Organisations are facing more disruptions as they deal with an increasingly complex threat landscape from both internal and external risks. What is particularly important is for Risk Management leaders is to commit to a Business Impact Analysis (BIA) to identify the impact of downtime, data loss requirements, recovery time, and many more instances.
Business Continuity Management is essential for every organisation to ensure that your business can survive in everchanging market conditions and even in the face of crises or disasters. Conducting a Business Impact Analysis (BIA) or otherwise known as Business Impact Assessment, helps condition organisations for the worst-case scenarios, but at the same time it designs recovery strategies (and contingency plans) for risks that mitigate negative impacts and quickly gets the business workflow back on track.
This principle is the essence of Business Impact Analysis (BIA) and is the solid foundation for any Business Continuity Framework. The step where a business can forecast or predict the potency of all its core functions and thereby, identifying the processes that are most critical to your organisation. But it is possible to avoid the destructive consequences of impending risks with proper preparation and planning. Stakeholders must be vigilant in checking and assessing business disruptions that damage an organisation’s competitive advantage and impairs future growth.
What are the 6-Steps to conduct a Business Impact Analysis?
Whilst there are no concrete standards on how to conduct a Business Impact Analysis (BIA), most methodologies are composed of the following six (6) steps:
Step 1 – Define the Objectives & Scope
The first phase of Business Impact Analysis is to define the goals, objectives, and scope analysis. The organisation’s goals and strategy for undertaking this project should be clear!
Think of the Business Impact Analysis as any other significant project in the organisation.
Just like a regular project, start by creating a Project Plan that outlines your approach —including defining the goals, scope analysis, objectives, and specific stakeholders you’ll be working with.
An actionable Project Plan provides a clear path forward for your Business Impact Analysis. It helps stakeholders understand what they’re responsible for, and ensures you have an easier time co-ordinating the project resources you need. Once approval has been obtained, your project resources will be gathered and comprise of individuals that understand the organisation’s key business processes and be familiar with Risk Assessment methods (and reporting).
Ensuring that all the important activities and resources are “in-scope”, then Frame Meetings are scheduled to determine answers to certain questions, such as:
- What is the purpose of the Business Continuity Plan?
- What products and/or services will we try to protect?
- Who are the parties that will be involved in the program?
- How much business continuity is enough?
Step 2 – Establish the value proposition with your Executive Management Team
Identifying and evaluating the impact of risks, disruptions, or disasters on businesses provides the basis for key investment in recovery strategies, as well as the simultaneous investment in prevention and mitigation strategies.
The second phase of conducting a Business Impact Analysis is to promote the value with your organisation to understand (and support) the need for Business Continuity Management and developing a Business Continuity Plan. However, they may not realise what goes into executing the Business Impact Analysis specifically, so once you’ve determined the project outline (goals, objectives, scope analysis, stakeholders, timeframe, and outcomes), then present your Project Plan to your Executive Management Team. They need to be informed of the investment into the Business Impact Analysis process, the potential value that will stem from both implementation and deliverable outcomes – guide them in your work and provide as much information upfront.
Step 3 – Collect data & information from key stakeholders
For this third phase, you need to consult the experts within the organisation – the stakeholders who manage and execute the business processes that you are investigating. Before you can accurately predict the consequences of business disruptions, first you need to understand how critical business processes work.
Whilst you may have a holistic view of processes and understand the “big picture” needs, it’s always important to talk with individuals (or teams) closer to the work. That way, you can understand the ‘on-the-ground’ impacts of business disruptions and generate further insights and recommendations.
With information-gathering methods, there are three (3) methods:
- Set up interviews with stakeholders – more personal approach and provides answers to your in-depth questions.
- Commence with the documentation review (Policies, Procedures, etc.) – understand any process gaps that affect productivity.
- Create a Business Impact Analysis Questionnaire that stakeholders can complete asynchronously – helps standardise and validates your data.
The process information collected should include the following:
- Process name?
- What does the process entail (in detail)?
- Inputs and outputs?
- All Business Impact Analysis tools and resources to be implemented in the process?
- Users involved in the process?
- Timing?
- Financial and operational affect?
- Regulatory and legal impacts?
- Historical data?
The data information collected should include the following:
Qualitative Data Collection
- This information comes from in-person interviews, focus group discussions, stakeholder workshops, Business Impact Analysis Questionnaire, and surveys.
- The Project Team seeks to identify (and uncover) critical business processes and the key relationships between them.
Quantitative Data Collection
- This information comes from Enterprise Resource Planning (ERP) systems, finance systems, supply chain systems, and BI databases.
- The Project Team is looking for concrete measures concerning the organisation’s business processes, since this data helps determine the costs of disruption and identify critical dependencies between business functions.
Step 4 – Review & document the collected data information
The fourth phase of Business Impact Analysis is the process of documenting and reviewing the collected data to prioritise the list of business functions or processes, identify employee and technology resources needs, and establish a recovery timeframe. This phase is important in Crisis Management and contingency planning because it helps the Executive Management Team make decisions about allocating resources and managing operational activities, during and after a disruptive event.
The Project Team will then aim to accomplish the following items:
Determine the interdependency of policies, procedures, processes, and workflows
- By identifying relationship between inter-linking processes and objective outlines that guide employees through their daily work activities.
Identify business requirements for optimal productivity
- What does the organisation need to maintain normal operations (e.g., staff, raw materials, utilities, vendors, suppliers, equipment, etc.) under both optimal and sub-optimal conditions?
Quantify the effect of disruption beyond just the financial cost
- Aside from assessing the financial cost of an adverse event, also account for the hidden effects (e.g., damage to reputation, damage to employee morale, data loss, productivity loss, etc).
