A few of you didn’t take kindly to a blog I wrote a while back that suggested some of us business continuity planners have fallen victims to our own methodology. Well, get ready to be offended once again.
This time, I want to take a look at the Business Impact Analysis (BIA) process and how we establish Recovery Time Objectives (RTO) – be they for business functions or software and applications.
In this case, I think we have fallen victims to our questionnaires. Now, of course, some questionnaires are much more detailed and better than others, but I think they all fail from the problem that we do not put our questions in perspective of the bigger picture. Ultimately, these questionnaires come down to the question of, “How long can we go without … doing something, or running something?” Like I said, some questionnaires do a pretty good job of also gathering the justification for the ultimate answer, but…
I think the savvy business manager is the one who everyone else thinks is a pain in the asking. The savvy business manager will stop short of answering these questions until he or she knows what the corporate position is on business targets during a crisis. I would resist answering these questions until I knew what the Executive Teams’ expectations were for my department.
In other words, I would want to know; During a crisis…
- Are our revenue targets adjusted?
- Are profit targets adjusted?
- Are margin targets adjusted?
- Or, whatever business metrics I am measured against – are they adjusted?
I think most BIAs start and end with middle management answering individual BIA questionnaires, when, in fact, they should start with Executive Management establishing a Crisis Management Business Plan establishing the acceptable business targets to be achieved during a crisis. Armed with that information, middle management has a more realistic shot at providing valid answers to our questionnaire. Right now, every business manager is making their own assumptions about what Senior Management is expecting and these are likely not consistent across the board.
Furthermore, I think most planners simply accept the BIA answers provided with little push back. Look, I’ve been a planner for a long time – I know exactly how easy it is to be so excited just to get any answers back that you do not dare challenge the results. But, how often have you seen situations where business managers say they cannot be down for more than 4 hrs and yet close the entire office for a day or more during a snow storm? Or, there is a function performed by 3 staff members and at time of crisis they say they need all three to be up and running in 4 hours – you mean none of these people ever take a vacation? Again, it goes back to the original problem – it all depends what they think they need to achieve during a crisis.
Now before you jump down my throat – I do get that during a crisis you may not be functioning the same as normal. You may be doing some things manually, requiring more labor. I am just suggesting that sometimes we need to push back a little and have the managers support their answers and make sure they have thought things through logically.
Now on the opposite side of the spectrum, I was working for Comdisco during the World Trade Center bombing in 1993 and I worked very closely with two financial services firm recovering from that event. On the Monday following the bombing – the first business day following the event – these companies experienced a call and transaction volume almost 10 X their normal volume! So they, in fact, had some functions in which they really needed more than 100% of the workforce recovered. I think, as planners, we may need to also push back on some departments to make sure they have taken into consideration the possible changes in work flow and volumes, given the fact that they had a disaster. Insurance companies are just one example of organizations in which the disaster itself could be a catalyst for increased work activity.
It just seems to me that sometimes, and I don’t mean everyone does this, but sometimes, the BIA really simply becomes a Business Impact information gathering tool and we forget to do that “A” part – we forget to analyze the answers provided.
So, in summary, I think we can sometimes help the process along if we first get Senior Management to establish adjusted business targets for operations during crisis before asking middle management how long they can be down; and, I think we could do a better job challenging some of the answers we get back to our, sometimes, ambiguous questions.
Okay, there you go, now let me have it and tell me why I’m wrong.