业务影响分析示例
【写在前面：本文是对《ISO/TS 22317: 2021 安全和韧性 – 业务连续性管理体系 – 业务影响分析指南》中”附录D 业务影响分析示例”(Examples for performing a BIA)的中英文对照翻译，供大家参考使用。】
1. 例1 — 估算产品和服务的MTPD，用它估算活动MTPD并设定RTO Estimate product and service MTPD, then use it to estimate activity MTPD and set RTO
1.1 综述(General)
本示例给出的表格可用于记录最高管理层对产品和服务交付的优先级的决定(见表1)，因此用于确定组织活动和资源的优先级(见表3到表7)。 This example presents forms that can be used to record top management’s decisions on the priorities for the delivery of products and services (see Table1). These are then used to prioritize the organization’s activities and resources (see Tables 3 to 7).
步骤如下： a) 为每种影响类型界定MTPD阈值； b) 记录产品和服务，并估算其各自的MTPD； c) 对于每种产品和服务，记录活动，确定其MTPD并设定其RTO； d) 对于每项活动，记录资源； e) 整合所有活动的资源需求。 The steps are as follows: a) define the MTPD threshold for each impact type; b) document the products and services and estimate their respective MTPD; c) for each product and service, document the activities, identify their MTPD and set their RTO; d) for each activity, document the resources; e) consolidate resource requirements across all activities.
1.2 第1步 为每种影响界定MTPD阈值(Step 1 — Define MTPD threshold for each impact type)
完成影响表(见表1)，其中包含影响描述和经最高层管理层同意的、确定的MTPD 阈值。 Complete an impact table (see Table 1) with the description of impacts and the defined MTPD threshold as agreed by top management.
表1 MTPD影响表(MTPD impact table)
| 影响类型Impact Type | 描述Description | MTPD阈值MTPD Threshold |
|---|---|---|
| 业务目标 Business objectives | 未能实现目标或利用机会 Failure to deliver on objectives or take advantage of opportunities | 跌幅大于15% Drop greater than 15% |
| 财务 Financial | 由于罚款、罚金、利润损失或市场份额减少导致的财务损失 Financial losses due to fines, penalties, lost profits or diminished market share | 损失超过100万美元 Loss greater than USD 1 million |
| 法律法规 Legal and regulatory | 诉讼责任和吊销营业执照 Litigation liability and withdrawal of license to trade | 监管机构暂停营业执照 Regulator suspends operating license |
| 市场份额 Market share | 客户流失转移到竞争对手 Loss of clients moving to competitors | 新订单下降超过25% New orders drop greater than 25% |
| 声誉 Reputational | 负面意见或品牌损失 Negative opinion or brand damage | 负面关注广泛，需要聘请外部沟通专家 Negative attention extensive enough to engage external communications experts |
1.3 第2步 记录产品和服务，并估算其各自的MTPD(Step 2 — Document products and services and estimate their respective MTPD)
产品和服务BIA表单(见表2)给出了组织已识别的产品和服务。对于每种产品和服务，最高管理层为商定的影响类型确定阈值，并在影响类型中选择最低的MTPD值。 The product and service BIA form (see Table 2) presents the organization’s identified products and services. For each product and service, top management determines the threshold for the agreed impact types (see Table 1) and selects the lowest MTPD value across the impact types.
表2 产品和服务BIA表单(Product and service BIA form)
| 产品或服务 Product or service | 影响类型 Impact Type | MTPD阈值(见表1) MTPD threshold | 产品或服务MTPD Product or service MTPD |
|---|---|---|---|
| 客户服务 Customer service | 业务目标Business objectives | 48小时(48 hours) | 24小时 24 hours |
| 客户服务 Customer service | 财务Financial | 5天(5days) | 24小时 24 hours |
| 客户服务 Customer service | 法律法规Legal and regulatory | 不适用(Not applicable) | 24小时 24 hours |
| 客户服务 Customer service | 市场份额Market share | 不适用(Not applicable) | 24小时 24 hours |
| 客户服务 Customer service | 声誉Reputational | 24小时(24hours) | 24小时 24 hours |
| …… | …… | …… | …… |
| 保单手册 Insurance policy booklet | 业务目标Business objectives | 不适用(Not applicable) | 48小时 48 hours |
| 保单手册 Insurance policy booklet | 财务Financial | 5天(5days) | 48小时 48 hours |
| 保单手册 Insurance policy booklet | 法律法规Legal and regulatory | 48小时(48hours) | 48小时 48 hours |
| 保单手册 Insurance policy booklet | 市场份额Market share | 1个月(1 month) | 48小时 48 hours |
| 保单手册 Insurance policy booklet | 声誉Reputational | 1周(1 week) | 48小时 48 hours |
1.4 第3步 对于每种产品和服务，记录活动，确定其MTPD并设定其RTO(Step 3 — For each product and service, document the activities, identify their MTPD and set their RTO)
活动BIA表单(见表3)给出了交付每种产品和服务必需的活动。活动RTO应当设定在活动MTPD以内。本示例假定，对于这个服务，所有3个活动都需要在服务MTPD内恢复。 The activity BIA form (see Table 3) presents the activities required to deliver each product and service. The activity RTO should be set within the activity MTPD. This example assumes that, for this service, all three activities need to be resumed within the service MTPD.
