ISO 22301 FAQ Business Impact Analysis

Under ISO 22301, the BIA is the process that turns business disruption into concrete continuity priorities and requirements. It should start from the BCMS scope and the products or services the organization has decided to protect.

The output should tell a visitor, auditor, or internal owner which activities are prioritized, why they matter, when disruption becomes unacceptable, what minimum capacity is needed, and which resources and dependencies must be available for recovery.

The BIA should assess impacts over time and identify the point where not resuming an activity becomes unacceptable. That point is commonly expressed as the maximum tolerable period of disruption, or MTPD.

The recovery time objective should sit inside that maximum tolerable period and state when the disrupted activity must resume at a defined minimum acceptable capacity. For information and ICT-dependent activities, the BIA should also capture recovery point expectations where data loss or transaction loss affects continuity.

A BIA is weak if it only ranks activities. It should also identify the resources needed to support prioritized activities and the dependencies and interdependencies that affect recovery.

The useful version names the people, facilities, information, data, technology, suppliers, partners, utilities, records, and decision forums needed to continue or recover the activity within the agreed time frame and capacity.

The BIA and risk assessment should feed the selection of business continuity strategies and solutions. If the selected strategy cannot meet the BIA time frames and minimum capacity, the organization should either improve the strategy or formally accept the gap.

Business continuity plans, recovery procedures, exercise scenarios, and post-exercise actions should all be traceable back to BIA outputs. Otherwise the organization may test convenient scenarios while leaving the most important recovery assumptions unproven.

Good BIA evidence shows both the analysis and the operating process around it. Keep the approved BIA, criteria, assumptions, owner approvals, dependency records, resource decisions, strategy links, exercise results, audit findings, corrective actions, and management-review inputs together.

Review the BIA at planned intervals and when significant changes affect the organization or its context. Practical triggers include a new product, site, supplier, system, legal obligation, customer commitment, incident lesson, exercise failure, major staffing model change, or recovery target change.