What it means
A business impact analysis, or BIA, examines what happens when a process, service, system, facility, supplier, or workforce capability becomes unavailable or unreliable. It translates technical disruption into operational, financial, legal, safety, customer, and reputational consequences over time.
How it works
The analysis identifies critical activities, peak periods, upstream and downstream dependencies, required data, minimum staffing, acceptable workarounds, and time-based impact. Its outputs commonly inform maximum tolerable downtime, recovery time and recovery point objectives, recovery sequencing, alternate procedures, and investment decisions.
A payroll platform may tolerate a brief interruption most days but become time-critical near a processing deadline. The BIA captures that timing and the dependencies on identity services, banking interfaces, accurate employee data, and trained staff.
Practical focus
- Interview process owners and validate assumptions with technical teams
- Describe impact at multiple outage durations rather than using one static rating
- Record dependencies on people, data, facilities, vendors, and communications
- Revisit the analysis after major business or architecture changes
Common mistakes
- Allowing IT alone to assign business priorities
- Treating every system as equally critical
- Setting recovery targets without considering the cost and feasibility of meeting them
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: