BACKGROUND IMAGE: iSTOCK/GETTY IMAGES
Business impact analysis (BIA) is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency. A BIA is an essential component of an organization's business continuance plan; it includes an exploratory component to reveal any vulnerabilities and a planning component to develop strategies for minimizing risk. The result is a business impact analysis report, which describes the potential risks specific to the organization studied. One of the basic assumptions behind BIA is that every component of the organization is reliant upon the continued functioning of every other component, but that some are more crucial than others and require a greater allocation of funds in the wake of a disaster. For example, a business may be able to continue more or less normally if the cafeteria has to close, but would come to a complete halt if the information system crashes.
The role of BIA in disaster recovery planning
As part of a disaster recovery plan, a BIA is likely to identify costs linked to failures, such as loss of cash flow, replacement of equipment, salaries paid to catch up with a backlog of work, loss of profits, staff and data, and so on. A BIA report quantifies the importance of business components and suggests appropriate fund allocation for measures to protect them. The possibilities of failures are likely to be assessed in terms of their impacts in areas such as safety, finances, marketing, business reputation, legal compliance and quality assurance. Where possible, impact is expressed monetarily for purposes of comparison. For example, a business may spend three times as much on marketing in the wake of a disaster to rebuild customer confidence. The BIA should assess a disaster’s impact over time and help to establish recovery strategies, priorities, and requirements for resources and time.
BIA vs. risk assessment
Business impact analysis and risk assessment are two important steps in a business continuity plan. A BIA often takes place prior to a risk assessment. The BIA focuses on the effects or consequences of the interruption to critical business functions and attempts to quantify the financial and non-financial costs associated with a disaster. The business impact assessment looks at the parts of the organization that are most crucial. A BIA can serve as a starting point for a disaster recovery strategy and examine recovery time objectives (RTOs) and recovery point objectives (RPOs), and resources and materials needed for business continuance.
A risk assessment identifies potential hazards such as a hurricane, earthquake, fire, supplier failure, utility outage or cyber attack and evaluates areas of vulnerability should the hazard occurs. Assets put at risk include people, property, supply chain, information technology, business reputation and contract obligations. Points of weakness that make an asset more prone to harm are reviewed. A mitigation strategy may be developed to reduce the probability that a hazard will have a significant impact.
During the risk assessment phase, the BIA findings may be examined against various hazard scenarios, and potential disruptions may be prioritized based on the hazard’s probability and the likelihood of adverse impact to business operations. A BIA may be used to justify investments in prevention and mitigation, as well as disaster recovery strategies.
How to conduct a BIA
No formal standards exist for a BIA, and the methodology can vary by organization. A BIA is generally a multi-phase process that includes the following steps:
- Gathering information
- Evaluating the collected information
- Preparing a report to document the findings
- Presenting the results to senior management.
An organization may elect to outsource the BIA to a skilled third party or may include internal and external staff on the project team.
A detailed questionnaire or survey is commonly developed to identify critical business processes, resources, relationships and other information that will be essential in assessing the potential impact of a disruptive event. An education session may be conducted for key personnel with knowledge of the business. Information can be collected in a variety of ways, including in-person interviews and automated surveys. Follow-up interviews may be necessary.
Business impact analysis template
Use this free, downloadable template to conduct your own business impact analysis.
The information gathered may include a description of the principle activities that the business units perform, subjective rankings of the importance of specific processes, names or organizations that depend on the processes for normal operations, estimates of the quantitative impact associated with a specific business function and the non-financial impact of the loss of the function, critical information systems and their users, the staff members needed to recover important systems, and the time and steps required for a business unit to recover to a normal working state.
Questions to explore during the discovery phase include interdependencies between systems, business processes and departments, the significance of the risk of points of failure, responsibilities associated with service-level agreements, staff and space that may be required at a recovery site, special supplies or communication equipment needed, and cash management and liquidity necessary for recovery.
Data the business impact analysis questionnaire should gather
- The "functional parent" of the process, this may be a department or location.
- The process name and a detailed description of the process.
- List of all inputs and outputs from the process.
- Define maximum allowable outage time before impact occurs.
- Descriptions of the financial and operational impact experienced during an outage.
- Human and technology resources needed to support the process including computers, networks, offices, people, etc.
- A description of the customer impact of external facing or inward facing processes, and a list of departments that depend on the process outputs.
- Explanation of any legal or regulatory impacts that may be created in an outage.
- Description of past outages and the impacts associated with each.
- Description of workaround procedures or work shifting options to other departments or remote workers as applicable.
A BIA for information technology might start with the identification of applications supporting essential business functions, interdependencies between existing systems, possible failure points, and costs associated with the system failure. The analysis phase examines the risks and prioritizes uptime requirements and RTO and RPO.
When information gathering is complete, the review phase begins in consultation with business leaders who can validate the findings. A spreadsheet may be used to store and organize information such as interview details, business process descriptions, estimated costs, and expected recovery timeframes and equipment inventories. A diagram of important business processes and systems and workflow analysis may be useful. A draft report may be prepared to elicit feedback in advance of the final report.
Analyzing the results of a BIA
The goals of the BIA analysis phase are to determine the most crucial business functions and systems, the staff and technology resources needed for operations to run optimally, and the time frame within which the functions need to be recovered for the organization to restore operations as close as possible to a normal working state. The analysis may be manual or computer-assisted.
Challenges include determining the revenue impact of a business function and quantifying the long-term impact of losses in market share, business image or customers. Impacts to consider include delayed sales or income, increased labor expenses, regulatory fines, contractual penalties and customer dissatisfaction.
The business impact analysis report typically includes an executive summary, information on the methodology for data gathering and analysis, detailed findings on the various business units and functional areas, charts and diagrams to illustrate potential losses, and recommendations for recovery. The report prioritizes the most important business functions, examines the impact of business interruptions, specifies legal and regulatory requirements, details acceptable levels of downtime and losses, and lists the RTOs and RPOs. The report may list the order of activities necessary to restore the business.
Senior management reviews the report to devise a business continuity plan and disaster recovery strategy that takes into account maximum permissible downtime for important business functions and acceptable losses in areas such as data, finances and reputation. Senior managers need to review and update the BIA periodically as business operations change.