Disaster Recovery Journal Fall 2023

n A list of the systems or applications needed to support the process. n All specialized equipment needed to support the process (i.e., unique equipment that would take a long time to replace). n Any internal dependencies (other departments at the organization whose participation is required for the process to work). n Any external dependencies (outside entities such as banks, law firms, or computer consultants needed to support the process). Setting the Stage for the BIA Interview Once the client has gathered and pro vided us with the information, we have assembled in one convenient place the data on the identity of the department, what they do, what their most critical processes are, and what equipment, other departments, and third parties they depend on to complete their important processes. This sets the stage for a focused, effi cient BIA interview. Validating the Data Once we receive the business unit’s information, the first thing we do is vali date it. Often in looking over the client’s responses, we see things that are obviously incorrect. For example, instead of listing their unit’s critical business processes, the source might have listed the critical situa tions they might potentially face. If we see something that’s obviously incorrect, we notify the respondent and ask them to review and correct their infor mation. After that, we’re ready for the inter view, where the first order of business is usually to confirm the information the business unit provided. We then use that information as a springboard to do a deep dive into each of their critical business processes, asking them about its regula tory and legal requirements and the impact on the organization if the process couldn’t be performed. Lessons From Experience Experience has taught us many things over the years when it comes to asking our

the link, and the tool walks them through the information we would like them to provide. Similar functionality is available in other tools, and the basic result can be achieved through forms prepared in Word, Excel, or similar programs. Including a Cover Note Prior to sending the link to the pre work, we send a note explaining what we are doing. These emails typically go out over the name of a department head or other high-ranking person sponsoring our project. In the note, we tell the people when we would like them to provide the informa tion, typically giving them at least two weeks to finish and submit it. The Types of Information We Request In doing BIA pre-work, we ask for two types of information: general informa tion about the business unit and techni cal information about the unit’s critical business processes. The requests are typi cally directed to a department-level busi ness unit, such as the call center, finance department, or claims department. The general information we ask for includes the following: n What the business unit or department does. n How many employees it has. n Where it’s located. n What its hours of operations are. Then we start to get more technical. We ask the business unit to tell us what their most critical business processes are and to provide us key information for each pro cess. Typically, we ask them to tell us their five to seven most important processes. We try to get them to focus on the most important processes rather than cataloging every single one. For each process, we then ask them to provide the following: n Its name (e.g., the accounts payable process). n A description of what the process does (e.g., “it’s designed to pay our vendors within 30 days”).

clients to fill out BIA pre-work. Here are two of the main ones: n Some people forget to do the pre-work, or just decline to. Don’t be thrown off your stride if this happens to you. You have to not take it personally and work with what you get. n It doesn’t pay to assume too much about people’s level of understanding of the process. Sometimes people who have worked in a department for decades are at a loss when you ask them what its critical business processes are. Simplify and take things slow. That’s the BIA pre-work process in a nutshell. If, in doing your BIAs, you incorporate a pre-work phase similar to that described above, rather than trying to collect all the information in the interview, you will most likely find your interviews will be shorter and more productive, your colleagues will be happier, and the infor mation you get will be of higher quality. Takeaways n In doing BIAs, it is best to obtain information from the departments ahead of time to produce better information and shorten the time needed for BIA interviews. n Pre-work should take no longer than 30 minutes to complete. n Pre-work questionnaires seek two types of information: general information about the business unit and technical information about the unit’s critical business processes. n After you receive the completed questionnaire, you should validate the data. n Don’t take it personally if some people don’t complete the pre-work. v Michael Herrera is the CEO of MHA Consulting, a leading business continu ity planning and information technology consulting firm. Herrera is the founder of BCMMetrics, which specializes in business continuity software designed to aid organizations in devel oping and executing business continuity programs. Better Results, Happier Colleagues

28 DISASTER RECOVERY JOURNAL | FALL 2023