Business Impact Analysis ( Bia )

a business continuity plan starting with a risk analysis, business impact analysis, and alignment of critical

Our company’s Continuity Management Program (CMP) dictates that the business adheres to an annual testing program. The program does utilize the guidelines from the Homeland Security Exercise and Evaluation Program (HSEEP). The Continuity Management team has written and scripted into our process to incorporate our Tabletop Exercise’s (TTX’s). Our annual process is to test each of our business units for resiliency. TTX’s allows for us to open up discussions and dialogues focusing on many different areas in the event we need to declare. Also, the exercises aid in discovering any gaps and working through each tier of the recovery process. Our business lines have Recovery Time Objectives (RTO’s) starting at 1 hour up to 72 hours. During the TTX’s we cover the business impact analysis (BIA’s ) and each of the RTO’s.

Business impact analysis (BIA) is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency. A BIA is an essential component of an organization's business continuance plan; it includes an exploratory component to reveal any vulnerabilities and a planning component to develop strategies for minimizing risk.

The overall objective of the BIA is to identify the impact of outages. More specifically, the goal is to identify the critical functions that can affect the organization. After these you can identify the critical resources that support these functions. Each resource has a MAO and impact if it fails. The ultimate goal is to identify the recovery requirements.

What is the purpose of having a Business Continuity Plan policy definition that defines the organization’s Business Impact Analysis? To identify critical business functions and what disruptions in the services can have on the organization.

Do all critical employees understand their role should an outage/disaster occur? Are there third party vendors that need to be considered in the BIA? Is there an alternate site available, should the current building not survive? Is data stored at an off-site facility?

When performing a BIA, you are trying to assess and align the affected IT systems, applications, and resources to their required recovery time objectives (RTOs). The

3.) Strong presence in high margin health services business. In addition to UnitedHealth Group’s leadership position in the health benefits market segment, UnitedHealth Group has strong information and technology based health services platform through its business segments which is Ingenix, OptumHealth and PrescriptionSolutions. The “CNN MONEY” (2012) website states Ingenix is one of the largest health information, technology and consulting companies in the world. The UnitedHealth Group derived $2.3 billion of revenues from Ingenix which contributed $284 million (excluding $200 million in goodwill impairment and business line deposition charges) of operating profit, and an operating margin of 12.1% during FY2010.

In this day and age, a business continuity plan is essential to an organizations risk management. A large organization like Sunshine Machine Works understand that time is critical when it comes to natural disasters or man made interruptions to their network systems. When a system is offline for excessive amounts of time, could mean a loss to the organization. That’s why having an effective business continuity plan is vital to keeping operations for being disturbed during a time of crisis whether it is an attack or natural disaster that could potentially affect Sunshine Machine Works operations, data and networks.

Every business and organization can experience a serious incident which can prevent it from continuing normal operations. This can happen any day at any time. The potential causes are many and varied: flood, explosion, computer malfunction, accident, grievous act... the list is endless.

Disasters have become an inevitable part of businesses and organizations as well. They not only have a major effect on business and organizational continuity; they also result to an overhaul in organizational operational mechanisms (Awasthy, 2009). It is for this reason that many organizations and business resort to preparing business continuity plans and disaster recovery plans that will facilitate better disaster management in future. Effective disaster recovery plans are important to every business and organization (Thejendra, 2008).

As a consultant brought into an organization concerned about business continuity I would recommend to first perform a Risk Assessment Analysis and/or Business Impact Analysis (BIA). Conducting a business impact analysis will allow an organization to know the system or application’s downtime tolerance. The analysis will identify all systems and applications that can experience little to no downtime. Conducting risk assessment analysis will allow the organization to identify all the risks at the beginning and during the life of the organization, and grade the risks in terms of likelihood of occurring and seriousness of impact on the organization. Either analysis is an excellent tool and will result in the beginning creations of disaster recovery and business continuity planning. If using the BIA method a good first step is identifying the business’ most crucial systems and processes to assess what effect the outages will have on the business. All systems or applications should have a back-up location offsite to ensure business continuity. The higher the impact the more money a company should spend in order to quickly gain restoration of their business.

Owning a business can have many stressors day to day. When starting a business there is a lot of planning and preparation involved. Many small businesses are owners who have put their own money into the business and look at it as an investment. Unfortunately with all the planning that goes into starting a business, one thing is often over looked. Most of the time the “what ifs”, are not part of the planning stage. One reason for this is that people do not like to think of the bad things that could or may happen. So with all the time and planning put into starting a business why not put some extra thought into a plan B if a disaster strikes? This plan B could be a business continuity plan or a disaster recovery plan. Business continuity plans are an essential part of the modern day business. There are so many potential disasters for small businesses that could seize the production or even close the business down for good. A recent study from Gartner Inc., found that “90% of companies that experience data loss go out of business within two years. It also found that 80% of company owners have not thought about how they would keep their businesses up and running if a data disaster occurs.” According to the Association of Records Managers and Administrators, “about 60 percent of businesses that experience a major disaster such as a fire close

We found that a Business Impact Analysis (BIA) had never been performed to prioritize disaster recovery based on the cost of loss. We also found a significant lack of integration of disaster recovery governance into the overall organizational structure.

Contingency planners are now asserting that contingency planning is a value-added component that can be a competitive advantage in the marketplace as well a means of helping organizations save money. Processes that are deeply analyzed in terms of continuity will usually be more secure, and new ways of working may emerge to help streamline operations. Contingency planning can be useful when forging alliances with external organizations or during acquisition phases. Contingency planning should be part of an organization’s quality cycle as well. “Business continuity and disaster recovery have gained somewhat in the eyes of top corporate management since the start of the 1990s. As the industry has slowly evolved from what could almost have been called a ‘black art’ to something starting to resemble a disciplined science, basic business principles have begun to become increasingly relevant” (Rothstein, 2003, p. 1).