We often receive requests for proposals (RFPs) to perform a business impact analysis (BIA) – some dictating the preferred approach, some leaving it open. A recent RFP requested a consultant-executed BIA (and did not dictate the desired approach), but the use of consultants was eliminated due to budgetary constraints. As a result, they began the process to internally build and administer a questionnaire-based BIA approach. Why? They thought this approach would be more efficient when compared to an interview-based data gathering effort, thus preserving the internal team’s time to perform other activities.
The key question is this – is a questionnaire-based approach more efficient and what are the possible drawbacks? This perspective explores this issue and summarizes the pros and cons associated with the exclusive use of questionnaires versus an interview-based data gathering approach.
First Things First
What is a Business Impact Analysis (BIA)? A common definition used by the British Standards Institution and ASIS International (as well as a definition that may be used in the future ISO 22301 standard) is:
“The process of analyzing business functions and the effect that a business disruption might have upon them.”
In collaboration with executive management’s input and feedback, a well-executed BIA clarifies the scope of the preparedness effort, while defining the recovery objectives and associated justification necessary to architect appropriate, pragmatic recovery strategies.
There are numerous ways to execute a BIA depending on the scope of the business continuity effort and size and culture of the organization. The three main techniques include:
- BIA questionnaire that is completed by process owners;
- Data gathering interviews conducted by business continuity professionals with process owners; or
- A hybrid, whereby questionnaires and interviews are both used.
Overall, Avalution recommends options two or three in order to deliver actionable results in a cost-effective manner.
Based on a quick Google search of the top 20 returns to the question “How to Perform a BIA,” we learned the majority of those offering an opinion on BIA execution believe questionnaires are the best approach:
(It’s also important to note that regardless of which data gathering approach the organization used, the BIA doesn’t stop there. The business continuity professional must perform an analytic effort with this “raw” data in order to develop actionable conclusions.)
Fact or Fiction?
I believe that many people think that using a questionnaire is faster and, overall, the most efficient approach to perform a BIA; however, I would like to take the opposite view. Based on my experience, the questionnaire-based (or questionnaire-only) approach is the LEAST efficient and LEAST value-adding approach primarily due to the:
- Time to build the questionnaire;
- Time to educate the business on how to complete the questionnaire;
- Time to administer and obtain initial feedback; and
- Time to normalize the data across business processes and obtain improved responses consistent with BIA process expectations.
As the fourth point indicates, different respondents interpret questions differently, resulting in data that is often inconsistent and incomplete. Additionally, many questionnaires require follow-up in order to obtain actionable information, which results in the need to schedule interview time regardless. And, to add a fifth (and arguably most important) item to the list is the lost opportunity for face time. The opportunity to interact and build relationships with the business process owner is priceless, and the opportunity to read the face of the interviewee and probe into initial responses is invaluable.
Conclusions – Why Not Both?
Avalution has always advocated an interview-centric BIA data gathering approach. As alluded to above, interview interaction is extremely valuable for six main reasons:
- Questionnaire design is tough and questions are often open to interpretation;
- Chasing down delinquent responses is time-consuming;
- Exploring issues in more depth requires discussion;
- Relationship building is critical to long term success;
- The interview time enables awareness building; and
- During the interview, the business continuity professional gets the opportunity to learn more about the business.
As a result, consider utilizing a hybrid approach to BIA data gathering where individual interviews are scheduled and performed for each business process that contributes to the delivery of an in-scope product or service. Then document the results of these interviews and seek approval of the meeting summary as an input to the analysis. Use questionnaires to collect discrete, quantitative data such as financials.
And, always remember, the results of questionnaires and interviews should be viewed as raw data that requires analysis and summary, as well as the development of recommendations for management’s consideration and approval. For more information on the BIA process in general, please be sure to review the Avalution perspective titled, Achieving Meaningful Results: Establishing the Context for Your Business Impact Analysis (BIA).
Brian Zawada, Director of Consulting Services
Avalution Consulting: Business Continuity Consulting