A business impact analysis (BIA) is a technique of assessment that evaluates how a disruption such as an accident or emergency to conventional business operations affects multiple aspects of the business.
A BIA is necessary for ensuring continuity and resilience of business operations after drawbacks.
When operating a business, there are always risks involved, foreseeable and unforeseeable. Some may even be out of the business’s control, hence the need to prepare ways to prevent, mitigate, or adapt to such events. A BIA helps businesses achieve this by assessing the timescales and intensity of disruptions and the extent (scope) and intensity of the resulting consequences/impacts. For example, the scope can cover lost sales and revenue, regulatory fines, increased production costs, loss of customers, delays in approval, etc.
A BIA will always look into the operational and financial impacts of a disruption based on the following assumptions:
- Every aspect of a business depends on whether other aspects of a business are operational.
- Different business segments have different levels of importance, and thus some will require more allocations after a disruption.
Through a BIA, a business can identify probable impact types of disruption, assess them, assess the business’s tolerance to impacts, determine recovery time periods and develop incident response and operational resumption (recovery) strategies timescales.
Examples of business disruptions are physical damages to premises, access restrictions to a worksite, utility outages, machinery/system breakdown, disruptions in the supply chain (e.g., failure to supply, delays in delivery of supplies), absenteeism of critical employees, and disruptions in communications and information flow such as damage, loss or corruption of information technology (computers, servers, operating systems, data storage, applications, etc.) A BIA helps a business make well-informed decisions and get equipped by laying a foundation for minimizing risk.
Customizable BIA Templates
How to Conduct a Business Impact AnalysisÂ
A BIA is conducted in two phases; exploration, which involves identifying and evaluating disruptions/vulnerabilities, and planning which involves creating a report on risk mitigation strategies. The steps involved in these phases will vary from one business to another, depending on the objectives and requirements of the business.
This section will discuss a standard BIA guide for businesses below:
Get approval
First and foremost, a BIA has to be approved by executives and senior management. This helps with mobilizing resources such as a project team, funds, access permits, location, etc. once approval is obtained, the process is initiated, and subsequent steps can commence.
Scope the business impact analysis
The second step is determining the scope of the analysis. This involves defining objectives, strategizing, defining activities, assigning duties, listing requirements, and prioritizing risks/vulnerabilities. A BIA should ensure the appropriate activities and resources are in scope. The Frame meeting can be completed in this regard.
The Frame meeting is used to define the purpose of the BIA, business operations that need to be prioritized during disruptions, products, and services required for continuity of business operations, define leadership/authority positions and identify participants. The in-scope products and services are essential to identify as they support key business functions/departments that ensure the business survives disruptions.
Defining the analysis’s scope helps the team focus on the key aspects of the business that are important for its continuity. In addition, any supporting departments or experts should be identified and notified of any documentation or activities required of them.
Schedule interviews
Thirdly, once the analysis scope has been defined, one-hour meetings should be scheduled with all the supporting departmental leaders and experts to collect information such as departmental operations/functions, system requirements (inputs and outputs), probable risks, and any other.
Selected participants can have the following traits; a clear understanding of the organization’s key priorities in terms of products and services, associated departmental daily activities, and the resources required to complete each associated departmental business activity. This information is then used to determine the dependencies between departments to perform an all-inclusive BIA.
Execute BIA and risk assessment interviews
Next, execute the impact analysis by interviewing the identified participants. Ensure that they are aware of the purpose of the analysis and meeting objectives of the meeting beforehand to come prepared with the required documentation and information.
Questionnaires can also be used to collect data. Questionnaires are detailed surveys and are more commonly used. Suitable participants in a questionnaire survey are managers, supervisors, team leaders, team members, and other well-informed persons. Â
The information about the different processes that will typically be required for a comprehensive analysis report includes:
- Name of the process/function/department
- Location of where the process is undertaken –functional parent
- Background information
- Applicable steps
- Consumables (inputs) and deliverables (outputs) of the process
- Users
- Human Resources and tools needed to carry out the business function successfully
- Timing
- Dependencies associated with each step of the process
- Associated financial and operational impacts of the business function
- Associated legal, regulatory, and compliance impacts
- Information on workaround procedures, for example, shifting functions to other departments or outsourcing labor from remote workers in case of a disruption.
