RISK MANAGEMENT

The True Impact Of

Disruptions To Your Business
By Reuben Kisigwa

Introduction Organizations have struggled with the

difficulty of not recognizing the priority
the Business Impact Analysis. These
effects include missed sales and income,
activities, which is one such item to avoid. delayed sales or income, higher expenses,
Business disruption is one of the most
Every establishment must prioritize its fines from the government, penalties from
typical risks to every organization. This
tasks during a disruption. People will tug contracts, a loss of clients, and a delay in the
could range from a brief interruption of
in different directions if priorities are not implementation of new company strategies.
service owing to poor internet access to
established or agreed upon. Simply said, you look at what your company
prolonged outages brought on by a rainstorm
needs to perform and then determine what
or security breach. Data loss/breach, data
Any business continuity program must will happen if you are unable to achieve it.
recovery, power outages, network outages,
include a business impact analysis (BIA),
natural disasters, pandemics, and physical
which defines the business processes The main goal of a Business Impact Analysis
disruptions are some of the scenarios that
connected to the prioritized goods and is to assist an organization in assessing the
cause the most business disruptions.
services as well as their dependencies, potential implications of a disruption to
including IT systems and staff. vital business processes brought on by any
Such disruptions may have such a negative
Organizations can use this analysis to unfavorable event. Understanding potential
effect that they drive out a top-tier business.
figure out which systems are essential to effects on the organization is the main goal,
In order to ensure their recovery, executives
their ongoing operation, and which should and creating contingency plans to lessen
should ensure that their planning efforts are
receive priority attention in terms of risk such effects is the secondary goal.
in support of a strong business continuity
management and budget allocation. In this
strategy or program. A Business Impact
case, it’s important to work smarter, not Business Impact Analysis, seeks to predict
Analysis (BIA) should be conducted as part
harder, and make sure that crucial systems precisely how a disruptive event will unfold
of these efforts to make sure the business
are adequately safeguarded and quickly and to identify the potential effects of
can withstand any unexpected events. The
recoverable in the event of a disruption in various disruptions. This knowledge can
protection of the business’s core functions
order to resume normal business operations. then be applied to create strategies for the
is always the aim of BIA.
organization’s response in the event that
one of those disruptions occurs.
Business Continuity What is Business Impact
Management Mistakes to Analysis?
Every aspect of the business depends on
the other aspects’ continuous operation,
Avoid The process of determining and evaluating and certain aspects of the business are
more vital than others, necessitating more
the potential effects that a disruption or
incident could have on an organization is allocations when interruptions occur. These
Organizations should avoid doing certain
known as Business Impact Analysis (BIA). assumptions form the basis of the business
things when managing risk in order
The operational and financial effects of a impact study.
to prevent their ability to respond to
disruptions from being compromised. business disruption are examined through

