U.S. BIA Buyers: Compare Business Continuity Consultants

Which providers cover BIA, exercises, and recovery planning?

For a U.S. organization buying business impact analysis (BIA), facilitated exercises and recovery planning in one engagement, Riskonnect and 11:11 Systems are the two of these six whose pages describe all three [4][6]. Riskonnect provides the clearest exercise deliverable, stating that each facilitated exercise ends with a structured after-action review and specific recommendations [4].

BSI

• BIA depth: Identifies downtime limits, establishes recovery time and recovery point objectives, and prioritizes recovery according to financial, operational, and reputational risk [1].
• Facilitated-exercise maturity and outputs: Distinguishes tabletop, functional, full-scale, and focused exercises; ask whether BSI facilitates them and what report follows [1].
• Business-recovery scope: Covers strategy and plan development for business continuity, IT recovery, and crisis response [1].

Warren Averett

• BIA depth: Begins with an operational and risk assessment using information about processes, assets, vendors, IT infrastructure, staff, and facilities [2].
• Facilitated-exercise maturity and outputs: Includes scenario testing and team education; ask who facilitates and what after-action output is delivered [2].
• Business-recovery scope: Develops customized strategies and documented manual and systems-recovery procedures [2].

MHA Consulting

• BIA depth: Covers products, services, processes, dependencies, disruption impacts over time, recovery priorities, time objectives, resource requirements, continuity strategies, and technology tolerances [3].
• Facilitated-exercise maturity and outputs: Lists exercises and structured walkthrough, standalone, integrated, and operational tests [3].
• Business-recovery scope: Separates recovery of critical business functions from IT disaster recovery and crisis management [3].

Riskonnect

• BIA depth: Examines departmental weaknesses, required resources, disruption tolerances, response and recovery requirements, and single points of failure [4].
• Facilitated-exercise maturity and outputs: Facilitates tabletop, functional, and full-scale exercises. Each ends with a structured after-action review and specific recommendations addressing identified gaps [4].
• Business-recovery scope: Program Build may include governance, BIAs, department plans, an enterprise crisis-management plan, exercises, and maintenance processes [4].

Advantage Industries

• BIA depth: Its analysis covers personnel, necessary systems, recovery mechanisms, remote-work risks, and business functions; ask whether RTO and RPO targets are outputs [5].
• Facilitated-exercise maturity and outputs: Exercises are not described on the page, so treat them as a separate quote item [5].
• Business-recovery scope: Offers managed pre-disaster consulting, documented procedures, and property- and data-protection sections [5].

11:11 Systems

• BIA depth: Names Business Impact Analysis and risk-based standards assessment services [6].
• Facilitated-exercise maturity and outputs: Publishes tabletop facilitation and relocation exercises; confirm whether functional or full-scale exercises and an after-action report are included [6].
• Business-recovery scope: Develops plans addressing emergency action, incident management, technology, facilities, workforce, and third-party failures [6].

Project consulting or managed support?

A defined project suits an organization prepared to maintain plans, records, exercise schedules, and corrective actions after the engagement. The statement of work can cover assessment, BIA, specified plans, agreed exercises, and handoff to an internal owner. Riskonnect describes consulting as generally project-based and time-limited, while its managed services are ongoing [4].

Managed support may be more suitable when an organization lacks dedicated BCM staff, needs to rebuild a neglected program, faces regulatory scrutiny, or is managing mergers, acquisitions, or geographic expansion. Riskonnect identifies these conditions for managed services and says support can include plans, program calendars, BIAs, exercises, reports, or broader BCM operations [4].

MHA offers BCaaS and on-demand Program Augmentation [3]. 11:11 Systems offers tailored consulting or longer-term outsourced business resiliency [6], while Advantage Industries markets fully managed pre-disaster continuity consulting [5].

How should recovery exercises progress?

An exercise program can progress from discussion to operational activation:

1. Tabletop: Participants discuss a scenario, interpret the plan, and work through decisions without activating operations. BSI describes this format as suitable for new or untested plans [1][4].
2. Remediation and focused drills: Teams address tabletop findings before advancing. A focused drill tests one task, system, or item of equipment [1].
3. Functional exercise: Selected capabilities—such as communications, notifications, or IT recovery—are activated without deploying every resource [1][4].
4. Full-scale exercise: Personnel and resources are deployed to test an integrated response under conditions designed to be as realistic as possible [1][4].

BSI advises addressing tabletop findings before functional testing and establishing functional proficiency before a full-scale exercise [1]. A proposal that starts at a later stage should explain how plans, participants, and individual capabilities have already been validated.

Exercise outputs also need definition. Riskonnect is the only one of the six whose page says every facilitated exercise ends with a structured after-action review and specific recommendations [4]. For other providers, require the proposal to identify the findings, recommendations, corrective-action owners, priorities, and due dates to be delivered.

How to narrow the shortlist

• Riskonnect: Consider when the required scope includes BIA, recovery planning, facilitated exercises, documented after-action recommendations, and the option to continue with managed support [4].
• 11:11 Systems: Consider for BIA, broad continuity-plan development, facilitated tabletop work, and possible long-term outsourcing. Confirm detailed BIA outputs, advanced exercise formats, and after-action reporting [6].
• BSI: Consider for a governance-through-validation process covering BIA, risk assessment, strategy, plans, training, and testing. Confirm facilitation responsibilities and exercise outputs [1].
• MHA Consulting: Consider when business continuity, IT disaster recovery, crisis management, BCaaS, or staff augmentation is required. Confirm who facilitates exercises and what findings are delivered [3].
• Warren Averett: Consider for customized assessment, recovery procedures, scenario testing, training, and independent review. Confirm whether the proposed BIA and exercises satisfy each required deliverable [2].
• Advantage Industries: Consider for small and midsize businesses in Maryland, including Columbia and Bethesda, as well as Virginia and Washington, DC [5].

What to confirm with each provider

None of the six pages lists consulting fees, managed-service prices or contract terms, and Warren Averett says timing varies with organizational circumstances [2].

MHA advertises a free, non-obligation consultation [3]. Advantage Industries advertises a free 10-minute consultation and a no-obligation review or free IT assessment [5]. These entry offers do not establish the cost of subsequent consulting work [3][5].

• BIA scope: Specify included entities, sites, departments, processes, interviews, stakeholders, dependencies, impact categories, time horizons, RTOs, RPOs, approvals, and required files. BSI confirms that downtime limits, RTOs, RPOs, and financial, operational, and reputational impacts can be explicit BIA outputs [1].
• Exercise scope: Define the format, scenario, participating teams, activated systems or resources, facilitator duties, observers, injects, success criteria, and scheduling assumptions. Require attendance records, a decision log, findings, corrective actions, owners, priorities, due dates, and a final after-action report. Riskonnect’s structured review and specific recommendations provide a contractual benchmark [4].
• Recovery plans: List each required plan. Distinguish business recovery for critical functions from IT disaster recovery for technology, applications, data, and infrastructure, and from crisis management for leadership decisions, coordination, communication, and stabilization [3].
• Commercial limits: Obtain total price and assumptions, along with limits on departments, interviews, plans, sites, scenarios, participants, revisions, and consulting hours.
• Project controls: Specify the schedule, acceptance criteria, revision rounds, file ownership, tool access, travel treatment, buyer dependencies, change-control rates, knowledge transfer, project-end conditions, and any managed-service handoff.
• Contract terms: Confirm duration, renewal, cancellation, termination assistance, service levels, warranties, liability, and the treatment of unfinished work.
• Delivery coverage: Confirm which U.S. locations BSI, Warren Averett, MHA, Riskonnect and 11:11 Systems will serve and whether consultants work on site.

Evaluate written proposals on BIA depth, facilitated-exercise responsibilities, business recovery plans, after-action outputs, internal effort, delivery model, and commercial clarity. Request named consultants and qualifications, redacted deliverable samples, relevant references, and a walkthrough showing how BIA findings flow into plans, exercises, and corrective actions.

Everything above comes from the providers’ own pages, case material and testimonials, not independent comparisons of recovery time or downtime. As a neutral reference point, NIST publishes a Business Impact Analysis template alongside SP 800-34 Rev. 1, its contingency planning guide for federal information systems (May 2010, updated November 2010); ask how a consultant’s BIA format compares [7].

References

1. Business Continuity Consulting | Minimize Downtime | BSI US (bsigroup.com)
2. Business Continuity Consulting: Frequently Asked Questions (warrenaverett.com)
3. Business Continuity Consulting | MHA Consulting (mha-it.com)
4. Business Continuity & Resilience Consulting and Managed Services · Riskonnect (riskonnect.com)
5. Business Continuity Consulting – Advantage Industries (getadvantage.com)
6. 11:11 Systems Business Continuity Consulting and Services (1111systems.com)
7. NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (nist.gov, 2010)