CVS Blog » Business Continuity

Why a Business Impact Analysis (BIA)?

Mon, 11 Jul 2011 09:31:10 +0000

Briefly it is to enable you to determine the impacts resulting from possible disasters and interruptions that could affect your business; the risks you have assessed previously.

It would also enable you to ascertain critical processes, their priority in the recovery phase, and anything dependent upon those processes so can set a goal for overall recovery

You cannot develop a strategy for your Business Continuity Plan if you cannot determine the extent of the impact on your business of risks occurring.

The purpose of the BIA is to:

Determine those functions of your business that are critical to its operation together with those particular processes / applications each function accomplishes.
Put a figure on the potential loss to you and your business for each of those processes if they cannot be conducted for a given period of time.
Research the probability of losing each function and assign a risk factor— low (L), medium (M), high (H) or severe (S).
Any process rated H or S must be further evaluated in order to determine alternative strategies.
Finally, you need to decide upon what you consider to be an upper limit of for any outage that could be caused by the occurrence of an H or S risk function so as to reduce the effects to M or L

Terence Kierans CAVB (Certified Australian Virtual Business)
Principal, Cyberspace Virtual Services
PO Box 93 Quinns Rocks, Western Australia 6030
http://www.virtualservices.com.au – Experience the Difference
http://vacertified.com/client-info/ – First in the World to be VA Certified (and you can benefit)
http://www.avbn.com.au – Australian Virtual Business Network—You Deserve the Best
2007 Thomas Leonard International VA of Distinction Award Nominee
Contented Member of ‘A Clayton’s Secretary’
Use our skills to help you succeed
Tel: 61 8 9304 6983 Fax: 61 8 6230 5156 Mobile: 61 414 25 1091 UK Residents: 07092391723

Find any document in 15 seconds or less
http://tinyurl.com/64ag2

Share and Enjoy:

Risk Management—the Five Ws

Tue, 07 Jun 2011 09:21:40 +0000

You can’t prepare for a possible disaster if you don’t know how much impact on your business the different situations could have. So, before planning for recovery we need to know what we would be recovering from – the risks that are out there.

In order to manage these risks we must first decide:

What are those things that can happen?
What external issues can impinge on your business?
What is the likelihood of these risks happening?
What is the cost to your business when it happens?
What are the costs involved in preventing them happening?

After determining what can happen — items 1 and 2, then items 3, 4 and 5 are used to compile a table (Table 1) to guide you in managing the outcome of items 1 and 2 occurring.

What are those things that can happen?
Communications outage; fire; flood; hard drive crash, power outage—to name but a few.
However, the risks to which a large finance organisation may be exposed differ widely from those relating to a small business.

What external issues can impinge on your business?
These could include government legislation; legal problems, or strike action.

What is the likelihood of these risks happening?
Here you need to assess a probability for each risk; best expressed as a percentage per year.
As an example, the possibility of a power failure is more likely in a bushfire or storm than at other times. So the probability of a power outage can also depend on your physical location as well as the average weather pattern.

What is the cost to your business when it happens?
Several calculations are involved here, including the probable duration of the crisis as well as the problem itself.
If you rely on external communications to conduct your business the cost to you if this event took place would be high. Not only in lost revenue but also the possibility of losing clients.

What are the costs involved in preventing them happening?
Prevention, as a business cost, is not necessarily better than curing it when it happens. Again, other factors such as the probability of happening also need to be taken into account.

Risk Analysis
To focus on each risk, and supply an overall picture, the use of the following table is suggested:

Find any document in 15 seconds or less
http://tinyurl.com/64ag2

Share and Enjoy:

Analyze Your Business

Tue, 10 May 2011 07:26:40 +0000

80% of businesses affected by a major incident close within 18 months.

90% of businesses that lose data from a disaster are forced to shut within two years.

Formal analysis of your business is the essential foundation for Business Continuity Management (BCM). This analysis will provide you with an understanding of your business and what is critical for its continued operation.

Ask yourself these basic questions:

What are the principle business objectives of your business?
What are the deliverables (products / services) of these objectives?
When are the objectives to be accomplished?
Who is necessary to the achievement of these objectives?
How will these objectives be achieved?

You may, or may not, have a Business Plan and / or Mission Statement. If you have, then they should provide the answers to these questions. If you haven’t then now is the time to produce one.

There are critical activities and their dependencies that enable the achievement of your business purpose. These are the focal point of your Business Continuity Plan (BCP).