Organise business functions by importance and preservation
- By identifying the Business Units with the greatest impact on organisational operations, financial performance, and compliance, you will prioritise what mission-critical processes to preserve (during a disruption event).
Planning for recovery and timeframe
- This involves identifying the timeframe, resources, activities, and staffing costs required to recover from a disruption.
Identify process and systems vulnerability for future protection
- This involves identifying vulnerabilities of processes, workflows, and systems and uncovering ways to protect them from disruptive events in the future.
Step 5 – Documenting the findings & review of the Business Impact Analysis
With the fifth phase, the findings of the Business Impact Analysis will now be compiled in a Business Impact Analysis Report. The report should describe the details of disruptive events and how they affect the organisation’s specific processes and the future impact on the business. For the Business Impact Analysis to be a helpful business continuity tool for the overall Business Continuity Plan, the Business Impact Analysis Report must be actionable, and since it should establish the acceptable duration of downtime, acceptable losses, and then plan for recovery.
Business Impact Analysis Report
Your Business Impact Analysis Report should include the following components:
Executive Summary
- The depth of the Business Impact Analysis – Which organisation components and department processes were analysed?
- Main goals – Which are the primary and secondary objectives that you identified during the Business Impact Analysis?
- Overall Business Impact Analysis approach – The entire process that led to the creation of the Business Impact Analysis Report.
Objectives & Scope
- The detail about the key objectives of your Business Impact Analysis and an explanation WHY? they are so significant to the organisation.
- The scope of the analysis, which represents the data subset that you have used for the analysis.
Overview of Methodology Type
The methodology section should describe your approach and how you conducted the Business Impact Analysis. This includes information such as:
- How did you conduct the various interviews process?
- How did you analyse the data and information obtained?
- Which assumptions did you make from the interviews and information from your findings?
- What quantitative categories did you use to measure the impact (explain their meanings and rank them accordingly)?
Breakdown of Findings (for each process)
Provide a prioritised list of the most important business processes.
- How a disruption to that process would impact singular departments or alternatively different areas of your organisation?
- How long you could reasonably take to recover after notification of the disruption? – this is also known as a Recovery Time Objective (RTO).
- What is the maximum allowable threshold or “tolerance” of losses your organisation could tolerate? – this is also known as a Recovery Point Objective (RPO)?
Provide a comparison between the potential financial cost of a disruption and the cumulative cost of business recovery strategies.
- How much money ($) would a disruption event cost your organisation?
- How much money ($) would need to be spent to implement the recovery strategy?
- Execute a comparative cost ($) of the two (2) items to evaluate if the current strategy would be able to cover the possible incurred financial losses.
Supporting Documents
- Share the documentation gathered (high-level) from the Business Impact Analysis process, stakeholder’s names, participants names, IT system recovery time, or any other specifics (e.g., transcripts of interviews, screenshots of metrics, reports, etc).
Summary
- By combining the data presented, the Summary will explain what will be required by the organisation to keep the business operational.
- Provide insights to the value of the most important information of each finding.
- Ensure to include all the significant data, evaluations, and findings so your Executive Management Team can visualise the “big picture” details.
Recommendations for Recovery
- Create a Findings Table so you can categorise the information easier and ensure the details translate to more understandable language.
- Deliver your recommendations for recovery and be ready for discussion of the relevant information with your Executive Management Team.
Step 6 – Presentation of Business Impact Analysis Report
Creating a detailed Business Impact Analysis Report is the most important part of the process and then presenting the information for review with your organisation’s Executive Management Team. This report comprehensively documents the findings of the previous phases and highlights the vulnerabilities and recovery plans for the organisation’s most important business functions by offering recommendations for recovery (in the event of a disruptive incident).
The main goal is to create organisational buy-in, helping Executives to engage in and understand the role they play in mitigating those risks and the associated necessity of the Business Impact Analysis and a Business Continuity Plan. Their involvement is critically important to providing efficient strategy directions and organisational resource allocation. The main “pain points” you want your Executives to understand are:
- Key business activities and which departments support operational areas
- Most valuable products and services
- Recovery expectations
- Impact areas
- Business Impact Analysis participants
After the Business Impact Analysis Report has been reviewed (and approved) by your Executive Management Team, the contents can help develop an Action Plan and to scope the “right-fit” Business Continuity Plan in the event of disruptions.
Summary
Contrary to popular belief and industry insights, organisations that achieve resiliency success learn to practice informed decision-making that will produce the most actionable results possible for its Change Management Plan. This empowers businesses to use a combination of tools and analyses that are painstakingly manoeuvred, developed, tested, and implemented – by planning for possible disasters and mitigating their damage to daily operational activities.
A successfully executed Business Impact Analysis entails asking the right questions and implementing the right strategy at the right time. By conducting an in-depth Business Impact Analysis, this clarifies to businesses which risks they’re most likely to encounter, resulting in targeted resource allocation and robust planning (backed by data from process experts) by improving their chances of a quick recovery. Also, it requires knowledgeable understanding of the internal and external factors that have impacted the organisation and accessing key vulnerabilities in critical elements that your Executive Management Team can point out.
However, there is a requirement to understand that business disruptions are going to be a natural part of an organisation’s operations and organic growth (in general). By continually evaluating your current strategies, this allows your organisation to “stay in step” with the current business environment. But, by building a Business Impact Analysis Team that can execute this transition as a core part of your overall day-to-day business operations, this decision alone will help you get that much closer to total organisational resilience.
Need some guidance on your next steps? Let’s start a conversation…
