Companies may not consider the interdependencies between critical operations, departments, personnel, and services until an event disrupts normal operations. A Business Impact Analysis (BIA), a key component in business continuity planning, presents the ability to identify and quantify which business unit that, when absent, would significantly impact a company. While the size and complexity of essential business elements required for sustainability varies among industries, companies, and specific facilities, the ability to quantify and prioritize critical workflow components is a key business continuity element.
Critical business units, associated functions, and a trained workforce provide the greatest financial value to companies. Companies that prioritize process sustainability initiatives that can meet recovery time objectives have a better chance of minimizing impacts of impeding disruptions.
Within each key business unit, additional business functions should be considered and evaluated. By identifying cross business unit dependencies, the need for integrated risk mitigation solutions can be highlighted and proactive measures can be taken. A workflow analysis may prioritize those business functions and processes that must be recovered in order for business continuity plans to be effective. Functions within each business unit may include, but are not limited to:
- Supply and trading
- Personnel and payroll
- Accounts payable
- Environmental health and safety
- Information technology
Once critical business functions and workflows are assessed and prioritized, a BIA should be performed. The goal of the analysis should be to identify the potential impacts of identified risks, uncontrolled threats, and potential non-specific events on these business functions and dynamic processes. Any potential resilience capabilities should be prioritized and mitigation opportunities should be examined. Operational and process managers should explore and quantify the following aspects to initiate the BIA process:
- Identify critical operational time periods when an interruption would have greater impacts (seasonal, end of quarter, specific month, etc.).
- Priorities should be determined if an interruption during high-output timeframes creates amplified operational and financial impacts.
- Indicate how likely each specific threat could occur, considering existing capabilities, mitigation measures, and history.
- Identify the duration and point in time when an interruption would impair operational processes and have financial impact.
- Estimate the maximum allowable downtime for each specific business function
- Consider downtime impacts from less than 1 hour to greater than one month
- Identify staffing level requirements (including contractors or suppliers) to meet typical daily productivity goals, as well as recovery time objectives.
- Identify the effects associated with a business unit interruption, considering existing mitigation measures. These may include, but are not limited to:
- Lost sales and income
- Negative cash flow resulting from delayed sales or income
- Increased expenses due to overtime, outsourcing or other operations that increase costs
- Regulatory fines and legal implications
- Contractual penalties or loss of contractual bonuses
- Customer dissatisfaction or withdrawal
- Delay of business plan execution or strategic initiatives
- Identify the time frame necessary to recover specific critical processes under existing capabilities and, if possible, potentially altered conditions.
- Determine and quantify financial impacts, considering existing mitigation measures.
- Critical functions that have the highest financial impacts should be prioritized in business continuity plans.
If a business continuity incident affects two or more business processes, the incident has a greater potential for impact. Interoperable communication and coordination among departments must be exercised for a swift recovery. The effects of a multi-tiered business continuity event can extend beyond the facility borders to affect personnel, multiple critical business processes, vendors or suppliers, and customers.
Adverse information technology (IT) conditions may affect numerous company departments, units and functions. IT components may include networks, servers, desktop and laptop computers and wireless devices. The ability to utilize both office productivity and enterprise-wide software may be essential to restore normal operations. Therefore, time critical recovery strategies for information technology, such as exercised data backup and restoration procedures, should be developed in order to limit the effects of interruptions across multiple business units.
Once critical business units are identified and the BIA is completed, companies can develop an applicable business continuity plan, ensuring a faster state of recovery.