This week I have been in Perth, Australia, working with a Scottish client’s Australian operation starting them on their journey to ISO 22301.
I haven’t been following the UK or European news so I am not going to write on the Euro 2016 “riots” which have been taking place. I thought I would write this week on an altogether on a much more exciting subject for us business continuity people; conducting a BIA!
In the Business Continuity Institute’s Good Practice Guidelines 2013 there are three different ways of gathering the information which goes in a BIA. The three ways are:
1. Workshops
2. Interviews
3. Questionnaires
I personally favour a hybrid approach ofworkshops followed by asking people to fill in a BIA questionnaire.
During the workshop we give people training on ‘what is business continuity’; followed by the key knowledge they need to fill in the BIA questionnaire. We try and get those attending the workshop to get as much of the information into the questionnaire during the workshop. Theyare then encouraged to discuss the information with their colleagues and send the completed workbook to PlanB Consulting where we compile all workbooks into a single BIA document. By giving those attending the workshop the knowledge to fill in the questionnaire, and making them fill out the document, we achieve sustainability in business continuity as they have the knowledge to update their part of their answers and understand how the outputs of the BIA such as MTPD, and RTOs, were arrived at.
When teaching students, the reason I am not very keen on interviews is because they can take a very long time; 45 minutes per interview and then the same again to write them up. Consultants like interviews as they can charge large sums of money per day for doing them. Some people find it difficult when put on the spot to give the key information about their business and prefer some time to reflect on their answers, or to discuss it with colleagues.
Questionnaires, I believe, can be a disaster unless you give staff training on how to fill them in. However good your accompanying explanation of what they need to put in the forms, they will inevitably not be filled out correctly without training, and you will spend ages chasing people for information.
This week, because we were not familiar with the operations of the client, we decided to interview all senior staff and try and gather the information needed for the BIA during the interview. We then wrote up the information from the interviews and played it back to them a couple of days later for confirmation. We felt this could be done in a shortened workshop of two hours rather than our normal 4-5 hours.
I found conducting the interviews to be quite difficult as we had limited time with each member of staff. The interview started with them explaining what they did and how they did it, followed by looking at some of the timings associated with their activities, resources required, and risks. I found it difficult to move from the very broad brush of what they do, to the very detailed stuff such as what IT systems they use. I also found, as I hadn’t explained in advance why I was asking certain questions, which you would do in a workshop, that they started to question our methodology and that we didn’t understand what they did. We got the information in the end but it was hard work. The information on the business was excellent and we had a good idea of what they did but the information which was required to fill out our BIA document was much more difficult. I felt I still needed to do a workshop and to get them to fill in the BIA Questionnaire as well as doing the interviews.
I would be interested to hear from any others of their experience of carrying out BIAs and how you have found the best way of getting the information you require. I am also interested in knowing, if you are doing interviews or workshops, how long you take to do them!
