Find out which interruptions matter, to whom and how quickly
A business impact analysis (BIA) examines the consequences of interruption to activities and determines recovery priorities and resource dependencies. It provides important continuity inputs; in regulated financial services it should also be reconciled with important business services and the firm’s impact tolerance decisions. The most dangerous BIA is one that confidently states recovery objectives nobody has challenged against customer harm.
We structure interviews around outputs rather than departmental status. A back-office team may be essential because a missed reconciliation makes customer instructions unworkable, even if its role appears secondary on the organisation chart.
The workshop questions that change the plan
What must be delivered at the firm’s busiest period? How does harm develop over minutes, hours and days? Which clients would have no accessible alternative? What manual workaround exists and what volume can it safely sustain? Which staff, data, locations, software, clearing systems and suppliers are essential? Which regulatory or contractual obligations would be affected by a degraded service?
The answers should be evidence-backed where possible. Estimates and assumptions remain visible until confirmed by owners or exercises.
MTPD, RTO, RPO and impact tolerance are not synonyms
A maximum tolerable period of disruption (MTPD) expresses the time beyond which the impact of an activity’s interruption becomes unacceptable in a continuity analysis. A recovery time objective (RTO) targets how soon a system or activity should recover. A recovery point objective (RPO) describes acceptable data loss measured in time. For FCA operational resilience, an impact tolerance concerns the maximum tolerable disruption to an important business service and considers client harm and system risks, not just technology restoration.
An organisation can meet its database RPO and still breach a service-level harm tolerance when transactions are unavailable or customer communications fail.
Typical BIA outputs
The work produces an approved scope, process and service inventory, consequence assessments, prioritised recovery objectives, resource dependencies, owner decisions, unresolved assumptions and recommended tests. For an integrated BCM programme, BIA findings inform strategies and plans. For a resilience programme, they contribute to but do not replace the formal important-business-service and tolerance analysis.
Keep the BIA alive
New products, outsourced processing, key people and seasonal peaks change the assumptions. A BIA that sits untouched until the next audit may cease to represent the operating model. The final handover should therefore specify who reviews the register and what material changes trigger an earlier revisit.
Frequently asked questions
Is a BIA compulsory for every firm?
That depends on the standards, contractual commitments and regulations applicable to the organisation. It is a common foundational continuity practice.
Who should participate?
Service and process owners, operations, IT, risk, supplier managers, continuity specialists and the decision-makers who can validate harm.
Can a BIA replace a scenario test?
No. A BIA develops priorities and assumptions; testing challenges how the organisation would perform under disruption.