---
title: [CM] [PM] [ISO] [P3] Business Impact Analysis with ISO ISO22361 Elements
description: [CM] [PM] [ISO] [P3] Business Impact Analysis with [ISO] ISO22361 Elements
image: https://blog.bcm-institute.org/hubfs/Mapping%20CM%20Planning%20Methodology%20Morepost/IC_Mapping%20CM%20PM_Business%20Impact%20Analysis.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Ebook Series
# \[CM\] \[PM\] \[ISO\] \[P3\] Business Impact Analysis with ISO ISO22361 Elements
Understanding the potential impact of crises on organisational operations is essential for effective crisis management. The Crisis Management Planning Methodology and ISO 22361:2022 emphasise the importance of a Business Impact Analysis (BIA).
Phase 3: Business Impact Analysis in the Crisis Management Planning Methodology focuses on identifying critical business functions, assessing vulnerabilities, and determining recovery objectives.
ISO 22361:2022, on the other hand, provides a comprehensive framework for conducting BIAs, integrating them into broader organisational resilience strategies.
This comparative analysis will explore the similarities and differences between these two approaches, highlighting how they guide organisations in building a proactive and resilient crisis management plan.
[Moh Heng Goh](https://blog.bcm-institute.org/en-sg/ebook-cm/author/moh-heng-goh) Sep 20, 2024
###### Crisis Management Certified Planner-Specialist-Expert
### Mapping Business Impact Analysis with ISO ISO22361 Elements
[![\[CM\] \[PM\] \[ISO\] \[P3\] Business Impact Analysis with ISO ISO22361 Elements](https://no-cache.hubspot.com/cta/default/3893111/7356867a-993d-4285-bc21-9c5570cd1019.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7356867a-993d-4285-bc21-9c5570cd1019)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fb527d9e-e121-4849-a28c-84be05543bde)The Business Impact Analysis (BIA) is crucial in understanding how potential crises affect critical operations and functions. Phase 3: Business Impact Analysis in the Crisis Management (CM) Planning Methodology focuses on identifying essential business processes and evaluating the potential impact of disruptions on these functions.
This phase helps organisations determine the resources, recovery time objectives (RTOs), and recovery point objectives (RPOs) necessary to maintain or restore operations after a crisis. The BIA lays the foundation for effective crisis response and business continuity planning by prioritising critical business functions and analysing vulnerabilities.
In comparison, ISO 22361:2022 also emphasizes the importance of a structured Business Impact Analysis as part of its CM framework. The standard outlines the need for organisations to assess the potential consequences of different crisis scenarios on key business functions, ensuring that response strategies are aligned with operational priorities.
ISO 22361 highlights the role of BIA in guiding resource allocation and decision-making during a crisis, ensuring that critical business functions are protected and restored as quickly as possible.
This comparison chart will examine the alignment and differences between Phase 3 of the CM Planning Methodology and the corresponding BIA requirements in ISO 22361:2022, showcasing how both frameworks contribute to building organizational resilience.
### Detailed Comparison Between Phase 3: BIA of CM Planning Methodology vs. ISO 22361:2022 Standard
#### **Objectives and Focus**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | The primary objective of BIA is to understand the potential impact of identified risks on critical business functions. It involves evaluating the effects of disruption on operations, financials, and reputation and determining the organisation's dependencies. | | | ISO 22361 emphasizes assessing vulnerabilities and how potential disruptions affect the organisation’s resilience. The standard views BIA as a tool for understanding critical functions, essential services, and disruptions' operational, financial, and reputational effects. | |
| | Focus: Identifying and prioritising critical business functions, understanding their dependencies, and determining recovery time objectives (RTOs) and recovery point objectives (RPOs). | | | Focus: Evaluating crises' impact on critical functions and services, determining dependencies, and understanding how crises impact organisational resilience. | |
##### **Comparison**
Both methodologies emphasise the importance of **identifying and analysing critical business functions** and understanding how potential disruptions affect them.
ISO 22361 takes a broader approach by emphasizing **organisational resilience** and integrating BIA into an overall resilience framework.
