<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=138560526769886&amp;ev=PageView&amp;noscript=1">

How to Create a Business Impact Analysis

The Headlines, DRaaS, Disaster Recovery, DR Plan, Disaster Recovery Plan, Business Impact Analysis, BIA, Downtime, Risk Assessment

Magnifying glass and documents with analytics data lying on wood table

Creating a disaster recovery (DR) plan is a key part of protecting your business from the cost of downtime, but in order for that DR plan to be effective, the first step you need to take is conducting a Business Impact Analysis (BIA).

What disaster scenarios could your business survive and for how long? What costs couldn’t you survive? Where do you draw the line of tolerable risk? A BIA aims to reveal the most critical parts of your business’s operations and to what extent a disruption of these areas could cause harm.

The words "Business Impact Analysis (BIA)" and a definition of BIA on a yellow and gray background

A BIA is not a plan of action—that’s what your DR plan is for. Instead, a BIA serves to inform your DR plan of what goals it needs to achieve and what areas of your business need the most protection. The best DR plans will start with conducting a BIA.

Ready to create your business impact analysis? This blog shares four steps to help get you started.

The words "Business impact analysis" (BIA) written on a black notebook sitting on top of documents on an office desk with a keyboard

4 Steps to Create a Business Impact Analysis


1. Plan, Prepare, and Communicate

To avoid hitting any roadblocks as you conduct your BIA, take time to prepare. Create a roadmap for how you will execute your BIA, mapping your goals and ensuring execs are onboard with your plans. Determine how you will gather and interpret both qualitative and quantitative data, including through surveys and interviews.

Everyone involved in your BIA should to be informed as to why you’re conducting the BIA, why it’s important, and how they’ll play a part. If possible, hold a kickoff meeting to answer questions and ensure everyone has a solid understanding of their roles and responsibilities.

Identify the key individuals and leaders in your business that you will interview and gather information from. Consider those with critical roles and subject matter expertise in your business, as well as those who work hands-on in key areas.

 Color-coded file folders for a business with a close-up on a tab reading the word "Risks"

Any information you can gather about your business’s finances, processes, and employees prior to conducting interviews will help you determine the focus of your questions. Utilize questionnaires and surveys to gain a solid starting ground.

You may also decide to conduct a Risk Assessment before conducting your BIA which aims to specifically identify what types of risks and hazards your business might face.

2. Gather Information

With a solid plan and a green light from execs, it’s time to start the interviews with these goals in mind:

  • Determine the most important processes, roles, and resources in your business
  • Learn what would happen if those critical responsibilities were unable to be carried out
  • Consider how various different disasters (natural disaster, human error, cyber threats, etc.) might impact your business, to what degree, and in what ways

Allow interviewees to review documented information afterward and suggest edits to ensure accuracy if necessary.

Two business partners discussing documents, data, and ideas at meeting

3. Document and Interpret Data

Gather all collected data into a formal document, check it for errors, and complete any further information-gathering that you may find necessary. Once everything is in order, it’s time to draw conclusions from your data:

  • Determine the resources most important to your business, prioritizing them from most to least important
  • Determine the minimum requirements for your business to become operable again after disaster
  • Determine your tolerance for how long can you go without these resources (RTO, or Recovery Time Objective) and how much data you can afford to lose (RPO, or Recovery Point Objective)
  • Determine how much you could be financially impacted by downtime
  • Determine vulnerabilities that your business would benefit from addressing

In your documentation, include any tables, graphs, charts, or other quantifiable information that highlights your potential for loss.

4. Use Your BIA to Create a Solid DR Plan

Once your BIA is complete, what do you do with that information? The most important thing is to get started on creating a successful DR plan to mitigate the vulnerabilities you’ve discovered.

But even if you wait to create your DR plan, you can still use the information from your BIA to help in disaster. Rather than scrambling to make decisions, you’ll know the most important parts of your business to focus on recovering.

Plus, by knowing how much a disaster can cost your business, a BIA can also help you calculate the cost-effectiveness of a DR solution like DRaaS and whether investing now will save you more down the line.

Want to Learn More About DR?

BIA’s take time and effort, but are well worth it in terms of how it can inform your DR plan and save you from losses down the line.

Want to ensure your business is protected by the best solutions in Disaster Recovery? Download our Disaster Recovery Guide for a detailed breakdown of all your DR options to help you find the best solution for your business.


July 30, 2018 / by Dane Dittemore