What a BIA answers
A business impact analysis answers four questions with numbers: Which activities are critical — whose interruption hurts revenue, obligations or safety first? How does the damage grow over time — what does hour four cost versus day three? How fast must each activity recover (RTO) and how much data can you afford to lose (RPO)? And what do those activities depend on — systems, people, suppliers, facilities?
Everything downstream — plans, alternate sites, technology spend, insurance limits — is priced by these answers. Which is why a BIA built on adjectives («critical», «high impact») instead of dirhams and hours quietly poisons the whole system.
The method, step by step
- 1 · List activities, not departments. «Issue invoices», «ship orders», «answer regulator» — units of work the business would miss, not boxes on the org chart.
- 2 · Interview the owners. One hour per activity owner beats any questionnaire. Ask what stops, who notices, and when it becomes irreversible.
- 3 · Draw the impact curve. For each activity: financial and non-financial impact at 4 hours, 24 hours, 3 days, a week. The curve, not a single number, sets the recovery objective.
- 4 · Set RTO and RPO from the curve. The RTO sits just before the curve steepens. An RTO chosen by comfort («by end of day sounds right») is a guess wearing a suit.
- 5 · Map dependencies. Systems, key people, suppliers, facilities per activity — then mark every single point of failure.
- 6 · Reconcile with the CFO. The cost-of-downtime figures must survive finance review. When the CFO signs the numbers, the BIA becomes an instrument of power.
Deliverable test: one table — activity, cost of a lost day, RTO, RPO, top dependencies, single points of failure. If it fits on two pages and the CFO signed it, you have a BIA. If it is forty pages of prose, you have a report.
The mistakes that sink BIAs
- Questionnaires instead of interviews. Self-assessed importance inflates everything to «critical» and the BIA loses its ranking power.
- Averaging the damage. Downtime cost is a curve. Averaging it hides the cliff — the point where clients leave and penalties trigger.
- Forgetting non-financial impact. Regulatory breach, safety, reputation: sometimes the activity with modest revenue carries the licence.
- One-and-done. The Rulebook and NCEMA 7000 both expect the BIA refreshed as the business changes. A 2023 BIA describes a company that no longer exists.
- Skipping suppliers. If one provider can stop a critical activity, their failure is your scenario — model it.
Frequently asked questions
How long does a BIA take?
For a mid-size organisation: 2-4 weeks including interviews, curves and CFO reconciliation. Longer usually means scope creep; shorter usually means questionnaires.
How is cost of downtime calculated?
Per activity: lost revenue and margin, contractual penalties, recovery overtime and expediting, regulatory exposure, and customer attrition risk — over the impact curve, from your own finance data. Precision matters less than honesty; ±20% is fine, adjectives are not.
Who should own the BIA?
The continuity or risk function runs it; activity owners supply the facts; finance validates the money; leadership signs. A BIA owned by IT alone becomes a systems inventory.
BIA or risk assessment first?
In practice, together: the BIA tells you what matters and how fast it must return; the risk assessment tells you what can take it down. NCEMA 7000 and ISO 22301 expect both.