How to Report BIA/RA Findings to Management – Your Opportunity for You to Shine!

You completed the hard work. Not it is time to wow management with what you have done and what you can do going forward!

After you have completed your Business Impact and Risk Assessment it is time to build an executive report for management’s review. I like to do one comprehensive report including both the results of the BIA and RA. The report can also be done separately for each analysis if you prefer. Either way the analysis will provide management with a comprehensive view of criticalities, dependencies, threats and risks.

Go into the meeting confident and proud. You will see, they will love your analysis.

Toward the end of the report include high level recovery strategy recommendations. They do not have to be finely detailed, as strategy development occurs in the next phase of the cycle. Let them know what might make sense and the options that are available. Management will most likely provide valuable input.

Work-up some costs versus impact rationale. During the early years of my career I did not include high level recovery strategies in this report and it was requested by management so I improved the process. These value-added suggestions have always been very well received.

Tip – Great news: having completed a thorough analysis of recovery time-sensitivity, impact and risk your business continuity plans will accurately reflect the reality of your business.

Tip – More great news: if you use an automated BCM system much of the dynamic content in your ensuing business continuity plan will be automatically populated and updated in real-time.

The executive report must be formatted in a professional – visual manner. When I did my first few executive reports years ago I Googled ‘executive reports’ for ideas on formatting. I admittedly do not have a very ‘visual eye’. When I used to develop software systems I would develop the back-ends – databases, logic, algorithms, etc. and I would leave design to the front-end folks. Again, if you are using a BCM tool you may have a nicely formatted and easy to customize Executive Report template that automatically populates – how cool is that!

I structure the sections of my combined BIA, RA Executive Report as follows. Every organization is different so please customize the report for the needs and requirements of your management:

1. Give a short high level overview of the work that was performed
2. List the objectives of the BIA
3. Describe the process you used to gather the information
4. Provide a listing of the processes in scope. I prefer to include all processes in my BIA’s
5. Describe the time buckets of time-sensitivity (criticality) to recover the process
6. Provide a list containing each process/sub-process in time sensitivity order from most time sensitive to the least time sensitive.
7. Include the process owner name and a brief description of the major impacts for each process
8. Graph of the process/sub-processes, grouped by time sensitivity buckets, i.e. 1-4 hours…
9. List of process/sub-processes by time sensitivity buckets, i.e. 1-4 hours…
10. Provide regulatory impacts – I list each sub process with a criticality rating, authorities, fines…
11. Provide revenue impacts – you can often get these from sales and/or accounting
12. Provide brand impacts
13. Provide customer loss impacts
14. List IT Systems. Map systems to processes. Include the RTO, RPO
15. List process staffing head-counts – both regular and recovery requirements. I group by time-buckets
16. List employee skills and certifications
17. Provide a summary of general findings during the interviews
18. List threats / hazards to each of your locations
19. Calculate the probability of threats becoming a reality
20. List vulnerabilities
21. List impacts
22. List risks
23. Include the BIA questionnaire you used to collect the results and the responses
24. Include the risk assessment analysis including threats vulnerabilities and impacts
25. Include the risk assessment charts (see risk assessment post for examples)
26. Summarize all of the findings
27. Describe high level prevention, mitigation and recovery strategies for each process/sub-process

Tip – For discussion purposes with management, include the previously mentioned high level recovery strategies you think are appropriate to meet the business recovery requirements.  I show maps with arrows and icons illustrating some possible recovery strategies. I emphasize how I am being cost conscious where it makes sense and I will save them money while still building resilience into the business. I include pictures of workstation area recovery rooms, tech’ed out mobile trailers recovery solutions, etc. Executives are probably not familiar with what is possible to keep their business going. Wow them with what you can really do!!!

Executive Report Cycle Steps:

1. Send the comprehensive report to management along with a meeting invite to discuss the report and to answer all of their questions. Give them a few days to read the report prior to the meeting.
2. Meet with them and discuss the report. Some executives will read the report prior to the meeting and some will not. They will have questions and comments. Go through each section with them during the meeting. Keep the acronyms to a minimum. Answer any and all questions.
3. During the meeting they will probably provide updates and adjustments for you to incorporate in the report. In some cases management might have a different view of the time sensitivity for recovering some of the processes. Occasionally, their view of a process is less time-sensitive than seen through a process owner’s lens. I have rarely seen anything drastically misaligned between management and process owners. You will then make the adjustments they request and resubmit the report to management for final sign-off so you can move forward.

Congratulations on getting to this significant milestone. Yes, it is time to celebrate. Enjoy dinner at your favorite restaurant.