ISO 22301 Business Impact Analysis Template

Start with a stable activity inventory. Each BIA row should name the product or service supported, the activity being analysed, the accountable business owner, the location or delivery model, and the disruption impacts to assess. Choose impact types and criteria that fit the organization's context; examples may include customer, safety, legal or regulatory, financial, operational, and reputational effects.

ISO 22301 requires the business impact analysis process to determine business continuity priorities and requirements. The BCMS owner should maintain the method and template, while product, service, and activity owners provide and approve the operating facts. The template should produce enough information to decide which activities are prioritized and what is needed to continue or recover them.

For each activity, assess how disruption impacts change over time using the defined impact types and criteria. Use time bands that fit the service, operating cycle, and evidence. A single severity score cannot show when an impact crosses the organization's unacceptable threshold.

Record the time frame within which not resuming the activity would become unacceptable. Then set a prioritized time within that limit for resuming the activity at a specified minimum acceptable capacity. ISO 22301 notes that these time frames can be called MTPD and RTO, respectively.

The BIA should make dependencies visible enough for continuity strategies to be selected. Ask each process owner what the activity needs at minimum acceptable capacity, then separate internal dependencies from third-party and infrastructure dependencies.

The result should be a resource profile for each prioritized activity. ISO 22301's resource categories include people; information and data; facilities and utilities; equipment and consumables; ICT; transport and logistics; finance; and partners and suppliers. Use the profile to identify candidate continuity solutions.

End the template with a controlled handoff. For each prioritized activity, record the resumption time, minimum capacity, dependencies, resource requirements, disruption risks, open gaps, and decision owner. Strategy selection should consider whether options meet time and capacity, the amount and type of risk the organization may or may not take, and costs and benefits.

The handoff should identify the selected strategy and one or more solutions, the approval rationale, the implementation owner, the linked plan, and how the organization will test whether the solution can be activated and meet the BIA requirement. Keep the disruption risk assessment as a linked but distinct record: the BIA determines impact-based priorities and requirements, while the risk assessment identifies, analyses, and evaluates disruption risks to prioritized activities and their required resources.

A BIA that records opinions without decisions cannot support the next step. The completed record should identify prioritized activities, resumption time and minimum capacity, required resources, dependencies, evidence, assumptions, approvals, and open gaps.

Do not copy recovery targets across activities without analysis. Each target should follow from the activity's impact over time and sit within the point where non-resumption becomes unacceptable. Dependencies and current capability determine whether the target is feasible.

Set planned review intervals and significant-change triggers. ISO 22301 requires review of the BIA and risk assessment at planned intervals and when significant changes occur within the organization or its operating context. Triggers may include new products, supplier or system changes, acquisitions, site moves, changed commitments, failed assumptions in an exercise, or an incident that reveals a gap.

The review output should be practical: updated BIA rows, changed continuity strategies, updated plans, corrective actions, risk acceptance, management-review input, or supplier follow-up.