4.2 Conducting a Business Impact Analysis

A full Business Impact Analysis will evaluate potential loss of profit and accumulation of penalties in all business processes, caused by involuntary interruption. There are several software packages to assist in carrying out a full Business Impact Analysis.

However, if the analysis is required solely in connection with the development of a BC plan, a simpler form of BIA may be more suitable.

The main purpose of the business contingency plan is to assist in the eventual restoration of all business activity following a disaster. The primary objective of an associated BIA is to help phase the restarting of business processes, from the most vital to the most deferrable.

• Identify the key business activities and outline the minimum resources required to continue each one, adding both internal and external dependencies.
  
  Imagine that, without prior warning, access to the building has been denied, for an anticipated period of several weeks' duration.
  
  
• Chart the effect of an incident occurring at different times during the working day at, say, three hourly intervals from 1am to 10pm. Also, consider other critical days in the year.
  
  
• Work with the I.T. department to obtain the recovery times for systems and latest available data.
  
  Add these recovery times to the incident chart to determine the most disruptive (and least disruptive) times for an incident to occur, in each business process. For departments having hundreds or thousands of computer entries during the day, the worst time for a disaster is usually late in the afternoon, before the end of day back up procedure has commenced (unless transactions are mirrored to a remote site).

An early morning disaster affects the printing of daily reports, as well disrupting work during the day, while the I.T. department restores systems.