Business Impact Analysis Key to Disaster Recovery Planning

Conducting Business Impact Analysis (BIA) is key to any organization looking to get a firm grasp on the effects of disruptions as a result of loss of data, loss of business, and reputation, among other things. The BIA has been known to save a business, or any organization, thousands and even millions of dollars.

In a recent interview with Business Continuity Institute board member Paul Kirvan, Bureau Chief Antony Adshead asks where a BIA fits into the disaster recovery process and the steps you should take to undertake one. The following is a quoted excerpt from Kirvan’s interview.

What is a business impact analysis, where does it fit in the Disaster Recovery (DR) process, and what are its aims?

Kirvan: “… a business impact analysis ... is the process of analyzing business functions and the effect that a business disruption might have upon them ... BIAs are usually performed after the DR project has been launched and prior to starting risk assessments. The BIA aims to identify critical business functions and the impact of a disruption to them and provides an important starting point for defining disaster recovery strategies that are used to respond to disruptive events …

Once BIAs are completed, the next step is to conduct risk assessments of the enterprise, its business units, operational infrastructure, internal and external risks and threats, and an analysis of any vulnerabilities.

What is involved in carrying out a business impact analysis?

Kirvan: BIAs require … a significant amount of data gathering, interviewing and analysis ... Research identifies activities that support the organization’s key products and services, identifies impacts resulting from the disruption to these activities, determines how these vary over time, establishes how long the organization can operate in the aftermath of a disruption, and defines the minimum operational levels the organization needs to function ...

The BIA seeks to categorize and prioritize business activities for recovery, identify all internal and external dependencies associated with critical activities, determine the amount of time required to resume critical activities, and estimate the resources that each critical activity will require for resumption of business ... A simple way to collect and organize the discovery data is to use a standard spreadsheet that can be organized to provide a place to store results of interviews, which can list each business unit and provide a detailed description of its processes; financial estimates … ; time scales for how quickly systems need to be recovered and restored; minimum inventories of office space, furniture, systems and utilities, and office supplies to resume operations; and a host of other items that need to be addressed following a disruptive event.

For more information about how Business Impact Analysis can help in disaster recovery planning, visit: