ISO 22301 FAQ Business Impact Analysis

Under ISO 22301, the BIA is the process that turns business disruption into concrete continuity priorities and requirements. It should start from the BCMS scope and the products or services the organization has decided to protect.

The output should tell a continuity planner, auditor, or activity owner which activities are prioritized, why they matter, when disruption becomes unacceptable, what minimum capacity is needed, and which resources and dependencies must be available for recovery. It is not limited to IT: activities may depend on people, facilities, information, data, equipment, logistics, finance, partners, and suppliers.

The BIA should assess impacts over time and identify the point where not resuming an activity becomes unacceptable. That point is commonly expressed as the maximum tolerable period of disruption, or MTPD.

The recovery time objective, or RTO, should sit inside that maximum tolerable period and state when the disrupted activity must resume at a defined minimum acceptable capacity. ISO 22301:2019 does not define or explicitly require RPO. For information- and ICT-dependent activities, an organization can add an RPO or equivalent data-loss tolerance when missing records or transactions would affect continuity.

A BIA is weak if it only ranks activities. It should also identify the resources needed to support prioritized activities and the dependencies and interdependencies that affect recovery.

The useful version names the people, facilities, information, data, technology, suppliers, partners, utilities, records, and decision forums needed to continue or recover the activity within the agreed time frame and capacity.

The BIA and risk assessment feed the selection of business continuity strategies and solutions. ISO 22301 requires selected strategies and solutions to meet the identified timeframes and agreed capacity. If current capability cannot do so, record the gap and change the solution, resources, or justified continuity requirement; risk acceptance alone does not establish conformity with the strategy-selection requirement.

Business continuity plans, recovery procedures, exercise scenarios, and post-exercise actions should all be traceable back to BIA outputs. Otherwise the organization may test convenient scenarios while leaving the most important recovery assumptions unproven. For example, if order fulfilment must resume within eight hours at 40 percent capacity, the selected solution should name the minimum staff, system access, inventory data, carrier dependency, and manual fallback needed to meet that result; the exercise should test those same conditions.

Good BIA evidence shows both the analysis and the operating process around it. Keep the approved BIA, criteria, assumptions, owner approvals, dependency records, resource decisions, strategy links, exercise results, audit findings, corrective actions, and management-review inputs together.

Review the BIA at planned intervals and when significant changes affect the organization or its context. Practical triggers include a new product, site, supplier, system, legal obligation, customer commitment, incident lesson, exercise failure, major staffing model change, or recovery target change.