Business impact analysis is an often misunderstood component of your business continuity plan—but it doesn’t have to be.
First, let’s review business continuity planning, which is simply the creation and validation of a plan for how your business will recover critical activities after an extended disruption, such as a disaster.
Business impact analysis is one of the first steps in creating a business continuity plan in that it simply seeks to identify your business’s exposure to a sudden disruption of critical activities.
How do you conduct a business impact analysis? Many resources, including templates, are available. Let’s review the basic steps.
First, when looking at your firm’s activities and the cost of their loss during a business disruption, you’ll want to be sure you consider both financial costs and non-financial costs (such as customer service, supplier confidence, and market perception). Be sure to consider a number of possible scenarios. For example, what if your building is completely destroyed? What if some key personnel are not available? What if the disruption occurs during a peak period for your business?
Second, you’ll decide what’s critical and what’s not. An activity is probably critical if (a) its functionality is required by law, or (b) you consider its disruption unacceptable.
Third, for each critical activity, you’ll then assign two values: a recovery point objective, which is the acceptable amount of data that will be recovered, and a recovery time objective, which is the acceptable amount of time to restore the activity.
You may want to perform a business impact analysis before you create a business continuity plan—and your IT infrastructure will play a big role in both. Is your data backed up? How often? Give us a call and let us help guide you through answering these questions and developing a plan for your critical business needs.
