A Business Impact Analysis is a critical component of a Business Continuity Management framework – required to understand the organization’s interdependencies and full range of operational complexities.
The goal of a Business Impact Analysis (BIA) is to identify the crucial business functions that will be affected in the event of a natural or man-made disaster. BIA findings allow leaders to set up recovery priorities, plan out recovery strategies, allocate the appropriate resources, and determine important metrics such as Recovery Time Objectives (RTO), a measure of the maximum time within which business functions should recover as close to normal during disaster recovery.
A BIA will collect a range of information including the people, technology, and resources involved in the organization’s processes and operations. It will determine the relationships/interdependencies between different business units/departments as well as set down expected costs (both qualitative and quantitative) if certain business functions suffer a disruption for specific periods of time. Our five BIA tips:
1. Avoid understating or overstating the financial impact
It is often a challenge to measure the total revenue impact of certain business functions. Some functions don’t directly contribute to revenue generation but are still fundamental to day-to-day business. At the same time, avoid over-focusing on financial impact. Business units should consider their function in context of the whole organization. Reputational loss, for example, can often be a major concern for the senior management. Thus, paying too much attention to financial risk can cause you to understate the impact of other areas.
2. Follow the facts
Use your preconceptions as a jump-off point but don’t rely on them: you might be able to guess the results of an analysis based on your past experience, but going through the BIA analysis is still necessary to prevent inaccuracies in determining possible impact, which might affect the courses of action you plan out in the event of disaster.
3. Cultivate strong working relationships with business units
As the first step in the business continuity process, getting the support and cooperation of business units during the BIA will enable efficiency and accuracy throughout. Inevitably, there will be discussion or even compromises made on determining prioritization. Business units can overestimate their importance relative to the whole organization and overstate impact – which can lead to inaccuracies in BIA findings down the line. It’s important to acknowledge their contribution to the organization while also explaining their role within the organization. While the BIA is the responsibility of the business units, the person-in-charge for BCM may have to lead or facilitate the process to ensure that all requirements are being met. Informal discussions with the business units or with management about worst-case scenarios can yield productive insights to build on in the BIA report.
4. Provide enterprise-wide BCM training
If an organization’s BCM maturity level is low, provide training programs so that BIA participants have a common level of understanding of the process. This training is also important to clear up any misunderstandings about the goals of the BIA, as well as emphasize organizational objectives and priorities. Ideally, business units will come away with greater awareness of the overall big picture as well as customer needs, rather than just focused on their own departments.
5. Exercise discretion
Context is an essential factor when considering prioritisation. For example, in theory, missing the payment of a supplier following a disruptive event to your organization could be a critical issue. In practice however, if the relationship with the supplier is long-term – criticality can be reduced if you notify the suppliers to delay the payment or negotiate for a partial payment, with the balance to be paid later.
All in all, an accurate BIA is critical to the success of BCM. By forming a complete picture of how business functions will be affected by disaster or failure, the appropriate strategies can be put into place to ensure that an organization can weather any storms that come its way.
What Next?
Want to know more about how a Business Impact Analysis links to your overall Business Continuity Management, Enterprise Risk Management, and organizational strategy? Find out more about our 3-day Business Continuity Leader (BCL™) Certification Program, covering essential BCM skills and knowledge.
