Some thoughts about the BIA debate…

Published: Wednesday, 02 October 2019 12:59

In a response to recent articles about the BIA’s role in business continuity, Dr. David Lindstedt responds, saying that much of the debate is predicated on a misunderstanding and is therefore, naturally, rather unproductive. In this article he seeks to clarify the nature of the debate regarding the value of the business impact analysis (BIA) and proposes new questions for consideration.

Where we agree

First off, let us all agree that it is important to identify which departments offer which kinds of services for the organization. And, let us agree that it is also important to identify who will be responsible for continuing or recovering each service following a disaster (and who will serve as alternates if the primary person is unavailable). These are not the points of debate.

Further, it is important to have an understanding as to what each department and service is about. What do they do? What functions or outputs do they provide and why is that significant? Which ones would matter in what kinds of post-disaster situations? Which customers would yell the loudest if they did not receive these functions and outputs like they normally do? What people and resources would you need to produce these functions and outputs in a post-disaster environment? These types of questions are crucial to business continuity discussions, analysis, and preparations and are also therefore not the points of debate.

Finally, note that the question, “HOW would you continue or resume your services in a post-disaster environment?” is not properly the purview of the BIA. Strategies, workarounds, problem solving, solutioning, and the like are part of later phases in the business continuity life cycle. In every existing BC standard, the BIA activities are done in one phase, while the design / strategy activities are done in a different phase. Therefore, we should also all be in agreement about solutioning activities, and this is not part of the debate.

So, what then, is the debate about in the first place? What does the Adaptive BC Manifesto mean when it says to ‘Omit the BIA’?

Wait, what IS the BIA?

It is not so surprising that the scope of the debate is confusing, as the scope of the BIA itself is confusing these days. The BIA has come to mean different things to different practitioners, encompas many kinds of practices, and get appropriated by practitioners to serve numerous purposes.  (1)

When Adaptive BC practitioners say to ‘Omit the BIA’, they are referring to the original understanding of the BIA, namely, what DRJ’s 2019 Glossary of Business Continuity Terms delineates as the ‘process of analyzing activities and the effect that a business disruption might have on them | ISO 22300:2012.” (2)

In other words, the main goal of the BIA is to try and sort out HOW BAD it would be to go without a department’s services if there were a business disruption, and to do this by quantifying impacts.

The heart of the debate

The debate over the BIA came about because the Adaptive BC approach maintains that the BIA’s central goal of quantifying impact has (at least) three significant problems:

Theoretically untenable

Problem #1 has been argued by different authors in different journals, most forcefully in Rainer Hübert’s definitive 2012 paper, ‘Why the Business Impact Analysis Does Not Work’. (3) In it, Hübert makes a compelling argument for the industry to abandon the practice of BIA work entirely because of the “very costly and even fatal misinterpretations and misrepresentations” inherent in the process. While I believe such theoretical problems are themselves enough reason to abandon the practice of the BIA, it has been discussed at length in other articles, and there are even more compelling reasons to consider.

Practically impossible

While it is important to understand why each service is important, and what value it provides (especially in a post-disaster environment), it is practically impossible to quantify ‘the effect that a business disruption might have’ on each of them. This is problem #2. If we are trying to understand how bad it would be to do without certain services if they were unexpectedly rendered unavailable, this leads to a host of questions that must necessarily be answered before we can quantify the impact. For example:

It is practically impossible for an interviewee to provide any meaningful quantitative answer to the question of degree of impact without first being provided with the entire holistic context of the imagined business interruption. It would take binders worth of if/then statements to establish the possible settings for each of the innumerable variables that constitute the entire holistic context of a post-disaster situation. Even if it were possible, what would be the value?

Not valuable

And here we come to the crux of the debate: What is the real value of a BIA? This is an especially important question given how much time and effort is required to produce that value.
Before trying to answer this question of value, it is absolutely essential to remember the scope of the debate: we are evaluating the BIA as defined as the ‘process of analyzing activities and the effect that a business disruption might have on them’, in other words, the attempt to quantify how bad it would be to lose each service offered by every department.

Adaptive BC maintains that there is not nearly enough value produced by performing a BIA to warrant the effort it requires. Understanding why a service is important is essential. But trying to quantify impact is ill-advised. There is great value in learning the business of the business, in seeing how all the different parts work together in support of the mission and goals of the organization. But trying to quantify the impact of the loss of isolated services under nebulous future disaster conditions provides little return for the investment.

Survey 2.0

The questions from Continuity Central’s original ‘To BIA or Not To BIA’ survey were an interesting start, but we can now narrow the focus of what we want to learn. After clearing away the misunderstandings of the debate, we can ask a different set of questions that focus on the value of the BIA and how much effort it takes to provide that value. With those sorts of answers in hand, we can perhaps continue the debate with more empirical evidence to inform it.

Here are the sorts of questions I believe would be educational and potentially insightful:

Estimation of effort

Consider a single department in your organization that might serve as a representative example for most departments in your organization. Answer the following questions based on your organization’s experience either actually conducting BIA assessments or, if your organization has not done BIAs, your estimate of what effort it would take to do so:

Estimation of value

Think back over how you have seen leadership and responders use the actual results of completed BIAs.
For these questions, ‘executive leadership’ refers to senior decision-making leaders within your organization, such as the Board of Directors, members of the c-suite, etc.  (If your organization has NOT done BIA assessments, you should SKIP these questions.)

Final thoughts

The recommendation to ‘Omit the BIA’ represents a rather small part of the overall Adaptive BC approach. In many respects, it is unfortunate that it is oftentimes the focus of debate and even the single point of judgement for the entire Adaptive BC approach. I believe it would be far more productive for industry thought leaders to focus their energy and attention on the best, proven ways to make organizations more recoverable. Business continuity ought to be about the continuous improvement of an organization’s preparedness and recovery capabilities. Our dialogues should center on the serious investigation of which activities actually do the best job of fulfilling this continuous improvement process in which types of organizations for which types of services. To this end, Adaptive BC provides a set of principles (not activities) to promote and frame such a dialogue.

Author

Dr. David Lindstedt, PMP, cABCF is an author, speaker, trainer, and consultant on project management and Adaptive BC.  He can be reached at david@AdaptiveBCS.com.

References