---
title: Information Gathering Methods for BC Assessments | MHA
description: Learn when to use questionnaires, interviews, workshops, document reviews, observation, and validation in business continuity assessments.
image: https://mha-it.com/hubfs/46-1.webp
---

[Skip to content](https://mha-it.com/blog/assessment-information-gathering-methods#main-content)

[![MHA by BCMMetrics - navy](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/)

- [Our Consulting Services](https://mha-it.com/what-we-do) 
    - [Business Continuity](https://mha-it.com/business-continuity)
    - [Crisis Management](https://mha-it.com/crisis-management)
    - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services)
    - [BCaaS](https://mha-it.com/bcaas)
    - [Program Augmentation](https://mha-it.com/program-augmentation)
    - [Training and Awareness](https://mha-it.com/training-awareness)
- [Our BC Software](https://bcmmetrics.com/)
- Resources 
    - [Blog](https://mha-it.com/blog)
    - [News](https://mha-it.com/news)
- [About Us](https://mha-it.com/who-we-are) 
    - [Our Team](https://mha-it.com/our-team)
    - [Clients](https://mha-it.com/clients)
    - [In the Community](https://mha-it.com/in-the-community)

[Contact Us](https://mha-it.com/contact)

[![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/)

<https://mha-it.com/blog/assessment-information-gathering-methods#business-header__mobile-nav__mmenu>

[Contact Us](https://mha-it.com/contact)

[![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/)

- [Our Consulting Services](https://mha-it.com/what-we-do) 
    - [Business Continuity](https://mha-it.com/business-continuity)
    - [Crisis Management](https://mha-it.com/crisis-management)
    - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services)
    - [BCaaS](https://mha-it.com/bcaas)
    - [Program Augmentation](https://mha-it.com/program-augmentation)
    - [Training and Awareness](https://mha-it.com/training-awareness)
- [Our BC Software](https://bcmmetrics.com/)
- Resources 
    - [Blog](https://mha-it.com/blog)
    - [News](https://mha-it.com/news)
- [About Us](https://mha-it.com/who-we-are) 
    - [Our Team](https://mha-it.com/our-team)
    - [Clients](https://mha-it.com/clients)
    - [In the Community](https://mha-it.com/in-the-community)

[Contact Us](https://mha-it.com/contact)

[![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/)

<https://mha-it.com/blog/assessment-information-gathering-methods#business-header__mobile-nav__mmenu>

[Contact Us](https://mha-it.com/contact)

- [Our Consulting Services](https://mha-it.com/what-we-do) 
    - [Business Continuity](https://mha-it.com/business-continuity)
    - [Crisis Management](https://mha-it.com/crisis-management)
    - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services)
    - [BCaaS](https://mha-it.com/bcaas)
    - [Program Augmentation](https://mha-it.com/program-augmentation)
    - [Training and Awareness](https://mha-it.com/training-awareness)
- [Our BC Software](https://bcmmetrics.com/)
- Resources 
    - [Blog](https://mha-it.com/blog)
    - [News](https://mha-it.com/news)
- [About Us](https://mha-it.com/who-we-are) 
    - [Our Team](https://mha-it.com/our-team)
    - [Clients](https://mha-it.com/clients)
    - [In the Community](https://mha-it.com/in-the-community)

[Contact Us](https://mha-it.com/contact)

Compliance

# Information Gathering Methods for Business Continuity Assessments

 Michael Herrera

 Updated on: September 28, 2026

#### Relevant Contents

#### Need Tailored Business Continuity Insights?

Contact Us Now for Personalized Guidance!

[Schedule a Free Consultation](https://mha-it.com/contact)

A business continuity assessment is only as useful as the information behind it.

If the inputs are incomplete, outdated, inconsistent, or based on assumptions no one validates, the problem eventually shows up somewhere else. Recovery priorities become difficult to defend. Dependencies are missed. Risk ratings look more precise than the evidence supports. Plans get built around information that may not reflect how the organization actually operates.

The goal of information gathering is not to collect as much data as possible. It is to collect the information needed to support the decisions the assessment is supposed to produce.

**In short**

- Use questionnaires when you need consistent information from many participants.
- Use interviews when the assessment requires context, explanation, or subject-matter expertise.
- Use workshops when several functions need to work through dependencies or conflicting views together.
- Use documents and operational data to support or challenge what people tell you.
- Use observation when the way work happens matters as much as how the process is documented.
- Use research when outside information is needed to understand threats, requirements, or operating conditions.
- Validate important findings before they become final assessment results.

