Before data collection (via questionnaires, interviews, documents, and research) can begin it is critical for a company to know what they are looking for. You may choose to hire subject matter experts to create such questionnaires or interview questions for you. It is important to have a comprehensive list of the major and minor departments, which are often the functional areas, in your company. Also, remember there may be internal or external dependencies that raise the criticality of particular business functions. Asking questions and providing scenarios can help people focus on specific business issues and generate better responses.
The following are some questions you might ask of your subject matter experts to help them focus on the key aspects of the Business Impact Analysis:
- How would the department function if desktop, laptops, servers, e-mail, and internet access were not available?
- What single points of failure exist? What, if any, risk controls or risk management systems are currently in place?
- What are the critical outsourced relationships and dependencies? What are the upstream and downstream risks to your business function?
- If a business disruption occurred, what workarounds would you use for your key business processes?
- What is the minimum number of staff you would need and what functions would they need to carry out?
- What are the key skills, knowledge, or expertise needed to recover? What are the key roles that must be present for the business to operate?
- What critical security or operational controls are needed if systems are down?
- How would this business function in a backup recovery site? What would be needed in terms of staff, equipment, supplies, communications, processes, and procedures?