The Institute of Enterprise Risk Practitioners (IERP®) is the world’s first and leading certification institute for Enterprise Risk Management (ERM).

Image Alt

IERP® International Institute of Enterprise Risk Practitioners

  /  Blog   /  Business Impact Analysis: 5 Tips for Accuracy

Business Impact Analysis: 5 Tips for Accuracy

A Business Impact Analysis is a critical component of a Business Continuity Management framework – required to understand the organization’s interdependencies and full range of operational complexities.

The goal of a Business Impact Analysis (BIA) is to identify the crucial business functions that will be affected in the event of a natural or man-made disaster. BIA findings allow leaders to set up recovery priorities, plan out recovery strategies, allocate the appropriate resources, and determine important metrics such as Recovery Time Objectives (RTO), a measure of the maximum time within which business functions should recover as close to normal during disaster recovery.

A BIA will collect a range of information including the people, technology, and resources involved in the organization’s processes and operations. It will determine the relationships/interdependencies between different business units/departments as well as set down expected costs (both qualitative and quantitative) if certain business functions suffer a disruption for specific periods of time. Our five BIA tips:

1. Avoid understating or overstating the financial impact

It is often a challenge to measure the total revenue impact of certain business functions. Some functions don’t directly contribute to revenue generation but are still fundamental to day-to-day business.  At the same time, avoid over-focusing on financial impact. Business units should consider their function in context of the whole organization. Reputational loss, for example, can often be a major concern for the senior management. Thus, paying too much attention to financial risk can cause you to understate the impact of other areas.

2. Follow the facts

Use your preconceptions as a jump-off point but don’t rely on them: you might be able to guess the results of an analysis based on your past experience, but going through the BIA analysis is still necessary to prevent inaccuracies in determining possible impact, which might affect the courses of action you plan out in the event of disaster.

3. Cultivate strong working relationships with business units

As the first step in the business continuity process, getting the support and cooperation of business units during the BIA will enable efficiency and accuracy throughout. Inevitably, there will be discussion or even compromises made on determining prioritization. Business units can overestimate their importance relative to the whole organization and overstate impact – which can lead to inaccuracies in BIA findings down the line. It’s important to acknowledge their contribution to the organization while also explaining their role within the organization. While the BIA is the responsibility of the business units, the person-in-charge for BCM may have to lead or facilitate the process to ensure that all requirements are being met. Informal discussions with the business units or with management about worst-case scenarios can yield productive insights to build on in the BIA report.

4. Provide enterprise-wide BCM training

If an organization’s BCM maturity level is low, provide training programs so that BIA participants have a common level of understanding of the process. This training is also important to clear up any misunderstandings about the goals of the BIA, as well as emphasize organizational objectives and priorities. Ideally, business units will come away with greater awareness of the overall big picture as well as customer needs, rather than just focused on their own departments.

5. Exercise discretion

Context is an essential factor when considering prioritisation. For example, in theory, missing the payment of a supplier following a disruptive event to your organization could be a critical issue. In practice however, if the relationship with the supplier is long-term – criticality can be reduced if you notify the suppliers to delay the payment or negotiate for a partial payment, with the balance to be paid later.

All in all, an accurate BIA is critical to the success of BCM. By forming a complete picture of how business functions will be affected by disaster or failure, the appropriate strategies can be put into place to ensure that an organization can weather any storms that come its way.

What Next?

Want to know more about how a Business Impact Analysis links to your overall Business Continuity Management, Enterprise Risk Management, and organizational strategy? Find out more about our 3-day Business Continuity Leader (BCL™) Certification Program, covering essential BCM skills and knowledge.

    Name (required)

    Email Address (required, business email address only)

    Mobile Number (required)

    Company (required)

    Designation (required)

    Preferred Contact Method: (required)

    CallEmail

    What is the biggest challenge in your job/industry

    Which modules are you interested in? (required)

    Managing ESGMechanics of ESGEnterprise Risk Management

    Message

      Name (required)

      Email Address (required, business email address only)

      Mobile Number (required)

      Company (required)

      Designation (required)

      Preferred Contact Method: (required)

      CallEmail

      What is the biggest challenge in your job/industry

      Message

        Name (required)

        Email Address (required, business email address only)

        Mobile Number (required)

        Company (required)

        Designation (required)

        Preferred Contact Method: (required)

        CallEmail

        What is the biggest challenge in your job/industry

        Which modules are you interested in? (required)

        Evaluating Risk and Internal ControlCorporate GovernanceEstablishing a Cybersecurity FrameworkEnterprise Risk Management

        Message

          Name (required)

          Email Address (required, business email address only)

          Mobile Number (required)

          Company (required)

          Designation (required)

          Preferred Contact Method: (required)

          CallEmail

          What is the biggest challenge in your job/industry

          Message

            Name (required)

            Email Address (required, business email address only)

            Mobile Number (required)

            Company (required)

            Designation (required)

            Preferred Contact Method: (required)

            CallEmail

            What is the biggest challenge in your job/industry

            Which modules are you interested in? (required)

            Digital Risk Management and DisruptionMechanics of CyberSecurityEnterprise Risk Management

            Message

              Name (required)

              Email Address (required, business email address only)

              Mobile Number (required)

              Company (required)

              Designation (required)

              Preferred Contact Method: (required)

              CallEmail

              What is the biggest challenge in your job/industry

              Which modules are you interested in? (required)

              Evolution of BCM Standards, Policies and FrameworksBIA & BCMS Frameworks and StrategiesRisk, Sustainability, Metrics and Crafting Effective Business Continuity Plans

              Message

                Name (required)

                Email Address (required, business email address only)

                Mobile Number (required)

                Company (required)

                Designation (required)

                Preferred Contact Method: (required)

                CallEmail

                What is the biggest challenge in your job/industry

                Which modules are you interested in? (required)

                Emergency Preparedness, Response, BC Awareness and trainingBCMS Performance, Metrics and Audits, Disaster Recovery Plans and Lean MethodologiesCrisis Management

                Message

                User registration

                Reset Password