Business Impact Analysis
What you must understand
The BIA is the analytical heart of BC. Candidates must know how to identify critical business functions/processes, their dependencies (people, technology, facilities, suppliers, data), and quantify impact over time across financial, regulatory, operational, reputational, and safety dimensions. Master these terms: MTPD/MAO (maximum tolerable period of disruption / maximum acceptable outage - when impact becomes unacceptable), RTO (target time to restore the function), RPO (acceptable data loss), and WRT (work recovery time). The RTO must be less than the MTPD, and the gap is the WRT. Understand that BIA outputs drive strategy selection and plan priorities.
Traps in questions
- Reversing MTPD and RTO: MTPD is the deadline set by the business; RTO is the target for recovery and must fit inside it.
- Treating RPO as a time-to-restore metric; RPO is about data loss.
- Letting IT dictate RTOs; RTOs come from the business impact analysis.
- Forgetting that impact is time-phased - impact grows the longer an outage lasts.
Worked example / rule of thumb
Order processing has an MTPD of 48 hours. The team sets RTO = 24 hours; WRT = 24 hours available for validation and catch-up. Rule of thumb: RTO + WRT ≤ MTPD, and RPO ≤ RTO for dependent data. If a stem shows an RTO longer than the MTPD, that answer is wrong.