But there are differences between well-done BIAs, and poorly done BIAs. This piece will focus on just one area: setting reasonable objectives. You really have to get that right if the overall process is to be of value.
Remember, the primary purpose of the BIA is to understand which business functions will cause the most pain if disrupted. That way you can focus your planning and mitigation efforts where they will do the most good. Once those functions are adequately addressed, you can move on to the next priority tier.
A secondary goal can be to understand some essential details about the critical functions: recovery time objectives, recovery point objectives, interdependencies, IT requirements, employee skills, essential third parties/records/equipment, etc.
Some BIA’s try to catalog detailed information for every function that occurs within an organization. Its unnecessary, and it’s a distraction. In fact you’ll be digging a hole because you’ll be asking people for a lot of information that won’t ever be used. People don’t like that, and you wouldn’t either. It’ll damage your credibility.
One Step at a Time
So, if the objective of step one was to fill your priority “buckets” (High, Moderate and Low criticality), you can now set an objective for the next step. In this step you’ll gather essential details for just the high criticality functions. Your stakeholders will understand why that’s appropriate. It makes sense and they can support it. And its far less taxing on the organization.
Regardless of how meticulous you prepare for the BIA, your results won’t be 100% spot on, and that’s actually OK. So keep the BIA as simple as you think you can…build support and understanding, and realize that some adjustment will be necessary. As people become more aware of the business continuity program, they’re thinking will evolve, as will their thoughts on what is most critical. That evolution in thinking is a terrific sign; it means that people are engaged and improving what’s been put in place. And you'll be on your way to an effective business continuity program.