#### **Identification of Critical Business Functions**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | **Critical Business Functions Identification**: BIA focuses on identifying the **most essential business functions**, processes, and resources that, if disrupted, would significantly impact operations. This involves collaborating with various departments to assess what functions must be prioritised. | | | ISO 22361 requires organisations to identify **critical business functions** and **essential services** for sustaining operations. These functions are assessed for their **importance to stakeholders**, regulatory obligations, and the organisation's strategic objectives. | |
| | The methodology categorises functions based on their importance to **operational continuity**, financial health, and reputation. | | | The standard emphasises the **continuity of operations** and the organization’s ability to **deliver essential services** to stakeholders, meet **legal obligations** and **maintain resilience** in crises. | |
##### **Comparison**
Both emphasise identifying critical business functions, but ISO 22361 strongly focuses on the broader impact on stakeholders and the organisation’s ability to deliver essential services while maintaining resilience.
#### **Vulnerability and Impact Assessment**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | **Vulnerability Assessment**: BIA involves analysing how each identified crisis scenario might affect critical functions and assessing the vulnerabilities within the organisation’s operations. It helps determine the potential **severity** of these disruptions. | | | ISO 22361 requires an analysis of **vulnerabilities and dependencies** between critical functions and how external and internal crises may disrupt these functions. The standard emphasises **continuous vulnerability monitoring** and ensuring the organisation knows interdependencies across its operations. | |
| | **Impact Analysis**: The methodology evaluates the potential operational, financial, reputational, and regulatory impacts a disruption could have on the organisation. | | | ISO 22361 encourages organisations to assess direct and **secondary impacts**, such as reputational damage, loss of stakeholder confidence, and cascading disruptions across the organization. | |
##### **Comparison**
Both methodologies emphasise vulnerability assessment and understanding the impact of disruptions on critical business functions. However, ISO 22361 introduces a more structured approach to understanding dependencies, interdependencies, and indirect implications like reputational harm.
#### **Recovery Time and Prioritisation of Functions**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | Recovery Time Objectives (RTOs): The methodology focuses on defining RTOs and determining the maximum acceptable downtime for critical business functions before significant damage occurs. This helps prioritise | | | ISO 22361 also requires the establishment of **RTOs** for critical functions and services, ensuring that recovery timelines are aligned with **stakeholder expectations** and **regulatory requirements**. The standard highlights the importance of balancing **organisational capabilities** with the urgency of recovery. | |
| | **Prioritization**: After identifying critical functions and RTOs, the organisation prioritizes their recovery to minimize disruption. Functions with shorter RTOs receive priority in resource allocation and recovery strategies. | | | ISO 22361 stresses the need to prioritise functions based on their **strategic importance** and **impact on resilience**. The standard encourages **flexibility** in prioritisation, considering the changing nature of crises and organisational needs. | |
##### **Comparison**
Both emphasise RTOs and prioritisation, but ISO 22361 expands on these concepts by incorporating stakeholder expectations, regulatory obligations, and strategic flexibility in the prioritisation process.
#### **Dependency and Interdependency Analysis**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | The methodology involves identifying **dependencies** on external resources, suppliers, and internal processes critical to maintaining business functions. Understanding these dependencies helps inform risk assessments and resource allocation during a crisis. | | | ISO 22361 emphasises the importance of understanding both **dependencies and interdependencies** between critical business functions, departments, and external entities. The standard highlights the cascading effects of disruptions across departments and how interdependencies can escalate a crisis. | |
| | The methodology primarily focuses on **direct dependencies** between resources and business functions. | | | ISO 22361 analyses **interdependencies**, particularly how crises in one area can **affect multiple functions** or **spread** throughout the organisation. It encourages organizations to understand how these relationships might exacerbate crises. | |
##### **Comparison**
While both approaches focus on dependencies, ISO 22361 introduces a more in-depth analysis of interdependencies and cascading effects, ensuring that organisations consider how one disruption could have wider-reaching impacts across functions and departments.
