Business Impact Analysis

1. Business Impact Analysis 1

2. Objectives Examine objectives of Business Impact Analysis (BIA) Define resource, outage, disruption and impact Define Recovery Time Objective (RTO) Define Recovery Point Objective (RPO) Review operations from the perspective of BCM Define supply chain and process flow Define single-points-of-failure Identify organization infrastructure and physical support operational requirements Review the relationship between BIA and BCM Determine the cost of BCM. 2

3. Organization Objectives and Business Impact Analysis What are the objectives of the organization? What are the deliverables of the organization? What resources do these deliverables require? 3

4. Impact of Disruption Over Time Identify critical business functions and operations Identify potential impacts Determine when impacts begin 4

5. Objectives of Business Impact Analysis Determine priority of objectives of the organization Determine critical deliverables of the organization Identify resources required by the deliverables Determine impact over time of the disruptions Determine resumption times for critical operations Provide information for recovery strategies. 5

6. A resource is an asset used to conduct operations. An outage is the unavailability of a resource which may cause a disruption in operations. 6

7. A disruption is an interruption of operations. 7

8. Impact is the effect of an event. The level of impact depends on factors such as loss of life, environmental damage, the destruction of assets and duration of disruption. 8

9. Recovery Time Objective (RTO) The prospective point in time when an operation must be resumed before a disruption compromises the ability of the organization to achieve its objectives. 9

10. RTOs are often used as the basis for: Establishing priorities Developing strategies As a determinant as to whether or not the event is a disruption or a disaster It may be necessary to define multiple RTOs. 10

11. Recovery Point Objective (RPO) Retrospective point in time to which information must be restored to ensure objectives can be met. 11

12. BIA determines the resource requirements over time to enable each function within the organization to achieve continuity and recovery within established timeframes. 12

13. Resources Requirements air conditioning communications data equipment facilities gas information technology inventory materials personnel power supply sewer supplies systems vital records water 13

14. Critical Operations Critical areas that must remain operational or rapidly recover need to be identified. Loss of these capabilities have an adverse impact. Critical operations include life-safety and environmental controls, customer service, and revenue generating operations. Critical areas include the maintenance of technology and facilities necessary that support critical business operations. The most profitable operations should receive special attention. 14

15. Critical Operations determined based on two variables: the importance of the business operation and the time sensitivity of the business operation 15

16. Interdependencies Supply chains and process flows illustrate interdependencies Just-in-Time may presents problems for business continuity Nearly all manufacturing operations are interdependent on one another. Manufacturing is dependent on support operations of Human Resources, Information Technology, and Facilities. Many support functions can be briefly suspended without impacting operations. IT is usually time critical 16

17. Supply Chain Supply chain is a sequence of operations conducted by a system of organizations involved in the creation and distribution of a deliverable. A process flow (internal supply chain) consists of the sequence of operations by which an organization creates a deliverable. 17

18. 18

19. Single-Point-of-Failure Any operation that relies on ‘one and only one’ item of equipment or ‘one and only one’ method of processing or any ‘one and only one’ resource. The BIA must identify each single-point-of-failure, identify alternatives and define the potential impact to the business associated with each single-point-of-failure. 19

20. Support Infrastructure Buildings and Building Systems Building Contents Community Infrastructure External Dependencies 20

21. Buildings and Building Systems General office space is easily replaced. Manufacturing requires systems that cannot be readily replaced. The destruction or denial of access to buildings could disable normal operations. The BIA documents important building requirements. Replacement times need to be identified. 21

22. Building Contents/Manufacturing Equipment Some businesses use specialized equipment that cannot be readily replaced. Protection measures for high value and/or specialized equipment are part of the planning process. BIA documents building content and manufacturing equipment requirements. Replacement times and alternative options are identified. 22

23. Community Infrastructure Fire and emergency services Police Transportation Communications Electricity Natural Gas Sewer Water 23

24. External Dependencies Businesses that provide important services, supplies and/or raw materials. Single-source providers of critical services or raw materials are a single-point-of-failure. BIA identifies single-points-of-failure alternatives and determines failure impact. 24

25. BIA Provides Direction for BC Program Provides a rationale for Business Continuity Planning Identifies processes and assets requiring the most protection Determines recovery timeframes Determines minimum resource requirements Provides decision support for business continuity strategies 25

26. Disaster Criteria An event may be designated as a disaster if the: Disruption continues beyond the RTO Impact is extensive and very costly 26

27. Direct financial losses Destruction of organization assets. Loss of revenue. 27

28. Indirect financial losses Decrease in customer and client satisfaction. Decrease in investor confidence. Damage to reputation and brand. Adverse media coverage. Reduction of competitive capabilities. Legal exposures. Missed filing and reporting deadlines. An increase in risk rating by financial institutions. Loss of business opportunities. 28

29. Validate and Document Findings Determine any missing information Confirm findings and review for consistency Document findings and recommendations 29

30. Business Impact Analysis Results Business insight Critical business functions Operational dependencies Time sensitivity of operations Resource requirements for recovery Resource replacement times Financial exposures 30

31. Management approval Recovery time objectives Order of recovery Recovery point objectives Prioritization of critical business functions 31

32. Business Impact Analysis provides crucial information to support decision making regarding business continuity planning. 32