88 MAL53/23 ISSUE

Components of BIA
Recovery Point Objective (RPO). This
is often measured in seconds and is an
indication of the potential quantity of
work that would be lost in the event of a
disruption. Any additional work loss could
seriously harm the firm’s bottom line.
Maximum Allowable Downtime (MAD).
This is the amount of time following a
disruption before the impact brought on by
zero or minimal output becomes severe.
Dependencies. The dependencies of
business processes and systems can be
established using a BIA. In the event of
downtime, it enables you to prioritize the
resources that require speedy recovery so
that you know which features or processes
need to be put back online immediately. If
numerous processes depend on a certain
business function to be functioning, that
function should always take precedence
over others.
Business Impact. A BIA, as we learned
before, identifies the most crucial
operations of your company. It assists in
identifying essential business processes,
critical resources contained inside these
processes, and crucial systems involved.
The Relationship be-
tween BIA and others
aspects of Risk Manage-
ment
A BIA and a business risk assessment
are similar, but a BIA is more focused
on the needs for business continuity, the
availability of resources, and the effects
of a business disruption. The focus of risk
assessment, in contrast, is on the gravity
and propensity of potential business risks.
This is done to prioritize the risks and
develop mitigation plans to address them.
A BIA is conducted to identify the most
crucial business processes, the effects of
business disruption on those processes,
and the resources required to restore
them. As such, a BIA is a component of
Business Continuity Planning because it
is intended to provide crucial data for a
Business Continuity Plan. These are all
essential elements to take into account
when developing a Business Continuity
Plan, which will serve as the action taken
to make certain that an organization can
recover from a business disruption.
90 MAL53/23 ISSUE
“
Business Impact Analysis, seeks to predict
precisely how a disruptive event will unfold
and to identify the potential effects of various
disruptions. This knowledge can then be ap-
plied to create strategies for the organization’s
response in the event that one of those disrup-
tions occurs.
The relationship between BIA and disaster those effects occurs, with the intensity of
recovery planning is similar to that between the effects on the company getting worse
BIA and Business Continuity Planning. with time.
The cost of each failure mode is determined
by the BIA. Once a BIA identifies business- Throughout the data gathering stage of
critical functions, safeguarding them with their analysis, many BIA teams make the
the best available tools and techniques error of attempting to perform too many
allows speedy restoration and ongoing things at once. Focusing on the four
operations. operational aspects of facilities, people,
tools and equipment, materials, and
suppliers - which are present in practically
Getting the Business every company process - is a solid strategy.
Impact Analysis Process A BIA questionnaire template, interviews,
and document reviews are just a few of the
right qualitative and quantitative methods used
to collect information. The objective is to
gather information that is pertinent to the
Stage 1: analysis and that can serve to shed light on
the opportunity or problem at hand. Utilize
objective standards to pinpoint crucial
The Goals and Scope are first defined. The
goals, primary objectives, and scope of the
functions.
business impact study are all defined during
When determining key processes, systems,
this stage, which is regarded as the first
phase. The company’s objectives must be
and functions, always apply an objective
criteria. If you listen to managers, they will
evident. Businesses should gather skilled
all tell you how important their own project
individuals to conduct a BIA together after
is. Once this data has been compiled,
receiving authorization. These people need
it can be used to produce findings and
to be knowledgeable about risk assessment
recommendations. Your business can decide
techniques and the business operations
what levels of risk you are ready to accept
of the enterprise. Never skip this stage as
once you have all the information. You can
it serves to reinforce the organization’s
decide how much downtime you can tolerate
mission.
and define recovery time objectives, as well
as recovery point objectives, depending on
Stage 2: how much data loss you can tolerate. There
is no space for error, so it is advised that
The second stage is data and information both you and your IT team get professional
gathering. The analyst will gather data once assistance.
the business analysis phase has begun. You
must closely examine the impact’s intensity,
which is a critical matter. Some business
Stage 3:
disruptions will be more detrimental than
Information review is the third stage
others, and they may have varying effects
of a business impact analysis. In order
on the company.
to prioritize a list of business services
or processes, identify the human and
A business interruption may have negative
technological resources that are required,
effects on your company’s finances,
and set a recovery timeframe, this process
operations, legal status, or even its
involves documenting and assessing the
reputation, depending on the nature of
data that has been gathered.
your industry. Generally, a combination of
The majority of businesses are shocked by
some of the findings they make after doing