#### **Communication of Findings**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | BIA results should be communicated to the **crisis management team** and key stakeholders to ensure alignment on critical functions, vulnerabilities, and recovery priorities. The methodology emphasises sharing findings to inform the overall CM Plan. | | | ISO 22361 mandates that BIA findings be **communicated across the organization** and to **external stakeholders** if necessary. The standard emphasises the importance of clear and transparent communication regarding **vulnerabilities**, **dependencies**, and **recovery priorities** as part of the organisation’s crisis response strategy. | |
| | The methodology encourages **regular updates** and adjustments to the BIA to ensure it remains relevant and practical. | | | ISO 22361 stresses establishing **communication channels** to ensure that all relevant parties are **aware of potential vulnerabilities** and **prepared for recovery efforts**. The standard integrates BIA findings into broader **governance and decision-making processes**. | |
##### **Comparison**
Both methodologies emphasize the importance of **communicating BIA findings**. However, **ISO 22361** focuses on more formalised and **structured communication processes** involving **internal and external stakeholders**, with integration into governance and broader decision-making.
#### **Integration with Crisis Management Plan**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis (BIA)** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | The BIA results are the foundation for developing a **Crisis Management Plan (CMP)**, ensuring that the organization’s response aligns with the most critical business functions. The methodology views BIA as an essential step before moving into plan development. | | | ISO 22361 integrates BIA into the **crisis management process** and organizational resilience strategy. The standard emphasizes that BIA findings should inform the **CMP** and guide **resource allocation**, **recovery planning**, and **decision-making** across all organizational levels. | |
| | The methodology focuses on translating the insights from the BIA into actionable recovery strategies for **key business functions**. | | | ISO 22361 stresses the need for a **comprehensive approach** that uses BIA findings to inform **multiple facets** of resilience planning, including **leadership decision-making**, **communication strategies**, and **coordination with external stakeholders**. | |
##### **Comparison**
Both methodologies highlight BIA as a critical **foundation for developing a crisis management plan**. **ISO 22361** further integrates BIA results into the **broader organisational resilience** framework, affecting **leadership decisions** and overall crisis preparedness.
#### **Continuous Improvement and Monitoring**
| | **Crisis Management Planning Methodology: Phase 3 - Business Impact Analysis** | | | **ISO 22361:2022 Standard** | |
| --- | --- | --- | --- | --- | --- |
| | BIA is considered a **living document** in the methodology, requiring regular reviews and updates as the organisation evolves. It encourages periodic assessments to ensure the organization’s vulnerabilities and critical functions are up to date. | | | ISO 22361 mandates that BIA be part of a **continuous improvement process**. The standard emphasises regular **monitoring** and **updating** of BIA findings in response to changes in the organisation, environment, and risk landscape. | |
| | The methodology recommends **periodically reassessing** business functions, dependencies, and recovery priorities. | | | ISO 22361 formalises the process of **continuous review** and **adaptation****. It** encourages organisations to remain **agile** and responsive to new threats and ensures that BIA findings remain relevant in a changing crisis environment. | |
##### **Comparison**
Both methodologies advocate for regular updates and continuous improvement of BIA. Still, ISO 22361 emphasises creating a formal, ongoing process for monitoring, reviewing, and adapting BIA in a dynamic risk environment.
#### **Summary of Key Differences and Similarities**
##### **Identification of Critical Functions**
Both emphasise identifying critical business functions. However, ISO 22361 extends this focus by considering stakeholder expectations and the broader organisational resilience context.
##### **Vulnerability and Dependency Analysis**
While both methodologies analyse vulnerabilities and dependencies, ISO 22361 introduces a more in-depth exploration of interdependencies and cascading effects within the organisation.
##### **Communication and Integration**
Both frameworks stress the importance of communicating BIA findings, but ISO 22361 emphasises integrating these findings into broader governance structures and decision-making processes.
##### **Continuous Improvement**
While both methods support regular BIA updates, ISO 22361 incorporates this into a more formalised framework of continuous improvement and organizational adaptability to emerging risks.