- Description of past disruptions within the respective departments
The different types of dependencies between business components are typically associated with facilities, applications, equipment, personnel, third-party suppliers, and other departments (interdependencies). Each type of dependency should be characterized by its use, workaround and alternate suppliers, recovery timeframe, and recovery point objectives, if any).
A risk assessment should be conducted on each dependency using a 1-10 rating scale for the likelihood of a loss and associated impact. The rating of each dependency can be obtained by multiplying the scores on likelihood and impact of loss. This information is part of the BIA.
As a result, the selected supporting participants should be well-informed of how the business produces or offers its products and services and the daily activities and responsibilities of their respective departments or filed/professions, for example, managers, supervisors, team members, and specialists. Additionally, they must understand the resource dependencies among different business activities required for continued operation.
Ask them to identify probable impacts of disruptions on their business function and the resources required to maintain continuity at their level/department if a disruption occurs. Additionally, the dependencies between facilities, applications, personnel, third-party suppliers (vendors), equipment, and other departments (interdependencies) must be established.
Review the information
Once all the significant information has been collected, it should be reviewed and analyzed. The objectives of these processes are to create a list of prioritized business functions, resources required to maintain each business function/operation at an optimal level and determine the business’s recovery timeframe.
These objectives need a critical evaluation of the collected information. With that in mind, a business can conduct the analysis automatically or manually depending on their preference, reliability, and sometimes the urgency of results.
Document and create the BIA report
After a conclusion has been arrived at, the entire analysis process can be compiled in a BIA report. A detailed BIA report should be prepared to outline the methodologies, data, findings, and recommendations obtained from the business impacts analysis.
A standard BIA should be formatted as follows:
- Executive summary
- Objectives and scope of the project
- Methodologies
- Report summary
- Detailed findings (can be categorized per department)
- Supporting documentation like charts and diagrams
- Recommendations
Each departmental report forms part of the overall BIA report, which is compiled before submission. The compiled report can then be presented to senior management and meeting participants. The participants can then review the document and then edit where necessary. If the report is satisfactory, the document can be approved. Management is responsible for reviewing, approving, and implementing the final BIA report.
Complete a BIA and risk assessment summary
Lastly, an organizational-wide BIA and risk assessment summary should be prepared once all departmental reports have been reviewed and approved. The report summary can be given in the form of a presentation highlighting key activities, risks, resource requirements, and any other relevant information collected during the exercise.
The summary should give a conclusive BIA report to leadership, commonly the Business Continuity Steering Committee) in a few pages or slides. Risk-treatment recommendations must also be presented. The recommendations should be based on conclusions and assessment results from departmental BIA reports and should focus on; the identified in-scope products and services, justifying proposed recovery timeframes and how they align to the identified products and services and key business risks and comprehensive recommendations to address the risks.
The recommendations should be prioritized such that to give the maximum resilience and in the order in which risk-treatment strategies will be developed.
How to Analyze the Results of a Business Impact Analysis
As earlier mentioned, analyzing information can be done manually or automatically. However, regardless of the method used, the objectives of the BIA can be achieved by analyzing the results as follows.
First, identify the most important business functions and processes, followed by defining the disruption, vulnerabilities, and risks. Then identify the resources (personnel, time, money, and technology) required to keep the business operations running optimally.
Next, determine the revenue impact of the disruption. These impacts can be delayed sales, increased production expenses, contractual fines, customer dissatisfaction, and regulatory fines. The long-term impacts can be quantified in terms of loss in market share, customers, or business image. This is then followed by an evaluation of the timeframe required to restore the impacts/consequences of the disruptions to an optimal level.
