Business

business impact analysis

2008-01-21T07:28:00.000-08:00

Business impact analysis (BIA) is an essential component of an organization's business continuance plan; it includes an exploratory component to reveal any vulnerabilities, and a planning component to develop strategies for minimizing risk. The result of analysis is a business impact analysis report, which describes the potential risks specific to the organization studied. One of the basic assumptions behind BIA is that every component of the organization is reliant upon the continued functioning of every other component, but that some are more crucial than others and require a greater allocation of funds in the wake of a disaster. For example, a business may be able to continue more or less normally if the cafeteria has to close, but would come to a complete halt if the information system crashes.

As part of a disaster recovery plan, BIA is likely to identify costs linked to failures, such as loss of cash flow, replacement of equipment, salaries paid to catch up with a backlog of work, loss of profits, and so on. A BIA report quantifies the importance of business components and suggests appropriate fund allocation for measures to protect them. The possibilities of failures are likely to be assessed in terms of their impacts on safety, finances, marketing, legal compliance, and quality assurance. Where possible, impact is expressed monetarily for purposes of comparison. For example, a business may spend three times as much on marketing in the wake of a disaster to rebuild customer confidence.

2008-01-21T07:24:00.000-08:00

What you will learn from this tip:

What is a business impact analysis, what are the benefits of a BIA and how to perform one.

Conducting a business impact analysis is hard work and takes time. But once this data is collected, security practitioners can confidently request resources, and more importantly, prioritize security efforts across the enterprise.

Simply stated, BIA is an analytic process that aims to reveal business and operational impacts stemming from any number of incidents or events.

A BIA traditionally leads to a report detailing likely incidents and their related business impact in terms of time and dollars. For example, a BIA report for an online retailer may include a Web site outage of one day with the loss calculated as the yearly gross sales divided by number of days per year the site is open for business.

In order to conduct a BIA you need to understand the business operations of your company in detail. You need to roll up your sleeves and reach out to operational folks to get the real picture. I remember one such exercise on a consulting engagement at a large bank where it was assumed that if the tellers lost their computer terminals that the dollar impact per hour was in the millions. The bank tellers later told me that when the terminals aren't available they can continue accepting deposits and other transactions, then manually batch the transactions at the end of the day. There was actually a five- to seven-hour window of no real loss of revenue.

Here is a simple step-by-step approach that will put you on your way to conducting a successful BIA.

Document the gross revenue and net profit your organization generates per year. This data sets the upper bound for business losses related to business operations. It will not, however, set the limits for reputation, regulatory or legal losses that can rise above yearly revenue.
Define the critical business systems your organization operates. This data can be entered and tracked in a spreadsheet. In many cases the revenue data can be linked to critical systems. This is especially true in e-commerce-driven companies.
Classify each system as business critical, important or non-critical. Ask system operators what would happen if a particular system was not available for an hour, a day or a week. In most cases you can quickly classify systems based on operator responses.
Document which systems have cross dependencies. There may be non-critical systems that act as upstream or downstream components to critical systems. For example, DNS service may not appear to be critical to an online store until it is discovered that the credit card gateway relies on DNS to send credit card requests and process transactions. This type of cross dependency may require a reclassification of systems when linked to critical applications.
Estimate the financial, revenue and non-revenue impacts associated with each system. For example, a payment gateway server for fax orders that does only 1% of the total revenue of the company can easily be estimated as .01 x gross revenue. If data does not exist or is not easy to estimate, the replacement cost (including labor) can be used for important and non-critical systems. For non-revenue related systems, note impact. For example, if the payroll system is not working, employees may not get paid on time -- which may cause other issues.
Estimate the cost to identify, remediate, recover and resume operations for each system in the spreadsheet. Include labor, hardware and software costs. For incidents that result in negative reputation, legal and regulatory outcomes, include estimate of fines, legal costs or a marketing campaign to win back customer confidence. Add these costs to impacts defined in step five.
Identify the Maximum Acceptable Outage (MAO) for each system. This is the time from the detection of the outage to obviation of importance to business. For example, if an online bookseller's Web site is down for over a week, it may lose all customers to the competition. However, an overnight outage may only result in a few lost orders. Some real-time financial industry systems may have very low MAO values, where more elongated global supply-chain processes with built-in delays may have MAO values that exceed a month.
Identify and document potential system threats, severity and the probability at which they may occur. For example, a datacenter fire severity would be 1.00 (on a .0–1.0 scale) but the probability may only be .01 (1%) in a given year. Threat statistics are available from a variety of sources and are used by insurance companies to calculate insurance premiums. Create a threat score for each incident type in a different section of the same spreadsheet. In the above example you would multiply (.01 x 1.0 =.01) and yield a combined risk score of .01 or 1%. Do this for all conceivable threats. You will also want to list one generic loss at 100% just to have a line item that reflects a complete loss for each system regardless of the incident or probability. This sets the upper bound for the system valuation.
Now you have most of the data needed to start the process. It is best to use the simple formula functions that a spreadsheet provides. For every system you have defined with a loss value, multiply the series of values from the threats listed in step eight with the combined loss values from step six to see the relative loss or impact per system. Do this on a line item basis. For each system calculate all possible listed threats. Do not include items that are not physically possible. For example, if you have business systems in Malaysia and New York, don't include the volcano or similar incidents that can't really happen in New York.
In this last step you will sort the data you have to show the top priority systems both from a business criticality and impact perspective. In the spreadsheet, select all columns in the sheet and use the "auto-filter" function on the data-sorting menu of your spreadsheet to link all the columns relationally. You can now sort on any of the variables in the sheet. Optionally, you can create a scorecard-like report by dressing up the spreadsheet, or add a narrative document and use the spreadsheet as the supporting data source.

