The need for business continuity and disaster recovery planning is unquestionable. However, it does tend to be one of those issues that somehow find their way to the backburner until some headline-grabbing crisis re-focuses attention on the need to be ready for the worst. (Our Carl Weinschenk authored a great article on this phenomenon recently, in the wake of the Japanese tsunami.)
The first step in resetting a BC/DR plan that has gotten stale (or just launching a program, if you don't have one yet) is a business impact analysis (BIA). A full-scale BIA looks at every business process in the company and determines who owns it, what other processes it impacts and its importance to the overall business.
It's a lot of information to wrangle.
Our partners at Toolkit Cafe have developed a Business Impact Analysis Questionnaire that lays out the data your organization needs to evaluate in a BIA before developing a business continuity plan. The three-page Microsoft Word template is available for free to IT Business Edge members here in the IT Downloads library.
The BIA template is designed to address the operations of a single business unit. The survey can be conducted within the unit or by a Ops/PMO office. After all business units in the company complete the survey, the information can be compiled into a master business continuity plan.
At this point, we should note that the push for a BIA (and for business continuity planning in general) often comes from the COO or some other operations office in the company - it's not inherently an IT function, and it certainly touches every silo of the business. But if your company does not have BC/DR planning in place, it's everybody's problem. If there's a fire, business managers will certainly ask IT why they can't process product orders. So, if there's a gap in your organization, a BIA is a smart step, regardless of who suggests it.
Areas that the survey template addresses are:
Regulatory Reporting: Does the business unit have any regulatory reporting requirements to local, state or federal agencies?
Critical Record Management: Identify critical business records by record name, alternate source (when required), media type.
Business Processes: What are the critical business processes performed by your business unit?
Once the key record and resources are identified, business managers must rate the risks associated with failure, in terms of revenue loss, liability and harm to public reputation, of every business process they have cataloged. The impact is broken out by month and across operational units, as you can see in the image below.
The template goes on to gather estimates on how many team members will be required to recover a failed process, and special supplies needed, and other technical assets (wire transfers, for example) needed to recover and keep the business running seamlessly.
It's an extensive exercise, but it needs to be. If you have gaps in your business continuity/disaster recovery planning, you should definitely check out this resource.