Conduct a business impact analysis

Once you have developed a risk management plan, you can conduct a business impact analysis to assess the likely impact of these risks on your business operations. This is the preparedness step in the prevention, preparedness, response and recovery (PPRR) model for developing a business continuity plan.

Critical business activities

A business impact analysis identifies the activities in your business operations that are key to its survival. These are referred to as critical business activities. You should consider things such as:

  • the records and documents you need everyday
  • the resources and equipment you need to operate
  • the access you need to your premises
  • the skills and knowledge your staff have that you need to run your business
  • external stakeholders you rely on or who rely on you
  • the legal obligations you are required to meet
  • the impact of ceasing to perform critical business activities
  • how long your business can survive without performing these activities.

As part of your business impact analysis, you should assign recovery time objectives to each activity to help determine your basic recovery requirements. The recovery time objective is the time from when an incident happens to the time that the critical business activity must be fully operational in order to avoid damage to your business.

Your business impact analysis will help you develop your recovery plan, which will help you get your business running again if an incident does happen.

Key questions in a business impact analysis

To conduct a business impact analysis for your business, ask yourself:

  • What are the daily activities conducted in each area of my business?
  • What are the long-term or ongoing activities performed by each area of my business?
  • What are the potential losses if these business activities could not be provided?
  • How long could each business activity be unavailable for (either completely or partially) before my business would suffer?
  • Do these activities depend on any outside services or products?
  • How important are the activities to my business? For example, on a scale of 1 to 5 (1 being the most important and 5 being the least important), where would each activity fall in relation to the rest of the business?

As the risks to your business change, so too will their potential impacts. When you update your risk management plan, you will also need to conduct a new business impact analysis.

Also consider...