Business impact analysis

The Cabinet Office Business Continuity Management Toolkit calls understanding the organisation "a key element of BCM and the foundation work from which the whole process is built", and the business impact analysis, or BIA, is how that understanding is reached. "A BIA identifies and documents your key products and services; the critical activities required to deliver these; the impact that a disruption of these activities would have on your organisation; and the resources required to resume the activities."

The toolkit sets out the steps. Step 1: list the key products and services which, if disrupted for any reason, will have the greatest impact, and document what the impact would be in the first 24 hours, at 24 to 48 hours, up to one week and up to two weeks. Step 2: identify the maximum length of time a disruption to each can be managed without threatening the organisation's viability, financially or through loss of reputation, which the toolkit calls the maximum tolerable period of disruption. Step 3: set the point by which each must be resumed, the recovery time objective. Step 4: document the critical activities required to deliver the key products and services.

The toolkit says a risk assessment "can only take place once a BIA has been completed".