To BIA or not to BIA? Final survey results
- Details
- Published: Thursday, 29 June 2017 14:34
One of the differentiators of the new approach to business continuity advocated by Adaptive BC is the removal of the business impact analysis and risk assessment from the business continuity process. Continuity Central conducted a survey to assess whether this is a realistic proposal. The results, based on a total of 212 responses, are now available and can be seen below. To read the full introduction to the survey, click here.
Respondents
The vast majority of responses came from larger organizations (83.49 percent were from organizations with more than 250 employees). 11.32 percent were from small organizations (less than 50 employees) and 5.19 percent were from medium sized organizations (51 to 250 employees).
Respondents came from many different countries with the top four being:
- United States: 29.7 percent
- United Kingdom: 25.9 percent
- Australia: 8.0 percent
- Canada: 7.5 percent.
Omitting the risk assessment?
The first question asked in the survey was ‘Do you think that it is possible to omit the risk assessment from the business continuity process?’ Overall responses were as follows:
- Yes: and the resulting business continuity plan would be fully functional: 33.33 percent
- Yes: but the resulting business continuity plan would be weakened: 13.62 percent
- No: the risk assessment is a vital part of the business continuity process: 46.48 percent
- I'm not sure: 6.57 percent
When broken down by organizational size, some significant differences can be seen, as shown in the following table:
| Organizational size | Yes: and the resulting business continuity plan would be fully functional | Yes: but the resulting business continuity plan would be weakened | No: the risk assessment is a vital part of the business continuity process | Not sure |
Small | 12.5 percent | 4.17 percent | 79.17 percent | 4.17 percent |
| Medium | 27.27 percent | 18.18 percent | 54.55 percent | 0 percent |
| Large | 36.72 percent | 14.69 percent | 41.24 percent | 7.34 percent |
Respondents were invited to make a comment about their response to this question. 116 comments were received and can be read here (PDF).
Omitting the business impact analysis?
The second question asked by the survey was 'Do you think that it is possible to omit the business impact analysis from the business continuity process?' Total responses to this question were:
- Yes: and the resulting business continuity plan would be fully functional: 19.25 percent
- Yes: but the resulting business continuity plan would be weakened: 9.86 percent
- No: the BIA is a vital part of the business continuity process: 64.79 percent
- I'm not sure: 6.10 percent
Again, when broken down by organizational size, some significant differences can be seen, as shown in the following table:
| Organizational size | Yes: and the resulting business continuity plan would be fully functional | Yes: but the resulting business continuity plan would be weakened | No: the BIA is a vital part of the business continuity process | Not sure |
Small | 8.33 percent | 16.67 percent | 75.00 percent | 0 percent |
| Medium | 9.09 percent | 9.09 percent | 81.82 percent | 0 percent |
| Large | 21.59 percent | 9.09 percent | 61.93 percent | 7.39 percent |
Respondents were invited to make a comment about their response to this question. 120 comments were received and can be read here (PDF).
Influence of standards
Respondents were asked to identify the business continuity standard which they are most familiar with and then were asked the following question: Thinking about compliance with the business continuity standard, which comes closest to your view:
- A risk assessment and a BIA are both essential for compliance with this standard.71.36 percent of respondents chose this option
- A risk assessment is essential for compliance with this standard but not a BIA. 4.37 percent of respondents chose this option
- A BIA is essential for compliance with this standard but not a risk assessment. 14.56 percent of respondents chose this option
- Neither a risk assessment nor a BIA are essential for compliance with this standard. 9.71 percent of respondents chose this option.
58 comments were received about this question and these can be read here (PDF)
Analysis
We have not included an analysis with these survey results in order to keep the information as objective as possible. An analysis will be published as a separate article at a later date; and readers are invited to submit their own analysis for publication: simply email it to editor@continuitycentral.com
