Business impact analysis and risk assessment
Establish what disruption would cost over time, set the point beyond which it is unacceptable, prioritize activities and their recovery, and judge the events that could cause it.
01What applies
Run and maintain the processes that establish what disruption would cost the organization over time and what could cause it, and refresh both whenever the organization or its operating context changes significantly. The impact analysis settles the impact types and criteria, the activities that support products and services, how impact grows over time, the maximum tolerable period of disruption, prioritized resumption time frames at a stated minimum acceptable capacity, the prioritized activities and their resources, dependencies and interdependencies. The risk assessment then judges the likelihood and impact of events that could disrupt those activities. The clause expects both to be processes, with a trigger for refresh, not a one-time study.
02Why it matters
The impact analysis is the evidence that the recovery targets were chosen rather than copied. The risk assessment is the evidence that the threats were considered against those targets. Together they decide where the money goes. When they are done once and left, the organization is planning for the business it used to be. The draft's process view makes the handoff explicit: the BIA output is the input to every later strategy decision.
03What good looks like
Refresh the analysis on a trigger list: new product, new site, new supplier, acquisition, regulatory change, a disruption, or the annual review, whichever comes first. Ask the service owners for impact over time, not for a single recovery time. Record the criterion behind each number. Keep the risk assessment scoped by the prioritized activities, so it cannot drift into a general threat register.
04Evidence an auditor asks for
Ask a service owner why the recovery time is what it is. If the answer is a number copied from a template, the impact analysis did not set it.
| Evidence | The record |
|---|---|
| Processes | Documented BIA and risk assessment processes, with a refresh trigger |
| Impact analysis | Impact types, criteria, activity inventory, impact over time and maximum tolerable period of disruption |
| Recovery targets | Prioritized time frames at a stated minimum acceptable capacity, approved by management |
| Risk assessment | Likelihood and impact criteria, scoped by the BIA outputs |
| Refresh | Evidence of review after significant change |
05Where it commonly fails
- Both analyses performed once and treated as permanent
- No defined trigger for refresh
- Risk assessment run without reference to the BIA outputs it should be scoped by
06What to do before the estimate
List the six triggers that would force a refresh. Put the next review date in the BCMS calendar and name the owner.