In a response to recent articles about the BIA’s role in business continuity, Dr. David Lindstedt responds, saying that much of the debate is predicated on a misunderstanding and is therefore, naturally, rather unproductive. In this article he seeks to clarify the nature of the debate regarding the value of the business impact analysis (BIA) and proposes new questions for consideration.
Where we agree
First off, let us all agree that it is important to identify which departments offer which kinds of services for the organization. And, let us agree that it is also important to identify who will be responsible for continuing or recovering each service following a disaster (and who will serve as alternates if the primary person is unavailable). These are not the points of debate.
Further, it is important to have an understanding as to what each department and service is about. What do they do? What functions or outputs do they provide and why is that significant? Which ones would matter in what kinds of post-disaster situations? Which customers would yell the loudest if they did not receive these functions and outputs like they normally do? What people and resources would you need to produce these functions and outputs in a post-disaster environment? These types of questions are crucial to business continuity discussions, analysis, and preparations and are also therefore not the points of debate.
Finally, note that the question, “HOW would you continue or resume your services in a post-disaster environment?” is not properly the purview of the BIA. Strategies, workarounds, problem solving, solutioning, and the like are part of later phases in the business continuity life cycle. In every existing BC standard, the BIA activities are done in one phase, while the design / strategy activities are done in a different phase. Therefore, we should also all be in agreement about solutioning activities, and this is not part of the debate.
So, what then, is the debate about in the first place? What does the Adaptive BC Manifesto mean when it says to ‘Omit the BIA’?
Wait, what IS the BIA?
It is not so surprising that the scope of the debate is confusing, as the scope of the BIA itself is confusing these days. The BIA has come to mean different things to different practitioners, encompas many kinds of practices, and get appropriated by practitioners to serve numerous purposes. (1)
When Adaptive BC practitioners say to ‘Omit the BIA’, they are referring to the original understanding of the BIA, namely, what DRJ’s 2019 Glossary of Business Continuity Terms delineates as the ‘process of analyzing activities and the effect that a business disruption might have on them | ISO 22300:2012.” (2)
In other words, the main goal of the BIA is to try and sort out HOW BAD it would be to go without a department’s services if there were a business disruption, and to do this by quantifying impacts.
The heart of the debate
The debate over the BIA came about because the Adaptive BC approach maintains that the BIA’s central goal of quantifying impact has (at least) three significant problems:
- It is theoretically untenable.
- It is practically impossible.
- It produces little to no value.
Theoretically untenable
Problem #1 has been argued by different authors in different journals, most forcefully in Rainer Hübert’s definitive 2012 paper, ‘Why the Business Impact Analysis Does Not Work’. (3) In it, Hübert makes a compelling argument for the industry to abandon the practice of BIA work entirely because of the “very costly and even fatal misinterpretations and misrepresentations” inherent in the process. While I believe such theoretical problems are themselves enough reason to abandon the practice of the BIA, it has been discussed at length in other articles, and there are even more compelling reasons to consider.
Practically impossible
While it is important to understand why each service is important, and what value it provides (especially in a post-disaster environment), it is practically impossible to quantify ‘the effect that a business disruption might have’ on each of them. This is problem #2. If we are trying to understand how bad it would be to do without certain services if they were unexpectedly rendered unavailable, this leads to a host of questions that must necessarily be answered before we can quantify the impact. For example:
- How are our competitors responding?
- How are stakeholders reacting?
- How are stockholders reacting?
- How have our competitors been impacted?
- How is the Board reacting?
- How is the market reacting?
- How is the media and social media portraying the interruption?
- How long is the interruption expected to last in the affected region(s)?
- How long will this service be interrupted?
- How widespread is the interruption?
- What events are scheduled for the next several days?
- What has happened to our customers?
- What is the time of day, week, month, and year?
- What other services in the organization have been interrupted?
- What percentage of people, places, and things have we lost?
- What percentage of people, places, and things are available within what timeframes?
- Where are we in our production schedule?
- Where are we in the lifecycle of key projects and time-to-market?
- Who, at this exact date and time of the interruption, is making decisions at each level, what is their state of mind, and what do they think is valuable?
- Who, specifically, is unavailable as a result of the interruption?
It is practically impossible for an interviewee to provide any meaningful quantitative answer to the question of degree of impact without first being provided with the entire holistic context of the imagined business interruption. It would take binders worth of if/then statements to establish the possible settings for each of the innumerable variables that constitute the entire holistic context of a post-disaster situation. Even if it were possible, what would be the value?
