What is business impact analysis?

Business impact analysis (BIA)

it is important for every organisation to have appropriate time-tested processes and techniques in place for a sound business impact analysis, says Astro Strategist and Business Astrologer Hirav Shah.

Businesses cannot avoid disruptions in the form of mishaps, disasters, etc. There could be financial disruptions too. Business impact analysis (BIA) is the process to determine and evaluate the effects needed to develop recovery strategies due to such disruptions that are critical to the functioning of a business. However, BIA is not similar to risk assessment and is done prior to risk assessment by either in-house or outsourced business analysts.

Business impact analysis or BIA is a process to determine and evaluate the potential effects needed to develop recovery strategies due to a disruption to critical business operations or a business function as a result of disaster, accident or emergency. Problems, setbacks, disruptions are bound to happen. While one cannot prevent them from happening, one can take steps to mitigate the effects of a disaster or other troublesome events. Businesses too need this approach as a disrupted business can impact hundreds or even thousands of people by causing breaks in supply chains and economies.

Business impact examples could be as simple as a broken door or as complex as a terrorist attack or as common as a competitor trying to eat into your market share. BIA is an essential component of an organization’s business continuance plan. However, at the very outset, one has to be clear that BIA is different from risk assessment.

However, both business impact analysis and risk assessment are two important steps in business continuity plan. A BIA takes place prior to risk assessment and focuses on the consequences of the interruption to critical business functions and attempts to quantify the financial and non-financial costs associated with a disaster. A BIA is the starting point for disaster recovery strategy and examines recovery time objectives or RTOs and recovery point objectives or RPOs, resources and materials needed for business continuance.

On the other hand, risk assessment identifies potential hazards such as earthquakes, hurricanes, fires, utility outages, cyber attacks and evaluates areas of vulnerability. Assets put at risk include people, property, supply chain, information technology, business reputation, etc. In the assessment, assets more prone to harm are reviewed and a mitigation strategy is developed to reduce the impact that a hazard could have.

Types of BIA (Business Impact Analysis)

Basic BIA: The basic BIA is a shortened version of a comprehensive BIA and is applicable for less critical systems and applications. It means that these can be restored later than 24 hours after the problem or disaster happens.

Comprehensive BIA: Comprehensive BIA is the full business analysis conducted for all critical systems or applications that need to be restored before 24 hours once disruption happens.

Kinds of business impacts that necessitate BIA

Most common impacts include

1) Customer dissatisfaction or loss
2) Delays in implementation of new business plans
3) Contractual penalties or loss of bonuses associated with contracts
4) Increase in expenses such as overtime, outsourcing, expediting costs, etc.
5) Lost sales and income
6) Regulatory fines

The impacts are associated with business disruption scenarios

Physical damage to company building
Equipment, machinery or systems breakdown or damage
Restricted access to a necessary site or building
Supply chain interruption including supplier failure and disruption of goods delivery from the supplier
Utility outage. For example: power
Corruption, damage or loss of IT assets including applications, computers, data, networks, operating systems, servers, voice and data communication systems
Core employee absenteeism

Five elements of business impact analysis or critical business processes

A good or effective BIA comprises five elements – executive sponsorship, understanding the organization, BIA tools, BIA processes and BIA findings. Find the business analysis steps listed below:

Executive sponsorship

As simple or obvious as it may sound, creating and conducting a business impact analysis requires support from the executives in the organisation. Without management support, the analysis is bound to fail and the efforts would go to waste. On the other hand, executive backing will provide you with the necessary cooperation and priority with other departments within the organization. The best way to get management support is by having top down communication. It could be in the form of an email or managers’ meeting. It is vital to stress the importance of BIA in keeping the business up and running in case of a disaster.

Understand the organization

Identify all critical business functions and processes that your organization performs. Check out company’s organizational structure, divisions and departments to identify key contacts or subject matter experts who can help you find and learn about the processes that will be impacted by a disaster. However, it has to be remembered that business processes, systems and functions should be considered critical if the failure to perform them would result in unacceptable damage to the organization.

Business impact analysis tools

BIA tools are indispensable for a successful analysis. These tools come into the picture once you have completed the review of the business and understood what each process, function and system plays in day-to-day operations. Tools such as organizational charts, interviews, questionnaires, data flow diagrams and BIA software can be used to gather data to analyse the potential impact of a mishap or disaster on the business.

