An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses information to make decisions about recovery priorities and strategies. The fundamental task in business impact analysis (BIA) is understanding which processes in your business are vital to your ongoing operations and to understand the impact the disruption of these processes would have on your business. Business impact analysis (BIA) is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency. A BIA is an essential component of an organization's business continuance plan; it includes an exploratory component to reveal any vulnerabilities and a planning component to develop strategies for minimizing risk. The result is a business impact analysis report, which describes the potential risks specific to the organization studied. No formal standards exist for a BIA, and the methodology can vary by organization. A BIA is generally a multi-phase process that includes the following steps:
Gathering information
Evaluating
the collected information
Preparing
a report to document the findings
Presenting
the results to senior management
An organization may elect to outsource the BIA to a skilled third party or may include internal and external staff on the project team.
A detailed questionnaire or survey is commonly developed to identify critical business processes, resources, relationships and other information that will be essential in assessing the potential impact of a disruptive event. An education session may be conducted for key personnel with knowledge of the business. Information can be collected in a variety of ways, including in-person interviews and automated surveys. The business impact analysis report typically includes an executive summary, information on the methodology for data gathering and analysis, detailed findings on the various business units and functional areas, charts and diagrams to illustrate potential losses, and recommendations for recovery. The report prioritizes the most important business functions, examines the impact of business interruptions, specifies legal and regulatory requirements, details acceptable levels of downtime and losses, and lists the RTOs and RPOs. The report may list the order of activities necessary to restore the business.
Senior management reviews the report to devise a business continuity plan and disaster recovery strategy that takes into account maximum permissible downtime for important business functions and acceptable losses in areas such as data, finances and reputation. Senior managers need to review and update the BIA periodically as business operations change.
User questions & answers