What Goes Into A Business Impact Analysis (BIA) Report?

Last week we talked in-depth about the Business Impact Analysis (BIA)—what it is, how it’s done, and common obstacles to getting it done right. Once that process is complete, you’ll want to create a Business Impact Analysis report to share your results with management. The BIA lays the foundation for your business recovery strategies down the line, so it’s critical to not only ensure the accuracy of your BIA procedure from the start, but also to convey its results to stakeholders in a way that’s clear, concise, and compelling.

Essential Elements Of A BIA Report

Before diving into the components of the report, consider your audience.

Your report should be designed to mirror the culture of your organization from a senior management perspective. Some companies, like those in the tech industry, are more informal; other industries, like finance or insurance, are more traditional. Some people prefer data organized in tables, others are used to seeing charts and graphs.

Conforming to expectations in your organization and industry increases the likelihood that your information will be received as relevant and authoritative—especially in light of the challenges inherent in the BIA process. Matching your style of delivery to the preferences of senior management is key to presenting your results in the best possible light.

Standard Report Components  

Aside from the possible variations in delivery, every BIA report should have the same key components. The standard flow of information is as follows:

1. Executive summary. This section includes a general overview of the BIA, touching on:

• The scope of the analysis: How many business units were evaluated?
• Key objectives: What was identified as the goal of the BIA?
• Business Impact Analysis methodology and approach: This section describes—in very general terms—the process you used to conduct the BIA, how interviews were conducted, and how you analyzed the resulting data. Include any assumptions you used while performing it (i.e., the disruption is not disaster-specific, that it occurs during a peak time of business, etc.) and the quantitative categories you used to measure impact (i.e., rankings from 1-5 and their meanings).

2. Business process criticality ranking. What were the results of the study? Describe in full which business units were deemed most critical as a result of the BIA. Also, outline the required recovery timeframes for all evaluated business units and processes, and their critical dependencies.

3. Additional findings. Very often the BIA interview process reveals vital information that could be useful for future planning of recovery strategies; include that information in your report. For instance, it may uncover unexpected areas with exceptionally broad exposure to risk.
4. Action plan. This section summarizes the key actions needed to address the most critical items as determined by the BIA and organizes them by timeframe, for instance, those that require immediate action (0-12 months), near-term action (12-18 months), or long-term action (18-24 months).
5. Conclusion. Tie together everything up to this point, with a summary of what’s needed to keep the company operational.
6. Supporting information. For those who want to see it, list the details of the process here, including names of the participants, tables summarizing business processes, and computer systems by recovery time.

Once you’ve finished the report, create a presentation to go along with it. Strive to make your presentation succinct and to the point. It should essentially be a downsized version of the report. Tell your audience quickly what the BIA was about, the results you came up with, and recommendations on what to do next.

What Should Happen As A Result Of The BIA Report

In a perfect world, management reads the report and signs off on it—that being the directive for relevant parties to get to work implementing recovery strategies and solutions to ensure the continued survival of critical business units in the event of a disruption.

That doesn’t always happen.

If management isn’t prepared to sign off on the full report, that doesn’t mean the process has all been for nothing. An alternative is to get approval for some recommendations and not others.

Start by addressing only those areas deemed most critical. If you can protect your most critical business units (required in the first three to five days of a disruption), your business can continue running and servicing your customers for at least one to two weeks even without your remaining business processes. This solution reduces the amount of cost and effort involved and still protects your business.

Need Help Getting Buy-in On Your BIA?

Do a BIA right the first time, and your business partners will thank you for it. Do it wrong, and you’ll likely never get the buy-in needed to get your recommendations off the ground.

BCMMetrics^TM can help. Our online BIA^OD tool streamlines the Business Impact Analysis process, and ensures that you ask the right questions the first time around. It allows you to easily run detailed reports for each business unit, giving you all the data you need to generate an authoritative and insightful BIA report. And if you need help managing the process, our consulting team will take you through it step by step. We’re committed to helping businesses minimize risk. Are you ready to get started?