Comment évaluez-vous l’impact d’un événement perturbateur sur vos opérations commerciales?

Identify your unique value propositions and your core goals as an organization. Focus on weak signals that can act as catalysts of a new beginning in a technological and innovative trend. Nokia for instance failed to get this and lost the relevance of its time due to the innovative disruption by other brands that raised the bar gradually.

Defining protection goals is a crucial first step in conducting a Business Impact Analysis (BIA). These goals will guide the BIA process and help determine the critical functions that need to be protected to maintain operations during and after an incident. Here are some key points to consider when defining protection goals. Identify Critical Business Functions: Determine which business functions are essential to the operation and survival of the company. Assess Risks: Understand the potential risks and threats that could impact these critical functions. Determine Impact Levels: Evaluate the potential impact of an incident on the company’s operations, finances, and reputation.

Defining the scope is crucial, when I am training new BC practitioners I discuss this at length. The scope gives your program focus, in very complex organisations you need start somewhere and build your program as it matures. To define the scope you need to evaluate at a strategic level the critical products and services and key agreement from the sponsor and / or senior leadership that these will form the scope for business continuity.

Ao identificar um evento disruptivo, mapeie os ativos impactados (desde localidades até sistemas) e confronte com sua BIA quais áreas e processos possuem dependência diretas ou indiretas para com tais ativos. Sabendo quais áreas e processos foram impactados, valide a avaliação de riscos e impactos da BIA para obter quais sãos as margens seguras de "Impacto X Tempo" nas escalas de impacto financeiro, regulatorio, reputacional e clientes. Uma boa BIA é capaz de responder essas questões, que servirá inclusive como exercício e avaliação para construção de estratégias de resiliência que atendam ao apetite de riscos da sua empresa.

To assess the impact of a disruptive event on business operations, conduct a Business Impact Analysis (BIA) to quantify financial, operational, and reputational consequences. Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical functions, assess dependencies, and perform scenario analyses to simulate potential disruptions. Evaluate the resilience of suppliers and vendors, consider customer impact, and address regulatory compliance. Assess the financial impact, review insurance coverage, and evaluate communication plans. Document findings and mitigation strategies, emphasizing continuous monitoring and periodic reviews to adapt to evolving risks and ensure a resilient business continuity plan.

Organizations analyze data through a variety of methods and techniques, largely depending on the nature of the data and the specific insights they aim to gain. Here are some key methods: Cluster analysis Cluster Analysis: This involves grouping data elements so that elements in the same group (or cluster) are more similar to each other than to those in other groups. Cohort analysis Cohort Analysis: A subset of behavioral analytics that takes the data from a given dataset and rather than looking at all users as one unit, it breaks them into related groups for analysis. Regression analysis Regression Analysis: It estimates the relationships among variables. It allows for identifying which factors matter most.

Gathering and analyzing data is fundamental for assessing the impact of a disruptive event on your business operations. Use methods such as surveys, interviews, workshops, and historical records to collect information from employees, managers, and external partners. Analyze this data to evaluate the current performance, capacity, and availability of your critical functions and processes. Identify potential threats and vulnerabilities they may face. This comprehensive analysis helps in understanding your operational landscape, enabling you to develop robust strategies for mitigation and recovery.

If the business is sufficiently large, then data is key - the more data based decisions that are made, the better. Difficult unless in a small organisation for one person to hold anything in their head, hence this being a collaborative process in developing a BCP.

If there are 25 departments and units, about 50 BC Champions (25 primary and their backups) will be attending BIA trainings and will be involved in conducting BIAs. The best way is to call for a workshop - most efficient way to collect data or to get the template filled in. But if you invite 25 people to workshop, only 15 will come for various reasons. The next best way for the remaining 10 people is to send BIA template and methodology to them and ask them to fill the template according to the methodology. This will be less effective, and the quality of data will get compromised. only 5 out of the 10 will respond. Then have 1-on-1 interviews with remaining 5 - the most time consuming way, but the best quality data will be captured.