## Choose the Method Based on the Assessment

There is no single information-gathering method that works for every business continuity assessment.

A business impact analysis may depend heavily on input from process owners. A threat and risk assessment may require facility information, historical events, external threat information, and interviews with security or operations teams. A current-state assessment may rely more heavily on policies, plans, exercise results, interviews, and evidence showing how the program actually operates.

The method should follow the question you need the assessment to answer.

That usually means considering three things before collecting data:

- What decision will this information support?
- Who or what is the most reliable source?
- What evidence will help validate the answer?

Using several methods does not automatically make an assessment stronger. The methods need to complement each other and produce information you can actually use.

## 6 Information Gathering Methods for Business Continuity Assessments

| Method | Useful For | Watch For |
| --- | --- | --- |
| **Questionnaires** | Collecting consistent baseline information from many participants | Incomplete answers, misunderstood questions, and unsupported estimates |
| **Interviews** | Understanding processes, impacts, dependencies, assumptions, and expert judgment | Answers based only on memory or one person's perspective |
| **Workshops** | Working through cross-functional dependencies, disagreements, and shared decisions | Group assumptions or dominant participants shaping the result |
| **Document and data review** | Validating procedures, requirements, historical performance, controls, and operating conditions | Documents that are outdated or no longer reflect actual practice |
| **Observation and walkthroughs** | Understanding facilities, physical dependencies, manual activities, and how work is actually performed | Treating one observation as representative of every operating condition |
| **Research** | Adding external threat, regulatory, geographic, historical, or industry context | Using information that is too broad or not relevant to the organization being assessed |

### 1. Questionnaires and Structured Pre-Work

Questionnaires are useful when you need the same baseline information from a large number of people or business units.

They can collect process descriptions, applications, dependencies, staffing information, locations, suppliers, recovery assumptions, or other structured inputs before a more detailed assessment takes place.

The advantage is consistency. Everyone starts with the same questions and the results are easier to compare.

The limitation is depth.

A questionnaire can tell you that a process depends on a particular application. It may not tell you how the process fails when the application is unavailable, whether a workaround exists, or whether the stated recovery requirement is supported by actual business impact.

Use questionnaires to establish a useful starting point, not to eliminate every follow-up conversation.

### 2. Interviews

Interviews are useful when the assessment requires explanation and context that cannot be captured easily through structured fields.

A subject-matter expert can explain how a process actually operates, why a dependency matters, what happens when a workaround is used, or where the documented procedure differs from everyday practice.

Interviews are particularly valuable when the answer requires judgment.

They also create a validation challenge. Process owners know their operations well, but people can still overestimate criticality, underestimate the limitations of a workaround, or answer from memory rather than evidence.

When conducting a BIA specifically, see [BIA Interviews That Produce Useful Data: Questions, Evidence, and Red Flags](https://mha-it.com/blog/bia-interview-questions-useful-data). That article goes deeper into the interview questions and evidence needed for BIA decisions.

### 3. Facilitated Workshops

Some assessment questions cannot be resolved effectively through separate interviews.

Workshops are useful when several teams share a dependency or when different parts of the organization have conflicting views of the same issue.

For example, the business may believe an application can be recovered in four hours while IT says current recovery capability is eight. A process owner may believe a supplier has a workable continuity arrangement while procurement has different information.

Putting the appropriate people in the same discussion can expose those gaps quickly.

Workshops work best when the session has a defined question to resolve. They become less useful when the purpose is simply to gather everything everyone knows about the topic.

### 4. Document and Data Review

Assessment results should not depend entirely on what participants remember during a meeting.

Documents and operating data can provide evidence for important answers and help identify inconsistencies that require follow-up.

Depending on the assessment, useful material may include:

- business continuity and recovery plans
- policies and procedures
- process maps
- application and asset inventories
- supplier agreements
- service-level commitments
- exercise and test results
- incident and outage history
- staffing or workload information
- audit and assessment findings

The document itself is not automatically proof that a capability works.

A plan may be current on paper but untested. A supplier contract may contain a recovery commitment that has never been validated. An application inventory may not reflect recent changes.

Use documents as evidence, then confirm whether they still describe reality.

