In last week’s episode, we discussed the traditional approach to the Business Impact Analysis (BIA), a part of the Business Continuity Lifecycle. This week, we’re going to talk about the trend towards not doing the BIA at all.
In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & CEO Bryan Strawser and Senior Consultant Jennifer Otremba talk through the recent trend of not completing a more traditional business impact analysis, or BIA, process as a part of an organization’s annual business continuity lifecycle. Topics discussed include why organizations are choosing not to complete a BIA, alternate processes that allow an organization to gain much of the needed information through other means, and thoughts on where this trend will continue to evolve.
Episode Transcript
Bryan Strawser: To BIA or not. That is the question.
Jen Otremba: That’s right. So last week, we talked about the BIA.
Bryan Strawser: We did. We talked about the traditional BIA.
Jen Otremba: The business impact analysis. Yep.
Bryan Strawser: And this week we’re gonna talk about not doing the BIA. Alternate ideas around the BIA. Or justification for not doing the BIA. Of course, I’m stealing from Shakespeare’s Hamlet …
Jen Otremba: All day long.
Bryan Strawser: All day long …
Jen Otremba: That’s right.
Bryan Strawser: I’ve been quoting Shakespeare. Not really. But when we do the traditional BIA, we expect to get certain outcomes. And those outcomes are understanding activities that support products and services at the company, understanding the impact over time of those activities not happening, or how we can measure the impact of a disruption to your critical processes, or …
Jen Otremba: Financial impacts.
Bryan Strawser: Yeah, we’re capturing all kind, and again, not just financial.
Jen Otremba: Right, absolutely.
Bryan Strawser: We’re capturing all kinds of impacts, reputational, community, brand, regulatory, et cetera.
Jen Otremba: Yes.
Bryan Strawser: We’re setting prioritized time frames for resuming these activities, in some kind of organized manner of what’s important first, and et cetera, and we’re identifying dependencies, and those might be suppliers, or technologies, or other relevant interested parties.
All important, but there’s a growing belief that, perhaps, doing this in-depth BIA on an annual or bi-annual basis, or every two years, or what have you, is not important more. Why is that?
Jen Otremba: Well, I think, in some aspects, they’re not necessarily making the argument that it’s not important, but that the expense of doing it, or the time it takes to do it, it is very time-consuming process, is unnecessary, is maybe the argument, and that their time can be spent better elsewhere.
Bryan Strawser: Agreed. We’re also seeing the argument that, really, things are either critical, or not. If they’re critical, they should be recovered as quickly as possible, and things that are not critical, we’re just not gonna worry about anymore. That’s one theory.
Another theory, that … this one actually makes more sense to me, is … when you’re in the crisis, your executives are calling the shots. And your executives know, very quickly, which services are mission critical,