Business Impact Analysis- Guide to Uncovering Risks in an Organization

Business Impact Analysis August 11, 2020

Jin Hyun

Writer

While many of today's businesses are more technologically advanced, automated, and data-driven than ever before, they are still not immune to the perennial problem of disruption.

From natural disasters and utility failures to willful damage and cybersecurity attacks, disruptive events can wreak havoc on any organization's operations. The company's response to these disruptions can either fix the situation or make things worse, depending on how they handle the crisis.

This is where a business impact analysis comes in. BIA is a tool that helps organizations of all sizes ensure business continuity during times of crisis, providing a framework for identifying and evaluating the effects of disruption.

Business Impact Analysis Explained

A business impact analysis is a systematic process of predicting how disruptive events affect an organization and its business operations. A BIA must also identify the operational and financial impacts caused by the disruption. These can include-

Loss of sales/income
Customer dissatisfaction
Loss of customers
Additional expenses (e.g., equipment repairs, employee overtime)
Failure to comply with regulations, resulting in fines
Slowdown in production

The analysis must provide a clear overview of the company's critical business processes, such as inventory, recruitment, and procurement among others, and the interdependent systems required (e.g., IT systems, human resources, utilities) to keep these processes running.

As a component of business continuity planning, a BIA seeks to gather as much data about potentially disruptive events and the vulnerable systems within a company to develop a range of recovery strategies.

Apart from describing crisis scenarios, a BIA must also plan for the timing and duration of the disruption and its estimated recovery time. For example, a loss of inventory caused by theft or damage during the busiest time of the year can naturally lead to lower sales. Businesses can consider the different outcomes within this scenario and formulate a possible contingency plan.

These risks and their corresponding strategies are then outlined in a business impact analysis report.

Common Problems Addressed by a Business Impact Analysis

According to the BCI Horizon Scan Report 2020 by the Business Continuity Institute (BCI), the five leading causes of company disruption over the past 12 months involved-

Health incidents
IT and telecom outage
Safety incidents
A lack of talent and people with critical skills
Cyberattacks and data breaches

However, contrary to popular belief, a BIA does not plan for every possible disruption. The point of the analysis isn't so much about dealing with a specific situation as it is about identifying the organization's most critical processes and developing a plan to ensure their continuity no matter the crisis.

For the sake of simplicity, a BIA can plan for certain types of events that have similar effects on businesses-

Accidents - Examples of accidents include equipment breakdowns or malfunctions (especially those that result in workplace injuries), toxic leaks and emissions, environmental dangers, fires, explosions, and malfunctions caused by human error among others.

Natural Disasters - Natural events like storms, hurricanes, wildfires, earthquakes, volcanic activity, droughts, and snowstorms/blizzards can cause businesses in an entire city or region to suspend or limit operations.

Emergencies - Emergencies tend to affect a single location or organization. They include utility and power outages, chronic tardiness and absenteeism, information technology infrastructure breakdowns, cybersecurity attacks, supply chain disruptions, stock shortages, supplier conflicts, government intervention (e.g., foreclosures, factory closures after failed inspections), and political strife (e.g., protests, riots, terrorist activity).

When conducting a BIA, a business should customize its analysis to the organization's specific circumstances. For example, during the risk assessment phase, an eCommerce retailer should focus on risks such as server downtime and electronic fraud. In contrast, a brick-and-mortar store will anticipate risks involving in-store theft, accidents, and natural disasters since it occupies a physical location.

4 Primary Types of Business Impact Analysis

Due to the complexity and breadth of information that goes into conducting a BIA, it's a good idea to plan at different levels of the business. Although there are different schools of thought on the types of impact analyses that organizations can use, they often boil down to the following four BIA types-

Initial Analysis - This high-level analysis helps set the foundation for deeper and more comprehensive analyses in the future.

Product Analysis - This type of BIA seeks to identify the company's products and services and their vulnerability to disruption.

Process Analysis - This BIA focuses on the processes, workflows, and systems that support the creation and delivery of products and services.

Activity Analysis - This BIA takes a granular assessment of the activities required to provide products and services to customers.

4 Steps to Conduct a Business Impact Analysis

steps to conduct a business impact analysis 1597178113 8964

While there are no concrete standards on how to conduct a BIA, most methodologies are composed of four basic components- data gathering, data analysis, documenting the findings, and presentation of findings. Here is a closer look at this multi-stage process.

1. Data Gathering

Many BIA teams make the mistake of trying to do too many things all at once in the data gathering phase of their analysis. A good strategy is to focus on four operations factors present in almost any business process-

Facilities
People
Tools and Equipment
Materials and Suppliers

From here, it's simply a matter of creating a list of the top 10 to 20 most important business processes in the organization and gathering information on how a potential disruption would affect these four factors. Generally speaking, there are two ways to do this-

Qualitative Data Collection - This comes from in-person interviews, focus group discussions, and surveys.

