The BIA is here to stay: but the chosen methodology is irrelevant
- Published: Tuesday, 24 October 2017 08:10
Rico Andrew Patron enters the contentious debate about the future of the business impact analysis, responding to two recent articles on Continuity Central, and concluding that, while the BIA will continue to be the foundation from which the BCM program is built, the BIA method chosen must match the unique needs of individual organizations.
I have had the opportunity to read Alberto Alexander’s recent Continuity Central article, “A methodological approach for developing a business impact analysis” which I found to be a helpful guide for any company that aims to do such a task for the first time.
Some time later, I also had the opportunity to read David Lindstedt’s response to Dr. Alexander’s article. Reading Dr. Lindstedt’s article did give me some pause (as he concluded in his article) and encouraged me to consider the relevance of the future of the BIA.
When I first conceptualized my comments to Dr. Lindstedt’s article, I was initially laying out the groundwork on why Dr. Alexander’s approach is sound and reasonable for any practitioner doing the BIA for the first time. Then I reflected on how I did my first BIA back in late 2001 and how my approach was only partially similar to that of Dr. Alexander’s. So, I took another look at Dr. Lindstedt’s article.
As I was digesting his article for the second time, I found myself reading into his other works and references on the BIA. I began to reflect on the various articles I’ve read thus far and how it relates to my response to the Lindstedt article.
While I disagree with Lindstedt in his position that the BIA is both inadequate and unnecessary, I find myself partially agreeing with him on how innovative practitioners work around the requirement and “just call it a BIA”. Yes, business continuity practitioners make use of other tools to develop an understanding of their business and the products and services they deliver. But I don’t believe practitioners “just call it a BIA” - it is BIA.
I believe the confusion here lies in what actually the BIA is versus what it represents. Dr. Alexander gave a methodology for what the BIA can represent but in no way should it be interpreted as what the BIA should actually be for everyone.
The BCI’s Good Practices Guidelines actually hit the nail on the head, stating that one of the deliverables of the BIA is “an understanding of the activities undertaken by the organization that are the most urgent.” I would even go so far as to say that the ultimate objective of the BIA is a holistic understanding of your business. This is what the BIA is and should be in the mindset of business continuity practitioners.
Coming from this perspective of the BIA, the methodology becomes irrelevant but the exercise is not. Dr. Alexander’s article becomes just one of the many tools available out there for business continuity practitioners to use in order to gain a holistic view of their business. This perspective of the BIA can also explain why there is no single approach to BIA that is acceptable to all — simply because every business is unique in its values, in its services, in its people.
This holistic view of the business becomes the framework for the development of the BCM program: which activities become critical given certain conditions? Which ones provide the most failure points that needs to be addressed? In what order should activities be recovered, among others?
Given this perspective of the BIA, it will continue to be the foundation from which the BCM program is built. It will continue to be relevant and necessary and it will be here to stay.
Rico Andrew Patron, AMBCI, MBA, ACS.