CBCI (Business Continuity Certifications): The BIA that says everything is critical

The output is unusable because the method allowed it to be. Four defects:

1. No impact criteria. Without agreed thresholds - a £ figure, a regulatory breach, a service level, harm to a member organisation - 'critical' is an opinion. Opinions cluster around the safest answer.
2. No time dimension. Impact was captured as one rating. Most impacts are trivial at four hours and severe at four days; the shape of the curve is what determines strategy. Rating without time cannot distinguish a payroll run from a stationery order.
3. No maximum tolerable period of disruption. RTOs were invented in isolation. An RTO is derived: it must be shorter than the MTPD, with a margin for recovery. Without an MTPD, the four-hour figure is arbitrary - and it was literally copied from a template in several cases.
4. Dependencies too coarse to act on. 'IT' and 'people' cannot be recovered. You need named systems, interfaces, data, suppliers, premises, skills and key individuals.

Changes: facilitated workshops with a fixed impact scale rather than self-service forms; impact assessed at 4 hours, 24 hours, 3 days and 1 week against agreed categories; MTPD set first, then RTO derived; dependency capture at asset and supplier level; sign-off by the risk owner who would bear the consequence, with a short evidence question - 'what happened the last time this stopped, and for how long?'

Expect the number of critical activities to fall to single figures. That is not a failure of the exercise; it is the exercise working.

Do not argue the rating; test it with evidence. The head is not lying - she is protecting her team from being told they can wait. Attacking the rating attacks her judgement, and you will lose that argument regardless of the data.

Approach:

• Ask about consequences, not categories. 'If payroll cannot run for a day, what happens? For three days? For a week?' Then write down the specific answer: which member organisations, which staff unpaid, which regulator, which date.
• Use her own history. 'The October outage took two days to restore - what broke, and what did not?' Real events calibrate faster than hypotheticals.
• Make the trade-off visible. Show what a four-hour recovery for eleven activities actually costs - the resilience budget is £400,000 and a four-hour recovery across all 62 critical activities is a seven-figure proposition. Give her a choice she can defend upward.
• Offer sequencing rather than denial. 'Your top three get four hours. The next five get 24. The rest are recovered in a week. Does that hold?' She keeps protection for what matters and gains a defensible position.
• Use the MTPD as the anchor. The question is not 'how fast would you like to be back' but 'when does the harm become unacceptable'. That reframes from ambition to tolerance.

If she still disagrees, record it as a documented disagreement with her rationale and escalate to the risk owner. Bullying a rating down is worse than an over-cautious one, because the BIA's credibility depends on being believed by the people who own the work.

The BIA as it stands proves nothing, and saying so is the honest position. It records 62 activities wanting four-hour recovery, which is not a funding requirement - it is 62 unvalidated preferences. If you take it to the board, you will either be refused (and lose credibility) or funded on a figure that will not survive scrutiny.

What to do instead:

1. Tier the results. Even from this data, dependency analysis will show that most of the 62 share the same small set of systems, sites and suppliers. Recovery of the shared dependencies delivers most of the requirement at a fraction of the cost of 62 separate plans.
2. Re-derive from MTPD. Re-interview the dozen activities with the highest genuine consequence. You will likely find a small number needing four hours, a middle band at 24–48 hours, and a long tail where the honest answer is days.
3. Model the gap. Present cost of the current requirement, cost of a risk-based alternative, and the residual risk accepted in each case, with the consequences named.
4. Put the decision where it belongs. If the executive's risk appetite requires four-hour recovery for all 62, that is a legitimate decision - but it must be recorded as an accepted funding requirement or an accepted risk, with a named owner.

Framing to use: 'The BIA tells us what people fear losing. It does not yet tell us what we must spend. Give me three weeks to convert it into a set of choices, and you will get a decision you can defend to the board.' That keeps the executive's concern alive without letting an unvalidated spreadsheet become the budget case.