表3 活动BIA表单(Activity BIA form)
| 产品或服务 Product or service | 产品或服务MTPD Product or service MTPD | 活动 Activity | 活动MTPD Activity MTPD | 活动RTO Activity RTO |
|---|---|---|---|---|
| 客户服务 Customer service | 24小时(见表2) 24 hours(from table2) | 前线呼叫处理 Front line call handling | 4小时 4 hours | 1小时 1 hour |
| 客户服务 Customer service | 24小时(见表2) 24 hours(from table2) | 二线问题解决 Second line problem solving | 8小时 8 hours | 2小时 2 hours |
| 客户服务 Customer service | 24小时(见表2) 24 hours(from table2) | 文档分派 Document dispatching | 24小时 24 hours | 8小时 8 hours |
1.5 第4步 对于每项活动，记录资源(Step 4 — For each activity, document the resources)
资源BIA表单(见表4)给出了每项活动必需的资源。每项活动(可能参与交付多个产品和服务)都有一张表。此表单的内容因组织资源需求的性质而有所不同。 The resource BIA form (see Table 4) presents the resources required by each activity. There will be one table for each activity (which can be involved in delivering more than one product and service). The contents of this form will vary according to the nature of the organization’s resource requirements.
表4 资源BIA表单(Resource BIA form)
| 活动 Activity | 前线呼叫处理(见表3“活动”列) Front line call handling (from Table 3 “Activity” column) |
|---|---|
| 活动RTO Activity RTO | 1小时(见表3“活动RTO”列) 1 hour (from Table 3 “Activity RTO” column) |
| 所交付产品和服务 Product(s) and service(s) delivered | 客户服务(见表3“产品或服务MTPD”列) Customer service (from table 3 “Product or service MTPD” column) |
| 相互依赖关系 Interdependencies | 客户产品部门的新定价 New pricing from customer products department |
| 资源 Resources | 员工(见表5) Staff(see Table 5) 装备(本示例中无) Equipment(not shown in this example) 应用程序(见表6) Application(see Table 6) 供应商(见表7) Suppliers(see Table 7) |
表5、6和7是记录一些资源需求的示例。 Tables 5, 6 and 7 are examples of how to document some resource requirements.
1.6 第5步 整合所有活动的资源需求(Step 5 — Consolidate resource requirements across all activities)
确定资源需求时，选择最小的活动RTO(见表5、6和7)。资源可在所有活动中累计，也可以按业务部门或地理位置制成表格。 When identifying resource requirements, the earliest activity RTO is selected (see Tables 5, 6 and 7). The resources can be accumulated across all activities. They can also be tabulated by business unit or location.
