Business Impact Analysis Format Business Continuity Whitepaper
The next step is to understand your exposures and make good decisions about your recovery strategy. If you have a solid strategy, developing your plans becomes straightforward. “The most critical part of the whole process is your business impact analysis, including the risk assessment,” said Debbie Hoppenjans, manager of business continuity planning at Siemens IT Solutions and Services. “That’s where you need to spend most of your time.”
At its core, a business impact analysis is the process by which you determine what systems or processes need to be recovered and how quickly, according to “Building an Enterprise-Wide Business Continuity Program ” by Kelley Okolita, published by CRC Press in 2009. Broadly speaking, CSO EXECUTIVE GUIDE The Ultimate Guide to Busi ness Continuity 4 the more time you can take to recover a business process, the more options you will have to recover it, and the less it will cost. Likewise, a business impact analysis can help you justify the expense of faster recovery capability on timesensitive processes.
“All business functions and the technology that supports them need to be classified based on their recovery priority,” Okolita writes. “Recovery time frames for business operations are driven by the consequences of not performing the functions.” If certain functions aren’t performed during the down-time, what will really happen?
To do a business impact analysis of any given team, list everything done by that group, and analyze each of these functions against three areas: “financial risk of not performing that function, regulatory risk of not performing that function, and customer or reputational risk of not performing that function,” writes Okolita. “… It is all about impact. What happens to the company if we do not do this?” Then, part two of the process is to ask, how long before we see this impact?
To help you assess levels of recovery, you might create a chart where you assign each business function a rating.
Business Impact Analysis Format Business Continuity Whitepaper
The next step is to understand your exposures and make good decisions about your recovery strategy. If you have a solid strategy, developing your plans becomes straightforward. “The most critical part of the whole process is your business impact analysis, including the risk assessment,” said Debbie Hoppenjans, manager of business continuity planning at Siemens IT Solutions and Services. “That’s where you need to spend most of your time.”
“All business functions and the technology that supports them need to be classified based on their recovery priority,” Okolita writes. “Recovery time frames for business operations are driven by the consequences of not performing the functions.” If certain functions aren’t performed during the down-time, what will really happen?
To do a business impact analysis of any given team, list everything done by that group, and analyze each of these functions against three areas: “financial risk of not performing that function, regulatory risk of not performing that function, and customer or reputational risk of not performing that function,” writes Okolita. “… It is all about impact. What happens to the company if we do not do this?” Then, part two of the process is to ask, how long before we see this impact?
To help you assess levels of recovery, you might create a chart where you assign each business function a rating.