AmalfiCORE Blog

Ideas on How to Collect Data for a BIA

How best to collect data input to a Business Impact Analysis-BIA [1] in a hospital setting?

There are a number of methods to obtain the necessary perspectives and information which create the foundations of the BIA. These methods are common to any data gathering exercise and may include interviewing, questionnaires, and workshops. [2]

In an environment like a hospital, I think performing the initial tasks to create a BIA can best be approached using the interview method. Also, by concentrating on one functional group at a time, I believe it does a better job of preserving the integrity of the BIA. The interview method can and should be systematic with defined and repeatable questions in a particular order. [3]  I suppose one could combine this approach and also send out an educational document to help prepare the interviewees for the session. This would be more efficient and give the employee the opportunity to do some research instead of just guessing during the interview. After all, we’re seeking accurate information, not just raw speculative data.

In my experience, questionnaires are useful to an educated audience, especially when review or repeat activity is necessary. However, to an audience of employees not accustomed to business continuity terminology or experienced in disaster preparedness, it may be a confusing or overwhelming task. There is quite a bit of overhead associated with the creation, distribution, collection, and interpretation of questionnaires [4]. In particular, some essays are necessary to gather the most useful information. Analyzing and understanding essay response may require iterative interactions with the respondents. In the end, it almost becomes an interview of sorts. This approach is very time-consuming and I wouldn’t recommend it. [5]

The advantage of workshops is about saving time. The disadvantage, as any good interviewer would tell you, is that we see ‘group-think’ develop live during the session. This group-think certainly helps to build consensus, but can mask some of the more subtle yet possibly important data points. [6]  Why does this masking occur? Well, the quieter folks just don’t speak up in a group setting, or what is heard sounds close to what a person was going to say and therefore the clarity goes unsaid. As more vocal strong speakers voice their ideas, others begin believing that what was said is correct, despite any previous thoughts they may have had. In my experience during search and rescue on the scene of dive emergencies we strive to separate witnesses in order to obtain ‘virgin’ untainted statements and observations. I believe the same is true of interviewing for the BIA. Last point on avoiding group think: If it’s decided to use the workshop or group meeting, a good solid facilitator will be key to successfully gathering the critically accurate information.

Summary

While each of the methods stated may work to obtain the necessary data for the BIA, it’s my preference that the one-on-one interviewing coupled with prepared, systematic questions, is the most useful approach.

References:

[1] Business Continuity Institute. 2008./ “Good Practice Guidelines: Section 2:Understanding the Organization”. ver. 2008.1, pg 4
BIA: “…process for evaluating the impact over time of a disruption to an organisation’s ability to operate”;

[2] Cobb, Steven.” Weekly Instructor Commentary for Week Four”, Norwich University MSBC

[3] “Business Continuity Impact Analysis, State Office of Resource Management, Texas. Retrieved 9-28-09 from http://www.sorm.state.tx.us/Risk_Management/Business_Continuity/bus_impact.php

[4] Burtles, Jim. 2007.  “Principles and Practice of Business Continuity: Tools and Techniques“, Rothstein Associates. Chpt. 5.

[5] Hallberg, Lillemor. “Some Thoughts About Interviewing“. Retrieved 9-29-09 from http://www.informaworld.com/smpp/section?content=a794904615&fulltext=713240928. Published in International Journal of Qualitative Studies on Health and Well-Being, volume 3, Issue 3, 2008., pages 130-131.

[6] Hansen, Robin. 26-JUL09. Overcoming Bias.com. “Who Will Fight Group Think“. Retrieved 9-29-09 from http://www.overcomingbias.com/2009/07/who-will-fight-group-think.html

_________________________________________________________________________________

Business Impact Analysis: Resolving Discrepancies

How do we handle getting different answers from different people about the same disruption periods or effects of loss when conducting a major analysis task in business continuity?

