The BIA That Everyone Agreed With
A regional hospital network is conducting its first BIA under a new continuity manager. Department heads were sent a spreadsheet asking them to rate the criticality of their own functions on a 1-5 scale and estimate their own RTOs. The results came back with 71 of 80 functions rated 4 or 5, and 62 functions claiming an RTO of 4 hours or less. The emergency department, laboratory, and IT infrastructure all appear in the top tier, but so do marketing, pastoral care, and the gift shop. The COO has signed off, saying the numbers reflect how seriously staff take resilience. The continuity manager is uneasy but has no baseline to argue from.
1. Diagnose why these BIA results are unusable and identify the specific methodological flaws.
Read the worked answer
The results fail a basic plausibility test: if nearly 90% of functions are top-tier, the ranking carries no information and cannot drive prioritization or spending. The distribution is a symptom of at least four flaws.
First, self-assessment without calibration. Department heads have an incentive to inflate criticality - high ratings attract resources and signal importance. There is no cross-functional moderation, no scoring rubric anchored in observable impact, and no challenge session.
Second, no impact dimensions. Respondents rated a single vague 'criticality' rather than separate financial, regulatory, patient-safety, and reputational impacts over time. That makes the ratings incomparable across departments.
Third, no dependency mapping. The lab depends on IT; the ED depends on the lab. Rating functions in isolation hides that the true recovery sequence is driven by dependencies, not by individual department opinions.
Fourth, no time-phased impact curve. Asking for an RTO directly skips the question of how impact grows hour by hour, which is what actually justifies an RTO.
Marketing and the gift shop appearing in the top tier is the tell that the instrument, not the organization, produced these numbers.
2. Describe how you would redo the BIA to produce defensible results, and how you would handle the COO's endorsement of the current output.
Read the worked answer
Redo the BIA with a structured, facilitated method. Define impact categories (patient safety, regulatory, financial, operational, reputational) and score each function against time bands - 0-4h, 4-24h, 24-72h, beyond 72h - using anchored descriptors rather than a 1-5 gut feel. Run calibration sessions where department heads defend ratings before peers, and have the continuity manager normalize scores across departments. Build a dependency map so IT and lab dependencies propagate correctly. Derive RTOs from where the impact curve turns steep, not from respondent preference. Validate the top tier against a tabletop discussion of what actually stops first.
Handling the COO requires care. Do not frame it as staff being dishonest - frame it as the instrument lacking calibration, which is a process issue, not a culture issue. Show the COO the distribution problem concretely: a prioritization list where 71 of 80 items are top-tier cannot allocate scarce recovery resources. Propose the redo as a refinement that will make the COO's sign-off more defensible to regulators and auditors, and ask the COO to sponsor the calibration sessions, which converts a potential adversary into the authority behind the new method.