The Business Impact Assessment Process

Abstract

Why business impact assessment? The reason that the business impact assessment (BIA) element of the business continuity planning (BCP) methodology takes on such significance is that it sets the stage for shaping a business-oriented judgment concerning the appropriation of resources for recovery planning efforts. Our experiences in this area have shown that, all too often, recovery alternative decisions such as hot sites, duplicate facilities, materials stockpiling, etc. are based on emotional motivations, and not on the results of a thorough business impact assessment. The bottomline in performing BIAs is the requirement to obtain a firm and formal agreement from the management group as to precise maximum tolerable downtimes (MTD). The formalized MTDs must be communicated to each business unit and support service organization (i.e., IT, Network Management, Facilities, etc.) that support the business units, so that realistic recovery alternatives can be acquired and recovery measures developed.