How to conduct a business impact analysis

Business continuity planning (BCP) has been our topic of discussion for the past few weeks. First, we explored the vital role it plays in an organisation, and then delved deeper into the subject. Finally, we discussed the vast number of benefits of having effective plans and processes in place in emergency or unplanned events like natural disasters, cybersecurity attacks and public health emergencies.


We discovered that a BCP is crucial, irrespective of how big or small a company is, to ensure that it can withstand any form of unplanned event. Each BCP plan should be customised for the specific company or organisation it covers to ensure that all significant areas of the company are covered and accounted for. Unfortunately, very few people know what a BCP entails and what needs to be considered when drafting the plan.


Suppose you are new to the concept of BCP, and you do not have any form of BCP in place. In that case, you need to start with the basics and do a full business assessment – covering all processes, vulnerabilities, potential areas of loss if impacted, etc. This is called a business impact analysis (BIA).


A BIA is a process of predicting, determining, and evaluating the potential impact and consequences of unplanned disruptions/disasters affecting your company’s systems and processes. It assesses which areas are vulnerable and where potential losses may occur due to a halt in everyday operations and unplanned downtime. Therefore, you identify the most critical business processes that will be necessary to keep your company afloat.


The primary purpose of a BIA includes gathering critical information, such as:


  • the critical business functions of your company, including service channels, physical storage infrastructure, distribution networks, data systems (physical and cloud), necessary operational utilities, and more;
  • identifying the necessary resources to ensure that essential products and services are still delivered;
  • identifying all contractual and legal obligations of the company;
  • estimating the amount of downtime that the company can afford; and
  • estimating the extent of the impact on the company.


The necessary elements contributing towards a successful BIA are as follows:


Executive input

Conducting an effective BIA relies on collecting the most relevant and accurate information. As such, you need the help of executives in your company, because no one knows the internal and external operations of a company better than they do. In addition, using the chain-of-command ensures that all tasks can be delegated and executed effectively and efficiently.


Organisational understanding

First establish and identify the vital functions and processes relevant to your company. To source the most accurate information, you need to go directly to the key personnel who excel in each important area of interest and who understand it the best. If you do not fully understand your organisation and the vital areas of importance, you will not be able to conduct an effective and reliable BIA.


Tools and software

An analysis means nothing without incorporating the correct software and tool usage to comprehend, break down, simplify, and portray the data in the most efficient way. Once you have a firm understanding of all the essential functions and processes in place that play critical roles in your company, you need to use tools. These include data flow diagrams, questionnaires, organisational charts, and the relevant software to analyse the extent of the impact on your business accurately.


BIA process

The BIA process is the step where you thoroughly analyse the data you have collected. List each function and process in your company, stating whether they are critical or non-critical, and list the personnel participating in each process.


When setting apart and focusing on all critical processes, it is essential to know who the relevant personnel are and precisely how each process works. Next, it is necessary to understand the impact on daily operations and finances of a process and the bare minimum needed to continue functioning if it came to a standstill. Lastly, compose a list of all internal and external dependencies of the company.


BIA findings

The last step is to present the findings to all the relevant parties concerned. This includes key personnel, managers, and executives, to ensure that everyone agrees that the data is accurate and specific to the company. Once the BIA has been completed, approval must be granted via executive management to use it to develop a tailor-made BCP.


We hope you have gained a better understanding of conducting a thorough, accurate, and reliable BIA. Keep your eyes peeled for our next blog, where we will discuss the inner workings and process of drafting a BCP.

0 replies

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published. Required fields are marked *