A business continuity plan is only as good as the analysis behind it. If you do not know which activities matter most, how quickly a disruption hurts, and what each activity needs to restart, you cannot choose sensible recovery strategies. That analysis is the business impact analysis, or BIA.
What a BIA is, and is not
A BIA identifies your organisation’s activities, assesses the impact of disrupting each one over time, and sets the recovery priorities and resources that follow. It is the foundation of a business continuity management system under ISO 22301, and ISO/TS 22317 gives detailed guidance on how to carry one out.
It is not a risk assessment. A risk assessment asks what could go wrong and how likely it is. A BIA deliberately ignores the cause: whether the warehouse floods, the system is hit by ransomware or a key supplier fails, it asks what happens to the business if this activity stops, and how quickly that becomes unacceptable.
The terms you will meet
- Maximum tolerable period of disruption (MTPD): how long an activity can be down before the impact becomes unacceptable to the organisation.
- Recovery time objective (RTO): the target time to resume the activity. It must be shorter than the MTPD.
- Recovery point objective (RPO): how much data you can afford to lose, measured back in time from the incident.
- Minimum business continuity objective (MBCO): the minimum level of service you need to deliver while recovering.
How to run a BIA, step by step
1. Agree the scope
Decide which sites, business units and products are in scope, who sponsors the work, and which impact categories you will use: financial, customer, regulatory, contractual, safety, reputation.
2. List the activities
Work with each department to list the activities that deliver your products and services, including support activities such as payroll, IT and procurement that others depend on.
3. Assess impact over time
For each activity, rate the impact of disruption at set intervals: for example 4 hours, 1 day, 3 days, 1 week and 1 month. The point where the impact becomes unacceptable gives you the MTPD; the RTO is set with a safety margin inside it.
4. Identify dependencies and resources
Record what each activity needs to run at its minimum level: people and skills, premises, IT systems and data, equipment, and critical suppliers. Single points of failure, such as one person who knows a process or one supplier with no alternative, usually surface here.
5. Validate and sign off
Review the results with department heads and senior management, challenge inconsistent ratings, and have management formally approve the recovery priorities. Without sign-off, the BIA is an opinion, not a decision.
Common mistakes
- Everything is critical. If every department rates itself as critical within an hour, the analysis cannot set priorities. Consistent impact criteria prevent this.
- IT-only thinking. System recovery matters, but people, premises and suppliers fail too.
- Done once and filed. A BIA should be reviewed at planned intervals, commonly once a year, and whenever the business changes significantly.
- No link to strategy. RTOs that the current IT set-up or supplier contracts cannot meet need either investment or a management decision to accept the risk.
From BIA to a working plan
The BIA feeds the continuity strategies (for example alternative sites, backup suppliers, cross-training or manual workarounds), then the continuity and crisis management plans, and finally the exercises that prove the plans work. Each stage should trace back to the priorities the BIA established.
Want an independent view of where you stand?
Our senior team in Kuala Lumpur can review your current arrangements and give you a clear, prioritised plan.
This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.
