Your business continuity program has been documented. It has not been tested.
Fixed-price Business Impact Analysis facilitation for U.S. banks and credit unions. $850 per department. You choose the scope, you see the price before anything starts, and you get six examiner-ready deliverables per department.
Book a 30-minute planning session
What an untested record looks like
A finding from a recent session
Nineteen minutes into a BIA session with one department at an $8 billion bank, we reached the armored-courier provider — the institution’s only means of physically moving currency between branches and vaults. It appeared nowhere in the department’s dependency record. It had been in continuous use the entire time.
The one resource that was linked to that function handled cash ordering, through a different vendor entirely.
Nobody was careless. The record had simply never been challenged by someone whose job that day was to challenge it.
That is the work. Your plans exist. Your RTOs are recorded. What is missing is the dependency nobody thought to write down, the recovery time frame that was entered once and never validated, and the resource marked recoverable with nothing behind the claim. Those do not surface in a document review. They surface when someone sits with the department manager and asks.
What it costs
Plus a one-time $400 environment setup for new clients.
That covers a 30-minute planning session, a facilitation session of up to 90 minutes with one to three of your staff, and all six deliverables.
A department carrying more than eight documented business functions is scoped as two — and you are told that before anything is scheduled or billed, not after. Sessions that run long are on us. Anything genuinely outside that scope is quoted at $150/hour and agreed in advance.
You pick the scope: one department, one division, or enterprise-wide. Multiply $850 by your own org chart and you have the number, without a call.
How an engagement runs
Planning session — 30 minutes
We review what already exists for the department and confirm scope. If the department is larger than one session can cover properly, you hear it here.
Facilitation session — up to 90 minutes
A structured working session with one to three of the department’s own staff. Not a questionnaire, not a form to fill in later.
Six deliverables
Returned as documents you own, structured so they can be entered into whatever system you already run.
What you get, per department
- Business Function Detail — every function with its recovery objectives, criticality, business impact ratings and dependent resources
- Resources In Use — each resource, its recovery strategy, and the gap against every function that depends on it
- Third-party service provider overview — the vendors actually behind the department’s work
- Threat Assessment / Incident Response (TAIR) — threats logged against resources, and the response plans that exist
- BIA Session Summary — what was discussed, decided and assigned, with owners
- Exercise Report — findings, recovery gap analysis, and prioritized follow-up tasks
See the actual reports
Two real deliverables, sanitized. Institution and department names removed; vendor names left exactly as recorded, because a finding with the vendor stripped out stops being a finding.
BIA Exercise Report
Recovery gap analysis function by function, interdependency detail, and prioritized follow-up tasks with named owners.
Open the sample (PDF)Business Function Detail
The record level — every function with its recovery objectives, impact ratings, and each dependent resource carrying its own gap.
Open the sample (PDF)It sits beside what you already own
This is not a platform and you are not being asked to replace anything. Every deliverable is built to be entered into whatever GRC or BCM system you already run. If you have a database, this feeds it. If you don’t, these documents stand on their own.
Who this is for
BCM coordinators, operational risk officers and CISOs at U.S. banks and credit unions — particularly the ones carrying an annual BIA cycle across more departments than there are hours in the week.
BNP, Inc. has worked with community and mid-size financial institutions since 1998, across more than 200 consulting engagements. Business continuity, risk management, incident response and third-party risk.
Start with one department
The report will tell you whether you want the next one.
Book a 30-minute planning session
Or email steve@bnpinc.org