Finally, a recovery time strategy can be developed based on the existing information and the resources required to implement it. The restoration strategy should prioritize the business functions with the highest impacts followed by the order of events that would get the business operating to a normal or close to the normal level.
Consequences of Not Performing a BIA
Failure to conduct the analysis can be detrimental to a business in more than one way. Below are some of the negative consequences of not conducting a BIA:
Lack of objectivity and mismanagement of resources
Should a business fail to conduct a conclusive BIA, it can end up prioritizing the wrong things when in a restoration phase. This can lead to losses in resources and a lack of objectivity when trying to restore a business after a disruption.
By instilling objectivity in the recovery strategy, a BIA ensures high-impact business functions are prioritized during the restoration phase. This eliminates confusion as management becomes aware of where to invest, how much, and who to assign different recovery objectives to.
Business continuity gaps and inaccurate program scope
The lack of the analysis can lead to misalignment of expectations from the senior management to bottom-level management when implementing plans and strategies. Implementation of strategies without senior management’s approval with company resources may hinder the completion of other business functions, which results in gaps in business continuity and, consequently, overall underperformance.
Also, inaccurate program scopes are more likely to be developed for strategies without first understanding the dependencies between business functions and the impacts of moving parts of those strategies, information that will be lacking without a BIA.  Â
Misallocation of investments in preparedness
BIAs also help justify recovery strategies and associated resources, thus ensuring senior management allocates the needed resources to cushion the business from foreseeable disruptions or risks. Preparedness ensures the continuity of the day-to-day activities of a business even after a disruption. With the analysis report in place, it is easier to answer management’s questions or concerns regarding restoration strategies.
Pros and Cons Â
A BIA is a good way for businesses to remain sustainable with all the probable risks in consideration. Note that all businesses are susceptible to diverse disruptions depending on multiple factors such as industry, location, product/services, accidents, etc.
Below are several advantages and disadvantages of the impact analysis:
Pros of conducting a business impact analysis
The pros of a BIA are as discussed below:
Useful in disaster recovery planning
Planning is essential in every aspect of a business. With a BIA, businesses can plan ahead and prepare for crises and the associated impacts in terms of finances, business reputation, safety, quality assurance, legal compliance, and marketing. This prevents a situation where a business has to formulate a discovery plan in the middle of a crisis, which might be more costly than it needed to.
A well-thought recovery strategy saves the business time, money, and other resources during disruptions by quantifying business functions and suggesting appropriate funding for measures to protect the functions. Through a BIA, impacts can be expressed in monetary terms for the purposes of comparison. This is done by determining the costs associated with disruptions such as the cost of replacing equipment, overtime salaries, cost of outsourcing labor, loss of cash flow, etc.
Identifies legal, regulatory, and contractual obligations
Most departments will typically not have a clear understanding of the organization’s legal and contractual obligations, yet these obligations have to be observed during a disruption. Therefore, while assessing the legal, regulatory, and contractual impacts of disruptions, legal, regulatory and contractual obligations can be identified and referenced to ensure the business remains compliant. This saves on money that would have otherwise been spent on fines, settlements, and time.
Clarity on business continuity strategy spend
The more objective a business program is, the more efficiently it is implemented. A BIA assesses the financial aspect of all impacts on all business components associated with disruption and the associated recovery strategies while prioritizing them depending on relevance to the business continuity.
This helps the organization determine the resources needed to implement and maintain business strategies which is beneficial in ensuring a company spends the appropriate amount of time and money on recovery strategies needed to meet recovery objectives without wastage.
Captures preliminary plan content
A BIA can be used as a data collection tool for business continuity plans. This is because when evaluating potential impacts on various parts of a business, a wide range of information such as staffing requirements, departmental spending, existing department strategies, etc., can be obtained. This information can be presented to persons appointed to create and maintain continuity plans to use as a starting point for carrying out their work.
