Rank
Priorities
Which services to protect and recover first.
Business impact analysis: How to run one, with an example
Find out which services matter most, and how long each can stop before the harm is too great.
What a business impact analysis is, the questions to ask, how to turn the answers into recovery targets, and a worked example for one service.
TL;DR
- A business impact analysis (BIA) works out what a disruption would do to each of your services or activities, and how that harm grows over time (NIST definition).
- It produces the numbers the rest of continuity planning runs on: a ranked list of services, how long each can stop, recovery time and recovery point objectives, and what each service depends on.
- Measure harm to customers and the market, not only lost revenue. UK and Australian regulators judge resilience by harm to customers and the financial system.
- The questions below work as a template, and the worked example shows the answers for one service.
What is a business impact analysis?
A business impact analysis (BIA) works out what a disruption to each service would do to your customers, finances and obligations over time, and how soon each must recover.
Time
Limits
How long each can stop before the harm is too great.
Needs
Dependencies
The people, systems, sites and suppliers behind each one.
What does a business impact analysis produce?
A finished business impact analysis gives you four things. Everything else in continuity planning builds on them.
A ranked list of services
Which services cause the most harm when they stop, in order. Regulators call the top of the list important business services or critical operations.
How long each can stop
The maximum tolerable period of disruption for each service: the point past which harm becomes unacceptable. Where regulated, it informs the impact tolerance.
Recovery targets
A recovery time objective and recovery point objective for each service, set inside that limit. RTO and RPO, explained.
What each service depends on
The people, processes, technology, sites, information and suppliers behind each service, so you know what has to recover together.
How do you run a business impact analysis?
Work service by service, from the customer's side. Agree what you will measure first, collect answers from the people who run each service, then turn the answers into limits, targets and a ranking.
- Set the scope and list the services. Name the services you provide to customers, not the departments that provide them. Which services count.
- Choose what to measure and when. Pick the impact areas (customers, finances, legal and regulatory, reputation, staff) and the time points (for example one hour, four hours, a day, three days and a week).
- Collect the answers. A short workshop with the people who run each service usually gets better answers than a long questionnaire. The questions below are a starting set.
- Find the point of intolerable harm. For each service, the time point where the harm becomes unacceptable sets its maximum tolerable period of disruption.
- Set recovery targets inside it. A recovery time objective and recovery point objective for each service, with room to spare. How to set RTO and RPO.
- Map the dependencies. Record what each service needs to run, down to the supplier, and mark the single points of failure.
- Rank, agree and review. Rank the services, have their owners and senior management agree the results, and review the analysis at least once a year and after a significant change such as a new product, system or supplier.
What questions should a business impact analysis ask?
Use these as a template for each service. Ask them in a workshop with the people who run it, and record the answers.
The service
What does this service do for customers, and how many use it?
Are any of them vulnerable, or unable to switch to another provider?
When is it busiest: time of day, month end, seasonal peaks?
The harm over time
What happens to customers after one hour, four hours, a day, three days and a week?
At which point does the harm become unacceptable?
What would it cost, and when would the board, a regulator or the press need to know?
The data
How much data could the service lose and still be rebuilt, and how?
Which records, if lost, would harm a customer directly?
How often is the data copied today, and has a restore been tested?
What it depends on
Which people and skills, systems, sites and information does it need?
Which suppliers sit behind it, and what recovery times do their contracts set?
Which of these has no alternative if it fails?
What does a business impact analysis look like for one service?
An illustrative analysis for one service at a fictional building society: members making payments from their current accounts, the same service as the RTO and RPO example. The numbers show the shape of the work, not recommended levels.
- After one hour: card and online payments queue and some members call in. Harm is low.
- After four hours: members miss same-day payments, calls and complaints rise, and the contact centre is stretched.
- After one day: members cannot pay rent or bills and some face late fees. The disruption is one the board must hear about. This is the point of intolerable harm.
- After three days: vulnerable members are seriously harmed and the backlog takes days to clear.
What the analysis produces for this service:
- Ranking: first of the society's services.
- Maximum tolerable period of disruption: 24 hours, which becomes its impact tolerance.
- Recovery targets: core banking platform back within 8 hours; no payment instruction lost once a member has sent it.
- Dependencies: core banking platform, the payments gateway supplier, the member contact centre and the online banking app, each with its own recovery target set to fit inside the 24 hours.
How does a business impact analysis fit CPS 230 and PS21/3?
Neither regime uses the term as a requirement, but both ask for what a business impact analysis produces, judged from the customer's side.
- Australia (APRA CPS 230). Identify critical operations, and set tolerance levels for each: the maximum period of disruption, the maximum data loss and the minimum service levels while running on alternative arrangements (CPS 230). CPS 230, explained.
- UK (FCA and PRA). Identify important business services and set an impact tolerance for each. The PRA says tolerances should assume the disruption has happened, not weigh how likely it is, and that internal services such as HR or payroll are not important business services on their own (PRA SS1/21). FCA operational resilience, explained.
Three changes bring a traditional business impact analysis into line: analyse services rather than departments, measure harm to customers and the market alongside cost, and map every supplier behind each service. This is the work operational resilience software is built for; see how RunReady approaches it.
How Drova helps
RunReady, the operational resilience module of Drova's RunGood platform, starts from your important business services and critical operations, maps the processes, people, technology, facilities and third parties behind them, sets tolerances, and runs scenario tests against them. Continuity planning and recovery workflows sit inside that picture, linked to the services they protect.
The outcome: every important service mapped, held within a tolerance you have set, tested, and backed by an Operational Resilience Self-Assessment report when the board or a regulator asks.
See how RunReady links services, dependencies, tolerances and tests.
Keep the analysis connected to the services it protects
Business impact analysis, answered
Do we need a business impact analysis for CPS 230?
CPS 230 does not name it, but it asks for what one produces: your critical operations and tolerance levels for each, covering maximum downtime, maximum data loss and minimum service levels. A business impact analysis built around services, measuring harm to customers, is the usual way to get those numbers.
What is the difference between a business impact analysis and a risk assessment?
A business impact analysis asks what happens if a service stops, whatever the cause. A risk assessment asks what could cause a disruption and how likely it is. You need both: one sets the limits, the other shows what threatens them.
Is a business impact assessment the same as a business impact analysis?
Yes. Both names describe the same work, and both are shortened to BIA.
How often should a business impact analysis be done?
At least once a year, and after a significant change such as a new product, system, supplier or acquisition.
Who should be involved?
The people who run each service, with operations, technology, finance and risk. Senior management agrees the results, because the ranking decides where recovery spending goes.
Is there a business impact analysis template?
The questions on this page work as one: ask them for each service and record the answers. Small organisations starting out can also use free government templates, linked from the business continuity plan guide.
Business continuity
Explore related topics
Business continuity planning
The hub: how the continuity discipline works.
RTO and RPO
Turn the analysis into recovery targets.
Business continuity plan
The sections a plan must contain, with an annotated example.
ISO 22301
The international continuity standard.
Business continuity software
How to choose the right kind of tool.
Operational resilience
Where continuity sits in the wider picture.
Important business services
Decide which services count.
Impact tolerance
Set the limit a service must not cross.
Scenario testing
Test whether services stay within their limits.
