A Business Impact Analysis Checklist For Continuity Managers

Getting ready to launch a Business Impact Analysis (BIA) for your organization? The information it will reveal about your critical business operations and their dependencies will be foundational in your future efforts to design a good business continuity plan.

If you’re not already well-versed in the components of a BIA, review this article first. Then, use the following example (it’s what we use here at MHA) as a guide for conducting a well-organized and thorough BIA. Transfer the steps to a blank document as a kind of Business Impact Analysis template, or simply use them as a reference—whatever works for you.

A Step-By-Step Business Impact Analysis Checklist

Phase 1: Information Gathering & BIA Validation

1. Identify the scope of your BIA: How many business units will you be evaluating? If you’re just starting out, keep it small. Do what you think might be the most critical units, and, if need be, you can do additional units later.

2. Develop a good BIA questionnaire. Your questionnaire needs to cover two areas:

• The dollar and non-dollar impact on each individual business unit and its processes should a disruption occur. (What would the loss of revenue be? How would it impact our reputation and image?)
• Identifying and collecting key information about the processes associated with the business unit, including legal/regulatory requirements, computer systems, special equipment, vital records, interdependencies, etc.

The BIA questionnaire should also align with authoritative standards, such as NFPA 1600. Less is more. Remember what the BIA is designed to do; don’t try to make it do more.

3. Meet with senior management. You’ll need them on board if you want the process to be successful. Explain the purpose of the Business Impact Analysis, share your plan and your questionnaire, and ask for their help and support to unite the relevant parties.

4. Ask IT for a complete list of systems and applications used company-wide. It will be helpful to refer to this list as you’re conducting the BIA interviews. It’s entirely possible that IT will need to generate this list, as they may not have one on hand.

5. Identify subject matter experts (SMEs) from the business units you selected. Managers may be present at interviews, but ideally your SMEs should be people who actually work with the processes.

6. Identify an IT representative for each BIA interview. It’s helpful to have someone from IT present during interviews to help clarify the names of computer processes and applications in case your SMEs don’t know. They also sometimes provide additional input that may be valuable.

7. Schedule BIA interviews. Work with your business unit and IT SMEs to coordinate time frames and schedules.

8. Finalize the interview logistics. This may include access to a conference room and/or online meeting software.

*9. (Optional) Schedule and conduct a kickoff meeting. It’s not required, but in some cases it’s useful to gather the team in advance of the actual interviews to give your interviewees a preview of what to expect.

Phase 2: Conducting BIA Interviews

10. Using your questionnaires, conduct BIA interviews. In-person interviews are preferable to virtual ones to encourage discussion and consideration of answers. Each business unit interview should take 2.5 hours or less and be led by an experienced facilitator. First, identify all departmental business processes. Then, for each process, identify:

• Recovery time objectives (RTOs).
• Recovery point objectives (RPOs).
• Supporting computer systems, applications, and equipment.
• Legal and regulatory requirements.
• External and internal dependencies.
• Vital records.
• Manual workarounds.
• Service level agreements, and legal and contractual requirements.

Phase 3: Validating The Interview Data

11. Review all business unit interviews for anomalies and missing data. If a particular business unit criticality or RTO doesn’t seem to make sense, review the results with the group and reassess. Be stringent! This is important if you expect management to take the results seriously.

12. Send each completed BIA questionnaire back to the business units for validation. Ask the relevant parties to review and return it with their approval. Discuss any questions or concerns with them and make adjustments as necessary.

Phase 4: Presenting Your Findings

13. Document the BIA process and results in a management report. Although some senior management teams may express a preference to forego the report, asking only for the less detailed presentation document (see the next step), it’s important to have a document that includes the results of your BIA in full along with supporting details and additional findings.

14. Create an accompanying management presentation. This downsized version of the report succinctly conveys what the BIA was about, the results you found, and your recommendations on what to do next.

15. Get management approval. Gather and incorporate any final revisions to the report based on management’s review, and get approval on the results of the BIA via email or a handwritten note.

If you’ve reached this stage, your Business Impact Analysis is complete. One final step not included in this template (but perhaps it should be) is to use the BIA to implement targeted recovery strategies to ensure the continued survival of critical business units in the event of a disruption. Once that’s happened, you’ve succeeded in your mission to provide protection for your business should the need arise.

Need help with your BIA?

This example of a Business Impact Analysis checklist may seem fairly straightforward, but putting the pieces together can pose a challenge—particularly when it comes to the questionnaire.

Our online BIA^OD tool will help you navigate BIA interviews with ease. You can send a link to the questionnaire to your participants in advance, allowing them to complete pre-work before the interview even begins. After the fact, you can generate management reports that are easy to understand and even easier to share.

To see the tool in action, schedule a free demo today. Your organization will be one step closer to being ready for anything.