Taking a casual attitude toward assessing the impact of interruptions to your business processes undercuts your whole business continuity program. In today’s post, we’ll explain how being systematic in assessing impacts improves resilience and show you an easy but effective way to perform this task.
Many companies take a casual attitude toward gauging the impacts of interruptions to their various business processes. When confronted with the question of, “What would the impact be if we lost business process X?”, they come up with an answer that amounts to an educated guess. There is a better way, as we’ll see in a moment. First, let’s look at why winging it in this area is not a good idea.
Why It Matters
As a reminder, where this issue comes up is in completing the Business Impact Analysis (BIA). The BIA is where you go through department by department identifying the most critically time sensitive business processes for each department and ultimately for the organization as a whole. Once you have your prioritized list of business processes, you know what to focus on in your business continuity recovery planning. The processes ranked highest in priority will be the ones that are protected the most and can be recovered the fastest.
Based on the above, you can see how important it is to make sure the prioritization truly reflects potential impact. To get this wrong is to protect some things more than they are worth and to protect others less than they need. Winging it increases the likelihood you will err in prioritizing your business processes. As a result, you are likely to waste resources protecting things that don’t need it and create vulnerabilities by not protecting things that do need it. This could cost dearly during an event.
A Good Way To Do It
There is not a one-size-fits-all solution to choosing and weighting BIA impact categories. The best approach varies depending on the organization’s industry, mission, culture, values and so on. The suggestions below are like a size 10 shoe—perfect for many people, and roughly in the middle for the population overall.
At MHA Consulting, we recommend that each organization settle on six impact categories for its BIAs. (More is too cumbersome.)
We further recommend that three of these should be quantitative and three qualitative.
For our clients, the three most commonly used quantitative impact categories are:
- Loss of revenue
- Increase in operating costs
- Penalties, fines, and sanctions
As you can see, all of those are measured in dollars.
The three most commonly used qualitative impact categories are:
- Impact to customer service and delivery (external and internal customers)
- Operating efficiencies
- Public good will, brand image, reputation
These can’t be measured in dollars, which incidentally leaves us comparing apples to oranges. (We’ll square that circle in a minute.)
There are three more parts of the puzzle: timeframes, impact scale, and category weighting.
If someone were to ask you how much it would impact your family financially if you were to lose the use of one car, you would almost certainly respond with a question of your own: lose it for how long?
It’s the same in doing impact assessments. In addition to settling on your impact categories, you also need to come up with a few timeframes to use. We generally recommend the use of these five:
- 12 hours or less
- Between 12 hours and 24 hours
- between 24 hours and 48 hours
- between 2 days and 5 days
- Greater than 5 days
So for every process, you’ll be evaluating the impact for each of these time periods. (What would it cost if your family lost the use of that car for up to 12 hours? How about between one and two days? And so on.)
If you guessed that these correspond with your Recovery Time Objectives (RTOs), go to the head of the class.
The impact scale is the tool that lets us convert everything (dollar and non-dollar items) into the same units for easy comparison. Basically, every impact is converted to a value on a scale of one (none to negligible) to five (catastrophic). For the financial items, this means setting up dollar ranges (e.g., a loss of up to $100,000 might qualify as a 1; a loss of between $1 million and $5 million might be a 4, and so on). The scaling would be different for every company.
Weighting The Impact Categories
The last piece of the puzzle is weighting the impact categories. This is important because not every category is equally important to every organization. This is handled with the use of percentages. Assign a percent value to each of your categories so that the total adds up to 100.
Traditionally, companies rated financial impacts higher than the qualitative ones. The situation has flipped in the past couple of years, presumably because of social media. Nowadays, many, possibly most, organizations rate impacts to customer service and delivery and reputational and brand damage as more potentially harmful than the loss of dollars.
Putting It All Together
By putting it all together—quantitative and qualitative impact categories, timeframes, impact scale, and category weighting—you can introduce method, system, and rigor to the process of assessing the impact of the loss of your various business processes. This increases the chances that you will prioritize and protect those processes that really matter to your organization.
If you still find it confusing, take a look at our ebook, Your BIA Action Guide: A Handbook for BCM Professionals, which discusses the topic in detail (free with registration).
Alternatively, you could get in touch with us for advice tailored to your organization’s unique needs and situation.
For more information on conducting BIAs and other hot topics in BCM and IT/disaster recovery, check out these recent posts from BCMMETRICS and MHA Consulting:
- How to Weight Your BIA Impact Categories
- BIA Blunders: 6 Common Mistakes Organizations Make When Conducting BIAs
- The Big Decision: Choosing What Software to Use for Your BIAs
- Top 5 Reasons Why Most BIAs Are DOA
- A Backward Glance: Revisiting Our Key Blog Posts from 2021