Business impact analysis process

Now, it’s time to list out each business process and function using the business impact analysis tools. Put each process into either of the two subheads – critical and non-critical – to conduct business. Then make a list of personnel who must be in place to perform these functions. For all critical functions, get detailed information about how each one is performed, who performs it and the operational and functional impact of interruption to each of the listed functions on the first day of disruption. Continue to do this for after one week, after 30 days of interruption and so on. Once done, determine a target recovery date for each process, business critical function and business system.

The next crucial step is to identify internal and external business dependencies. For example, make a list of vendors who need to be alerted about your situation or temporary location, etc. And last but not the least, assign a safe place for all the BIA data to be stored in a safe place for future reference in case of a disaster.

Business impact analysis findings

The last element in the list is to confirm business impact meaning and conclusion with department managers or key personnel to make sure what you have determined is accurate and realistic. Present BIA findings to the executive management team for approval to use the findings to develop business recovery strategies.

Once the responsible team finishes BIA, the findings are made available through a business impact analysis report.

Who conducts business impact analysis?

Usually, most organisations outsource business impact analysis to third-party consulting providers. However, businesses that want to conduct an in-house BIA must employ a business continuity manager and or representatives from IT or related areas, such as a business analyst. Here, it has to be mentioned that business impact analysts are particularly relevant as they have business analysis techniques at their disposal. Apart from business analysts or analysts, the organization should also have a team of people in place that include the business owner or representative, technical application manager, individuals with relevant system or application expertise. The team members are referred to as subject matter experts or SMEs.

Business analysis techniques used by business analysts

MOST Technique

Most is mission, objectives, strategies in short. It allows business analysts to perform thorough internal analysis of what is the aim of an organization, how to achieve it and how to tackle such issues.

PESTLE Technique

Pestle stands for political, economic, sociological, technological, legal, and environmental. This model helps business analysts to evaluate all the external factors which can possibly impact the organization and determine how to address them.

SWOT Technique

SWOT stands for strengths, weaknesses, opportunities and threats. This technique helps one to find areas of strength and weakness. It also allows for the proper allocation of resources.

MoSCoW Technique

Must or should, could or would process is the long form of MosCow. This technique allows prioritization of requirements by presenting a framework in which every individual requirement should be evaluated relative to the others.

CATWOE Technique

CATWOE is an acronym for customers, actors, transformation process, world view, owner, and environmental. This technique helps the business analysts to recognize processes that may be affected by any action the business undertakes.

The 5 Whys Technique

This technique is a backbone of both Six Sigma and business analysis techniques. It consists of leading questions that allow business analysts to single out the root cause of an issue by asking why such a situation arises.

An example of a problem is: The vehicle will not start.

Why? – The battery is dead. (First why)
Why? – The alternator is not functioning. (Second why)
Why? – The alternator belt has broken. (Third why)
Why? – The alternator belt was well beyond its useful service life and not replaced. (Fourth why)
Why? – The vehicle was not maintained according to the recommended service schedule. (Fifth why, a root cause)

Anther exmplae: Nokia phones, kodak film rolls, tape recoreds, VCRs etc businesses in demand.

Why? – … (First why)
Why? – …(Second why)
Why? – … (Third why)
Why? – … (Fourth why)
Why? – The ignorance of new technology and not adapting to changing market needs (Fifth why, a root cause)

Six Thinking Hats Technique

This process helps the business analysts consider alternate perspectives and ideas. The ‘six hats’ in a technique are categorized as:

Green — creative thinking
Blue — talk about big-picture overview
White — logical, data-driven thinking
Yellow — positive thinking, with focus on pros
Red — emotion-based reactions
Black — opposing thinking that is focused on cons.

Financial impact analysis

Financial impact analysis calculates the expected flow of expenditures and revenues in terms of a project or program, which is useful to assess its economic feasibility. The tool helps project initial affordability or up-front investment required and ongoing economic feasibility which is year-to-year cash flow to meet ongoing operations, maintenance and debt service requirements. Financial feasibility acquires significance as it is useful to establish a ‘business case’ for a project.