### 5. Observation and Walkthroughs

Direct observation can uncover information that does not appear in a questionnaire or procedure.

This is especially useful for facilities, manufacturing environments, physical security, manual workflows, specialized equipment, utilities, and processes with important physical handoffs.

A site walkthrough might reveal that two supposedly redundant operations depend on the same electrical feed. Observing a manual process may show that a workaround requires equipment, access, or staffing that was not captured in the plan.

The purpose is not to replace the process owner's knowledge. It is to compare that knowledge with the environment in which the process actually operates.

### 6. Internal and External Research

Some information has to come from outside the immediate assessment participants.

Internal research may include previous incidents, past assessments, audit results, exercise records, facilities information, or historical operating data.

External research may help provide context about geographic threats, utilities, suppliers, regulations, industry conditions, or other factors that could influence the assessment.

This is particularly useful in a threat and risk assessment, where the assessment team may need information beyond what internal process owners can provide.

For more on that process, see [Risk Assessment: The Best Way to Identify Your Biggest Threats](https://mha-it.com/blog/risk-assessment-identify-threats).

[![New Logo White](https://no-cache.hubspot.com/cta/default/46330580/interactive-223059772727.png)](https://mha-it.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKNpaiIeROtyffxFFJwRG070jbcJTjgBVkckNvj6YlmcRkwfuUbMDbENQJMBJDkMTXCPUSjXZ9Twujhy9uzIG6i88q1AhqtkeeZsfM%2FkjxQ%2B%2BT93cr0GOYrXiN8ToOdyOV6bfi39K5LE7LW3EVf8WLYdM5CffplmjSAps524LGm5WsDeTyUgTuZm77hapZDao8%3D&webInteractiveContentId=223059772727&portalId=46330580)

## Validate the Information Before Finalizing the Assessment

Information gathering does not end when the meetings are over.

Before important findings become final, review the inputs for conflicts, missing evidence, assumptions, and open questions.

If one person says a process can operate manually for five days but another says the workaround can handle only a small fraction of normal volume, that difference needs to be resolved.

If a recovery target is based on a contractual requirement, confirm the requirement.

If a control is being credited with reducing risk, determine what evidence shows that the control works as expected.

If an answer cannot be validated yet, record that uncertainty rather than allowing an estimate to become accepted fact simply because it appears in the assessment.

This distinction matters in both BIAs and risk assessments. For more on how those two assessments differ, see [BIA vs. Risk Assessment: What Each One Tells You](https://mha-it.com/blog/bia-and-risk-assesment).

## Match the Method to the Assessment

Different assessments will use different combinations of these methods.

### Business Impact Analysis

A BIA may begin with structured pre-work, move into interviews with knowledgeable process owners, and use business records to validate the answers that will drive recovery priorities and targets.

### Threat and Risk Assessment

A risk assessment may combine interviews, site walkthroughs, incident history, facilities information, external research, and documentation of current controls.

### Current-State Assessment

A current-state review may depend heavily on policies, plans, exercise results, interviews, program records, and evidence showing whether documented practices are actually being followed.

### IT and Disaster Recovery Assessment

A technology assessment may require architecture documentation, application inventories, recovery procedures, testing evidence, technical interviews, and direct review of recovery capabilities.

The combination should reflect what the assessment needs to establish. Do not use a method simply because it is part of the standard template.

## Common Information-Gathering Problems

More information does not automatically produce a better assessment.

Common problems include:

- collecting information that has no clear connection to a decision
- depending on one person for an important conclusion
- accepting estimates without identifying them as estimates
- treating old documentation as current evidence
- using workshops when participants need to provide independent views first
- allowing unanswered questions to disappear after the meeting
- collecting so much detail that the important findings become difficult to see

A good assessment process is selective. It gathers enough information to support the decision, then validates the information that matters most.

## Better Inputs Lead to Better Assessment Decisions

Questionnaires, interviews, workshops, documents, observation, and research each reveal different parts of the picture.

The strongest method depends on what you need to understand.

For a program owner, the practical goal is not to use every technique. It is to make sure important assessment conclusions can be explained, supported, and used to make the next decision.

---

## Frequently Asked Questions

### What are the main information gathering methods used in business continuity assessments?

Common methods include questionnaires, interviews, facilitated workshops, document and data review, observation or site walkthroughs, and internal or external research. Important findings should also be validated before the assessment is finalized.

