Back to Basics is a weekly feature that highlights important but possibly overlooked information that any EHS professional should know. This week, we examine how to prepare for a disruption of business operations by doing a business impact analysis.
As you prepare your business for any possible emergency, it makes sense to do a business impact analysis (BIA) to predict the potential impact that may occur after a business function or process is disrupted. This will help you gather information to develop recovery strategies, as well as boost your preparedness through prevention and mitigation strategies.
The Federal Emergency Management Agency’s (FEMA) Ready.gov spells out how to conduct a BIA and how it fits into your preparedness activities.
As you put together your BIA, consider the following operational and financial impacts of a business disruption:
- Lost sales and income
- Delayed sales or income
- Increased expenses (e.g., overtime, outsourcing, expedited costs)
- Regulatory fines
- Contractual penalties or loss of contract bonuses
- Customer dissatisfaction or defection
- Delay of new business plans
As with pretty much everything in life, timing is important. If the disruption occurs during a crucial time—like a store suffering damage just before the holiday shopping season—it could have a serious impact on the loss sustained. Similarly, a power outage lasting for hours could significantly hurt a business.
A business disruption could be caused by:
- Physical damage to a building or buildings
- Damage to or breakdown of machinery, systems, or equipment
- Restricted access to a site or building
- Supply chain interruption, including failure of a supplier or disruption of transportation of goods from the supplier
- Utility outage
- Damage to, loss, or corruption of information technology, including voice and data communications, servers, computers, operating systems, applications, and data
- Absenteeism of essential employees
To conduct the BIA, survey managers and others within your business using a BIA questionnaire. Ask them to identify how the business function or process they are responsible for will be affected by a disruption. In addition, the BIA should list the critical business processes and resources needed for the business to continue functioning at different levels, according to Ready.gov.
The BIA report should list the potential impacts resulting from the disruption of business functions and processes. Consider scenarios resulting in significant business interruption in terms of financial impact, comparing these costs with those of possible recovery strategies.
After you conduct the BIA, you should then develop a business continuity plan and information technology disaster recovery plan, according to Ready.gov.