity lifecycle. Topics discussed include why organizations are choosing not to complete a BIA, alternate processes that allow an organization to gain much of the needed information through other means, and thoughts on where this trend will continue to evolve.

Episode Transcript

Bryan Strawser:                   To BIA or not. That is the question.

Jen Otremba:                        That’s right. So last week, we talked about the BIA.

Bryan Strawser:                   We did. We talked about the traditional BIA.

Jen Otremba:                        The business impact analysis. Yep.

Bryan Strawser:                   And this week we’re gonna talk about not doing the BIA. Alternate ideas around the BIA. Or justification for not doing the BIA. Of course, I’m stealing from Shakespeare’s Hamlet …

Jen Otremba:                        All day long.

Bryan Strawser:                   All day long …

Jen Otremba:                        That’s right.

Bryan Strawser:                   I’ve been quoting Shakespeare. Not really. But when we do the traditional BIA, we expect to get certain outcomes. And those outcomes are understanding activities that support products and services at the company, understanding the impact over time of those activities not happening, or how we can measure the impact of a disruption to your critical processes, or …

Jen Otremba:                        Financial impacts.

Bryan Strawser:                   Yeah, we’re capturing all kind, and again, not just financial.

Jen Otremba:                        Right, absolutely.

Bryan Strawser:                   We’re capturing all kinds of impacts, reputational, community, brand, regulatory, et cetera.

Jen Otremba:                        Yes.

Bryan Strawser:                   We’re setting prioritized time frames for resuming these activities, in some kind of organized manner of what’s important first, and et cetera, and we’re identifying dependencies, and those might be suppliers, or technologies, or other relevant interested parties.

All important, but there’s a growing belief that, perhaps, doing this in-depth BIA on an annual or bi-annual basis, or every two years, or what have you, is not important more. Why is that?

Jen Otremba:                        Well, I think, in some aspects, they’re not necessarily making the argument that it’s not important, but that the expense of doing it, or the time it takes to do it, it is very time-consuming process, is unnecessary, is maybe the argument, and that their time can be spent better elsewhere.

Bryan Strawser:                   Agreed. We’re also seeing the argument that, really, things are either critical, or not. If they’re critical, they should be recovered as quickly as possible, and things that are not critical, we’re just not gonna worry about anymore. That’s one theory.

Another theory, that … this one actually makes more sense to me, is … when you’re in the crisis, your executives are calling the shots. And your executives know, very quickly, which services are mission critical,

We’re often asked about the Business Impact Analysis (BIA) process, a part of the Business Continuity lifecycle, and how that should be structured within an organization.

Over the next two episodes, we’ll take a look at the BIA, starting with the traditional business impact analysis process, followed by a look next week at the trend towards not doing the BIA at all.

In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through the traditional business impact analysis process. Topics discussed include how to structure the BIA process, how to use the results, connections to the ISO 22301 and 22317 standards, and some of our lessons learned from conducting the BIA at multiple clients over the years.

Episode Transcript

Bryan Strawser:                   We’re going to put on our business continuity and disaster recovery hat today and talk about, I think a two-part podcast is what we’re talking about here. We’re going to start by talking about the traditional idea of the business impact analysis. What is the BIA, Jen?

Jen Otremba:                        That’s a good question. The BIA, or the Business Impact Analysis, to me it’s sort of just a process to help determine critical functions within a company and what the relationship is with each other, in Jen’s words.

Bryan Strawser:                   That’s a good plain English description of the BIA.

Jen Otremba:                        In Jen words, not the ISO definition, the Jen definition.

Bryan Strawser:                   ISO says in the 22301 standard that the business impact analysis is a formal end document and evaluation process for determining continuity and recovery priorities, objectives and targets.

Jen Otremba:                        Yeah, what I said.

Bryan Strawser:                   It goes on to say that this is really about understanding the organization and its context and the needs and expectations of interested parties in order to be able to select business continuity strategies, implement business continuity solutions and write business continuity plans using this data.

Jen Otremba:                        Yes.

Bryan Strawser:                   I like your simple explanation.

Jen Otremba:                        We’ve had to describe this to organizations-

Bryan Strawser:                   Many people.

Jen Otremba:                        … recently quite a bit, right?

Bryan Strawser:                   Yeah.

Jen Otremba:                        Because there is a lot of confusion as to what exactly do I need, how do I get there, and then what do I do with the information once I have it?

Bryan Strawser:                   In the traditional world of doing the BIA, the way that I would say business continuity has been done for many, many years, there’s kind of a multi-part process here that you’re starting with a risk assessment to understand the risks and threats to an organization. Through that conversation you determine through some mechanism the criticality of functions because companies have teams. Those teams perform functions or processes, depending on what term you want to use, and those processes are either critical or not. Companies define what is and not critical. For example, in the world that I grew up in with BC a function that needed to be recovered within 30 days was a critical function, everything else wasn’t. We have lots of definitions as to how you get there. We would typically do a survey or some type of mechanism in a tool like Archer or Fusion or LDRPS or something that allows us to capture enough detail to understand whether or not this proce...