Business impact analysis (BIA): process, metrics and structure
What is a business impact analysis?
The business impact analysis (BIA) is the systematic examination of which business processes are critical for an organisation and what the consequences of their disruption over time are. The BIA asks how severe a disruption is and how fast the process must be back. Why something fails is a question for the risk assessment. The BIA is therefore the foundation of every BCM strategy: recovery priorities and the key target metrics are derived from it. Both ISO 22301 and NIST SP 800-34 place the BIA at the start of the BCM process: ISO 22301 requires it in clause 8.2 together with the risk assessment, NIST SP 800-34 lists it as the second step right after the contingency planning policy.
What is the aim of the BIA?
The aim of the BIA is a fact-based prioritisation. Not every process is equally important, and in a crisis resources are scarce. The BIA shows which processes must be restored first, which dependencies (IT systems, staff, service providers, sites) hang on them and from when a disruption threatens the organisation’s existence. A vague “everything is important” becomes a justified order.
How does a BIA run?
A BIA typically follows six steps:
- Define the scope: Which processes, sites and resources are considered? Clarify the boundary to the risk assessment.
- Record the processes: Record business processes and their dependencies (IT, staff, service providers, sites).
- Assess the impact over time: For each process: how does the damage grow over time (hours, days, weeks)? Financial and legal consequences and reputational damage are assessed.
- Determine criticality and MTPD: From which period of disruption does it become intolerable? That yields the priority of the processes.
- Derive RTO and RPO: Set target times for recovery and the maximum tolerable data loss per process.
- Document and approve the results: Write the BIA report, agree it with management and approve it as the basis of the BCM strategy.
Which metrics does the BIA deliver?
At the end of the BIA stand the recovery metrics. They translate the criticality of a process into concrete time targets:
| Metric | Meaning |
|---|---|
| MTPD | Maximum tolerable period of disruption: the longest period of disruption beyond which the damage threatens the organisation’s existence. |
| RTO | Recovery time objective: the target time until a process runs again after the disruption (must be below the MTPD). |
| RPO | Recovery point objective: the maximum tolerable data loss, measured as the period before the disruption. |
| MBCO | Minimum business continuity objective: the minimum level of service that must be maintained in emergency operation. |
RTO and RPO are the two most important of these values. How they differ and how to derive them is explained under RTO and RPO.
BIA and risk assessment: two perspectives
BIA and risk assessment are often confused but look at different things: the BIA is impact-oriented (what happens if process X fails?), the risk assessment cause-oriented (how likely is which threat?). Only together do they give a complete picture. The BIA sets the priorities, the risk assessment shows where prevention should start.
The BIA as a compliance element
The BIA is also anchored in regulation. NIS2 Art. 21 requires business continuity, DORA requires the analysis of critical or important functions, and ISO 22301 makes the BIA a core step of the BCMS. A properly conducted BIA therefore serves as evidence for several compliance requirements at once.
Frequently asked questions
What is a business impact analysis?
The business impact analysis (BIA) examines which business processes are critical and what the consequences of their disruption are over time. It delivers the metrics MTPD, RTO and RPO and forms the basis of every BCM strategy.
What is the difference between a BIA and a risk assessment?
The BIA asks about the consequences of a disruption (how critical is the process, how fast must it be back?), regardless of the cause. The risk assessment asks about the likelihood and the causes of specific threats. The two complement each other in BCM.
How often must the BIA be updated?
At least yearly and after significant changes to processes, IT or the organisation. Only a current BIA delivers reliable RTO/RPO values for contingency planning.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.