It’s widely accepted that the business impact analysis and risk assessment are critical initial activities in the business continuity programme. Indeed, they provide the basis on which the business continuity strategies and plans are built.

But it is possible to get too hung up on the analysis, with the result that subsequent activities are seriously delayed. It has been known for this phase to take so long that by the time it’s complete the business has changed and the results are no longer valid. It’s usually because those doing the analysis try to be too precise or too scientific. They get bogged down in detail and lose sight of the fact that the analysis is the means to an end, not the end itself.

In a rapidly changing environment it can be difficult to hit a moving target. But where business continuity management is concerned, it’s often better to be roughly right than precisely wrong.

So keep it simple, keep it short and sweet, and aim to get things roughly right.