表5 随时间推移所需的员工人数(Cumulative staff numbers required over time)
| 活动 Activity | 资源 Resource | 正常营业 BAU | 1小时 1 hour | < 2小时 < 2 hours | < 8小时 < 8 hours | < 1周 < 1 week | < 1月 < 1 month | > 1月 > 1 month |
|---|---|---|---|---|---|---|---|---|
| 前线呼叫处理 Front line call handling | 主管 Supervisors | 6 | 1 | 1 | 2 | 4 | 4 | 6 |
| 前线呼叫处理 Front line call handling | 接线员 Operators | 100 | 5 | 15 | 40 | 80 | 80 | 100 |
| 二线问题解决 Second line problem solving | 主管 Supervisors | 4 | 0 | 1 | 1 | 2 | 2 | 4 |
| 二线问题解决 Second line problem solving | 软件工程师 Software engineers | 30 | 0 | 5 | 12 | 20 | 20 | 30 |
| 文档分派 Document dispatching | 接线员 Operator | 5 | 0 | 1 | 1 | 1 | 3 | 5 |
| 合计total | 合计total | 145 | 6 | 22 | 56 | 107 | ||
表6 所需应用程序及其RTO和RPO清单(List of applications required with their RTO and RPOs)
| 应用程序 Application | 支持的活动 Used by activity | 活动RTO RTO from activity | 应用程序RTO Application RTO | 活动RPO RPO from activity | 应用程序RPO Application RPO |
|---|---|---|---|---|---|
| 呼叫登记系统 Call register system | 前线呼叫处理 Front line call handling | 1小时 1 hour | 1小时 1 hour | 2小时 2 hours | 2小时 2 hours |
| 呼叫登记系统 Call register system | 二线问题解决 Second line problem solving | 2小时 2 hours | 1小时 1 hour | 12小时 12 hours | 2小时 2 hours |
| 呼叫处理系统 Call handler system | 前线呼叫处理 Front line call handling | 1小时 1 hour | 1小时 1 hour | 24小时 24 hours | 24小时 24 hours |
| 文件管理存储库 Document management repository | 文件分派 Document dispatching | 24小时 24 hours | 24小时 24 hours | 24小时 24 hours | 24小时 24hours |
| …… | …… | …… | …… | …… | …… |
表7 供应商清单及其资源RTO(List of suppliers and their resource RTO)
| 供应商 Supplier | 资源 Resource | 支持的活动(见表3) Used by activity(from Table 3) | 活动RTO(见表3) Activity RTO(from Table 3) | 资源RTO Resource RTO |
|---|---|---|---|---|
| 供应商A Supplier A | 外部呼叫接线员 External call operators | 前线呼叫处理 Front line call handliing | 1小时 1 hour | 24小时 24 hours |
| 供应商A Supplier A | 软件工程师 Software engineer | 二线问题解决 Second line problem solving | 2小时 2 hours | 5天 5 days |
| 供应商B Suppliler B | 快递员 Courier | 文件分派 Document dispatching | 24小时 24 hours | 48小时 48 hours |
| …… | …… | …… | …… | …… |
2. 例2 — 确定MTPD并设定RTO Example 2 — Identify MTPD and set RTO
2.1 综述(General)
以下示例展示了在以下情况下，如何提前界定标准并在整个组织中应用以确保一致性： — 最高管理层估算产品和服务的MTPD； — 活动负责人确定活动的MTPD并设定其RTO。 The following example shows how criteria can be defined in advance and applied across the organization to ensure consistency when: — top management estimates the MTPD for products and services; — activity owners identify the MTPD and set the RTO for activities.
步骤如下： a) 记录和批准影响矩阵； b) 定义和批准评估影响的时间范围； c) 确定和批准产品和服务以及活动MTPD和活动RTO的标准； d) 估算和批准每组产品和服务的MTPD； e) 确定每项活动的MTPD并设定RTO。 The steps are as follows: a) document and approve an impact matrix; b) define and approve time frames for assessing impacts; c) determine and approve criteria for product and service as well as activity MTPD and activity RTO; d) estimate and approve the MTPD for each group of products and services; e) identify the MTPD and set the RTO for each activity.
2.2 第1步 记录和批准影响矩阵(Step 1 — Document and approve impact matrix)
需要完成影响矩阵，其中包含影响的描述和最高管理层同意的每个影响的标准。 An impact matrix (see Table 8) needs to be completed with the description of impacts and the criteria for each as agreed by top management.