The components of these critical activities include:

People
Facilities
Persons with a financial interest in your business
Your suppliers
Your clients / customers
Functions
Processes
Materials
Telecommunications
Technology
Data

Bear in mind that there are external organizations too that can have an effect on your critical activities. They can include:

Government bodies (regulatory and non-regulatory).
Your competition (not necessarily in the same line of business as you).
Trade Unions.
Professional organizations.

There are two distinct and complementary processes to a further understanding of your business and the identification of its critical activities and dependencies. They are the Business Impact Analysis (BIA) and the Risk Assessment. These will be examined in future blogs.

The author acknowledges the Business Continuity Institute as a source for much of this information.

Terence Kierans CAVB (Certified Australian Virtual Business)
Principal, Cyberspace Virtual Services, Western Australia
www.virtualservices.com.au – Experience the Difference
http://vacertified.com/client-info/ – First in the World to be VA Certified (and you can benefit)
www.avbn.com.au – Australian Virtual Business Network—You Deserve the Best
2007 Thomas Leonard International VA of Distinction Award Nominee
Contented Member of ‘A Clayton’s Secretary’
Use our skills to help you succeed
Tel: 61 8 9304 6983 Fax: 618 6230 5156 Mobile: 61 414 25 1091 UK Residents: 07092391723

Having problems coping with all that paperwork?
Turn those piles into files and find any document
in 10 seconds or less!
http://tinyurl.com/64ag2

Share and Enjoy:

How to Stay in Business — When the Sky Falls In Final

Mon, 20 Oct 2008 02:29:16 +0000

To wind up this series on Business Continuity Planning here’s a summary as to why you should plan:

Information systems built on computers have become increasingly vital to the effective operation of a business;
The provision of timely business services has become progressively more dependent on computer systems;
By now you should be even more aware of the impact on your business that a serious incident could have;
The necessity of setting up at least a semiformal procedure to be complied with when a disaster happens;
The high probability of an increase in inefficient IT and data protection safeguards;
The need to set up efficient and effective recovery strategies to diminish the consequences of any disrupting events;
To have the goal of lessening the costs and losses which might otherwise arise from the occurrence of severe events, and finally
Prevention of failure of your business resulting from any disrupting events.

Terence CAVB (Certified Australian Virtual Business)
Principal, Cyberspace Virtual Services, Western Australia
www.virtualservices.com.au – Experience the Difference
www.virtualservices.com.au/CVS_blog – My contribution to business owners
www.avbn.com.au – Australian Virtual Business Network—You Deserve the Best
2007 Thomas Leonard International VA of Distinction Award Nominee
Contented Member of ‘A Clayton’s Secretary’
Use our skills to help you succeed
Tel: 61 8 9304 6983 Fax: 61 8 9304 3202 Mobile: 61 414 25 1091 UK Residents: 07092391723

Having problems coping with all that paperwork?
Turn those piles into files and find any document in 10 seconds
or less!
http://tinyurl.com/64ag2

Share and Enjoy:

How to Stay in Business—When the Sky Falls In Part 3

Sun, 14 Sep 2008 01:57:57 +0000

Develop your plan.
BCM plans will be different for different businesses. However, effective continuity plans will share many important features:
1. Use non-technical language so that any- and every- one can understand it.
2. Identify who does what, and who takes responsibility for what. Try to include an alternative to cover key roles.
3. Use checklists.
4. Include clear, explicit instructions for the crucial first hour immediately following the occurrence of an incident.
5. List items that do not need to be addressed until after that first hour.
6. State how often, when and how you will check your plan to make sure it always a ‘live plan’. Always update your plan immediately changes occur in your organisation and in the risks you might face.
7. Include information from outside experts and from other business people who face similar risks.
  1. Find out what your local authority plans are in response to a major incident or terrorist attack.
  2. Ask the fire brigade what they will want to know from you during a major incident? Who will be the point of contact that emergency services will speak with after an incident? Ask about access to your premises after a major incident.
  3. Would a major incident on the premises of a neighbouring property or business affect you and vice versa?
  4. How can you help each other?
  5. Find out what your Utility companies will need to know if your business is involved in a major incident.
  6. How will you contact your clients and suppliers to advise them you have been adversely affected by an incident? Involve them if at all possible.
  7. What information does your insurance company need? Determine whether you would need their permission to replace damaged critical equipment immediately.
  8. What alternative lines of communication and data access have you established?
8. K.I.S.S. A good plan will be simple, but plan for worst case scenarios. You will never be able to plan in detail for every single eventuality. The aim of the plan is to enable people to be able to react quickly and effectively in an emergency
To be continued