a business impact analysis. Frequently,
businesses are unaware of how reliant
they are on a certain provider or business
process. Businesses typically lack a solid
understanding of how much and how soon
losing important processes can add up in
expenses. You can learn all of that from a
well-conducted Business Impact Analysis.
You can also use Business Impact Analysis
and Business Continuity Management
technologies to gather more comprehensive
data and do in-depth studies of the
outcomes.
Because it assists business leaders in
making decisions regarding the distribution
of resources and the management of
operations during and after a disruptive
event, this phase is crucial to crisis
management and contingency planning.
To do this correctly, the BIA team must
strive to identify process vulnerabilities,
quantify the effect of disruption, classify
business operations according to priority,
identify needs for optimal productivity, and
determine the interdependency of processes
and workflows. Although information
review may seem like a simple phase in
the Business Impact Analysis process, it is
crucial to ensuring that your organization is
ready for any crisis.
Stage 4:
The analysis’ results must then be
documented. This is one of the most
significant Business Impact Analysis
phases, often known as the report-making
“
phase. A BIA report must be applicable. The
Without executive
sponsorship, your or-
ganization might per-
form a Business Im-
pact Analysis, carry
out routine risk as- Reviewing and Updating
sessments, and seem your Risk Management
great on paper, but Plan and BIA
end up allowing seri- Updates to these parts of your Business
Continuity Plan can help you think about
ous vulnerabilities to new risks, lower treated hazards, and
highlight opportunities for improvement
creep in unnoticed. as time goes on and the business changes.
BIA report needs to be usable. The report updated, the organization runs tests or
should be detailed and comprehensive trials to evaluate what would occur if
on disruptive incidents and how they threats materialized.
impact particular organizational processes.
Additionally, the acceptable length of An exercise for emergency evacuations
downtime, acceptable losses, and recovery following a fire is a good illustration of
strategy should be determined for the BIA such tests. The drill will probably aid
in order for it to be an effective business in determining how the business fared,
continuity solution. whether the systems and processes are
efficient, and what areas require evaluation
or improvement. After evaluation, add new
Stage 5: procedures to your risk management plan
and let your staff know about the updates.
The presenting of the Business Impact
Analysis (BIA) report to the company’s
leadership for their review is the last stage Effects of Not Perform-
of the business effect analysis process.
Seniors should be shown the report to ing a Business Impact
gain their feedback on the conclusions and
suggestions. The BIA team must emphasize
Analysis
the weaknesses and backup plans for the After understanding the need of BIA,
most crucial business operations of the it is now simple to pinpoint the negative
organization during the presentation. By impacts of failing to conduct BIA.
assisting leaders in realizing the value of the
Such consequences include a lack of
BIA and a Business Continuity Plan, the understanding on which company processes
objective is to build organizational buy-in. are crucial and need to be protected, as well
as insufficient safeguarding of important
The BIA report can be used to create an assets and resources.
emergency plan of action after seniors
have reviewed and approved it. This phase’s Poorly designed continuity plans that
objective is to ensure that seniors are aware do not account for all risks have further
of the dangers and effects associated with negative implications, including increased
interruptions and that they comprehend exposure to financial, reputational, and
their role in mitigating those risks. legal concerns in the case of a disruption.
Make sure you regularly conduct training In the event of a loss, the organization may
sessions to share findings from a BIA. also have trouble getting enough insurance
Provide a training session highlighting coverage from insurers. Worst still, lack of
what your staff may and cannot do to ensure knowledge regarding the possible effects of
functional safety, for instance, after you’ve various actions during a crisis will almost
identified business-critical operations. certainly result in poor decision-making.
Executive sponsorship and commitment
is crucial because if a BIA framework Conclusion
has sponsorship, it means there’s an
endorsement from a top-level executive who Your company is better equipped to handle
will oversee and help it progress. Without challenges if you plan for them. To maximize
executive sponsorship, your organization the return on the investment in your
might perform a BIA, carry out routine risk
assessments, and seem great on paper, but
company’s business continuity program, it
is imperative that you do a Business Impact
end up allowing serious vulnerabilities to
creep in unnoticed.
Analysis. Because it enables planning for
potential outcomes and action to lessen
any adverse effects, the BIA is crucial for
organizations. Businesses are able to decide
whether or not a change is worthwhile by
completing a BIA.
`
Reuben Kisigwa is a strategic consultant and a
certified competency-based curriculum devel-
oper. You can engage him vide mail at: RKisig-
wa@gmail.com.
In order to determine what needs to be