表8 最高管理层批准的影响级别矩阵(Impact level matrix approved by top management)
| 影响类型 Impact types | 影响级别Levels of impact | |||||
|---|---|---|---|---|---|---|
| 影响类型 Impact types | 0 | 1 | 2 | 3 | 4 | 5 |
| 财务 Financial | 无 None | 收入或费用损失小于1万美元 Loss of < USD 10000 in revenue or expense | 收入或费用损失大于等于1万但低于5万美元 Loss of >= USD 10000 and USD 50000 in revenue or expense | 收入或费用损失大于等5万但低于25万美元 Loss of >= USD 50000 and USD 250000 in revenue or expense | 收入或费用损失大于等25万但低于1百万美元 Loss of >= USD 250000 and USD 1000000 in revenue or expense | 收入或费用损失大于等1百万美元 Loss of >= USD 1000000 in revenue or expense |
| 合规 Regulatory | 无 None | 监管机构未关注 Little interest from regulator | 监管机构要求补充材料 Regulator requests updates | 监管机构发出警告 Regulators issues warning | 吊销执照 Suspension of license | 因吊销执照而业务倒闭 Business failure due to loss of license |
| 声誉 Reputational | 无 none | 有媒体负面关注，不需要回应 Some negative attention in media Response not required | 媒体负面关注，需要回应 Negative attention in media Requires response | 由新媒频道报导的短期区域性关注 需要专门的响应团队 Temporary negative regional attention reported via news channels Requires a dedicated response team | 需要聘请外部沟通专家的全国性负面关注，要求最高管理层参与响应 Negative national attention extensive enough to engage external communications experts Requires top management to be included in response | 持续的负面媒体关注，被认为无能或对组织失去信心导致业务倒闭 Consistent negative media attention Business failure due to perceived incompetence or loss of faith in the organization |
2.3 第2步 定义和批准评估影响的时间范围(Step 2 — Define and approve time frames for assessing impacts)
表9中给出的时间范围是为本示例的目的而定义的。 The time frames given in Table 9 have been defined for the purpose of this example.
表9 商定时间范围的工作表(Worksheet with agreed time frames)
| 随时间推移的影响Impact over time | |||||
|---|---|---|---|---|---|
| 1小时 1 hour | 8小时 8 hours | 24小时 24 hours | 72小时 72 hours | 1周 1 week | > 1月 > 1 month |
2.4 第3步 确定和批准产品和服务以及活动MTPD和活动RTO的标准(Step 3 — Determine and approve criteria for product and service as well as activity MTPD and activity RTO)
根据表9中的信息，最高管理层同意以下内容： — MTPD是指影响级别达到4级时； — RTO设定为影响级别不大于3级的时间。 Based on the information in Table 9, top management has agreed the following: — the MTPD is when the impact level reaches 4; — the RTO is set at a time when the impact level is not greater than 3.
2.5 第4步 估算和批准每个产品和服务的MTPD(Step 4 — Estimate and approve MTPD for each product and service)
BIA负责人与最高管理层会面，并就每个产品和服务了解以下信息： — 被扰断影响的相关方，以及与产品和服务交付相关的重点问题，这可以让我们了解将要讨论的影响； — 扰断造成最大影响(最坏情况)的某天/月/年的时间、高峰期或情况，该最坏情况将用于以下讨论； — 扰断在每个商定的时间范围对产品和服务交付的影响，必要时质疑答案； — 可能在中短期影响这些影响的、与产品和服务相关的计划变更。 The BIA leader meets with top management and asks the following for each product and service: — the interested parties who would be affected by the disruption and main concerns related to the delivery of products and services, as this can give an idea of the impacts to be discussed; — the time of the day/month/year, peak periods or circumstances when the disruption will result in the greatest impact (worst case), as this worst case will be used for the following discussion; — the impacts of disruption to the delivery of products and services for each of the agreed time frames, challenging the answers as needed; — the planned changes related to the product and service that can influence these impacts in the short to medium term.
会面期间，工作表(见表10)填写如下： — 记录产品或服务名称； — 记录最坏情况； — 从第1个影响类型开始，对于每个”随时间的影响”列，使用影响矩阵记录影响级别(见表8)； — 对后续的影响类型重复以上步骤； — 在”产品或服务影响”行中记录每列的最大值； — 在工作表底部记录产品和服务达到MTPD的时间范围，以确定成果。 During the meeting, the worksheet (see Table 10) is completed as follows: — document the product or service name; — document the worst case; — start with the first impact type and for each “Impact over time” column record the impact level using the impact matrix (see Table 8); — repeat for subsequent impact types; — record the largest value of each column on the “Product or service impact” row; — record the time frame at which the product and service impact reaches the MTPD at the bottom of the worksheet to define the result.
