The purpose of this document is to help your business conduct a Business Impact Analysis (BIA), which identifies your business’s critical processes, required resources for each process and the order in which processes need to be recovered.  This document provides guidance on how to conduct the BIA, analyze the information that is collected, and report the findings of the assessment.  This document includes Business Impact Analysis Template, Application & Data Criticality Template, Final Business Unit Report Template, Final Executive Management Report Template, Examples of Impact and Examples of completed templates.

The Business Impact Analysis is only a part of the overall Business Assessment.  A Business Assessment is separated into two constituents, Risk Assessment and Business Impact Analysis (BIA).  The Risk Assessment is intended to measure present vulnerabilities to the business’s environment, while the Business Impact Analysis evaluates probable loss that could result during a disaster.  To maximize the Business Impact Analysis, a Risk Assessment should also be completed. 

IMPORTANT NOTE TO USERS
To help our clients use this document more effectively, we offer word file of this document with any excel worksheets (if available). Full information provided in the e-book on how to request for word/excel files.

Scope

The BIA is performed to identify the key business processes and technology components that would suffer the greatest financial, operational, customer, and/or legal and regulatory loss in the event of a disaster.  The main intent of a BIA is to identify all the critical resources, systems, facilities, records, etc., that are required for the continuity of the business.  Additionally, the time it would take to recovery such resources will be identified.   

Once the data is collected, an analysis of all requirements, dependencies, and impact will be completed.  A final report will be developed with recommendations of recovery strategies and presented to senior management.  This will allow the business to determine what recovery strategies and solutions they will implement.

Objectives of theBusiness Impact Analysis

The BIA is used to quantify adverse impacts to the business caused by a loss of business operations (functions/processes).    Based on the level of impact, the appropriate recovery strategy is selected to mitigate these impacts.  Objectives of the Business Impact Analysis include:

• Identifies all business process within each business unit
• Determines the financial, customer, operational, legal and/or regulatory impacts of each process
• Establishes the time frames in which business and technology processes must be recovered
• Defines key internal and external relationships and dependencies of each process
• Identifying the necessary resources that are required for the recovery of each process and their associated recovery time frames
• Providing a foundation for the Risk Assessment Process
• Educate and obtain participation from individuals who play a critical part in recovery
• Raise awareness throughout the corporation on Continuity Management

Once the assessment is completed, a business can make decisions regarding methods of mitigating risks.  By completing a Risk Assessment and Business Impact Analysis, a business can implement the best strategies for Contingency Planning.