Business continuity planning: How to conduct a Business Impact Analysis

Every business should have a business continuity plan, or BCP, in case the unexpected happens. That could be anything from a weather event knocking out telecommunications for a week, to Christmas stock stuck on a boat somewhere, or even an employee being injured at work. And while no business can – or should even try to – plan for everything, business continuity planning should form part of your ongoing business model.

But where to begin?

First, identify and analyse the risks likely to have the greatest impact on your business with a thorough Business Impact Analysis.

Get a Business Insurance quote today

What is a business continuity plan?

Business continuity planning is a document, or group of documents, describing how your business will keep functioning after a disruptive event.

What is a Business Impact Analysis?

A Business Impact Analysis, or BIA, predicts how disruptions will impact a business’ critical business functions (CBF) and what the likely outcomes of those disruptions would be. As potential loss scenarios are identified, this deep dive into your business can also offer recovery strategies, including the order in which critical functions and processes are restored. 

How do you conduct a Business Impact Analysis?

While every business is different, you should be clear about what you’re hoping to achieve. As a BIA covers many areas of your business, establishing a clear scope before you begin will help keep everything on track. The five key impact areas to think about are:

• financial
• reputational
• environmental
• regulatory, and
• production.

What are the goals or objectives of the analysis?

Once you’re clear about the scope of the BIA, what are the main objectives? These may include deciding on the following:

• The most critical business functions (CBF).
• The business impact of disruptions to CBFs.
• Acceptable limits of critical function failure.
• Minimum amount of resources needed to resume business as usual.
• The order in which functions will be recovered.

At this stage of the process, it’s likely to become clear just how inter or intra-dependent your critical business functions are on each other. This will impact the decision making process around resource allocation and recovery. 

Information gathering

The easiest way to gather all the information, or data, you need from across the business is to put together a BIA questionnaire. You can find examples online, but the main thing to remember is it doesn’t need to be complicated. Just a simple set of questions asking your people to:

• identify the potential impacts of critical failures in their part of the business,
• what would be needed to get everything back on track, and
• in what order this all needs to happen.

Review and analyse the data

Once you have all the information from the questionnaires, you need to verify its accuracy.

If you’re a sole operator or small business owner, chances are you can do this yourself. Just don’t skip this step.

If you own a larger business, you can organise face to face interviews and cross-reference with other business areas.

Now you’re ready to start sorting through the information to determine the priorities in each area and across the business. This includes establishing and estimating recovery times and resource allocation from the disruption until the full resumption of business as usual.

Create the BIA report

For larger businesses, a separate report containing all the critical information from the questionnaire should be compiled for each area of the business. The reports are to be reviewed and any adjustments or changes made. Once all these reports have been approved, the business wide BIA will be created.

Smaller businesses, however, can get away with creating just one report.

This final BIA report is an overview of all the risks, critical business functions and resource requirements. Containing all the necessary information, it will inform the BCP with recommendations based on risk levels. You should aim to conduct a BIA periodically, so you can address the changing needs of your business.  

Implementing the BIA recommendations

Once the BIA report has been prepared, it’s time to present it to employees and any other stakeholders. The report should be accurate, engaging and informative. Consider adding in some images, infographics and charts because you want people to read and use it.

Arrange face to face or remote meetings, allowing for Q&A as well as feedback regarding implementation.

Once you’ve identified, analysed and reported on your business risks, it’s time to write your business continuity plan.

Contact GIO

Read more:

• Business continuity plan (BCP) 101
• Why do I need Workers Compensation Insurance?
• The different types of Business Insurance

Insurance issued by AAI Limited ABN 48 005 297 807 trading as GIO. Read the Product Disclosure Statement before buying this insurance. Go to gio.com.au for a copy. The Target Market Determination is also available. This advice has been prepared without taking into account your particular objectives, financial situation or needs, so you should consider whether it is appropriate for you before acting on it. This information is intended to be of a general nature only. We do not accept any legal responsibility for any loss incurred as a result of reliance upon it – please make your own enquiries.