表10 完成的产品和服务工作表(Completed product and service worksheet)
| 产品或服务名称Product or service name | 在线销售童装Online sales of children’s clothes | |||||
|---|---|---|---|---|---|---|
| 最坏情况Worst case | 黑色星期五峰值期Peak period Black Friday | |||||
| 影响类型Impact types | 随时间的影响Impact over time | |||||
| 影响类型Impact types | 1小时 1 hour | 8小时 8 hours | 24小时 24 hours | 72小时 72 hours | 1周 1 week | >1月 > 1 month |
| 声誉影响Reputational impact | 0 | 0 | 0 | 1 | 2 | 4 |
| 合规影响Regulatory impact | 0 | 0 | 0 | 0 | 1 | 2 |
| 财务影响Financial impact | 0 | 0 | 0 | 0 | 1 | 2 |
| 产品和服务影响(以上影响最大值) Product or service impact (maximum of impacts above) | 0 | 0 | 0 | 1 | 2 | 4 |
| 成果Result | MTPD | |||||
2.6 第5步 确定每项活动的MTPD并设定RTO(Step 5 — Identify MTPD and set RTO for each activity)
用类似的方式，BIA负责人与活动负责人会面，并就每项活动了解以下信息： — 交付的每个产品或服务的输出； — 受扰断影响的相关方； — 扰断造成最大影响(最坏情况)的某天/月/年的时间、高峰期或情况，该最坏情况将用于以下讨论； — 扰断在每个商定时间范围的影响，必要时质疑答案； In a similar way, the BIA leader meets with the activity owner and asks the following for each activity: — the output for each product or service delivered; — the interested parties who would be affected by the disruption; — the time of the day/month/year, peak periods or circumstances when the disruption will result in the greatest impact (worst case), as this worst case will be used for the following discussion; — the impacts of disruption for each of the agreed time frames, challenging the answers as needed.
会面期间，工作表(见表11)填写如下： — 记录活动名称及其描述； — 记录最坏情况； — 从第1个影响类型开始，对于每个”随时间的影响”列，使用影响矩阵记录影响级别(见表8)； — 对后续的影响类型重复上一步骤； — 在”活动影响”行记录每一列的最大值； — 在工作表底部记录活动影响达到MTPD的时间范围以及设定RTO的该时间范围，以确定成果。 — 确保活动RTO设定在活动MTPD以内。 During the meeting, the worksheet (see Table 11) is completed as follows: — document the activity name and its description; — document the worst case; — start with the first impact type and for each “Impact over time” column record the impact level using the impact matrix (see Table 8); — repeat for subsequent impact types; — record the largest value of each column on the “Activity impact” row; — record the time frame at which the activity impact reaches the MTPD and the time frame to set the RTO at the bottom of the worksheet to define the result; — make sure that the activity RTO has been set within the activity MTPD.
表11 完成的活动工作表(Completed activity worksheet)
| 活动名称Activity name | 在线登记订单Register orders online | |||||
|---|---|---|---|---|---|---|
| 最坏情况Worst case | 黑色星期五峰值Peak period Black Friday | |||||
| 影响类型Impact types | 随时间的影响Impact over time | |||||
| 影响类型Impact types | 1小时 1 hour | 8小时 8 hours | 24小时 24 hours | 72小时 72 hours | 1周 1 week | >1月 > 1 month |
| 声誉影响Reputational impact | 0 | 2 | 3 | 3 | 4 | 5 |
| 合规影响Regulatory impact | 0 | 0 | 0 | 0 | 0 | 1 |
| 财务影响Financial impact | 0 | 2 | 2 | 3 | 3 | 4 |
| 活动影响(以上影响最大值) Activity impact (maximum of impacts above) | 0 | 2 | 3 | 3 | 4 | 5 |
| 成果Result | RTO | MTPD | ||||
3. 例3 用趋势分析验证活动RTO Example 3 — Validate activity RTO with trend analysis
在推动BIA时，BIA负责人可能发现一些活动负责人设定其RTO的方式不一致。以下是发生这种情况的原因，活动负责人可能： — 误解了影响类型标准的含义； — 对业务部门不熟悉，不完全理解扰断的影响； — 混淆了活动紧迫性和重要性； — 受个人偏见的影响，形成了与组织中其它活动负责人不一致的看法。 While facilitating the BIA, it is possible that the BIA leader will recognize inconsistencies in the way some activity owners have set their RTOs. The following are reasons why this occurs. It is possible that the activity owner will: — misinterpret the meaning of the impact type criteria; — be new to the business unit and does not fully appreciate the impact of disruption; — confuse the urgency of the activity with its importance; — be influenced by personal biases, creating an inconsistent view compared with other activity owners across the organization.
