Business Impact Analysis, Dependency Modelling and Beyond
Business impact analysis (BIA) is an essential activity that supports the development of an organisation’s business continuity plan. Its primary purpose is to identify the critical business functions within an organisation and to determine the impact of an unacceptable outage of any of these functions. An outage can impact an organisation in a number of different ways and needs to be evaluated against such criteria as the impact on clients, legal/statutory and financial consequences. This analysis should identify the effect of different external and internal factors upon the various parts of the organisation. It should show which elements of the organisation will be affected by an incident and the resulting impact on the company as a whole.
One of the most powerful tools for carrying out this form of analysis is a method known as Dependency Modelling (DM). Dependency Modelling is a well-established technique for representing the relationships between different business elements. When constructing a dependency model an organisation will uncover the relationships within the business and develop a clear understanding of the business elements that represent the greatest risk to business continuity.Dependency Modelling is a simple but incredibly powerful technique. Once a dependency model has been constructed it can be used to rank areas of impact and to apply more sophisticated calculations for risk assessment.
The model can also be used to refine specific countermeasures and to evaluate the cost and benefits of organisational change.Many organisations have used process re-engineering to consolidate core activities as a source of efficiency gains and cost reduction. Although this is accepted as good business practise, as organisations become more integrated the complexity of developing a comprehensive business continuity plan increases. This is due to the (counter intuitive) fact that although consolidation attempts to simplify an organisations operation, it will often increase the risk in maintaining delivery.
The ability for an organisation to maintain and control its business operations is not only related to the number of activities, but to the interdependencies between them.Dependency modelling allows a progressive approach to capturing, modelling and reporting these issues. As a first step an organisation must understand the relationships between its business elements. This does not mean that the whole organisation needs to be modelled, as it is more important to first develop an understanding of the critical activities. From here the model can be developed progressively to allow for more sophisticated analysis.
This analysis will take into account a number of different measures based around the trinity of Value, Cost and Risk (VCR). These VCR measures allow for a focussed approach to business continuity, relating directly to business objectives.When planning a change to a business activity, the value and cost of development and maintenance must be balanced against the risk in delivery. This is a core function of business continuity and can be complex due to the range of risks and impacts that may need to be considered. For example a change may be made to the organisation to reduce the cost of delivery of a particular service, but doing so may increase the risk in another business area of delivering against legislative requirements. This scenario is an example of a blended VCR measure and can be effectively analysed using a dependency model.
With the introduction of management techniques such as Total Quality Management (TQM), the natural operational behaviour is now a continuous cycle of feedback reporting. Continuous improvement is the key to sustainable growth, and business continuity is at the core of this process. To apply this continuous improvement practice an organisation must align its service delivery with a value-based assessment of the internal and external supplier capabilities. This assessment must take into account business continuity in order to deliver true continuous improvement. Cost reductions or efficiency gains are not true improvements to the organisation if the risk within the organisation increases beyond a sustainable level.
At Texonet we have been working with our clients and partners to devise best practice for developing, delivering and supporting Dependency Modelling. Over the past 5 years we have developed sophisticated techniques for simplifying the delivery of DM analysis. Using our expertise we have developed a revolutionary dependency-modelling tool called ImpactAware. It has been designed to allow business continuity planning to be devolved to non-practitioners and to allow any organisation to quickly and easily compile a robust approach to BC planning in line with emerging standards such as BS25999. Our software can quickly deliver the benefits of impact analysis so that our clients can work smarter, not harder, in the pursuit of high quality service provision and business continuity.
Niall Wright CEO Texonet Ltd.
