Three levels: strategic, tactical, operational

Why the BIA bogs down

The scenario is always the same. You send a questionnaire to every process owner, collect a hundred and twenty responses, each claiming its process is critical, and the exercise ends six months later on an unusable table.

The cause is a sequencing error: you started at the bottom.

The sequence that works

ISO/TS 22317 describes three successive levels. The order is not indicative, it is structural.

Level 1 — Strategic BIA

Question asked: which products and services must the organisation absolutely keep delivering, and in what order?

Interlocutor: executive committee, a two-hour workshop.

Deliverable: an ordered list of five to fifteen products and services, each with an indicative MTPD.

This is where the painful trade-offs happen — and precisely why it must come first. An executive team that has never had to rank its own products often discovers on this occasion that it has no internal consensus.

Level 2 — Tactical BIA

Question asked: which activities support each of those products, and which sit on the critical path?

Interlocutor: department heads.

Deliverable: the list of activities attached to each prioritised product, with their interdependencies.

At this level, activities supporting no prioritised product drop out of scope. That filter cuts the workload by two thirds.

Level 3 — Operational BIA

Question asked: what minimum resources does each prioritised activity need?

Interlocutor: operational owners of the retained activities only.

Deliverable: minimum resources — people, applications, premises, data, suppliers — and the derived technical RTOs.

The symmetric error

There is an opposite error, less frequent but just as costly: stopping at the strategic level. You then hold a list of priority products nobody can translate into resources, and therefore no operational plan.

The strategic level gives direction, the operational level gives substance. Both are necessary; the tactical level is what connects them.