Conducting a Business Impact Analysis

It is 2020.  Here is what we have learned:  giant murder hornets are coming, we all love Hamilton, and if something can go wrong, it will.  We have now come to expect the unexpected.  And this is a great thing in terms of business continuity, especially when it comes to conducting a business impact analysis.

Business impact analysis (BIA) is a way to predict the consequences of disruptions to a business and its processes by collecting data which is then used to develop strategies for the business to recover in the case of emergency.  All “what ifs” are explored and possible threats and disruptions are identified.  These can be as simple as delays in the supply chain and as complex as to what happens if there is a hurricane that knocks out your power in the middle of a pandemic and then the murder hornets invade.  The list of possibilities is usually long (and may or may not always include the murder hornets), but it is key to explore all possible threats thoroughly in order to best assess risk. By identifying these possible threat scenarios, a business can then get to work addressing each one in order to either prevent them entirely or to come up with plans for recovery and mitigation strategies.

The BIA should identify the operational and financial impacts resulting from disruptions to business functions and processes. It is also important to consider that these operational and financial impacts can vary based upon the timing of the disaster events.  A disruption to your business just as things are ramping up for your “busy” season will obviously mean a greater financial loss than if the disaster occurs during a time of year where your business is more stagnant. A BIA will also help you identify which areas of your business must be prioritized in order to maintain business continuity.

A BIA should consider the impacts of the following based upon the identified risks:

• Loss of revenue
• Delayed sales or slower sales cycles
• Increased expenses
• Changes in regulations due to certain disasters and the costs associated with adhering to the new regulations
• Customer dissatisfaction
• Delay of new business plans or ventures

To conduct a BIA, use a simple questionnaire to survey stakeholders within the business.  Survey those with inside knowledge of how the business works, its products, and services. They should identify what the potential impacts of disruptions of service would be and what is necessary to resume business function.

With the data gathered from the BIA questionnaire, a report should then be written that documents the potential impacts resulting from business disruptions. Scenarios resulting in significant business interruption should them be assessed in terms of financial impact. These costs should then be compared with the costs for both risk prevention and possible recovery strategies. It should also prioritize the order of events for the restoration of day-to-day business operations. Business operations and processes with the greatest operational and financial impacts should be restored first.