The "Who, What, When, Where, Why, and How" of a Business Impact Analysis April 25, 2018

What is a BIA? What are the components? What are the critical business processes? What is the desired output?

Why the need for a Business Impact Analysis?

Who should be interviewed? Depart heads SMEs (business and IT) Critical vendors Who should validate responses? Department IT Senior Management Who sees the final results?

Frequency Program Initiation Annually, in the Spring OR New Services New or Enhanced Applications/Systems New Processes New Vendors

Business Process Recovery Objectives Recovery Metrics RTO (RTA) RPO (RPA) MAD Workarounds Tiers

Where do you store the information you’ve collected? Word/Excel? BCM Software? (Cloud or in-house) Be sure it’s backed up! Where do you store the backup?

Executive Buy In Create a Project Plan Develop Questionnaire Kickoff Meeting Establish Timeline Objective Department Interviews Validate results (Business and IT) Publish Findings (business speak vs. BC jargon) Department Signoff Executive Presentation Executive Signoff

Considerations The Interview Distributed questionnaire vs. live interview Live Interview Group or Department (consider scope) Length of interview Questionnaire Length of questionnaire Time allowed to complete

Considerations The Questions Business cycles (peak periods) Operational Impacts Financial Impacts Qualitative Impacts (brand image, customer confidence) Legal or Regulatory impacts Upstream, Downstream dependencies Staffing requirements Vital records Process documentation and workarounds Downtime tolerances and data loss

Think worst case business impact Not our place to say right or wrong but we can challenge assumptions or statements Be cognizant of the number of total processes Have a standardized set of descriptions for critical processes Senior Management has final say or what is critical

Questions?