下面给出了一种方法，使用趋势分析来突显RTO的不一致，以便BIA负责人可以讨论并深入探索活动负责设定RTO的理由。这样的对话可能会让活动负责人重新考虑RTO。 The following provides a technique, using trend analysis, to highlight RTO inconsistencies so that the BIA leader can discuss and further explore the activity owner’s rationale for setting the RTO. Such a conversation can lead to the activity owner reconsidering the RTO.
作为RTO设定过程的一部分，活动负责人为其每项活动填写影响评级表(见表12)。结果是每项活动的RTO和影响评级。 Activity owners complete the impact rating table (see Table 12) for each of their activities as part of the process for setting the RTO. The result will be an RTO and impact rating for each activity.
表12给出了为每项活动计算影响评级的影响评级表。主要参数包括： — 考虑扰断随时间推移的影响的时间范围； — 影响类型(见表3)及其影响级别(即0到5，其中0表示根本没有影响)，以考虑在每个时间范围的影响程度。 Table 12 presents the impact rating table used to calculate the impact rating for each activity. The key parameters are: — time frames to consider the impact of a disruption over time; — impact types (see Table 3) and their levels of impact (i.e. 0 to 5, where 0 indicates no impact at all) to consider the magnitude of impact at each time frame.
表12 影响评级表(Impact rating table)
| 影响类型Impact types | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 影响类型Impact types | 1天(1 day) | 1天(1 day) | 1天(1 day) | |||||||||||||||
| 影响类型Impact types | 影响级别Level of impact | 影响级别Level of impact | 影响级别Level of impact | |||||||||||||||
| 影响类型Impact types | 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 |
| 财务Financial | ||||||||||||||||||
| 市场份额Market share | ||||||||||||||||||
| 法律Legal | ||||||||||||||||||
| 法规Regulator | ||||||||||||||||||
| 声誉Reputational | ||||||||||||||||||
| 业务目标Business objectives | ||||||||||||||||||
从第1个影响类型开始(在本示例中为”财务”)，如果活动被扰断并在第1个时间范围(即1天)内延迟向相关方交付产品或服务，选择影响矩阵(见表3)中描述的最接近的财务影响级别，并标记相应影响级别的单元格(见表12)。然后考虑每个后续时间范围的财务影响，并对每个其它影响类型重复此过程。 Start with the first impact type (in this example: “Financial”). If the activity is disrupted and delays the delivery of the product or service to the interested parties by the first time frames (i.e. 1 day), select the closest level of financial impact described in the impact matrix (see Table 3) and mark the corresponding cell (see Table 12) under the level of impact. Then consider the financial impact for each of the subsequent time frames and repeat this process for each of the other impact types.
根据样本影响评级表(见表12)中给出的6个影响类型和3个时间范围，应当有18个回应，派生出从0到90的影响评级。 Based on the sample impact rating table (see Table 12) presenting six impact types and three time frames, there should be 18 responses which will derive the impact rating in the range 0 to 90.
以下示例(见表13和表14)给出了被其负责人将RTO设为3天的两个活动的结果： — 影响评级为39的客户服务台(见表13)； — 影响评级为14的应付账款(见表14)。 The following examples (see Tables 13 and 14) present the results of two activities each set with a three day RTO by the activity owner: — Customer Help Desk (see Table 13) with an impact rating of 39; — Accounts Payable (see Table 14) with an impact rating of 14.
在此示例中，影响评级有很大不同，这表明客户服务台比应付账款会产生更大程度的影响，即使其各自的活动负责人将RTO设定为相同的时间。 In this example, the impact ratings are considerably different, suggesting that the Customer Help Desk will deliver a far greater magnitude of impact compared to Accounts Payable even though their respective activity owners have set the RTO at the same time point.
