Business Impact Analysis

A business impact analysis (BIA) is an important component of a business continuity plan. In fact, organizations must perform a BIA in order to determine which functions, activities, and business processes are of vital importance for the organization to function.

A BIA is essentially the classification of an organization's functions, activities, and business processes as either critical or noncritical. There are certain elements of an organization that are essential for its proper functioning (critical) and that must be addressed to have an organization up and running in the aftermath of a disaster. In other words, a BIA helps an organization identify critical components to its survival.

A critical component of any BIA is its recovery methods such as recovery point objective (RPO), recovery time objective (RTO), and business and technical recovery requirements. A recovery point objective (RPO) states how far back should an organization go in time in order to recover data after an incident. Recovery time objective (RTO) is based on how long it takes to restore backup data to its original state to resume business operations.

Understanding the balance between actions that are important and actions that are urgent is an essential concept in developing the near-term situation analysis. When a task is important, there may be severe consequences if it is not accomplished. When a task is urgent, there may not be another opportunity to accomplish the task before time or resources run out. Many tasks are obviously important or obviously urgent. Discerning which of these tasks are both important and urgent, however, is somewhat difficult in a postdisaster situation. The figure below shows a framework for assessing the priority of various possible actions.

Priority Assessment process displayed in a four sector box. Top sectors are Urgent Not Important on left and Urgent Important on right. Bottom sectors are Not Urgent Not Important on left and Not Urgent Important on right. An arrow on left marked Urgency goes from bottom to top. An arrow on bottom called Importance goes from left to right.
Priority Assessment

Near-term analysis of the disaster situation should determine whether the business process is recoverable within predetermined timelines or whether the focus should switch to more strategic actions such as:

  • reassigning business process responsibility to another organizational element
  • building a new permanent facility
  • foregoing the business process entirely

Globally or nationally dispersed organizations may have the option of reassigning business process responsibility to other similar facilities. This decision will shorten the business process recovery period and may improve overall organizational efficiency by decreasing excess production capability across the enterprise. Residual effects may include personnel relocation or integration of telecommunications features in remaining business processes or both.

Forward-looking organizational leaders can see opportunity in the aftermath of disaster. This type of planning is beyond the scope of a disaster recovery plan (DRP) but must be considered within the larger business continuity plan concept. If a facility is determined to be unrecoverable, but is still required to support a key business process, planners should focus on infusing new technology or workflow improvements into the supported business process. Armed with a thorough understanding of the organization's overarching business strategy, planners can create an outline for specific actions and investments to transform loss into new opportunity.

Discontinuing a business process may be a valid decision in view of the organization's long-term business strategy. If the business process was headed toward obsolescence in the current business perspective, merely accelerating the planned divestments will set the organization on its future course—ahead of schedule. Residual operating budgets and insurance payouts can be redirected toward developing next-generation capabilities.