Business Impact Analysis

The Business Impact Analysis is one of the most important steps in the overall Business Continuity Planning process. The data gatherer is critical in identifying key business issues and justifying the resources needed. The Business Impact Analysis determines the financial exposures and operational impacts resulting from a major disruption of services. It will provide your organization with: •The identity of its time-sensitive business operations and services •An analysis of the organization’s financial exposures and operational impacts •The time-frames in which time-sensitive operations, processes and functions must resume •An estimate of the resources necessary for successful resumption, recovery and restoration. In addition to a Business Impact Analysis, it is important to conduct a facility/structural vulnerability analysis. The Business Impact Analysis will provide the rationale and cost justification for risk mitigation and response, resumption, recovery and restoration-related decisions. Gather Business Impact Analysis Data

Business Impact Analysis questionnaires should be tracked against the recipient list. Follow up with any individuals who are overdue in returning their responses. If the organization is large or complex, evaluate automating this process as much as possible. Some Business Impact Analysis software automatically tracks questionnaires sent out and received. Review Initial Business Impact Analysis Results

Review initial BIA questionnaire data for completeness and consistency; request additional information as necessary. The initial review of returned survey data would allow the project manager to uncover any area of ambiguity in questions asked or answers given. Conduct Business Impact Analysis Interviews

•Every major business operation should be evaluated using the BIA approach. Each line manager must be aware of the length of time that a particular service, business operation or application system may not be available, and devise interim procedures to ensure the continuity of the most time-sensitive activities. •The resumption sequences, potential time delays, or service postponements for each business operation must be documented and endorsed by senior management. Senior management may be called upon to refine business time-sensitivity definitions, adjust resumption priority sequences or allocate additional resources and funding where resumption capacity becomes an issue. •The project team should use this information to support the organization’s strategies and any necessary investments in backup alternatives. Identify Time-Sensitive Business Operation Processes and Application Systems

•Establish a method of grouping business operations, processes and application systems in line with their importance to the overall function of the organization like business time-sensitivity ratings. Time-sensitivity ratings are usually expressed in terms of the minimum and maximum time that the organization can withstand an interruption of a particular business operation or application system. •Record each business operation, process, function or application system along with its time-sensitivity rating.