表13 客户服务台的影响评级(Impact rating table for Customer Help Desk)
| 业务部门Business unit | 销售Sales | 销售Sales | |||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 活动Activity | 客户服务台Customer Help Desk | 客户服务台Customer Help Desk | |||||||||||||||||||||||||||||||||||
| 位置location | 总部Head office | 总部Head office | |||||||||||||||||||||||||||||||||||
| 活动输出Activity output | 解决产品问题Resolve problem issues | 解决产品问题Resolve problem issues | |||||||||||||||||||||||||||||||||||
| 客户服务台的影响评级表(Impact rating table for Customer Help Desk) | 客户服务台的影响评级表(Impact rating table for Customer Help Desk) | ||||||||||||||||||||||||||||||||||||
| 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | ||||||||||||||||||||||||||||||||||
| 影响类型Impact types | 1天(1 day) | 1天(1 day) | 1天(1 day) | 1天(1 day) | |||||||||||||||||||||||||||||||||
| 影响类型Impact types | 影响级别(Level of impact) | 影响级别(Level of impact) | 影响级别(Level of impact) | 影响级别(Level of impact) | |||||||||||||||||||||||||||||||||
| 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 | ||||||||||||||||||||
| 财务Financial | ╳ | ╳ | ╳ | 1 + 2 + 4 = 7 | |||||||||||||||||||||||||||||||||
| 市场份额Market share | ╳ | ╳ | ╳ | 0 + 1 + 3 = 4 | |||||||||||||||||||||||||||||||||
| 法律Legal | ╳ | ╳ | ╳ | 0 +0 + 3 = 3 | |||||||||||||||||||||||||||||||||
| 法规Regulatory | ╳ | ╳ | ╳ | 2 + 3 + 4 = 9 | |||||||||||||||||||||||||||||||||
| 声誉Reputational | ╳ | ╳ | ╳ | 1 + 3 + 5 = 9 | |||||||||||||||||||||||||||||||||
| 业务目标Business objectives | ╳ | ╳ | ╳ | 1 + 2 + 4 = 7 | |||||||||||||||||||||||||||||||||
| 39 | |||||||||||||||||||||||||||||||||||||
表14 应付账款的影响评级(Impact rating table for Accounts Payable)
| 业务部门Business unit | 财务 Financial | 财务 Financial | |||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 活动Activity | 应付账款 Accounts Payable | 应付账款 Accounts Payable | |||||||||||||||||||||||||||||||||||
| 位置location | 总部 Head office | 总部 Head office | |||||||||||||||||||||||||||||||||||
| 活动输出Activity output | 向供应商付款 Funds to suppliers | 向供应商付款 Funds to suppliers | |||||||||||||||||||||||||||||||||||
| 应付账款的影响评级表(Impact rating table for Accounts Payable) | 应付账款的影响评级表(Impact rating table for Accounts Payable) | ||||||||||||||||||||||||||||||||||||
| 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | 时间范围1(Time frame 1) | ||||||||||||||||||||||||||||||||||
| 影响类型Impact types | 1天(1 day) | 1天(1 day) | 1天(1 day) | 1天(1 day) | |||||||||||||||||||||||||||||||||
| 影响类型Impact types | 影响级别(Level of impact) | 影响级别(Level of impact) | 影响级别(Level of impact) | 影响级别(Level of impact) | |||||||||||||||||||||||||||||||||
| 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 | 0 | 1 | 2 | 3 | 4 | 5 | ||||||||||||||||||||
| 财务Financial | ╳ | ╳ | ╳ | 0 + 0 + 0 = 0 | |||||||||||||||||||||||||||||||||
| 市场份额Market share | ╳ | ╳ | ╳ | 0 + 0 + 0 = 0 | |||||||||||||||||||||||||||||||||
| 法律Legal | ╳ | ╳ | ╳ | 0 + 0 + 3 = 3 | |||||||||||||||||||||||||||||||||
| 法规Regulatory | ╳ | ╳ | ╳ | 0 + 1 + 3 = 4 | |||||||||||||||||||||||||||||||||
| 声誉Reputational | ╳ | ╳ | ╳ | 0 + 2 + 2 = 4 | |||||||||||||||||||||||||||||||||
| 业务目标Business objectives | ╳ | ╳ | ╳ | 0 + 1 + 2 = 3 | |||||||||||||||||||||||||||||||||
| 14 | |||||||||||||||||||||||||||||||||||||
要确定客户服务台的RTO是否应当更短，或者应付账款的RTO是否应当更长，需要对BCMS范围内所有活动的RTO和影响评级的关系进行全面审查。 To determine whether the Customer Help Desk should have a shorter RTO, or whether Accounts Payable should have a longer RTO will require a holistic review of the relationship between the RTO and the impact rating for all activities within the BCMS scope.
在BCMS范围内的所有活动都设定了RTO并计算了其影响评级后，可以创建一个有以下数据列的工作表： — 业务部门； — 业务活动； — 活动负责人； — RTO，用作按升序排列的主排序； — 影响评级，用作按降序排列的次级排序。 When all activities in the BCMS scope have their RTO set and their impact rating calculated, a worksheet can be created with the following columns of data: — business unit; — business activity; — activity owner; — the RTO, used as the primary sort in ascending order; — the impact rating, used as the secondary sort in descending order.