Prioritizes operations accordingly
Through recommendations, a the impact analysis identifies which business functions should be prioritized during a recovery phase and which can wait. This way, resources can be set aside to mitigate impacts of disruptions such as fines and penalties, loss of customer base and business reputation, lost income, and any other that may be inevitable during a disruption.
Also, a BIA uses a set of criteria to test the success of recovery plans to establish consistent results depending on which operations are prioritized.Â
Cons involving business impact analysis
Below are several shortcomings of a business impact analysis. They include:
Time-consuming
BIAs take a long time to conduct and finalize. This will often involve the use of company resources and staff, which might negatively impact a business. Considering the array of activities involved in a BIA process, completion time can go up to months.
Inaccurate or unrealistic recovery time objectives
The implementation of a BIA is typically governed by top management. This can lead to a subjective selection of recovery time objectives (RTOs) without sufficient business justification. These RTOs may not be objective and considerate of departmental capabilities and priorities, making them inaccurate or unrealistic to achieve.
Doesn’t evolve as the organization evolvesÂ
Once a BIA is completed, it reflects the impacts of disruptions at that particular point in time. It may, therefore, not be fully sufficient for future disruptions. A BIA must then be periodically updated to accommodate changes in priorities, needs, and expectations within the business.
Overwhelming to analyse if poor quality data is collected
If the analysis is incorrectly scoped, BIA participants are incorrectly identified, and ineffective data gathering methods are used; this may often lead to collecting a lot of unorganized and low-quality data that can be too overwhelming to analyze. This may lead to time and effort wastage and poor utilization of business resources, and poorly developed business continuity strategies.
The use of organograms and facility lists is one method known to produce too much data that is often difficult to analyze as well as using internal subject experts (SMEs) as BIA participants as they are well informed about departmental objectives, daily activities and supporting resources. Also, using a combination of surveys, interviews, and questionnaires can help collect quality data.
Disengaged executives
In most cases, the top management will be involved in the impact analysis’s final stage (reporting). Lack of engaging executives may result in poor business continuity program performance since they are the ones to implement the restoration strategies. This can be reduced by involving senior management in the approval, scoping, and reporting stages of the BIA.
Frequently Asked Questions
A BIA is a procedure that identifies the disruptions and ways a business can cope with associated impacts and requirements to ensure business continuity. In contrast, a risk assessment evaluates the likelihood and impact of a loss of an activity or resource in order to develop prioritized remedies alternatives directed towards reducing the likelihood of a disruption occurring. A BIA focuses on business continuity requirements, whereas a risk assessment focuses on potential threats to the delivery of products and services.  Â
The most recommended frequency of carrying out a business impact analysis is annual. A business can do a BIA more or less depending on the frequency of organizational changes. Therefore, the frequency of BIAs is dependent on significant organizational changes.Â
Different parties are involved throughout the BIA process. Examples of participants are the Business Continuity Steering Committee, departmental leaders/managers, program sponsor(s), and subject matter experts. Different participants can be engaged at different stages of the BIA, depending on the information required.
Definitely, however, it is recommended that surveys be combined with other data collection techniques such as interviews and questionnaires. Data obtained from surveys may not produce quality data as it does not provide context, depth, or additional details.
A BIA report gives a detailed summary of all activities completed during the process, associated impacts, dependencies, and resources required for optimal completion of each activity or process. It also gives business continuity requirements and recommends recovery strategies associated with probable disruptions.
Scoping is the first step of performing the actual BIA process. The scope can entail company departments, processes, products and services, and positions within an organization depending on its operational structure.
The use of software for a BIA will usually be based on the size of the organization. Small businesses of 10-15 departments and less than 1000 employees can effectively perform a BIA without software. However, they can still use it for analytic processes and to automate certain steps. With large organizations, the use of a software may be necessary due to the tons of information needed to conduct a comprehensive BIA.
About This Article
