Business Impact Analysis questionnaire template
One of the first steps in preparing for a Business Continuity Plan and developing a Disaster Recovery Plan is to first identify the impact that your business would experience as the result of a disaster.
Engage with senior management (as this process takes up considerable time and needs focus and attention to be worthwhile), prepare for a workshop by sending out questionnaires to gather information from each department or business unit;
Business Impact Analysis questionnaire template
Function – What is your Business Unit responsible for? (List all processes and responsibilities – label each function with a capital letter – e.g. “A”. If relevant, also list sub-functions with a small letter – e.g. “a”)
| Ref | Function | Description |
| A | Accounts Receivable | Processing of incoming payments |
| a | Collections | Tracking and following unpaid income |
| C | Order processing | Collating orders to produce invoices |
Outputs – Which processes, departments or third parties depend upon your outputs? (List all ‘downstream’ activities and products, refer to the letter of the responsibilities from above item. Label each downstream output with a number– e.g. “3”). This may include customers, executive management, data or products that another internal department needs.
| Ref | Function | Output | Description | Benefactor |
| 1 | A | Invoice generation | Preparation of invoices for sending to debtors | Customers (debtors) |
| 6 | B | Monthly reports | Financial reports and analysis | Departmental Managers |
Dependencies – Which processes or departments or data providers does your Business Unit depend upon to complete normal activities? (List all ‘upstream’ dependencies, refer to the letter of the responsibilities from first item. Label each upstream dependencies with a Roman numeral – e.g. “iv”). This may include paperwork, data, authorisations, external organisations etc.
| Ref | Function | Dependency | Description | Supplier |
| iii | C | Order data | Orders come in via customer calls | Call Centre, IT, CRM system |
| xi | J | Tax rules | Updated tax rulings | Supplier X over Internet |
| xiv | A | Credit Card orders | Timestamp for orders must be accurate | IT via NTP system |
Time – How long does it take for each of your department’s outputs? (List each numbered output, the frequency and the time it takes to generate the output. Cross reference with relevant function letter or output number)
| Ref | Function | Task | Description | Time |
| A | A | Invoice generation | Julie and Emma prepare invoices daily | 8 mins per invoice |
| 6 | B | Monthly reports | Financial reports and analysis | 16 man hours per report |
Costs – What is the cost of performing activities to produce your outputs? (List per hour / per day / per item / per person – refer to the letter of the responsibilities from the function list. If relevant, refer to the cost from an upstream dependency with its Roman numeral)
| Ref | Function | Cost Description | Description | Costs |
| 1 | A | Invoice generation | Preparation of invoices for sending to debtors | $0.25 for paper & post, $7.22 for staff |
| vi | B | Oracle support | Charges from external vendor for support and systems | $10k pm |
Revenue – What revenue does your department generate for each responsibility your unit provides (include per hour / per day / per item / per person direct revenue – refer to the letter of the responsibilities from your list of functions and, if relevant, refer to reference number of downstream outputs)
| Ref | Function | Revenue description | Description | Revenue |
| 1 | A | Invoice generation | Invoicing | $87,346 per day |
Tools – What are your main business tools and systems (include software application names and connected database/source name, tools such as computer / phones / fax / Internet / printing / photocopying, include office supplies such as pre-printed forms. Cross-reference with the function letter and who provides the tools.
| Ref | Function | Tools | Description | Provided by |
| 1 | A | Payments module | Oracle eBusiness Suite | IT |
| 1 | A | Revenue module | Oracle eBusiness Suite | IT & external support |
MAO – How much time can elapse before a major impact is felt by the business as a whole? (List each of your functions by letter and evaluate how long it can be idle for; specifying days, weeks or hours)
| Ref | Function | MAO description | Description | MAO time |
| 1 | A | Invoice generation | Preparation of invoices | up to one business week |
| 2 | B | Vendor payment – X | Payment to vendor X for service Y | 30 days after monthly invoice |
RPO – Of your dependencies, how long does that information remain in an easily accessible state? (This may be orders / records on paper or an external system / database. List each dependency by Roman numeral and then how long the source information is available)
| Ref | Function | RPO description | Description | RPO time |
| 1 | C | Orders to invoices | Orders are retained in CRM system for 30 days | 15 days |
| 6 | B,b,D | Monthly reports | Financial reports and analysis | 90 days |
People – Who are your critical or key people or teams? What are their key responsibilities or skills? (List each function by letter or output by number, and specify the title or name of the person and what their function is. This may include Subject Matter Expert, security clearance or access, authorisation and skill base) Also provide a list of alternatives, such as people or teams who could achieve a similar quality output if the primary person is unavailable.
| Ref | Function | People | Description | Capability |
| 1,2 | A,B,C | Julie Jones | Financial controller | Skilled with eBusiness Suite |
| 1 | A,a | Emma Smith | Financial clerk | Only knows invoicing and collections |
| 4,7,9 | B | John Anderson | Departmental Manager | Departmental Management, 24×7 access |
| 3,4,5,6,7 | B,b,C,D | Peter Ngyuen | Operational Support | SME in all financial systems, trained in Z |
Workarounds – List all conceivable alternatives for your functions and outputs. (Consider paper-based processes, bill estimation, working from home, outsourcing, etc. List by reference to letter of function, number of output or Roman numeral of dependencies)
| Ref | Function | Workaround name | Description | Location of instructions |
| 1 | A | Typewritten invoices | Preparation of invoices by typewriter | Filing cabinet B |
| 6 | B | Monthly reports | Financial reports and analysis | Cloud storage X |
Regulation – Provide a list of all relevant regulatory or compliance requirements that need to be met. (Include reference to output numbers and function letters if relevant).
| Ref | Function | Regulation | Description | Timescale |
| 6 | B | Monthly reports | Financial reports and analysis | Tax reports must be submitted monthly |
Analysis of BIA questionnaires
Now comes the interesting part. Once you have gathered information from departmental managers and leaders of business units, hopefully this will have made them think a little more about their functions. The next step is to analyse the responses and start prioritising the results. I find that this is best done by a third party (i.e. no vested interest in their department’s functions being considered more critical than the others) and drafted for further review.
The review of the prioritisation of the results should be discussed in a workshop with all the contributors. This will allow the results to be clarified or reviewed – for example, can you really tolerate a month of data loss because all records arrive on paper before they are entered? How long would it take to re-enter the backlog?
This workshop should end up with a consensus of the most important business processes, how long they can be inoperable for, alternatives or workarounds and impact to the business. This will allow the business to decide which business processes should benefit from the maximum BCP and DR planning.