Quantitative Data Collection - Metrics such as maximum tolerable outage (MTO) and recovery time objective (RTO) reflect the amount of time that processes and systems can stay down before an undesirable effect occurs.

This approach allows the company's leadership to understand how the business operates from the ground up, making it easier to picture how disruptive events affect the individual cogs of a process.

2. Data Analysis

Data gathered in the first stage of BIA is analyzed, typically using project management and business continuity tools. The BIA team will then aim to accomplish the following-

Determine the Interdependency of Processes and Workflows - For example, in the event of a fire, a graphic design firm can continue operations by allowing its employees to work from home. But productivity may suffer without an existing remote work policy guiding employees through their work-from-home setup.

Identify Requirements For Optimal Productivity - What does the organization need to maintain normal operations under optimal and suboptimal conditions? Be sure to cover variables such as staff, raw materials, power, suppliers, and equipment among others.

Quantify the Effect of Disruption - Aside from assessing the financial cost of an adverse event, the BIA team should also account for the hidden effects like damage to reputation, damage to morale, data loss, and productivity loss.

Organize Business Functions by Importance - By identifying the functions with the greatest impact on business operations, financial performance, and compliance, the BIA team will know what mission-critical processes to preserve during a disruption.

Plan For Recovery - The BIA team will identify the time, resources, and staffing costs required to recover from a disruption.

Identify Process Vulnerability - This involves identifying vulnerabilities of processes, workflows, and systems and finding ways to protect them from disruptive events.

3. Documenting the Findings of the Analysis

The findings of the BIA will now be compiled in a BIA report. Along the way, the BIA team can also present the preliminary findings of their analysis to the key people they interviewed in the data-gathering stage, allowing them to review and confirm the outcomes.

The contents of a BIA report will vary from company to company, but it should at least have these components-

Executive summary
Scope and objectives
Overview of methodologies used
Discussion of findings
Summary and recommendations
Supporting documents (e.g., transcripts of interviews, screenshots of metrics)

More importantly, the BIA report must be actionable. The report should describe the details of disruptive events and how they affect the organization's specific processes. For the BIA to be a helpful business continuity tool, it should establish the acceptable duration of downtime, acceptable losses, and plan for recovery.

4. Presentation of Findings

Finally, the BIA report is presented to the company's leadership for their review. Leaders may want the full report to be presented and distributed simultaneously, or delivered days in advance to give them time to digest its contents and prepare questions for the actual presentation.

During the presentation, the BIA team must highlight the vulnerabilities and recovery plans for the organization's most important business functions. The goal is to create organizational buy-in, helping leaders understand the necessity of the BIA and a business continuity plan.

Reasons to Regularly Conduct a Business Impact Analysis

reasons to conduct a regular business impact analysis 1597178113 8042

For business owners and managers still on the fence about the value of conducting a BIA, below are a few specific reasons why they are crucial to organizational success.

Proactive Planning - Conducting a BIA helps the business take a more proactive approach to crisis management. Planning for disruptions is often safer and more efficient than reacting to them as they happen.

Better Understanding of Critical Processes - Before any recovery measures can be created, the BIA team needs to develop a better understanding of the functions that allow the company to operate smoothly. The benefits of discovering these insights go beyond the BIA itself. For example, the analysis can provide inventory managers with information about the true financial cost of stockouts and carrying excess inventory.

Prioritize Business Functions - By uncovering the organization's mission-critical functions, business leaders will know which processes to bolster and protect from disruption. This ensures that during a crisis, any degradation of critical processes is within tolerable limits.

Much can happen to an organization over time, making it imperative to regularly update the BIA. A good rule of thumb is to conduct another impact assessment and analysis after two years. However, smaller businesses that experience fewer changes can get away with longer intervals. Conversely, organizations that are prone to disruption, like banks, may require more frequent analyses.

The Relationship Between Business Impact Analysis and Forecasting

In many ways, a BIA and a business forecast share similar goals.

Both attempt to predict specific outcomes in the future based on different variables within the organization and outside of it. However, the integration of risk and impact assessments into forecasting and planning has allowed business owners and managers to have a more robust and transparent evaluation of disruptive events. This, in turn, has helped to create forecasts that take into account the volatile conditions organizations can find themselves in at any given point in time.

The use of BIAs has also made it possible for organizations to go beyond simply predicting budgets, sales, and inventory based on historical performance and future conditions. With BIAs, business leaders can also take the necessary steps to ensure that, even if a disruptive event happens, the company is still in the proper condition for previous forecasts to be reliable.

Any business can be disrupted by accidents, emergencies, and natural disasters. However, a BIA isn't about preventing these events. When done right, a BIA can be a powerful risk management tool, helping businesses control the impact of the disruption.