What a BIA answers
A business impact analysis answers four questions with numbers: Which activities are critical — whose interruption hurts revenue, obligations or safety first? How does the damage grow over time — what does hour four cost versus day three? How fast must each activity recover (RTO) and how much data can you afford to lose (RPO)? And what do those activities depend on — systems, people, suppliers, facilities?
Everything downstream — plans, alternate sites, technology spend, insurance limits — is priced by these answers. Which is why a BIA built on adjectives (“critical”, “high impact”) instead of dirhams and hours quietly poisons the whole system.
The method, step by step
- 1 · List activities, not departments. “Issue invoices”, “ship orders”, “answer regulator” — units of work the business would miss, not boxes on the org chart.
- 2 · Interview the owners. One hour per activity owner beats any questionnaire. Ask what stops, who notices, and when it becomes irreversible.
- 3 · Draw the impact curve. For each activity: financial and non-financial impact at 4 hours, 24 hours, 3 days, a week and a month. The curve, not a single number, sets the recovery objective.
- 4 · Set MTPD, RTO and RPO from the curve. MTPD is where the impact becomes unacceptable; the RTO sits inside it with margin. An RTO chosen by comfort (“by end of day sounds right”) is a guess wearing a suit.
- 5 · Map dependencies. Systems, key people, suppliers, facilities per activity — then mark every single point of failure.
- 6 · Reconcile with the CFO. The cost-of-downtime figures must survive finance review. When the CFO signs the numbers, the BIA becomes an instrument of power.
Deliverable test: one table — activity, cost of a lost day, RTO, RPO, top dependencies, single points of failure. If it fits on two pages and the CFO signed it, you have a BIA. If it is forty pages of prose, you have a report.
The mistakes that sink BIAs
- Questionnaires instead of interviews. Self-assessed importance inflates everything to “critical” and the BIA loses its ranking power.
- Averaging the damage. Downtime cost is a curve. Averaging it hides the cliff — the point where clients leave and penalties trigger.
- Forgetting non-financial impact. Regulatory breach, safety, reputation: sometimes the activity with modest revenue carries the licence.
- One-and-done. The CBUAE Rulebook and NCEMA 7000 both expect the BIA refreshed as the business changes. A 2023 BIA describes a company that no longer exists.
- Skipping suppliers. If one provider can stop a critical activity, their failure is your scenario — model it.
Download the template
BIA sheet with 22 columns and a worked example: impact scored on five horizons, MTPD, RTO, RPO, MBCO, dependencies and workarounds; a Scale sheet with criteria tied to revenue, regulators and safety; a Summary sheet for approval. Xlsx.
Download xlsx (bia-template-gulf.xlsx)
One row per prioritised activity; outputs feed the recovery objectives worksheet and the continuity plan. No registration, no forms. Need it adapted to your organisation or a full programme: see how we work.
Frequently asked questions
How long does a BIA take?
For a mid-size organisation: 2-4 weeks including interviews, curves and CFO reconciliation. Longer usually means scope creep; shorter usually means questionnaires.
How is cost of downtime calculated?
Per activity: lost revenue and margin, contractual penalties, recovery overtime and expediting, regulatory exposure, and customer attrition risk — over the impact curve, from your own finance data. Precision matters less than honesty; ±20% is fine, adjectives are not.
Who should own the BIA?
The continuity or risk function runs it; activity owners supply the facts; finance validates the money; leadership signs. A BIA owned by IT alone becomes a systems inventory.
BIA or risk assessment first?
In practice, together: the BIA tells you what matters and how fast it must return; the risk assessment tells you what can take it down. NCEMA 7000 and ISO 22301 expect both.