ISO Certification Consultancy Services: Why Your Business Impact Analysis Is Probably a Survey of Opinions

Here’s how the business impact analysis usually gets done. A spreadsheet goes out to department heads. It asks them to rate how critical their activities are and how quickly each must resume.

The results come back. Almost everything is critical. Most recovery times are four hours or less. A few brave souls say twenty-four hours and feel they’ve been generous. That document then becomes the foundation of the entire continuity system.

If you’re weighing ISO certification consultancy services for ISO 22301, this is the first document to examine. It matters from Singapore to Nigeria, wherever buyers ask for proof that your continuity numbers are real.

Why does the usual BIA produce inflated recovery times?

It happens because of what you asked and who you asked. You asked people to rate the importance of their own work, which isn’t a neutral question. You asked how quickly it must resume, without asking what happens if it doesn’t. Only the second question has an evidence-based answer.

Nobody wants to record that their department could be unavailable for a week without consequence. In a period of cost scrutiny, that answer feels professionally unwise.

What does ISO 22301 actually require from a BIA?

ISO 22301:2019 clause 8.2.2 requires you to define impact types and criteria, assess impacts over time, and identify when not resuming becomes unacceptable. You then set prioritised time frames, by that point, for resuming activities at a minimum acceptable capacity. Nothing in it asks departments how critical they feel.

The clause lists six steps: define impact types and criteria, identify the supporting activities, assess impacts over time, identify when impacts become unacceptable, set prioritised time frames at a minimum acceptable capacity, and identify the prioritised activities. The recovery time objective is the timeframe within the maximum tolerable period of disruption for resuming activities at that minimum level. 

ISO also publishes guidance. ISO/TS 22317 gives guidelines for a formal, documented BIA process but doesn’t prescribe a uniform way to do it. ISO last reviewed and confirmed the 2021 edition in 2025, so it remains current. 

What should you ask instead of “how critical is it”?

Ask what happens. If this activity stopped now, what would the effect be after four hours, a day, three days, a week, and a month? Then require specifics: a financial figure, a contractual breach, a regulatory reporting failure, a safety consequence, or a named customer lost.

This changes the conversation. A finance team asked how critical payroll is will say extremely. Asked what happens if payroll is delayed by four hours, the honest answer is usually nothing, because it runs monthly. Asked what happens if it’s unavailable across a pay date, the answer becomes serious and specific.

Impact over time is the whole point of the analysis. The survey approach flattens it.

Who should you ask?

Ask more than the department head. The people doing the work know which parts can’t wait, and which informal workarounds already exist. Ask customer-facing teams about external consequences too. Internal teams routinely underestimate what customers tolerate and overestimate what they notice.

How do you test whether a BIA is any good?

Take any prioritised activity, look at its resumption timeframe, and find a stated consequence at that point in time. If the timeframe is four hours, something specific should happen at four hours. If nothing does, the number came from instinct, and every strategy and cost built on it is aimed at the wrong target.

The same logic shows up in regulation. The UK’s FCA requires firms to set impact tolerances for each important business service and keep them under review. An impact tolerance is the maximum tolerable disruption, measured by time and other relevant metrics. It’s common to set recovery time objectives well within the tolerance. ISO 27001 consultants in London who serve UK regulated firms will recognise the pattern. 

Why does an inflated BIA cost real money?

Overstated recovery objectives are expensive. Every hour you shave off a recovery time costs money in standby capability, and organisations spend that money against numbers nobody validated. Getting the BIA right often saves more than certification costs, by showing that half the “four-hour” activities are comfortably day two.

Downtime is costly too, which is why the numbers need to be real. ITIC’s 2024 survey of over 1,000 firms found an hour of downtime costs over $300,000 for more than 90 percent of mid-size and large enterprises. ITIC says these are self-reported figures. An exhibit in the same report says six in ten businesses can’t calculate hourly downtime costs. A good BIA replaces guesses with evidence on both sides. Source: https://www.calyptix.com/wp-content/uploads/Hourly-Cost-of-Downtime-ITIC.pdf 

Which industries need a proper BIA most?

Banks, healthcare and medical device makers, manufacturers, logistics firms and IT providers need it most, because disruption quickly breaks contracts, safety duties or reporting rules. Education institutes, law firms and audit firms matter too. Fixed deadlines and client data make some days far worse than others.

Many of our ISO 9001 consulting clients are manufacturers, importers and distributors who add continuity later. Medical device makers have a further layer. A stalled batch or a missed regulatory report matters whether they work with ISO 13485 consulting or CE marking consultants. 

Whether you operate in India, the Philippines, Kenya, Oman, New Zealand or the USA, customers increasingly ask for continuity evidence in tenders and audits.

How do ISO consultants play a main role?

ISO consultants run the BIA as an evidence exercise, not a survey. They set the impact criteria, interview the people doing the work, test each time frame against a stated consequence, and challenge numbers that came from instinct. Management system consultants then link the result to strategy, budget and audit evidence.

That’s the real benefit of ISO consultancy services. They save you from over-engineered standby COSTS and from an audit finding on a document nobody can defend.

What advice do MSCi’s ISO consultants give?

Our advice is practical. Most weak BIAs fail at the questions, not the spreadsheet.

• Agree impact criteria with leadership before the first interview.

• Ask for numbers. Money, contracts, regulators, safety, and named customers.

• Interview the people who do the work. Write down their workarounds.

• Write the consequence next to every recovery time. If it’s blank, challenge it.

• Revisit the BIA after change. New products, suppliers, and systems all shift the answers.

How can ISO certification consultancy services help your business?

MSC Incorporation (MSCi) is an ISO consultancy with 40+ years of experience in ISO consultation. Our ISO certification consultancy services cover gap analysis, business impact analysis, continuity strategy, training, and internal audits. We prepare your company for the audit. An independent accredited certification body issues the certificate, not MSCi.

5. Frequently Asked Questions

Is there a free ISO readiness checklist for a BIA?

Start with five questions. Have leadership approved impact criteria? Does each recovery time have a stated consequence? Did people who do the work contribute? Are dependencies and suppliers listed? Is there a review date? Check MSCi’s free ISO readiness checker tool: https://mscincorporation.com/iso-readiness-checklist/ 

How do ISO certification consultants review a BIA?

They pick prioritised activities at random and ask for the consequence behind each recovery time. Blank answers show where numbers came from instinct.

Why would I hire an ISO 22301 consultant in Singapore or elsewhere?

A consultant helps you build the BIA on evidence and avoid audit findings. It’s not compulsory. Local knowledge helps when regulators or customers have their own expectations.

How does the BIA support ISO 27001 consulting services and IT recovery?

The BIA gives IT teams evidence for recovery targets. Without it, systems get protected to a standard nobody validated.

Does this matter for medical device makers?

Yes. Stalled supply or a missed regulatory report can follow a disruption. A BIA doesn’t replace ISO 13485 or CE marking requirements, but it shows which activities can’t wait.