Business Impact Analysis is best done when everyone is educated about the goal of the exercise. Otherwise the activity is academic. Hence spend the full year in continuous education and the business impact analysis will get complete as a natural process. Resilience is all about this.

Estimating the impact and prioritizing the recovery of critical functions and processes is a key part of Business Impact Analysis (BIA). Here’s a high-level overview of the steps you might take. Identify Critical Functions: Determine which functions are vital to your organization’s survival and understand their dependencies. Assess Impact: Evaluate the potential qualitative and quantitative impacts of disruptions on these functions. Determine Recovery Objectives: Set Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for each critical function. Prioritize Recovery: Based on the impact assessment and recovery objectives, prioritize the order in which functions should be restored.

This is a difficult step for a lot of companies in the dance of creating a BCP. Which functions or processes do you pick for more resources, what is a priority? Generally production and revenue generating processes for me are the key. Ancillary functions are often given incorrect weighting, but there's often a tolerable delay on accounts versus getting products shipped and upsetting customers. Therefore, I'd always suggest a customer centric view of a business otherwise you're putting at risk reputation and future revenue.

Estimating the impact and prioritizing the recovery of your critical functions and processes is crucial in assessing a disruptive event's impact on your business operations. Evaluate the financial, operational, reputational, and legal consequences of a disruption. Rank your functions and processes based on their importance and urgency for restoring normal operations. Utilize a matrix or scale to assign impact and priority levels, ensuring a clear, structured approach to recovery. This method helps you focus resources effectively, minimizing downtime and mitigating the overall impact on your business.

Communication is key, luckily in ISO Standards such as 27001 and 22301 that's very much part of the design of what you're doing. However, I really feel that communication stretches into your key stakeholders outside of the business - again largely forgotten about. If you have feedstocks into your processes or customers who would be unable to meet production for their customers, you're all part of the supply-chain. Communicating a BIA outwardly to interested parties in the supply-chain gives that view of professionalism and commitment that could potentially give you a competitive edge.

As much as there is a lot of enthusiasm to begin and understand the impact - when it comes to doing the same thing - the detail diminishes the enthusiasm. There is a need to everyone to understand that every little step in business continuity is work, detail work, micro detail work. Hence keeping the enthusiastic mood ON is the first step of a leader. Top down engagement and simple questions which need the detail work to be done - is the path to success.

Create a comprehensive report summarizing your findings, recommendations, and action plans. Share these results with senior management, employees, and external stakeholders to ensure transparency and solicit their feedback and support. Regularly update your BIA to reflect changes in your business environment or objectives. This ongoing process ensures that everyone is informed, engaged, and prepared to enhance the organization’s resilience.

Designing BIA Methodology/ Process and Template is the first important step. A good expectation is that CEO sets an expectation e.g. 25% MBCO/ LoS or 50% MBCO/ LoS. Another decision required from the top is the categories of impact - financial (always there), reputational (always there), regulatory, environmental, social, operational, safety etc. Then you need to know from them the depth of 'impact over time)-mostly 30 days, in some cases I have seen 90 days. I pick this from the force majeure clause. Next parameter you need a decision on from the top management is the 'break periods' within this span of period e.g 1hr, 1day, 7days, 30days etc. Lastly the impact range-low, medium, high critical etc. And you are ready to conduct BIA.

Do your best, and someone may not be happy. Running a consulting assignment with an investment Bank in Abu Dhabi, BIAs were completed, reviewed and approved by the department heads. I then had to present the results to the CEO in presence of dep. heads who had approved the BIAs. The moment I said 'the lowest RTO had come out to be 2 hours and that will be the most critical process (es) for the bank', the CEO went off 'I am the boss, I know the business, nothing in this bank needs to be recovered in 2 hours'. The project was delayed by 1 month, then they approved 'the business need is 2 hours, but the bank approves 6 hours RTO, the risk is understood'. This was signed by the CEO. This may happen in your case also - be prepared!