The publishing of the ISO 22317 Business Impact Analysis Guidelines represents a significant step forward for the world of business continuity, but business continuity managers may find that it doesn’t offer as complete a recipe as they need.
For the first time, people working in business continuity management have recourse to a reliable method and list of ingredients to complete a business impact analysis (BIA), enabling them to assess the effects of serious interruptions to their operations and plan accordingly. The BIA has been considered something of a soufflé in business continuity management, simply because it has proven so difficult to get the recipe right under all organisational conditions.
If you or your family watch the Great British Bake Off, you may well know that each week the contestants faced a technical challenge. Given a set of ingredients, and a stripped down version of the recipe, they would be tasked with creating a complex bake that they had most likely never eaten or even seen. The results are often eyebrow-raising, with people using the same ingredients for different purposes, or missing crucial elements and techniques.
The ISO 22317 guidelines are the technical challenge of business continuity management. The document is badged as a Guide but still tastes strongly of "Standard" whereas its 29 pages could be usefully expanded to provide more practical hints and tips whilst still remaining universal in its context. Even though the problems of a poorly put together BIA aren’t as simple as a misshapen sponge or runny crème patisserie, business continuity managers are still expected to create a perfect analysis first time to strict deadlines.
With that in mind, I’ve put together a some thoughts on the guidelines which you can download, covering additional areas that business continuity managers and business continuity consultants alike need to consider in putting together their BIA. With a little extra consideration, you can be on course to achieve star baker with an analysis that arms your organisation with the information it needs to respond to disruption.