Your BIA report can be used to request and prioritize resources, and incident-response activity. If done properly, it will be in a format your CFO and finance department can understand and include impact data gathered from these very same people, thus overcoming any objections or pushback on the validity of your report and subsequent resource requests!

2008-01-21T06:54:00.000-08:00

Nine Tips for Successful Business Succession Planning

Okay, so succession planning isn't the first thing that comes to mind when you think about launching a business. But turning a small business into a success depends largely on building a strong culture with strong relationships, and on having an exit strategy that you can use to help define your goals.

If you've yet to give a thought to succession planning, or if you've simply been putting it off while you concentrate on more immediate

Start early. Business advisors recommend that entrepreneurs build an exit strategy into their business plan. Nurturing your future leaders, transitioning clients and customers, and establishing operating processes that will continue should be carefully thought out and accomplished over a period of time.
Keep it in the family. If your business is family-owned and you want to keep family harmony, it's important to make sure that your heirs apparent know exactly who is being slotted for what roles. By breaching the topic early, you'll lay the foundation for a smooth transition. Examine the strengths of all possible successors as objectively as possible, and think about what's best for the business.
Train your successor. If you decide to go outside the family, start devoting some serious thought to what you're looking for in a successor. List the skills, interests, talents, and resources your successor must possess in order to capitalize upon the opportunity your business represents. Once you've decided on a successor, start working with them years in advance, if possible. Doing so will expose them to all the various aspects of the business -- from the shipping docks, to balancing the books, to forming or solidifying important client relationships. Be the example they learn from at each step along the way.
Consult with the experts. Seek outside advice from professionals -- e.g., lawyers, accountants, financial advisors, and business coaches. They can help you put together a formal succession plan, and to iron out any issues that surface. Also check out The Importance of Succession Planning for some good advice.
Plan your exit. Before you pass the baton, make sure you've planned for your own personal future. What would you be doing if you weren't working all day? Traveling? Carpentry? Where would you live? What style of life would you lead? Such self-examination can be a real eye opener, and just might teach you something about your own values. When the time comes to step aside, try to do so gracefully. If you plan to continue as a consultant for the company, define what that work will be and how compensation will work.
Establish financial resources. Plan today for a better financial tomorrow. Reduce debt, set up a well-diversified portfolio, and look at investment opportunities that are independent of your primary business. There are a variety of tax advantaged retirement programs available that can help you maintain the same lifestyle in your retirement that you're living now, provided you begin contributing to them well enough in advance.
Prepare the business for transfer. Take stock of those areas where your personality, skills, or influence are key elements of your firm's success. Begin a program to transfer these activities to others within the company. Also read Should You Develop a Business Exit Strategy? for some good advice.
Review the business's factors of success. You and your team need to determine your replacement's exact role. Succession planning, as well as downsizing or expanding the business, all present unique opportunities to take a hard look at what you, the current leader, will do in both the near and long term.
Determine your business's value. In order to accomplish this you need to know the difference between the various types of buyers active in today's marketplace. Then codify the structure by documenting operating costs and procedures, as well as the management structure.