ISO 22301 business impact analysis: how to run one management will act on

What does ISO 22301 require of a business impact analysis?

ISO 22301 requires a documented process that analyses the impact of a disruption on the organisation as time passes, and uses that analysis to decide which activities come back first. The standard defines the business impact analysis in exactly those terms, and places the requirement in clause 8.2, where it is paired with the risk assessment.

Within that clause, the BIA is expected to:

• define the types of impact and the criteria that matter in the organisation's context;
• identify the activities that support the delivery of products and services;
• assess how the impact of disrupting each activity grows over time, using those criteria;
• identify the point after which not resuming an activity would become unacceptable, and the shorter time frame within which it is to resume at an acceptable level;
• use the results to identify and prioritise activities;
• determine the resources each prioritised activity needs, and its dependencies inside and outside the organisation, including partners and suppliers.

ISO/TS 22317 gives guidelines on running a BIA but deliberately does not prescribe one uniform method. What the certification auditor tests is whether your method produces those outputs, consistently, and whether the results were used.

Impact criteria: the decision management takes before the workshops

Most BIAs that management ignores went wrong here. If each process owner judges severity on a private scale, every activity is rated critical and the results cannot be compared. The fix is a short impact scale, written once, approved by top management and used in every interview.

The finance band and the client thresholds belong to the business, not the consultant; sign-off by the sponsor turns the scale into the organisation's stated appetite for disruption.

Running the BIA with process owners

The analysis is only as good as the people in the room. Questionnaires sent by email come back late, optimistic and inconsistent; a facilitated session of about two hours per department, with the manager and the person who actually does the work, produces better answers in less total time.

Start from products and services, not from the organisation chart

List what the organisation delivers to clients within the certificate scope, then trace the activities each one depends on. Support functions such as payroll or facilities appear where a client-facing activity needs them.

Ask how the damage grows, hour by hour and day by day

For each activity, walk the impact scale across set time points, for example four hours, one day, three days, one week and a month. Ask for evidence: the contract clause, the regulatory deadline, the month-end peak.

Capture resources and dependencies while the owners are present

Record the minimum people and skills, the workspace, the applications and data, the equipment, and the internal teams and outside suppliers each activity needs to run at its reduced, acceptable level. Suppliers found here feed the supply chain work that ISO/TS 22318 guides.

From impact curves to recovery time frames

The time point at which the impact reaches the level management called unacceptable is the maximum tolerable period of disruption for that activity. The recovery time objective is then set inside it, leaving room for the unexpected. Where information matters, the team also agrees how much data loss is acceptable, and the minimum capacity at which the activity must run during the disruption.

Two cross-checks keep the numbers accurate. First, a dependency cannot recover more slowly than the activity that needs it: if claims handling must resume in a day, the claims system and the people who run it must too. Second, the time frames must be compared with what the organisation can actually do today. The difference is the gap management has to close.

The BIA then feeds the risk assessment in the same clause, which looks at the scenarios that could disrupt the prioritised activities and their resources, and decides which risks need treatment.

A worked example: a contact centre serving three clients

The table follows four activities in a fictional outsourced contact centre. The time frames are illustrative decisions of that company, not benchmarks; real values come from your own criteria, contracts and management's approval.

The analysis shows something the organisation chart hid: scheduling, an internal activity, must recover faster than one of the client services, because every shift depends on it. That is the kind of finding management acts on.

Turning the analysis into decisions management will take

A long spreadsheet of ratings is evidence, not a decision. Present the results as a pack of two or three pages:

• the prioritised activities in recovery order, with their time frames;
• for each, whether today's capability meets the objective, and by how much it falls short;
• the options for closing each gap, with their capacity, time frame and cost described in ranges;
• the decisions needed and a date for them.

Management's approval of the time frames and the chosen options is the bridge to clause 8.3, Business continuity strategies and solutions; our ISO 22301 requirements guide follows that chain. Plans written later are tested against the same objectives in business continuity exercises, and the BIA is evaluated again at planned intervals, after an incident or invocation and when significant changes occur.

The record the auditor asks to see

Expect requests for the approved impact criteria, the method, the completed analysis with its time frames, the resource and dependency lists, evidence of management approval and the date of the last review. What must be retained is covered in the ISO 22301 documentation guide.

Mistakes that make a BIA shelfware

• Every activity rated critical. Without approved criteria, owners protect their own teams, and a list where everything comes first sets no priority.
• Objectives nobody can meet. Time frames agreed in a workshop but never compared with current capability give management nothing to decide.
• Suppliers left out. The telephony carrier or payroll provider is often the single point of failure the analysis should have found.
• Written once, never revisited. A new client, site or system changes the priorities; an analysis older than the business it describes will not survive the auditor's questions.

Business impact analysis: questions buyers ask