BIM results in a decision framework and a database to improve decision
making in every phase of the continuity
or resilience program. Importantly, it is an
interactive concept that seeks to not only
ascribe impacts, but to also understand
relationships, identify resources and alternatives, and establish core strategies.
BIM establishes a clear picture of how
a business works and how it might break
and begins the process of establishing
the core elements of how an organization
might best protect and recover. I believe
that BIM, in many cases, actually pro-
vides more value than planning where too
much focus is on formatting information
in a document rather than preparing for an
actual event.
Now before you react to that, I am not
saying don’t plan, but with BIM information, your plans will be more usable, which
is the true test on a plan’s value.
People try all the time to get ideas about
questions to ask in a BIA. With BIM, the
focus is on what questions need to be
answered now, and at the time of a crisis,
including what data we need to most com-
pletely answer those questions.
BIM outcomes should include reports
and dashboards designed to answer key
questions so that it is clear what happened,
what the options are, what the collateral
damage is, and what expectations should
be set and can be met.
This is very different than simply trying
to make a case for further investment in
planning or establishing RTOs and RPOs.
What Can You Do?
Most importantly, ask yourself if your
BIA process really captures the knowledge
you need to better position your organization to prepare for and respond to incidents
that will occur.
My belief is that the BIA process has
run its course and adopting an active
threat-risk-impact-based process such as
the outlined business impact management
approach can better serve your organization and position you as more in tune with
the organization’s needs.
Know your capabilities to respond
and recover so you can factor those into
discussions. Understand the threats to
the business, determine how the threats
evolve into risks, and identify how risk
impacts vary based on the situation. Parts
of a business will react and respond differ-
ently to situational impacts
So, decide to make business impact
management a part of the regular process
of how you work internally. Structure data
gathering to directly support strategy and
action development and present data gath-
ering in terms of realistic and probably
impacts. In my opinion, your standing in
the organization and the quality of your
results will benefit from the change.
v
John A. Jackson FBCI Hon., CORE,
is an executive advisor for Fusion Risk
Management and on the board of directors for Business Continuity Institute
(BCI). Jackson has more than 30 years
of continuity industry leadership and is widely regarded
as an early and current visionary in enterprise business
continuity, crisis management, risk management, and
disaster recovery. Jackson’s industry experience includes
executive management of Comdisco, HP, and IBM’s business continuity organizations. Jackson co-founded Fusion
Risk Management in 2005 and today actively contributes to
the industry by serving on the Disaster Recovery Journal
Executive Advisory Board and the Disaster Resource
Guide Editorial Advisory Board.
Regina Phelps is an internationally-known emergency management and continuity planning
expert. For more than 30 years, she has advised large corporations, government entities, and
other organizations on how to prepare for circumstances that put their enterprises at risk. She
designs and conducts more than 100 exercises a year. She previously wrote Emergency
Management Exercises (available on Amazon).
