5 Steps to Conduct a Business Impact Analysis (BIA)

A business impact analysis (BIA) helps a company determine its risk tolerance as well as disaster recovery plans. Learn the five steps required to conduct a BIA for your own business operations.

Everyone is a creature of habit, and each morning, you anticipate that all of your business operations will be online and ready to go. In reality, though, all anyone can expect is the unexpected.

Your business will inevitably face issues — both small and large — that affect its operations: an essential employee suddenly quits, a computer server goes down, or your offices are unexpectedly flooded after a storm.

To prepare for these events, you need to know the potential financial impacts of a variety of business interruptions. That’s the information you’ll capture in a business impact analysis (BIA).

Overview: What is a business impact analysis?

A BIA identifies potential business operation disruptions and the financial impact that can result from them, depending on the amount of time necessary for their resolution. As such, this business impact assessment comes under the umbrella of your overall business intelligence efforts.

Unlike the calculation of many other business metrics, there is no formal methodology to conduct a BIA. In addition, you can produce this business impact report using in-house personnel or a third-party provider, depending on the scope of work required.

What is the purpose of the business impact analysis?

First, the BIA calculates the financial impact of different business operations being offline over varying amounts of time, whether that’s one hour, one day, one week, or longer. It will also help you identify the most critical operations processes that are integrated within all the systems throughout your company.

For example, if the heating system goes out in your offices, that’s likely an inconvenience — depending on exactly where you’re located — but not a critical failure. If your point of sale (POS) system goes down, though, the financial impact will be demonstrably more costly over time.

Typically, the BIA will measure impact in three basic areas: delayed/lost income, increased expenses, and customer dissatisfaction/defection.

Delayed/lost income

If you have an assembly line go down for even a short period of time in a production facility, you will likely have delayed income as stock to sell will be reduced temporarily. If production is shut down for an extended period of time, you could lose market share as your competitors take advantage of your ongoing difficulties.

Increased expenses

Any interruption in business operations will also increase your expenses due to the cost of repairs or buying new equipment. In addition, if you find yourself out of regulatory compliance, including emissions or safety regulations, your bottom line will be negatively affected due to fines and other penalties.

Customer dissatisfaction/defection

Whether your sales are business-to-business (B2B) or retail, revenue generation is dependent on customer satisfaction. Any disruption — especially over an extended period of time — to production, sales, or services will leave your customers at first dissatisfied, and then looking for another provider.

Challenges of conducting a business impact analysis

Despite the importance of BIA reports as a part of both risk management and business development, they face challenges stemming from not being part of the front-line business operations. A lack of buy-in within the organization as well as an unclear definition of the work to be done can hinder a BIA’s production.

Organizational buy-in

Executive buy-in is critical, otherwise, the results of the BIA will likely not be implemented in a meaningful way throughout the company. At the same time, if mid-level management or front-line workers don’t take their participation in and input to the BIA process seriously, the results will be flawed.

Scope of work

The scope of the BIA should follow the Goldilocks Rule: It must be just right. If the scope is too wide, actionable results will be hard to define. If it’s too narrow, all processes will be defined as critically important, and the resulting financial impact analysis will be too granular to be useful.

How to conduct a business impact analysis

If you’re using a third-party provider to conduct your BIA, they will work with you through the five steps below to produce and implement the final report. If you decide to generate your BIA in-house, you’ll want to use accepted project management techniques to streamline the process of data collection, analysis, and reporting.

Step 1: Project setup

The saying that “People don’t plan to fail; they fail to plan” is a cliche. However, there is an element of truth in it. Every project needs the right foundation from the outset to produce the best results possible.

Tips for project setup:

Your BIA will only be as successful as the preparations you take before beginning, which includes everything from organizational buy-in to carefully defining the scope of work to be done.

• Executive sponsorship: Support from senior-level management is critical to ensure participation in the BIA’s production at all levels within the company as well as enacting its final conclusions and recommendations.
• Organizational education: The BIA requires input from multiple personnel and departments, so explaining why their input — and time! — is critical will increase engagement and data accuracy.
• Statement of work: To prevent the scope of the BIA becoming too wide or going off track, a statement of work will keep your BIA team focused throughout the entire process.

Step 2: Data collection

Your BIA will only be as effective as the evidence it presents. That requires you to be both methodical and comprehensive in collecting key data from multiple people and departments.

Tips for data collection:

No matter what types of information you are gathering during the BIA process, you’ll need uniform “instruments” — that is, methods — to consistently capture your data.

• Quantitative data: This type of data can be expressed numerically — percentages and statistics, for example — and is usually generated through the use of surveys.
• Qualitative data: This data cannot be expressed numerically because it is more descriptive and based on people’s perceptions. Therefore, using interviews with a uniform set of open-ended questions will best gather this information.

Step 3: Data analysis

While the depth and breadth of the data you collect about personnel, processes, equipment, and suppliers is key, its analysis is what ultimately makes the BIA useful. Otherwise, you will have multiple data points without the necessary context to explain their importance.

Tips for data analysis:

The BIA is built around the financial impact of — usually! — worst-case-scenario events, so there are some common terms and metrics you’ll need to know and use.

• Recovery Time Objective (RTO): The amount of time required for a business process to be restored after an interruption to avoid unacceptable consequences from a lack of continuity.
• Recovery Point Objective (RPO): The amount of time during a disruption before data loss exceeds the maximum allowable threshold or tolerance.
• Level of impact: This is typically measured on a scale of 1-5, where 1 indicates minimal impact and 5 is maximum impact.

Step 4: Preparing the BIA

Now that you’ve analyzed the collected data, you must put together a report that can be easily understood by senior-level executives, who will have varying amounts of knowledge and expertise pertaining to the granular-level information you’re providing.

Tips for preparing the BIA:

As stated earlier, the BIA identifies both the financial impact of operational disruptions and the company’s most critical processes. Given that, focus on the 10-15 most important processes instead of providing an encyclopedic overview.

• Elements of the report: The BIA should contain an executive summary, identification of scope and objectives, description of methodologies, discussion of findings, recommendations, and an appendix with supporting documents such as the survey(s) used, interview questions, and the names of those interviewed.
• Language and readability: While the BIA team will be familiar with the terminology and concepts used in the report by the time it’s completed, the same will not be true for its audience, which will consist of executives with different backgrounds and specialties within the company. Make sure to define all jargon, explain the ideas used, and clearly label figures and charts containing quantitative data.

Step 5: Post-BIA actions

It might be tempting to breathe a sigh of relief once the BIA is submitted and assume you can return to your normally scheduled work life. In some fundamental ways, though, the real work is just beginning.

Tips for actions after the BIA is submitted:

The BIA is not just a descriptive document — this is how much disaster X will cost the company — but as an impact analysis tool, it also provides key information for ongoing risk assessment and contingency management planning.

• Implementing recommendations: What your company does with the BIA’s recommendations is critical and will ideally lead to related activities such as a follow-up gap analysis or feasibility study.
• Scheduling the next BIA: The BIA is not a one-and-done project. At best, it provides a snapshot of potential financial liabilities and critical processes at one point in time. Be prepared to conduct BIAs on an annual basis to generate updated findings, because no business is static.

Generating your BIA

Working through the business impact analysis steps above will produce the most actionable results possible for your organization and its change management plan.

In addition, while there is no standardized method for producing a BIA, if you decide to generate your own, using the best project management software will make your efforts as efficient and useful as possible.