Business Impact Analysis Example – How do you prioritize different processes in a Business Impact Analysis?
Some processes being unavailable will be of high impact during a certain period and after that will only have a negligible impact.
Feeback from BCP Builder Community on LinkedIn:
Process Prioritization
- Prioritize on recovery time objective and re-prioritize on the day on urgency.
- Process prioritization should only be carried out based on major changes within each process or to the organization as a whole. This would include a crisis situation (such as coronavirus) – which is in reality a major change to the organization.
- Prioritizing processes may be an hour by hour / day by day /month by month issue. If the business has processes that must have certain functions / data on a set basis, this should be reflected in the priority listing. Business units and sub units should have their input and concurrence on what is most important. The listing should be ‘rolling’ by time slice. Each of the ‘critical’ operations should have their own fail over or backup processes to ensure minimal impact.
- Processes should be prioritized by criticality, where quantitative and qualitative rationale is being considered. We look at financial, operational, customer, regulatory and reputation impacts at various points in time, which could be hours, days or weeks.
Worst Case Scenario
- Assume the incident happened at the worst time of year/day/week for that process and make sure capability meets that, otherwise you end up with very complex matrices and too many variables to plan for.
- Availability requirements should be performed based on the worst case scenario. This is so that capability can be built to ensure you can recover within the time frame required to cover the worst case scenario. The timing of the incident will drive the priority of the process recovery. The key is having good crisis management processes that can identify and manage the recovery effort based on when the incident occurs.
- You should consider realistic, worst-case scenarios and the overall impact of the process and how it affects the business locally, regionally, nationally or globally.
Business Impact Analysis Example – Payroll
- There are often incorrect assumptions made when dealing with payroll:
- 1 – Payroll are only busy one week in four.
- 2 – Just pay people what you paid them last month. I’ve seen grown men brought to their knees with these assumptions.
- Payroll is run every day in big organizations. One as a means of keeping up with starters, movers, leavers, overtime, tax errors etc. Also as a mechanism for paying vendors. So they are busy every day.
- Paying people what you paid them last month, will ensure the people who have left the company get a “bonus” salary. Those that have started get none and it reverses any changes you made every day since the last pay day. Thus overwhelming the payroll department with additional corrections to be made.
- Payroll is significantly under rated as a process. Paying people what they were paid last time is complex and fraught with dangers.
- Ask the business to consider the impact to their business during their busiest work times, for payroll these are normally the last and first week of the month. Consider this and Payroll always ends up in the critical bucket.
- Some organizations use a third party badge swipe payroll data collection system. If a reader goes down or an employee has a ‘long day’ [badges in, doesn’t badge out and then badges in again] the supervisor gets a report daily to review and seeks adjustments. They soon learn this is a critical task. The payroll is actually run by a third party based on HR data and the swipes. Most distribution is electronic but visible online.
If you want to increase your Organizational Resilience, start with preparing a Business Continuity Plan and check out BCP Builder’s Business Continuity Planning Templates.
