Business Impact Analysis: How to Run One in 6 Steps

A business impact analysis, often shortened to BIA, answers one question: what happens to the business if this service stops? First, it ranks your services by how much damage an outage causes. Then it sets recovery targets, so your plans focus on what matters most.

Many Australian organisations skip this step and jump straight to writing plans. However, a plan built without evidence usually protects the wrong things. This guide shows how to do the analysis properly, and how it supports a business continuity plan.

Business Impact Analysis Steps: A Six-Step Method

1. List your services. Include customer services, internal functions and the systems behind them.
2. Interview the owners. Ask each owner what the service does and who depends on it.
3. Measure the impact over time. Estimate the harm after one hour, one day, one week and longer.
4. Set recovery targets. Agree a recovery time and a data loss limit for each service.
5. Map dependencies. Record the people, systems, suppliers and sites each service needs.
6. Rank and review. Sort services by priority, then have leaders confirm the result.

Keep the first round simple. A two-hour workshop per department is often enough.

What to Measure in Each Interview

Good questions produce usable numbers. For each service, ask about money, people, law and reputation. For example, how much revenue is lost per hour, which customers are affected and which contracts carry penalties?

• What is the busiest period, and what happens if it is missed?
• Which systems and suppliers does the service rely on?
• Is there a manual workaround, and for how long can staff use it?
• Are there legal or regulatory deadlines attached?

Also, ask who else would be affected. Services often depend on teams that the owner had not considered.

Recovery Targets From a Business Impact Analysis

The analysis produces three numbers for each service. Because the terms are easy to mix up, define them in your report.

• Recovery time objective (RTO): How quickly the service must be working again.
• Recovery point objective (RPO): How much recent data you can afford to lose.
• Maximum tolerable downtime: The point where the harm becomes unacceptable.

Set the recovery time well inside the tolerable downtime. Then check that your backups and suppliers can really meet it.

A Short Worked Example

Imagine a small firm with three services. Online payments cost about the most per hour, so they rank first with a four-hour target. Customer email ranks second with a one-day target. Internal reporting ranks third and can wait three days.

As a result, the firm spends its backup budget on payments first. It also writes a manual workaround for email and leaves reporting for later. That simple ranking saves money and effort.

Using the Results in Your Plans

The analysis feeds everything that follows. Your recovery strategies, your exercise scenarios and your business continuity plan template all rely on it. Similarly, a standard such as the international business continuity standard expects the analysis to be documented and reviewed.

Review the analysis every year, and after any major change. If you also manage cyber risk, a cyber compliance assessment shows how technology weaknesses could trigger the outages you have just ranked.