然后，选择RTO和影响评级列，创建散点图以查看最适合数据的趋势线，如图1所示。 Then, the RTO and impact rating columns are selected and a scatter graph created to see the trend line that best fits the data, as shown by Figure 1.
| X | RTO days |
|---|---|
| Y | impact rating |
其中X轴为RTO天数，Y轴为影响评级；1代表客户服务台，2代表应付账款。 注1：图中点表示每项活动的RTO/影响评级位置。 注2：图中线表示RTO/影响评级点的趋势，这些点不一定要在趋势线上。您可以接受一个置信区间，例如±5至10的影响评级。 Key X RTO days Y impact rating 1 Customer Help Desk 2 Accounts Payable NOTE 1 The dots present the RTO/impact rating position of each activity. NOTE 2 The line presents the trend of RTO/impact rating dots. The dots do not have to be actually on the trend line. You can allow a confidence margin, e.g. an impact rating of ±5 to 10.
远高于趋势线的代表活动的点，表明活动负责人要么在时间线上设定RTO太晚，要么高估了影响评级表中的影响程度。例如，对客户服务台： — 如果对影响等级恰当地反映了影响的真实程度很有信心，则RTO应当向左移向趋势线并重新设定为1天； — 然而，如果很有信心认为RTO反映了务实的恢复时间范围，那么应当通过重做影响评级表(见表12)来重新评估影响评级，将影响评级向趋势线下降，即趋向影响评级28。 Dots representing activities well above the trend line indicate that either the activity owner has set the RTO too late on the timeline or overestimated the magnitude of impact on the impact rating table. For example, consider the Customer Help Desk: — if there is great confidence that the impact rating appropriately reflects the true magnitude of impact, then the RTO should move left towards the trend line and be reset towards 1 day; — however, if there is great confidence that the RTO reflects a pragmatic recovery time frame, then the impact rating should be reassessed by redoing the impact rating table (see Table 12) to bring the impact rating down toward the trend line, i.e. towards an impact rating of 28.
反之，远低于趋势线的代表活动的点，表明活动负责人要么在时间线上设定RTO太早，要么低估了影响评级表中的影响程度。例如，对应付账款： — 如果对影响等级恰当地反映了影响的真实程度很有信心，则RTO应当向右移向趋势线并重新设定为11天； — 然而，如果很有信心认为RTO反映了务实的恢复时间范围，那么应当通过重做影响评级表(见表13)来重新评估影响评级，将影响评级向趋势线上降，即趋向影响评级28。 Conversely, dots representing activities well below the trend line indicate that either the activity owner has set the RTO too early on the timeline or underestimated the magnitude of impact on the impact rating table. For example, consider Accounts Payable: — if there is great confidence that the impact rating appropriately reflects the true magnitude of impact, then the RTO should move right towards the trend line and be reset towards 11 days; — however, if there is great confidence that the RTO reflects a pragmatic recovery time frame, then the impact rating should be reassessed by redoing the impact rating table (see Table 13) to raise the impact rating up toward the trend line, i.e. towards an impact rating of 28.
重要的是要记住，这个方法不应当强迫活动负责人修改结果。它旨在强调他们的RTO需要复核，因为它与其它活动负责人的想法和要求不一致。BIA负责人应当始终记住，选择RTO是活动负责人的责任。 It is important to remember this technique should not force the activity owner to change the result. It is designed to highlight that their RTO needs a review because it is not consistent with the thoughts and requirements of other activity owners. The BIA leader should always remember that the choice of RTO is the responsibility of the activity owner.
这种方法可以扩展以适应每个组织。例如： — 影响类型可以多于或少于6个； — 影响类型可以有权重，例如声誉的影响是法律的2倍，那么影响评级表中的声誉子分数可以加倍； — 影响类型指标的级别可以多于或少于6个； — 可以有更多的时间范围。 This methodology can be scaled to suit each organization. For example: — there can be more or less than six impact types; — impact types can be weighted, e.g. reputation has twice the impact of legal so the reputation subscore in the impact rating table can be doubled; — the scale of impact type metrics can be more or less than six; — there can be more time frames.
原文发表于公众号”业务连续性+” | 原文链接