Business impact analysis (BIA)

Business impact analysis (BIA)

What is business impact analysis (BIA)?

A business impact analysis (BIA) is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency. A BIA is an essential component of an organization's business continuity plan (BCP). It includes an exploratory component to reveal any threats and vulnerabilities and a planning component to develop strategies for minimizing risk. The result is a business impact analysis report, which describes the potential risks specific to the organization studied.

One of the basic assumptions behind a BIA is that every component of the organization relies on the continued functioning of all the others. However, some are more crucial than others and require a greater allocation of funds and operational resources in the event of a disaster.

For example, a business may be able to continue more or less normally if the cafeteria has to close, but it would come to a complete halt if the information systems and IT infrastructure crash. It is easy to confuse BIA and risk assessment (RA); they are complementary steps in the development of a BCP.

How to conduct a BIA

Even though an international standard for conducting BIAs exists, the methodologies used can vary by organization. A BIA is generally a multiphase process that includes the following steps:

1. securing approval for the BIA from senior management;
2. gathering trained people who can perform a BIA;
3. preparing a BIA plan;
4. gathering information from questionnaires, interviews and documentation that is relevant to the analysis;
5. evaluating the collected information and interview data;
6. performing an analysis to identify mission-critical business processes, the technologies those processes depend on, the impact if those processes cannot be performed and specific performance metrics, such as recovery time objective (RTO) and recovery point objective (RPO);
7. preparing a report to document the findings;
8. presenting the results to senior management;
9. coordinating BIA results with RA results to help define strategies for recovery and restoration of mission-critical processes; and
10. using these results to develop a BCP.

Employees who perform a BIA must examine materials available from several sources to prepare for the process. They also should review the global standard, ISO/Technical Specification 22317:2015, Societal security -- Business continuity management systems -- Guidelines for business impact analysis (BIA), developed by the International Organization for Standardization.

Other options for performing a BIA include the following:

• Consultants. When hiring a third-party consulting firm to perform a BIA, it is important to check that team members have demonstrable experience performing BIAs.
• BIA software. These applications are typically a module within a larger, more costly BCP development application.
• BC as a solution. These cloud-based offerings are also available.

BIAs often include a detailed questionnaire or survey to collect a variety of information, including the following:

• critical business processes;
• resource requirements;
• relationships with internal and external entities; and
• financial impact of a disruption.

This information is essential in assessing the potential impact of a disruptive event. An educational session may be conducted for key personnel with knowledge of the business. Such an activity may precede formal interviews as a way to set the stage for the BIA.

Information can be collected in a variety of ways, including in-person interviews and automated surveys. Follow-up interviews may be necessary.

Posted by waleed Azad