The BIA That Everyone Signed Off On
A mid-sized insurer completes a business impact analysis across 22 business units. The BIA questionnaire asks unit heads to state their maximum tolerable downtime (MTD). The completed returns show a striking pattern: 18 of 22 units declare an MTD of exactly 24 hours, including the actuarial modelling team and the facilities helpdesk. The continuity manager suspects the number was circulated informally before submission. Separately, the IT disaster recovery plan is built to a 48-hour recovery time objective for the claims platform, which the claims unit has listed as its most critical system. The board's risk committee meets in three weeks and expects a BIA summary. The continuity manager has no budget for external consultants this year.
1. Diagnose the root cause of the uniform 24-hour MTDs and explain why this BIA cannot be used as the basis for recovery strategy.
Read the worked answer
The clustering at exactly 24 hours is a classic anchoring artefact, not a finding. When 18 of 22 units independently produce the same round number, the most probable explanation is that unit heads treated the question as a compliance formality, copied a peer's answer, or picked the shortest option that sounded defensible. A genuine BIA produces a distribution, because units have genuinely different tolerance for outage.
The BIA is unusable for strategy for three reasons:
- No differentiation means no prioritisation. If everything is equally critical, the recovery sequencing decision has no input, and IT will default to whoever shouts loudest.
- The MTDs are inconsistent with the DR capability. Claims declares 24 hours but the platform is designed to 48. Either the MTD is wrong or the DR plan is under-funded - and the BIA as written cannot tell you which.
- MTD was collected without the impact analysis that justifies it. An MTD is a derived figure: it should fall out of quantified impact over time (financial, regulatory, reputational, contractual). Asking for the number directly invites guessing.
With no consultant budget, the continuity manager must fix this in-house through method: replace the single-question form with a facilitated impact workshop per unit, walking each through impact at 4h, 24h, 72h and 1 week, and requiring them to name the source of each impact figure.
2. The board meeting is in three weeks. Recommend what the continuity manager should present, and what she should explicitly not claim.
Read the worked answer
She should present an honest interim position, not a sanitised summary. Three weeks is enough to re-run the highest-value units and not enough to redo all 22.
Present:
- The finding itself - the clustering and its likely cause - framed as a data-quality issue the committee should know about. Boards respond better to a disclosed weakness than a discovered one.
- A re-based sample: re-interview the 5–6 units with the largest financial or regulatory exposure using the time-series impact method, and show the resulting MTDs alongside the original 24-hour claims. The contrast makes the case for the method better than any argument.
- The claims/DR inconsistency as a discrete decision: either fund recovery to 24 hours or formally accept a 48-hour MTD with the business owner's signature. That is a risk-acceptance decision, which is the committee's to make, not hers.
Do not claim:
- That the BIA is complete or validated.
- That the 24-hour MTDs represent business tolerance.
- Any recovery prioritisation derived from the current data.
She should ask the committee for a dated mandate to complete the re-run, with the units themselves accountable for signing their impact figures.