A business impact analysis is a process that analyzes the impact of a disruptive incident over time on an organization. This helps to determine the business continuity requirements for that organization and provides the information needed to identify appropriate business continuity solutions.

The purpose of the business impact analysis is to determine the business continuity requirements for the organization. Business continuity requirements include the time frames and resources necessary to continue the delivery of prioritized products, services, processes and activities following a disruptive incident.

A business impact analysis is used to understand the impact over time a disruptive incident may have on products, services, processes and activities, and to determine the business continuity requirements. A risk assessment is used to assess the risk of prioritized products, services, processes and activities being disrupted so that appropriate measures can be put in place to reduce the likelihood and/or impact of a disruptive incident.

A business impact analysis is important because it helps to prioritize products, services, processes and activities for business continuity planning and, following a disruptive incident, it also helps an organization to focus efforts on resuming the most time critical parts of the organization first. The business impact analysis is also used to identify dependencies, which is useful during a disruptive incident as it helps when thinking about which stakeholders need to be engaged.

After a business impact analysis has been completed, you will have an improved understanding of the processes and activities needed to deliver your products and services. This will help to either confirm the scope of the business continuity programme or can be used to justify amendments to the scope. Processes and activities will be prioritized by time based on the impact that is unacceptable to the organization and the time required to recover the process or activity. Legal, regulatory and contractual requirements may be clearer if this is included within the business impact analysis. The resource requirements for processes and activities will also be clearer and will help with identifying risk.

The main components of a business impact analysis include criteria to help make sure business impact is consistently understood and scored across the organization. Identification of processes and/or activities that contribute to the delivery of your organization’s products and services. Identification of buildings, people, ICT systems and data, specialist equipment and/or consumables, partners and suppliers. Transport and logistics, and finance can also be included. Time frames for assessing impact over time to help determine the maximum acceptable outage and recovery time objective.

I would advise that the first step of the business impact analysis is to decide which type of business impact analysis you wish to do as there are different types. For example, the Business Continuity Institute Good Practice Guidelines break this down into an initial business impact analysis, a product and service business impact analysis, a process business impact analysis and an activity business impact analysis. You do not have to do all of these and you may decide to a combination of the above which is effectively what I have done with the business impact analysis template on my website. It partly depends on how much time and resource you have, and what the scope of your business continuity programme looks like. For more information, I recommend looking at the Business Continuity Institute’s Good Practice Guidelines as they are super helpful.

The steps, or process and tasks, depend on which type of business impact analysis you decide to do. Once you know which type of business impact analysis you want to do, I recommend thinking about how that business impact analysis will then be delivered. That can be influenced depending on your time and resource, and the scope of your business continuity programme. You might choose to email the template and guidance to staff, schedule a workshop, develop a questionnaire that can be completed quickly, or meet with the staff needed to complete the business impact analysis. Then it’s a case of completing the business impact analysis, obtaining sign-off and reporting on the findings.

My experience

In the past, I’ve used a combination of emailing a business impact analysis template (such as the one on my website) along with a webinar explaining how to complete it and workshops. I’ve found some staff will complete the template fairly quickly and are fine to crack on with the webinar, others need more support and benefit from attending a workshop. Once the template has been completed though, then the owner obtains approval and sign-off, and I’ve recorded it in a governance spreadsheet so I can monitor when the next review is due. We’ve then moved onto the next step with the findings.

There are many different ways to do a business impact analysis and the good thing about that is there’s a way that benefits everyone. It all depends on your appetite, time, resource and to some extent the culture of the organization. Budget can also influence which way you go. You might choose to email business continuity representatives a spreadsheet template with guidance or a webinar (similar to the one on The Continuity Advisor), hold a workshop, circulate a questionnaire, schedule meetings/interviews or hire a consultant to do it for you. If you want to know how to fill in the actual business impact analysis then you can find the relevant webinars in our Shop.

Organizations can use many different categories for analyzing business impact and to some extent the type of industry you work in can influence this. Typically business impact categories might include welfare, finance, legal and regulatory, reputation, business objectives. You might also include operational, contractual, environmental or project. I wouldn’t say there’s a hard rule, it really depends on what is relevant for your business.