Business Impact Analysis Consultancy

What BIA is usually taken with

Few organisations stop at one standard, and the second costs far less than the first — the clauses that take longest are the ones they share. Where BIA sits next to something else, this is what carries over.

• ISO 22301 consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.
• BCP consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.
• DR Plan consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.

Certified to more than one, you hold a single management system with one set of objectives, one internal audit programme and one management review — audited in one visit. Run as separate systems they cost roughly twice as much to keep, which is the usual reason a second certificate feels harder than it was.

Working out which activities the business cannot do without

A business impact analysis establishes what a disruption would cost, activity by activity, and how fast that cost accumulates. It is the analytical step that has to come before any continuity or recovery planning, because until you know which activities matter most and how long each can be interrupted, every recovery investment is a guess. ISO 22301 requires one, as do most regulators supervising operational resilience. It examines the organisation's activities, not its servers.

It is commissioned by organisations certifying to ISO 22301, by firms under regulatory resilience expectations, by companies whose largest customers now ask about continuity in supplier contracts, and by boards after a disruption made the priorities obvious the hard way. Manufacturers, hospitals, banks, logistics operators, business process providers and utilities are frequent clients. Group functions such as payroll and treasury usually turn out to be far more critical than anyone had assumed.

Interviews, dependency chains and impact measured over time

We work through the organisation activity by activity with the managers who run them. For each one we establish what it produces, who depends on it inside and outside the business, and what happens if it stops, measured as financial loss, regulatory breach, contractual penalty, safety consequence and reputational damage. The impact is plotted over time, because an activity that is tolerable for four hours may be ruinous at four days, and that curve drives every decision that follows.

From the curve we derive a maximum tolerable period of disruption and a recovery time objective for each activity, then work backwards into the resources recovery would need: people with specific skills, applications and data, premises and equipment, utilities, key suppliers and outsourced services. Dependencies between activities are mapped, since restoring a process whose upstream input is still down achieves nothing. Single points of failure surface here, usually more of them than expected.

Priorities, resource requirements and a foundation for continuity planning

The output is a prioritised list of activities with recovery objectives, an impact analysis for each, the resources required to run at a minimum acceptable level, a dependency and supplier map, and a register of single points of failure with options set against each. Findings are validated with senior management, because recovery priorities are a business decision and the analysis exists to inform that decision rather than replace it. MSCi runs the analysis and the workshops directly.

With the analysis done, continuity and recovery planning becomes straightforward, since the requirements are already stated in writing. Arguments about which system gets restored first are settled before the incident instead of during it. And several findings are worth acting on immediately whatever happens to the plan: a supplier with no alternative, a process only one person can perform, a data set with no tested restore. Those are cheap to fix in advance.