What a BIA is and why you need it
Business impact analysis (BIA) is an assessment of how the stoppage of each process hits the company over time and in money. A BIA answers three questions: which processes are critical, what their downtime costs and how quickly they must be restored. Without a BIA, a business continuity plan is built blindly.
Key metrics: MTPD, RTO and RPO
- MTPD is the maximum tolerable period of disruption, after which the damage becomes unacceptable.
- RTO (Recovery Time Objective) is the target time to restore a process, always shorter than the MTPD: “how quickly the function must be back so that losses stay acceptable”.
- RPO (Recovery Point Objective) is the acceptable amount of data loss: “for what period can data be lost without critical consequences”.
How to run a BIA: step by step
- Make a list of processes (see the critical process register).
- Assess the impact of downtime for each process over time: after 1 hour, 1 day, a week. What do you lose (revenue, penalties, customers, reputation)?
- Rank the processes by criticality.
- Set RTO and RPO for critical processes.
- Identify recovery resources: people, IT, suppliers, sites.
Who sets the RTO and why IT should not
The target recovery time must be set by the process owner: the manager who is responsible for the result and understands the consequences of a stoppage. If the IT department sets the figure, you get a description of what the equipment can do today. That is different from a business requirement. The difference is fundamental: the first tells you what you have, the second tells you what you need.
The process owner's first answer is almost always “we need it immediately”. That is normal. Then you ask a second question, and it is sobering: how much is the company willing to pay for recovery to take an hour instead of a day? Once the acceptable time is linked to the budget for redundancy, the figures become realistic.
The result is approved by the sponsor, a member of the management board or the owner. The analyst and the coordinator do not approve it. A signature under the RTO table records a commitment the company has accepted. It does more than confirm that a document has been filled in. How this logic is explained to the board of directors is covered in BCM for the board of directors.
Five mistakes that make the analysis worthless
- Surveying everyone. A questionnaire across the whole company produces a hundred processes, and each one turns out to be “critical”. Interview only the owners of key business areas.
- Scoring in points instead of money. A scale from one to five is convenient for the analyst and useless to the CFO. Calculate losses in roubles per hour and per day: see the cost of one day of downtime.
- Forgetting dependencies. A process may not be critical in itself but may feed three critical ones. These links show up in the critical process register, and points of concentration show up when you look for a single point of failure.
- Ignoring seasonality. A day of downtime at the end of a quarter and a day in mid-July cost different amounts. For processes with peaks, use the worst period.
- Shelving it. An analysis without a next step is just a report. The result must turn into redundancy requirements and a business continuity plan.
What you get at the end
A properly run analysis produces more than a document. It gives you four decisions. First, the list of processes to restore first and the order among them. Second, figures for acceptable downtime and acceptable data loss for each process, confirmed by the business. Third, a justified budget: you can see where redundancy is really needed and where the company overpays for excess reliability. Fourth, the gap between what is required and what the infrastructure delivers today.
The last point usually turns out to be the most useful. The gap between the declared RTO and the real ability to recover can only be checked in practice, through exercises and a stress test. What to do with the results next is covered in the articles on how to measure business resilience and the business backup plan.
BIA results are the input for the business continuity plan (BCP) and a mandatory element of the ISO 22301 standard. Without a BIA you cannot set recovery priorities.
BIA form: Excel template
The form follows the steps from the section “How to run a BIA”, in more detail: five time horizons (from 4 hours to a month), five types of impact, MTPD, RTO, RPO, minimum level, dependencies and workaround mode.
Download the template. A “BIA” sheet with 22 columns and an example, a “Scale” sheet with 1–5 assessment criteria, and a “Summary” sheet for approval by the management board. xlsx format.
The process owner fills it in during an interview of about one hour. The results go into the RTO and RPO matrix (in Russian). No registration, no forms. If you need the template adapted to your organisation, or want to run a review with it, write to us: how we do it and how long it takes.
Frequently asked questions
A shortened impact analysis, done in one or two working days for ten to fifteen key processes instead of the full list. It is enough to see which processes are critical and where to start the plan. The full BIA comes later, based on the results of the rapid assessment.
Critical processes are the output of the impact analysis. A BIA assesses what happens when each process stops, and this assessment splits processes into critical, important and other. Without a BIA, the list of critical processes is drawn up by gut feeling. Such a list contains the processes people notice, and these are not always the ones that cost the most.
How does a BIA differ from a risk assessment?
A risk assessment answers “what can happen and how likely is it?” A BIA answers “how much will it hurt if the process stops, and how quickly must it be restored?” In BCM the two are used together.
Can a small company run a BIA?
Yes. Take 3–5 key processes, assess the impact of their downtime over time and set target recovery times. This can be done in one working day.
Check your recovery numbers
The assessment shows where the recovery times the business needs do not match what the technology can deliver. After that, either your specialist calculates these numbers, or we do.
Impact analysis and recovery
This is the core page of the section. Below are the other materials in the section. They cover specific parts of the topic.
- Critical process registerWhich processes are critical and how to build a register in one day
- Cost of one day of downtimeHow to calculate losses per hour and per day, using a real case
- Single point of failureHow to find irreplaceable elements and remove them without a budget
- How to measure resilienceBIA, RTO and RPO in plain language, and testing in exercises
- Disaster recovery plan (DRP)Recovery of systems and data, and how a DRP differs from a business continuity plan
- Business continuity plan (BCP)Plan structure and a working document in seven steps
- Business backup planWhat must be ready in advance to survive a disruption
- Business continuity risk assessment (in Russian)Five steps of the method, likelihood and impact scales, table template
- RTO and RPO matrix: template (in Russian)Target recovery time and recovery point by process, gaps between target and actual