Disaster Recovery Journal Winter 2023

A Business Impact Analysis Checklist

A well-conducted BIA pro vides a solid foundation for your future efforts to design a good business continuity plan. A bad BIA can provide false reassurance, leave critical gaps undiscov ered, or prompt unneeded expenditures. How do you make sure your BIA is thorough and well-organized? Over the years, we have developed a checklist for use in conducting BIAs for our clients. We find the checklist invalu able in making sure the BIAs we conduct are focused, comprehensive, and well grounded. Below is a version of our checklist you are welcome to use in conducting your own BIAs (explanations have been added to increase its usefulness to you). The list could be leveraged in many ways. You could transfer the steps to a blank docu ment to make a kind of BIA template, con sult them as a reference, or use them in some other way—whatever works for you.

By MICHAEL HERRERA

regulatory requirements, computer systems, special equipment, vital records, interdependencies, etc. Note that the BIA questionnaire should also align with authoritative standards such as NFPA 1600. o Meet with senior management. You’ll need them on board if you want the process to be successful. Explain the BIA’s purpose to them, share your plan and questionnaire, and ask for their help and support to unite the relevant parties. o Ask IT for a complete list of systems and applications used company-wide. Such a list would be helpful as you’re conducting the BIA interviews. o Identify subject matter experts (SMEs) from the business units you selected. Your SMEs should be people who actually work with the processes. o Identify an IT representative for each BIA interview. It’s helpful to have someone from IT present during interviews to help clarify the names of computer processes and applications, in case your SMEs don’t know.

The items are divided among the four phases of the BIA: information gathering and BIA validation, conducting BIA inter views, validating the interview data, and presenting your findings. A Step-By-Step Business Impact Analysis Checklist Phase 1: Information Gathering and BIA Validation o Identify the scope of your BIA. How many business units will you be evaluating? If you’re just starting out, keep it small. Do what you think might be the most critical units, and if need be you can do additional units later. o Develop a good BIA questionnaire. Your questionnaire needs to cover two areas: the dollar impact on each individual business unit should a disruption occur (e.g., what would the loss of revenue be?) and the non-dollar impact (e.g., how would it affect our reputation and image?). o Identify and collect key information about the processes associated with the business unit, including legal/

20 DISASTER RECOVERY JOURNAL | WINTER 2023