A Practical Approach to Business Impact Analysis: Understanding the Organisation Through Business Continuity Management

An effective business impact analysis is vital to the success of any business continuity plan. Done well, it ensures that the continuity strategies that you put in place are adequate to protect your organisation should an incident disrupt its operations. This book delivers a simple and practical method for conducting a business impact analysis by providing an understanding of what information is required and how to use it. Examples illustrate tried and tested approaches to all you need to know, including: planning an initial analysis; integrating the analysis in to your business processes; and using your results to shape the business continuity strategies and plans. Whether looking to implement the requirements of BS 25999-2 or ISO 22301, or simply looking to increase the resilience of your business, this is the essential guide for anyone undertaking or reviewing a business impact analysis. Give yourself the confidence that should an incident disrupt your operations your business continuity response will reflect the real needs of the organisation. A quote for back cover (need to check with Lyndon Bird that he is ok for us to use it): This book is thought provoking as well as highly informative and might be destined to become the definitive guide on how to conduct an effective BIA.A" - Lyndon Bird, International Technical Director, Business Continuity Institute

Table of Contents:
Acknowledgements 6 Foreword 7 Introduction 9 The aim of this book 9 About this book 9 1. What is Business Impact Analysis? 11 1.1 A definition 11 1.2 Why is a BIA so important? 11 1.3 What are the prerequisites? 12 1.1 BIA Scope 13 2 Understanding the BIA 14 2.1 Time and Impact 14 2.1.1 Why is time everything in managing incidents? 14 2.1.2 Stakeholder identification 14 2.1.3 Defining the 'Customer' 15 2.1.4 The nature of impacts 16 2.1.5 Measuring impacts 17 2.1.6 The relationship between impact and time 19 1.1.1 Double whammies 21 1.1.2 BIA and culture 21 1.1 Terminology 21 1.1.1 Activity and process 21 1.1.1 Maximum tolerable period of disruption (MTPD) 23 1.1.1 Recovery Time Objective 28 1.1.2 Is the activity 'Critical'? 29 1.1.3 Maximum Tolerable Data Loss (MTDL) 30 1.1.4 Maximum Survivable Incident 30 1.1 Resources 32 1.1.1 Types of resources 32 1.1.1 Workarounds 33 1.1.1 Backlogs 33 1.1 Interdependencies 34 1.1.1 Dependence on IT 34 1.1 BIA in different sectors 37 1.1.1 BIA in a manufacturing environment 37 1.1.1 BIA in government and public bodies 39 1.1.1 BIA in an emergency response organisation 40 1.1.1 BIA in an organisation with distributed outlets 40 1.1 Alternative approaches 41 1.1.1 How does Risk fit into a BIA? 41 1.1.1 Quick BIAs 43 1.1.1 Too much change? 43 1.1.1 Can we 'Fast-track' (by-pass) the BIA? 44 3. Planning the BIA - Project or Programme? 45 1.1 BIA as a project 45 1.1.1 Sponsorship 45 1.1.2 Setting the initial Terms of Reference 45 1.1.3 Products and Services 45 1.1.4 Trial BIA 46 1.1.5 Duration & Scope 46 1.1.1 The optimum project team numbers 47 1.1.1 Role of external specialists 47 1.1.2 Acquiring the skills 47 1.1.1 When should we review/redo a BIA? 49 1.2 BIA as a process 49 1.2.1 The BIA process 50 1.2.2 The elements of the BIA process 50 3 Strategic BIA 51 3.1 The organisation's strategic review 51 1.1 Using a BIA to set the Scope of the BCM programme 51 1.1 Preparing for the Strategic BIA 51 1.1.1 Understanding the context of the organisation 52 1.1.2 Grouping Key products and services 52 1.1.3 Estimating a draft MTPD 52 1.1 Conducting a strategic BIA 53 1.1 Strategic BIA report 54 4. Tactical BIA 56 4.1 Setting the scope 56 1.1 How do I initiate a tactical BIA 56 1.2 Data collection - Choosing the participants 57 1.3 Data Collection - the data 57 1.1 Data Collection - methods 58 1.1.1 Interviews 58 1.1.2 Questionnaire 58 1.1.1 Workshop 59 1.1.2 Mixture of methods 59 1.1.1 SWOT analysis of data collection methods 59 1.1.1 Conducting an interview 61 1.1.2 Background documents search 62 1.1.3 Analyse and verify data 62 1.2 Completing the process 64 1.2.1 Reporting the findings? 64 1.2.2 Tactical BIA report 64 1.1.1 Presenting the Tactical BIA to top management 70 5 Operational BIA 72 5.1 Activity urgency 72 1.1 Quantifying Resource requirements 72 1.1 Collection of operational data 77 1.1.1 Resource requirements 77 1.1.1 Additional operational data 79 1.1.1 Other operational data 81 1.1 Analysing the Operational BIA data 81 1.1 Reporting the Operational BIA data 82 6 Outcomes from the BIA programme 84 6.1 Threat assessment 84 .1 BC Recovery Strategies 84 1.1.1 Recovery Time Objective 84 1.1.1 Recovery Strategies 85 1.1.1 Data back-up strategy 85 1.1.1 Staff and skills 86 1.1.1 Evaluating supplier BC Plans 86 1.1.1 Risk mitigation measures 86 1.1 Writing the plan 87 1.2 BCM Awareness 88 1.3 Improving the business 88 1.1 Personal development 89 Appendix 91 Consolidated Tactical and Operational BIA form 91

About the Author :
Ian Charters is a specialist in all aspects of Business Continuity Management with a client profile covering many sectors and organisation sizes. He was accepted as a Member of the Business Continuity Institute in 1997, elected a Fellow in 2004 and served as a Board member 2001-7. He is a member of BSI's BCM/1 Committee and a UK expert appointed to ISO TC223. He has experience in a wide range of sectors having undertaken BCM projects in the finance, insurance, logistics, manufacturing and public sectors. He specialises in undertaking BIAs and ensures that the organisation can develop an appropriate BCM programme from the results. Ian is a skilled training presenter and has delivered courses on BIA and other BCM topics in the UK, Cyprus and the Middle and Far East. This book is derived from the successful BIA course run regularly in the UK.