perform-a-business-impact-analysis

name	perform-a-business-impact-analysis
category	data
description	Analyze disruption impacts and recovery priorities across services, people, facilities, data, suppliers, and obligations. Use when continuity plans need evidence-based recovery objectives and dependency-aware sequencing.

perform-a-business-impact-analysis

Prioritize outcomes that must be restored, then test whether dependencies and resources make the proposed objectives credible. Do not rank systems by stakeholder preference alone.

When to use

• Use when continuity, disaster recovery, investment, or crisis planning needs evidence-backed recovery priorities.
• Use a narrower service review when cross-business impacts and dependency-constrained recovery are not involved.

Preconditions

• Confirm sponsor, scope, planning horizon, decision authority, risk criteria, and treatment of sensitive workforce or customer information.
• Obtain service records, incident history, contracts, financial models, regulatory guidance from authorized owners, architecture, staffing, and supplier evidence.

Procedure

1. Define critical products, public duties, customer journeys, safety outcomes, and decision boundaries.
2. Identify disruption scenarios and time bands meaningful to each outcome.
3. Estimate time-dependent harm across safety, people, customer outcomes, operations, finance, legal obligation, reputation, and recovery complexity.
4. Preserve impact provenance by separating sourced figures, stakeholder estimates, assumptions, and unknowns and recording calculation methods.
5. Map upstream and downstream dependencies including identity, data, facilities, communications, people, vendors, and manual workarounds.
6. Propose maximum tolerable disruption, recovery time, recovery point, minimum service level, and restoration priority as decision candidates.
7. Test candidates against dependency constraints including lead times, data loss, staffing, simultaneous failures, and supplier commitments.
8. Model degraded-service and recovery scenarios, including backlog accumulation and post-restoration capacity.
9. Reconcile conflicts between services and route obligation or risk interpretations to accountable owners.
10. Produce prioritized investments, continuity requirements, owners, acceptance tests, and review triggers.

Failure plan

• Do not convert unsupported interview opinions into exact financial or legal facts.
• Stop approval when objectives are impossible under known dependencies or lack accepting authority.
• Avoid declaring a service noncritical without examining delayed and cumulative harm.
• Preserve uncertainty and minority-risk views where aggregate scoring would hide severe impact.

Done

• A sourced impact model retains source, method, range, confidence, and time-dependent harm
• Dependency-tested objectives remain credible under shared resource and recovery constraints
• Recovery sequence accounts for minimum service and backlog
• A recovery priority record names sequence, rationale, owners, conflicts, and minimum service
• Residual gaps have funded actions or explicit risk acceptance