How to Conduct a BIA (Business Impact Analysis)

The Business Impact Analysis (BIA) shows which processes are most critical to your organisation and which resources support them. It is the starting point of a Business Continuity Management System and the basis of any continuity plan.

This guide explains what a BIA is, how to carry it out step by step and how to use its results to prepare the continuity plan, following the approach of ISO 22301. It is for continuity coordinators and the teams taking part in a first BIA or reviewing one they already have.

What's in the guide

1. Before you startThe prerequisites and the first steps: a coordinator, a service catalogue, the organisational structure, information sources and a process dependency tree.
2. Types of impact and timescaleOperational, financial, reputational and legal impacts, with levels, criteria and disruption intervals from the first hour to two weeks.
3. The values the BIA gives youMTPD, RTO, RPO and MBCO: what each one is and how it is set.
4. Prioritising processes and activitiesThe restoration order and what to collect about each activity: timing, constraints, resources and interdependencies.
5. Consolidating the resultsHow to get the full picture, validate it with management and keep it up to date.
6. The BIA in GlobalSuite®Automated calculations, scenario simulation and traceability with risks and continuity strategies.

Who should take part

• Continuity coordinator
• Business areas
• Process owners
• Employees and managers
• Management
• Suppliers

After the BIA

The BIA paves the way for the rest of the ISO 22301 requirements. The next step is to analyse the risks of the assets that support the critical processes.