ISO 22361:2022 provides a broader resilience focus, ensuring BIA is not just part of the crisis response but also integrated into long-term resilience and strategic decision-making processes across the organisation.
#### Summing up...
The Crisis Management Planning Methodology and ISO 22361:2022 emphasize the critical role of Business Impact Analysis (BIA) in effective crisis management. While both approaches share common objectives, ISO 22361 provides a more comprehensive and structured framework for conducting BIAs.
Key differences include ISO 22361's broader focus on organizational resilience, interdependencies, and integration with broader decision-making processes. Both methodologies are essential for organizations seeking to build a proactive and resilient approach to crisis preparedness.
| ##### **Map Crisis Management Planning Methodology Against ISO2261:2022** | | | |
| --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0408e7ba-409a-4b5c-9096-c18ae43e3acf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c40a68fb-e45f-4773-8ca3-3a3443e5c45a) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/97fe4877-76ab-4508-a441-b53ac2151a37) | [![\[CM\] \[PM\] \[ISO\] \[P3\] Business Impact Analysis with ISO ISO22361 Elements](https://no-cache.hubspot.com/cta/default/3893111/7356867a-993d-4285-bc21-9c5570cd1019.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7356867a-993d-4285-bc21-9c5570cd1019) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/646227a1-2914-411f-8547-c8f87c96c28a) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/d150166b-2a56-4ad1-a835-df55f57aca8f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fab1db37-346f-47d0-9d66-8ddf05c4ded9) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b351352d-bee0-449d-b76e-51d6e8a3cb8b) |
| ##### **Crisis Management Planning Methodology** | | | |
| --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e8ad8ed7-15cd-4d3e-a7d1-0b4755ede185) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b36d7a35-d843-427c-9da1-e25b9b2c383f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0d7ec489-5d93-48e0-951b-524259a2b30e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/97fc620d-9076-417d-974f-bed1397cba3e) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/835b2f38-3bbd-44d1-9f57-58c0b756afb9) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74e741da-590d-41d1-9bae-afe2ef9d4cc2) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/45e1cf63-5954-4dfc-8022-914e5a429705) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/41f13ad5-16bd-4e43-83d9-e6e025bd6ed4) |
---
#### More Information About Crisis Management Courses
To learn more about the course and schedule, click the buttons below for the CM-300 Crisis Management Implementer \[CM-3\] and the CM-5000 Crisis Management Expert Implementer \[CM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5ffecd2d-8000-4805-b5e3-e9ead2e259cc) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c3546220-6c76-4a10-8c76-4040b94e09e5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/03294547-1df3-435c-9243-971c3d9bb6ce) | | |
| --- | --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b29594fe-d44a-4ff8-8160-03f7ce454385) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/dd120e7f-9fe2-49ed-ad24-489b81c06739) | [![\[BL-CM\] \[5\] Register](https://no-cache.hubspot.com/cta/default/3893111/82024308-16f4-4491-98be-818a882c6286.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/82024308-16f4-4491-98be-818a882c6286) | | |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c8aaf76b-4c0b-402a-ad12-c8aff24eb911) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/695c974d-ad26-4e7b-b4d2-25ca9e080e0a) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/397d3df1-5691-4ee9-ba12-2cbe42fc8844) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/30bcbbbf-c8ea-48d8-8643-da2638f3f0f8) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/83d00c12-c51c-4476-9902-69f9b7667a91) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/672d2949-6233-4b26-ad42-ae0dd0a1a3ac) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3ca6f50d-a3c5-41b8-8da2-26feb8a7613e) | | |
### Your Comments Here:
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/en-sg/ebook-cm/author/moh-heng-goh"
},
"dateModified" : "2024-09-25T12:46:13.041Z",
"datePublished" : "2024-09-20T07:14:14.000Z",
"headline" : "[CM] [PM] [ISO] [P3] Business Impact Analysis with ISO ISO22361 Elements",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/en-sg/ebook-cm/cm-pm-iso-p3-business-impact-analysis-with-iso-iso22361-elements",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```