Writing the Business Impact Analysis Report

Preparing the Business Impact Analysis Report

There is no standardized format for a business impact analysis report and, as with many other processes, this document will likely follow your company’s standard format.

At minimum, the report should include the business functions, the criticality and impact assessments and the recovery time objective (RTO) assessment for each. Dependencies, both internal and external, should be noted and the correlation to IT systems should be delineated.

This report should be prepared in draft format with initial impact findings and issues to be resolved. The participating business unit BCM coordinators, business unit heads and managers, subject-matter-experts (SMEs), and BC/DR team members should review the findings. Revise the report based on participant’s feedback to the draft document.

If needed, you can schedule a review meeting to discuss the finding in the draft. Often this is helpful (and needed) to resolve conflicts with regard to the criticality and maximum tolerable downtime ratings, since there is a correlation between these ratings and the cost of mitigating the risks and reducing downtime.

Once the feedback has been gathered, revise the draft and finalize the document. This document is used along with the risk assessment as an input to the risk mitigation process.

Key Elements in BIA Report

To assist you in preparing your final report, we’ve recapped the elements you may choose to include.

• Key processes and functions
• Process and resource interdependence
• IT dependencies
• Criticality and impact on operations
• Backlog information
• Key roles, positions, skills, knowledge, expertise needed
• Recovery time requirements
• Recovery resources
• Service level agreements
• Technology (IT and non-IT technology)
• Financial, legal, operations, market, staff impacts
• Work-around procedures
• Remote work, workload shifting
• Business data, key records
• Reporting
• Competitive impact
• Investor/market impact
• Customer perception impact
• Other (business-specific data not already included)

Additional key elements an organization may choose to include in preparing a final BIA report: