By Brian Peterson, Contributor
Our Channel Explained series provides targeted articles that flesh out detail on channel terminology but avoid information overload. This week we examine the question, What is a business impact analysis?
In IT leadership circles, the term "business impact analysis," or BIA, is a common initiative, yet many people in the industry still don't completely appreciate what it's all about. Successful solution providers understand and leverage the value a good BIA brings to customers. Here we define the term, describe the process for completing a BIA and of course discuss how it can benefit both customers and solution providers.
A business impact analysis (as it pertains to IT systems) can be defined as the process of reviewing and defining the risk that an IT system or process presents to business operations when or if it fails. The BIA defines the potential cost of failures so that it can be compared against the cost of mitigation. The costs are usually financial, but can also be measured in nonmonetary terms.
It's standard practice for organizations to outsource the business impact analysis, because the evaluator must be impartial and skilled at quickly separating fact from emotion. Therefore integrators and consultants are ideal candidates to conduct a BIA.
The specific business impact analysis methodology can vary quite a bit from organization to organization, but there are some common elements. The process for most BIAs should start with the development of an application portfolio. This identifies the applications that support specific business processes like "payroll," "supply chain" or "order to cash." The BIA study then should determine the likely failure points for the components defined in the portfolio. Next, the examiner should determine the cost of such failures. The cost is often measured in expense per hour but, depending on the business process being evaluated, may instead be defined by share price, the impact of a mission failure or even life and limb.
Once the cost of a failure is understood, you should document the organization's risk appetite and define required application availability metrics like uptime, RTO (recovery time objective) and RPO (recovery point objective). The final product of a BIA is usually a gap analysis that documents the delta between the desired state and the actual current state of the IT systems that support the business.
Customers derive real value from business impact analyses. First it helps them to pinpoint areas of gaping risk and focus on patching them. It also helps the IT management team build a solid business case for investing in IT resources to resolve the problem. Finally, it ensures that the business will get the most risk reduction value out of their investment dollar.
Solution providers also benefit from a customer's BIA study -- and not just by the billable hours associated with the study. A business impact analysis provides great intelligence about a customer's business and helps the solution providers understand what is important to the customer. A BIA usually speeds up the sales process; with a defined pain point, it is much easier to craft a solution that will get funding. And delivering a BIA for customers will improve the channel professional's executive relationships in the account. BIA studies often catch the interest of senior leadership and help to build quality sponsorship at executive management levels.
About the author
Brian Peterson is a sales engineer for a value-added reseller, with a background in enterprise storage and open systems computing platforms. A recognized expert in his field, Brian has held positions of responsibility on both the supplier and customer sides of IT.
