Business Impact Analysis
Purpose
The BIA quantifies how the organization is hurt as a function or process stays down over time. It drives prioritization and recovery objectives - and therefore every strategy decision downstream.
Concepts you must know
- Impact categories - financial, operational, regulatory/legal, reputational, safety, contractual.
- Impact over time - impact is plotted against elapsed time, not stated as a single number.
- MTD (Maximum Tolerable Downtime) - the longest outage before unacceptable harm.
- RTO (Recovery Time Objective) - target time to restore the process; must be less than the MTD.
- WRT (Work Recovery Time) - time to validate, catch up backlog, and return to normal.
- RPO (Recovery Point Objective) - acceptable data loss, measured backwards in time.
- Dependencies - internal teams, applications, vendors, facilities, people, records.
- Criticality tiers and prioritization for recovery sequencing.
Traps in questions
- Stating RTO as equal to MTD, or greater than it.
- Confusing RPO (data loss) with RTO (time to restore).
- Assuming the BIA selects the strategy - it defines requirements; strategy selection is the next domain.
- Using only financial impact and missing regulatory or reputational harm.
- Interviewing only management and skipping process performers.
Rule of thumb
RTO + WRT ≤ MTD. If a process has an MTD of 72 hours, a 48-hour RTO leaves 24 hours of work recovery time.
Worked example: Payroll must run within 5 business days or staff are unpaid (MTD = 120 hours). Restoration takes 36 hours and validation/backlog catch-up 12 hours, so RTO = 36 and WRT = 12; 48 ≤ 120, comfortably compliant. Data can be up to 4 hours old - RPO = 4 hours.