Risk Assessment and Business Impact Analysis
Two complementary analyses
Risk assessment looks forward at what could happen: it identifies threats and vulnerabilities, estimates likelihood and impact, and produces a ranked risk picture that drives treatment. Business impact analysis (BIA) looks at consequence over time: it identifies critical activities, then quantifies how impact grows as disruption lengthens. The BIA output is a recovery time objective (RTO) per activity and a recovery point objective (RPO) for data, plus dependencies and minimum resource needs.
Concepts to hold firmly
- Maximum tolerable period of disruption (MTPD) is set by the business and is the outer limit; RTO must be shorter than MTPD, never equal to it.
- Impact categories typically include financial, regulatory, customer, reputational, and safety; use consistent scales.
- Dependencies include people, premises, technology, suppliers, and information; a single-activity BIA that ignores suppliers is incomplete.
- Risk assessment feeds strategy: high-likelihood, high-impact risks justify preventive controls, while high-impact, low-likelihood risks justify continuity and response capability.
Traps
- Confusing RTO (time to restore the activity) with RPO (acceptable data loss).
- Accepting an RTO copied from a system owner without business validation.
- Treating the BIA as a one-time project rather than a refresh cycle triggered by change.
- Ranking risks by impact alone while ignoring likelihood, or vice versa.
Rule of thumb
If a proposed RTO is longer than the MTPD, the strategy is non-compliant regardless of cost. Recalculate or escalate the trade-off to the business owner.
Worked example
Payroll must run within 5 days (MTPD). The team proposes a 5-day RTO. That fails, because the RTO must leave time for the activity to complete after recovery; a 2-day RTO with a tested workaround is defensible.