PREPARING A BUSINESS IMPACT ANALYSIS

Business impact analyses help business continuity/disaster recovery professionals identify business priorities and validate or modify them for plan development. Questionnaires must be formulated for pre-interview data gathering and/or in-person interviews. People with in-depth knowledge of and experience with the business functions being analyzed are ideal candidates for BIA interviews. In some cases it may be possible to organize interview questions into an automated survey (an example of which is BIA Professional, from SunGard Availability Services), in which the results can be captured and summarized.

Often it is useful to include an incident description for interviewees to use when answering the questions. An example of such a situation is:

• The business unit's portion of the building is completely destroyed;
• All records, data files, technology, supplies, and other support systems are lost;
• Some key personnel may not be available;
• Primary business processes will be affected immediately and for at least 30 days;
• The disaster occurs during a peak processing period for the business unit.

Incident descriptions help frame the interviewee's response so it can be in alignment with specific risks and threats.

Ultimately, the BIA's purpose is to identify, prioritize and document the relative importance of various business processes conducted by business units.

TIPS FOR PERFORMING A BUSINESS IMPACT ANALYSIS 

Keep in mind the following key tips when performing a business impact analysis:

1. Get the support of senior management. Given the nature of BIAs, and the time needed for research, be sure to obtain senior management support so that your project goals can be achieved
2. Take the business impact analysis process seriously. Although the BIA can take a great deal of time for data gathering and analysis, its value can be essential as you develop plans. BIAs do not have to be dozens of pages long. They simply need the right information, and that information should be current and accurate.
3. There are no formal BIA standards. Despite many business continuity standards available in the U.S., no formal standards exist for BIAs.
4. Keep it simple. Gathering the right information is critical; the associated template provides a baseline for information to be gathered. If a one-page business impact analysis summary provides the relevant information, versus one with dozens of pages, it can be perfectly acceptable
5. Review results with business units. Once the plan is complete, review the findings with business units leaders to make sure your assumptions arte correct
6. Be flexible. The suggested template in this article may be too complex for some organizations; feel free to modify it as you see fit to accomplish your goals.

USING OUR BUSINESS IMPACT ANALYSIS TEMPLATE 

Next, we'll examine the structure and content of the template, indicating key issues to address and activities to perform. This can be easily organized and managed via standard spreadsheets.

1. Business unit name: Enter the business unit name
2. Head count: Enter the number of full-time staff in the business unit, optionally, part-time and contractors, if applicable
3. Parent process: Describe the principal activities the unit performs, e.g., sales, contractor interface, or investor relationship management
4. Priority ranking: Enter a number here for subjective ranking of process importance
5. Recovery time objective: Enter a time frame, e.g., one hour, one week in this section; it describes the time a parent process must return to "business almost as usual" following a disruption
6. Recovery point objective: Enter a time frame, e.g., one hour, one day in this section; this is a point in time to which parent process work should be restored following a disruption
7. Parent process depends on: Enter names of organizations and/or processes the parent process depends on for normal operations
8. Parent process required by: Enter names of organizations and/or processes that depend on the parent process for normal operations
9. (Optional) Sub-process: Enter description of supporting activities the unit performs, e.g., sales analysis, financial analysis