### Which information gathering method is most useful?

It depends on the assessment. Questionnaires are useful for consistent baseline data, interviews provide depth, workshops help resolve cross-functional issues, documents provide evidence, and observation helps confirm how operations work in practice.

### Are interviews enough for a business continuity assessment?

Interviews can provide valuable context and subject-matter knowledge, but important conclusions may also require documents, operational data, observations, or other evidence. The appropriate combination depends on the decision being supported.

### Why should assessment data be validated?

Validation helps identify conflicting answers, unsupported assumptions, outdated documentation, and gaps between what is documented and what actually happens. That makes the resulting assessment easier to use and defend.

### How is information gathering different in a BIA and a risk assessment?

A BIA gathers information about business impacts, dependencies, recovery requirements, and operating needs. A risk assessment gathers information about threats, vulnerabilities, controls, and the exposure those conditions create. Some gathering methods are useful for both, but the questions and decisions are different.

## Further Reading

- [BIA Interviews That Produce Useful Data: Questions, Evidence, and Red Flags](https://mha-it.com/blog/bia-interview-questions-useful-data)
- [BIA vs. Risk Assessment: What Each One Tells You](https://mha-it.com/blog/bia-and-risk-assesment)
- [Risk Assessment: The Best Way to Identify Your Biggest Threats](https://mha-it.com/blog/risk-assessment-identify-threats)

---

![](https://mha-it.com/hubfs/Michael-Herrera-MHA-Consulting%201.png)

#### Michael Herrera

Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.

## Start building a stronger future

##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera.

[Schedule your consultation](https://mha-it.com/contact)

## Other resources you might enjoy

![operational risk management](https://mha-it.com/hs-fs/hubfs/Imported_Blog_Media/operational-risk-management-1.jpg?height=245&name=operational-risk-management-1.jpg)

#### [Every Single Day: Make Risk Management Part of Your Company’s Culture](https://mha-it.com/blog/operational-risk-management)

[Read More](https://mha-it.com/blog/operational-risk-management)

![Hit or Myth: 5 Common Misconceptions About IT/disaster recovery](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/it-disaster-recovery.jpg?height=245&name=it-disaster-recovery.jpg)

#### [Hit or Myth: 5 Common Misconceptions About IT/disaster recovery - MHA Consulting](https://mha-it.com/blog/it-disaster-recovery-myths)

[Read More](https://mha-it.com/blog/it-disaster-recovery-myths)

![What Comes Naturally: Dealing with Disasters Made by Mother Nature](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/dealing-with-disasters.jpg?height=245&name=dealing-with-disasters.jpg)

#### [What Comes Naturally: Dealing with Disasters Made by Mother Nature - MHA Consulting](https://mha-it.com/blog/dealing-with-disasters)

[Read More](https://mha-it.com/blog/dealing-with-disasters)

## Ready to start focusing on higher-level challenges?

[![MHA by BCMMetrics - White](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/)

Business continuity consulting for today’s leading companies.

#### Company

- [Who We Are](https://mha-it.com/who-we-are)
- [Team](https://mha-it.com/our-team)
- [Clients](https://mha-it.com/clients)
- [News](https://mha-it.com/news)
- [Blog](https://mha-it.com/blog)
- [Contact](https://mha-it.com/contact)

#### Services

- [Business Continuity](https://mha-it.com/business-continuity)
- [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services)
- [Crisis Management](https://mha-it.com/crisis-management)
- [BCaaS](https://mha-it.com/bcaas)
- [Training & Awareness](https://mha-it.com/training-awareness)
- [Program Augmentation](https://mha-it.com/program-augmentation)

© 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy)

```json
{
  "@context" : "",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://mha-it.com",
    "name" : "Home",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://mha-it.com/blog",
    "name" : "Blog",
    "position" : 2
  }, {
    "@type" : "ListItem",
    "name" : "Information Gathering Methods for Business Continuity Assessments",
    "position" : 3
  } ]
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Michael Herrera",
    "url" : "https://mha-it.com/blog/author/michael-herrera"
  },
  "dateModified" : "2026-09-28T20:33:21.073Z",
  "datePublished" : "2013-06-03T16:19:04.000Z",
  "headline" : "Information Gathering Methods for BC Assessments | MHA",
  "image" : [ "https://mha-it.com/hubfs/46-1.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://mha-it.com/blog/assessment-information-gathering-methods",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg"
    }
  }
}
```