Not valuable
And here we come to the crux of the debate: What is the real value of a BIA? This is an especially important question given how much time and effort is required to produce that value.
Before trying to answer this question of value, it is absolutely essential to remember the scope of the debate: we are evaluating the BIA as defined as the ‘process of analyzing activities and the effect that a business disruption might have on them’, in other words, the attempt to quantify how bad it would be to lose each service offered by every department.
Adaptive BC maintains that there is not nearly enough value produced by performing a BIA to warrant the effort it requires. Understanding why a service is important is essential. But trying to quantify impact is ill-advised. There is great value in learning the business of the business, in seeing how all the different parts work together in support of the mission and goals of the organization. But trying to quantify the impact of the loss of isolated services under nebulous future disaster conditions provides little return for the investment.
Survey 2.0
The questions from Continuity Central’s original ‘To BIA or Not To BIA’ survey were an interesting start, but we can now narrow the focus of what we want to learn. After clearing away the misunderstandings of the debate, we can ask a different set of questions that focus on the value of the BIA and how much effort it takes to provide that value. With those sorts of answers in hand, we can perhaps continue the debate with more empirical evidence to inform it.
Here are the sorts of questions I believe would be educational and potentially insightful:
Estimation of effort
Consider a single department in your organization that might serve as a representative example for most departments in your organization. Answer the following questions based on your organization’s experience either actually conducting BIA assessments or, if your organization has not done BIAs, your estimate of what effort it would take to do so:
- About how long would it take you / the BC practitioner to prepare to administer a BIA? Be sure to think about preparation activities such as: identifying participants, communicating with them, scheduling their time, preparing the BIA survey materials, setup, and travel. (Hours);
- How many people on average would participate in answering BIA questions for a department? (Do not include you / the BC practitioner in this count.) (Number) ;
- How long on average would each participant spend answering BIA questions? (Hours) ;
- How long on average would you / the BC practitioner spend facilitating BIA questions with all the participants? (Total hours);
- Finally, roughly how many departments are there in your organization? (If you have a very large organization, you can estimate how many geographic or functional areas there are and roughly how many departments there are in each area to estimate a total.) (Number)
Estimation of value
Think back over how you have seen leadership and responders use the actual results of completed BIAs.
For these questions, ‘executive leadership’ refers to senior decision-making leaders within your organization, such as the Board of Directors, members of the c-suite, etc. (If your organization has NOT done BIA assessments, you should SKIP these questions.)
- Has any member of your executive leadership spent more than 10 minutes directly analyzing BIA results? (Y/N)
- Has any member of your executive leadership made BC investment decisions specifically based on their review of BIA results? (Y/N)
- Has any member of your executive leadership changed their minds about which services in their organization are most important based on their review of BIA results? (Y/N)
- Do middle managers (directors, vice presidents) meet together to discuss BIA results? (Y/N)
- In a post-disaster situation or while responding to the threat of a significant business interruption, did key responders use BIA results to manage the disaster and recovery response? (If your organization has not been in such a situation, simply answer “NA”.) (Y/N/NA)
- In your own personal opinion, what do you estimate as the value of BIA results in your organization? (Likert scale, 1-6, with 1 being “No value,” and 6 being “High value.”)
- (Bonus: Directly ask two members of your executive leadership to estimate the value of BIA results in your organization using the Likert scale!)
Final thoughts
The recommendation to ‘Omit the BIA’ represents a rather small part of the overall Adaptive BC approach. In many respects, it is unfortunate that it is oftentimes the focus of debate and even the single point of judgement for the entire Adaptive BC approach. I believe it would be far more productive for industry thought leaders to focus their energy and attention on the best, proven ways to make organizations more recoverable. Business continuity ought to be about the continuous improvement of an organization’s preparedness and recovery capabilities. Our dialogues should center on the serious investigation of which activities actually do the best job of fulfilling this continuous improvement process in which types of organizations for which types of services. To this end, Adaptive BC provides a set of principles (not activities) to promote and frame such a dialogue.
Author
Dr. David Lindstedt, PMP, cABCF is an author, speaker, trainer, and consultant on project management and Adaptive BC. He can be reached at david@AdaptiveBCS.com.
References
- While I have tried to outline and analyze these different conceptions and uses of the BIA, that topic itself is much too long to try and cover here. C.f., https://www.continuitycentral.com/index.php/news/business-continuity-news/2113-what-was-the-bia
- https://www.drj.com/downloads/drj_glossary.pdf, viewed 8/24/19
- http://connection.ebscohost.com/c/articles/76150560/why-business-impact-analysis-does-not-work