‘Prevention is the best medicine’, is a common phrase typically associated with the medical field. The best way to handle discrepancies and validate data is to educate those participating in the process and offer transparency in the approach and method of gathering the data. Begin with early communications and inclusion of those who will be involved in the Business Impact Analysis-BIA. [1]

The following is the general approach I recommend for any organization, but particularly one with as many diverse and dependent functions as a hospital (A typical hospital organizational structure includes: “Administrative Services, Informational Services, Therapeutic Services, Diagnostic Services, Support Services” or other variations.) [2]:

1. Target function: Begin with choosing the functions one at a time. Since an enterprise-wide analysis can be a lengthy process, it may be helpful to begin with some of the key functions and build a plan which addresses the more critical business elements. [3] As an example, a hospital, like any organization, has an infrastructure of diverse functions, hopefully working together to provide the best patient care and safe and rewarding environment for the employees. [4] [5]
2. Select the people: It’s important to determine who from the target functions will be key individuals who can offer the most accurate perspective. The people we speak with should be close enough to the daily tasks and work to understand what needs to get done, what process or procedure is used, and also has an understanding of information flow and dependencies. However, we need to also select middle management or supervisors that have a broader understanding of the interface to other functions. By selecting the right participants, the number of incidents of discrepancy can be reduced. [6]
3. Education and transparency: People seem to respond well to being informed and being included. So, now that we have the target function(s) and selected the key participants, it’s time to educate. By educate I mean be transparent and include the participants in a general understanding of the goals of the project (Business Continuity-BIA [7] or Risk Assessment-RA [8]) and how they can help. Also, describe the steps of gathering information, when they will be asked to participate, and how they will have the chance to review the material before it is included in the final analysis.
4. Resolution: Now it’s time to share what’s been collected with the participants. In my experience (borrowed from a recent COOP plan implementation), we can resolve discrepancies with a ‘de-conflict’ or resolution meeting. (Of course, there are some that suggest the term ‘de-conflict’ is a new word indicating poor planning by managers. I’m trying to avoid that. [9]) However, this can be a great opportunity to reach a common understanding and ferret out and resolve discrepancies. I see a resolution meeting as a very necessary step prior to launching into a full analysis.

Summary

The approach I’ve described can be used to effectively reduce the incidence of discrepancy regarding perspectives on disruptions periods and their impact on business. The fine nuances of the incident and its impact on tasks can be better understood when we select a variety of key people with both a detailed and broad interface perspective of the essential functions.

Communication, education, transparency, and inclusion can go a long way toward mitigating and resolving viewpoints. This is best accomlished well before beginning the data-driven analysis of critical functions and the impact of disruptions.

References:

[1] Burtles, Jim. 2007.  “Principles and Practice of Business Continuity: Tools and Techniques“, Rothstein Associates. Chpt. 5.

[2]  ”Hospital Organizational Structure“. Retrieved 9-29-09 from http://74.125.155.132/search?q=cache:nht9uxFfDkcJ:www.cte.unt.edu/health/curriculum/Organizational_Structure_of_a_Hospital.ppt+hospital+organizational+structure&cd=1&hl=en&ct=clnk&gl=us

[3] Cobb, Steven.2009. “ Weekly Instructor Commentary for Week Four”, Norwich University MSBC

[4] Business Continuity Institute. 2008./ “Good Practice Guidelines: Section 2: Understanding the Organization”. ver. 2008.1.

[5] Miora, Michael. 2007. “Performing a Business Impact Analysis: A White Paper by Michael Miora. Retrieved ,9-28-09 from https://norwich.angellearning.com/AngelUploads/Content/MSBC_LOR/_assoc/msbc_sem01/msbc_s1_reading_page/pdf/wk04_miora-bia.pdf

[6] “Business Continuity Impact Analysis”, State Office of Resource Management, Texas. Retrieved 9-28-09 from http://www.sorm.state.tx.us/Risk_Management/Business_Continuity/bus_impact.php

[7] Disaster Recovery Journal: Glossary. 2009. Business Impact Analysis-BIA: “A process designed to prioritize business functions by assessing the potential quantitative (financial) and qualitative (non-financial) impact that might result if an organization was to experience a business continuity event.”

Retrieved 9-29-09 from http://www.drj.com/index.php?option=com_glossary&func=display&letter=R&Itemid=297&catid=35&page=1

[8] Disaster Recovery Journal: Glossary. 2009. Risk Assessment/Analysis-RA: “Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.”

Retrieved 9-29-09 from http://www.drj.com/index.php?option=com_glossary&func=display&letter=B&Itemid=297&catid=35&page=1

[9] Urban Dictionary. May 2009. Retrieved 9-29-09 from http://www.urbandictionary.com/define.php?term=deconflict