There are several ways to carry out a business impact analysis, from simply sending out questionnaires, to carrying out one-to-one interviews, to holding group sessions or workshops. And there are pros and cons to all of them. For instance :

• The questionnaire-only approach is less time consuming for the person carrying out the analysis, and a large number of people can potentially be “hit” simultaneously, but there’s a significant trade off in terms of the accuracy of the data coming back and the ability to validate it.
• The one-to-one interview approach (often with a questionnaire involved) gives the opportunity to question and to better understand the responses, although it’s still possible for the interviewee to misrepresent their own importance, and it can be time consuming for  the interviewer.
• The workshop approach has the advantages of getting people involved and of sanity checking the data by peer review at the point that it’s given, so it’s much more likely to be accurate, but it can be difficult to schedule and there’s a risk that some people might switch off when the focus isn’t on their area of responsibility.

A business impact analysis often comprises two distinct elements – firstly, identifying the impacts of a disruption, which, in turn, helps to identify the recovery time objectives, and secondly identifying the specific requirements for recovery (people, facilities, IT, etc) in order to meet those objectives.

One suggestion, therefore, is to use a combination of the workshop approach and the one-to-one interview approach. That is, hold a workshop to discuss and assess, as a group, the business impacts and recovery time objectives, then follow it up with a series of shorter, one-to-one interviews to identify detailed recovery requirements. In this way you get the best of both worlds – immediate validation of the key information needed to develop the business continuity strategy and the ability to go into as much detail as you need to with each business area.

Whatever you do, don’t just send out some questionnaires and expect to get sufficient accurate information back to be able to determine a meaningful business continuity strategy. It’s good to talk!