Business impact analysis (BIA) is the process of determining the impact on an organization, should potential loss identified by risk analysis actually occur. Business impact analysis should quantify, wherever possible, the loss impact from the standpoint of business interruption (number of days) as well as from the financial angle.
The ideal business impact analysis template should show how soon specified actions need to be undertaken in order to safeguard the organization’s reputation, cut losses, and stay in business, regardless of the crisis. Business impact analysis is an essential component of an organization’s business continuity plan; it includes an exploratory component to reveal vulnerabilities, and a planning component to develop strategies for minimizing risk. One of the basic assumptions behind business impact analysis is that every component of the organization is reliant upon the continued functioning of every other component, but that some are more crucial than others, and require a greater allocation of funds in the wake of a disaster.
As part of a disaster recovery plan, using a suitable business impact analysis template one can identify costs linked to failures, such as loss of cash flow, replacement of equipment, loss of profits, and so on. A business impact analysis template report quantifies the importance of business components and suggests appropriate fund allocation for measures to protect them. The possibilities of failures are assessed in terms of potential impact on safety, finances, marketing, legal compliance and quality assurance. Where possible, impact is expressed monetarily for purposes of comparison.
Figure 1. Business impact analysis as part of standard business continuity cycle (Image courtesy: Robert L. Moisoff, MBCP)
Role of business impact analysis in business continuity planning
Before any recovery strategies can be put into place, a thorough and comprehensive knowledge of the business is required. The three tools for understanding your organization, for business continuity purposes, are:
- Business impact analysis for evaluating the impact over time of a disruption, on the organization’s ability to operate.
- Continuity requirements analysis (CRA) to estimate the resources, facilities and external services that each activity will require at resumption and return to normal after a disruption.
- Risk assessment to estimate the likelihood and impact on specific functions from known threats.
Along with a disaster recovery plan, a business continuity plan and a crisis management plan, business impact analysis is an essential component of any business continuity program. It identifies, quantifies and qualifies the business impacts of a loss, disruption and interruption of business processes in an organization. In addition, the business impact analysis report will provide data from which suitable continuity and recovery strategies can be determined. This data includes identifying the processes or functions performed within the organization. A criticality rating is applied to each function – this is known as a V-rating or recovery time objective (RTO), representing the target time in which a business process can be recovered following a disruption. IT systems, applications and infrastructure for each process are identified, and the recovery point objective (RTO), indicating the time in which the data associated with an application must be restored, is also established.
Additional data for the business impact analysis template includes:
- Process manager and contact details.
- Financial impact of a process.
- Number of staff required to perform a process.
- Process dependencies, with inflows and outflows.
- Regulatory requirements of a process.
Keep in mind the following five points when completing the business impact analysis template and process in your organization:
- Top down support for business impact analysis: Support for business impact analysis must come from the top and be driven by senior management. Their enthusiasm needs to filter down through the organization.
- Current and accurate concise data: Collect only relevant data that can be used later for business continuity planning.
- Use business impact analysis that works for you: Business impact analysis is not one-size-fits-all. It would vary depending on industry type, organization structure, culture, and other similar parameters.
- A good business impact analysis evolves over time: Completing the business impact analysis template is not a one-time exercise. Rather it is an annual process, with each iteration building on the previous one.
- Review the final business impact analysis template report with stakeholders: Identify and address any incorrect assumptions, errors and omissions.
Using business impact analysis during a crisis
To manage a crisis in any organization, the four most important components are:
- Crisis management team: You need to identify key people available to manage a crisis. This team needs to include members representing all critical organizational areas, with decision-making authority and knowledge.
- Communications: Various groups of people need to be communicated with, in the event of a crisis. These include staff, vendors, shareholders, customers, and maybe even the media.
- Crisis information: Key personnel need to be kept informed of the crisis and the status as it evolves. Current crisis status must feed directly into the decision-making process.
- Organization information: Information gathered during the business impact analysis phase of the business continuity planning process can be used to recover the business, should a crisis occur. The crisis management team can determine where to concentrate its efforts in a pre-determined manner. Detailed information about processes, made available at the time of a crisis, could make the job of the crisis management team that much easier.
You can download our free business impact analysis template to assist you in your business continuity planning. This business impact analysis template also contains sample text under the various heads to make things even simpler. Download and modify our business impact analysis template based on your priorities and specific organizational needs.
This was first published in September 2011