Terence CAVB (Certified Australian Virtual Business)
Principal, Cyberspace Virtual Services, Western Australia
www.virtualservices.com.au Experience the Difference
www.avbn.com.au Australian Virtual Business Network—You Deserve the Best
2007 Thomas Leonard International VA of Distinction Award Nominee
Contented Member of ‘A Clayton’s Secretary’
Use our skills to help you succeed
Tel: 61 8 9304 6983 Fax: 618 9304 3202
Mobile: 614 1425 1091 UK Residents: 07092391723

Having problems coping with all that paperwork?
Turn those piles into files and find any document in 10 seconds or less!
http://tinyurl.com/64ag2

Share and Enjoy:

How to Stay in Business—When the Sky Falls In Part 2

Mon, 25 Aug 2008 07:03:52 +0000

There are five key steps to developing your continuity plan.

Analyse your business.

BCM requires a comprehensive understanding of your business and all of its processes. These should be documented in your Operations Manual. Without this documentation, how could anyone fill in for you, effectively and efficiently, in your absence, either on holiday, or due to illness, whether short- or long-term? How else can you be consistent in operating your business? Have you got one?
Assess the risks to your business.

Risk assessment is the process of determining the risks that could cause business interruption and consequent damage to your income and reputation. This assessment is based on how you run your business.

In evaluating risk a business impact analysis will help to enable prioritisation based on probability of occurrence. You cannot afford to include every business process and application in a mitigation process or a recovery, so you should inventory and prioritise every critical business process.

Software is available to help with this process, but a spreadsheet can be designed to achieve the desired outcome.

Develop your strategy.
Having assessed the risks, whatever type business you are conducting, you will probably choose a proven strategy:
- Accept the risks—change nothing.
- Accept the risks, but make reciprocal arrangements with other businesses. They could even be competitors.
- Attempt to minimise risks.
- Attempt to minimise risks and make arrangements for assistance after an incident.
- Reduce all risks to where you should not need outside assistance.

Evaluation of cost effectiveness will be the driver in choosing your strategy.

To be continued

Terence CAVB (Certified Australian Virtual Business)
Principal, Cyberspace Virtual Services, Western Australia
www.virtualservices.com.au Experience the Difference
www.avbn.com.au Australian Virtual Business Network—You Deserve the Best
2007 Thomas Leonard International VA of Distinction Award Nominee
Contented Member of ‘A Clayton’s Secretary’
Use our skills to help you succeed
Tel: 61 8 9304 6983 Fax: 61 8 9304 3202 Mobile: 61 414 25 1091 UK Residents: 07092391723

Having problems coping with all that paperwork?
Turn those piles into files and find any document in 10 seconds or less!
http://tinyurl.com/64ag2

Share and Enjoy:

How to Stay in Business—When the Sky Falls In

Sat, 09 Aug 2008 03:49:37 +0000

Part 1

In essence, Disaster Recovery Planning is an essential part of Business Continuity Management (BCM). It is not just about disaster recovery, crisis management, risk management or about IT. It is demonstrably a business issue.

In summary — Foresee the Unexpected

To quote the Business Continuity Institute, the professional body for Business Continuity Management:
“Business Continuity Management is the act of anticipating incidents which will affect critical functions and processes for the organisation and ensuring that it responds to any incident in a planned and rehearsed manner”.

You are taken ill; your office is burnt down; your computer hard drive dies on you; a key supplier goes bankrupt or closes down. How would any of these occurrences affect your business?

A Gartner research found that 50 percent of all businesses fail after experiencing a major disruption.

Nearly one in five businesses suffers a major disruption every year; yours could be next. With no recovery plan, you have a lessened chance of survival.

Your business cannot avoid all forms of risk or potential damage. However, you can ensure the survival of your organisation by compiling a Business Continuity Management (BCM) Plan—and following it.

Learn how to cope with the risks that could cause:

Inability to maintain customer services, and subsequent loss of work to competitors;
Damage to image, reputation or brand;
Failure to protect the company assets;
Business control failure;
Higher insurance premiums; and
Failure to meet legal or regulatory requirements.

To be continued

Having problems coping with all that paperwork?
Turn those piles into files and find any document in 10 seconds or less!
http://tinyurl.com/64ag2

Share and Enjoy: