Business Impact Analysis
Business Impact Analysis
handbook
November 2015
health.wa.gov.au
Contents
What is a Business Impact Analysis 3
Process 3
Templates and tools 5
Carrying out the BIA 6
Step 1 Preparation and set-up 6
Step 2 Dependencies Assessment 7
Consolidated dependencies profile 9
Step 3 Impact assessment 10
Consolidated BIA profile and priorities 12
Step 4 Business continuity strategies and resource requirements 13
2
BIA Handbook November 2015
Purpose
The purpose of this handbook is to provide guidance on how to undertake a
Business Impact Analysis (BIA) using the templates and tools that have been
developed for healthcare facilities in the Department of Health. There is, however, no
requirement to standardise the BIA – health services and divisions are free to use
other BIA methodologies and tools that are deemed appropriate so long as the
objectives of the BIA are met. These objectives are described in the sections below.
Whilst all the daily activities1 carried out in a healthcare facility are important, not all
these activities are “time critical”. In the event of a major disruption, some of these
activities could temporarily be suspended with little or no negative consequences on
patient care or the broader health system. On the other hand, some activities have
very low tolerances for disruption because the consequences of disruption on the
organisation are unacceptable, even for a few minutes or hours. The BIA allows you
to prioritise the activities from a time perspective, separating those that are time
critical from those that are not.
The BIA is an important process as it allows the organisation to determine the scope
that will form the cornerstone for the development of business continuity strategies
and response plans.
Process
The BIA is a 4-step process as illustrated in Figure 1 below:
1
The term ‘activities’ is used broadly to include services, functions and processes that are
undertaken in a business area
3
BIA Handbook November 2015
4
BIA Handbook November 2015
Approach
The BIA should be conducted with managers who have overall responsibility for a
department, unit, or business area. They must be able to “stand back” and provide
an organisation-wide perspective when assessing the impacts of disruption, and
have the authority to make an educated determination of the recovery priorities for
activities within their department or unit.
Inputs should be sought from multiple participants so that the analysis is balanced
and not based on the opinions of a single person. For this reason, the BIA is best
conducted in a facilitated workshop setting with department and unit managers.
BIA workshops should be conducted for each directorate. Depending on the size of
the directorate, you may need to have separate workshops for each department /
unit to keep it manageable. The BIA is conducted bottom-up – i.e. information is
collected at the unit / business area level, and then rolled-up and consolidated at the
department / directorate and organisation-wide level.
2
The Impact Reference Table is a subset of the Consequence Description Table found in
the RiskBase (version 3) DoH Data Definitions document. The table has been simplified by
removing the impact categories that are not relevant for business continuity. Note that
RiskBase will be discontinued from March 2016.
5
BIA Handbook November 2015
Key tasks: 1. Identify the directorates and units / Business Areas in the
organisation, and the managers responsible for these areas.
2. Identify the sub-units (if appropriate) under each Unit /
Business Area.
3. Identify the activities that are performed in each Sub-unit (or
Unit / Business Area if Sub-units are not applicable).
6
BIA Handbook November 2015
Who should Senior staff members with good operational knowledge. Results
provide inputs: are to be reviewed by the respective Unit / Business Area
managers
Approach: One-on-one / small group interview with facilitator
7
BIA Handbook November 2015
8
BIA Handbook November 2015
Template / None
tool:
Objectives: To present a consolidated view of the resource dependencies
across the healthcare facility
Who should The person who is coordinating business continuity across the
provide inputs: healthcare facility will consolidate the information when all the
units / business areas have completed Step 1.
9
BIA Handbook November 2015
Who should Managers for the respective Units / Business Areas. Results to be
provide reviewed and endorsed by the Director
inputs:
3
MTPD refers to the maximum amount of time that an activity can tolerate a disruption
before the impact on the organisation becomes unacceptable
10
BIA Handbook November 2015
participants
11
BIA Handbook November 2015
Template / None
tool:
Objectives: To present the consolidated findings of the impact assessment
for Executive management endorsement
Who should The Business Continuity Coordinator for the healthcare facility is
provide inputs: responsible for consolidating the information when all the units /
business areas have completed Step 3.
Key tasks: 1. Upon completing the impact assessments for all the
Directorates, the results (from WS3) should be consolidated
and presented to the Executive for endorsement.
2. As a general guideline, all activities with MTPDs of 2 weeks
or less are considered as “priority activities” and must fall
within the scope of the organisation’s business continuity
strategies and response plans
12
BIA Handbook November 2015
Who should Managers for the respective Units / Business Areas. Results to
provide inputs: be reviewed and endorsed by the Director
Note:
There may be instances where the Immediate and
Sustainable continuity strategies are the same
Examples of strategies include (not exhaustive)
o Temporary suspension of an activity
o Redirecting the activity to another facility
o Transferring resources to another facility
o Redirecting patients to alternate care options
o Using alternate procedures / workarounds
o Stopping altogether until full recovery can be
achieved, etc.
13
BIA Handbook November 2015
People
14
BIA Handbook November 2015
WS4C Interdependencies
15
Attachment 1 Impact Reference Table
SEVERITY LEVEL 1 2 3 4 5
CONSEQUENCE
CATEGORIES Insignificant Minor Moderate Major Catastrophic
FL FINANCIAL LOSS
$5,000 to less than
(Destruction, Theft, or Less than $5,000. $100,000 to less than $3M. $3M to less than $20M. $20M +.
$100,000.
Litigation / penalties)
Headline profile. Repeated
exposure. At fault or Maximum multiple high-level
Non-headline exposure. Repeated non-headline unresolved complexities exposure. Ministerial
Non-headline exposure.
RI REPUTATION AND Clear fault. Settled quickly exposure. Slow resolution. impacting public or key censure. Direct intervention.
Not at fault. Settled
IMAGE by Departmental response. Ministerial enquiry / briefing. groups. Ministerial Loss of credibility and public
quickly. No impact.
Negligible impact. Qualified Accreditation. involvement. High priority / key stakeholder support.
recommendation to preserve Accreditation withdrawn.
accreditation.
Major breach of contractual Serious breach of contractual
Breach of contractual or or statutory obligations. Non- or statutory obligations. Non-
Innocent procedural
Breach, objection/complaint statutory obligations, or compliance results in compliance results in loss of
breach. Evidence of good
NC NON- lodged. Minor harm with probity infringements. Lack termination of process or accreditation, litigation or
faith by degree of care /
COMPLIANCE investigation. Evidence of of good faith evident. Non- imposed penalties, formal prosecution with significant
diligence. One off minor
good faith arguable. compliance results in investigation or disciplinary penalty. Dismissal.
legal matter. Little impact.
performance review. action. Ministerial Ministerial censure. Public
involvement. enquiry
Increased level of care Increased level of care Increased level of care Increased level of care Death, permanent total
(minimal). No increase in (minimal). Increased length (moderate). Extended length (significant). disability.
length of stay. Not of stay (up to 72 hours). of stay (72 hours to one Extended length of stay ALL SAC 1 EVENTS.
disabling. Recovery without week). Recovery without (greater than one week).
complication or permanent significant complication or Significant complication Major / debilitating and long
HP HEALTH IMPACT disability. significant permanent and/or significant permanent term impacts on individuals
ON PATIENT(S) / Little or no noticeable disability. disability. and overall delivery of
STAKEHOLDERS impact on patient care**. Inconvenience & minor ALL SAC 1 EVENTS services**
delays to individuals but little Moderate impacts on a
or no impact on overall number of individuals, Serious impacts on
service delivery** resulting in noticeable impact significant numbers of
on overall service delivery** individuals, resulting in
noticeable impact on overall
service delivery**
OO Material delays. Marginal Significant delays. Non-achievement of
ORGANISATIONAL Little impact. Inconvenient delays. under achievement of target Performance significantly objective / outcome. Total
OBJECTIVES performance. under target. performance failure.
*Note: Table is a subset of the Consequence description table in the Riskbase DOH Data Definition. Text in italics added to provide clearer contextual
reference for the purpose of the BCM Business Impact Analysis
16
Attachment 2 Dependency Rating Table
Level Description
Minimal There is minimal dependency on this resource. Resource is nice to have; successful delivery of critical
1
dependency services or completion of a task is possible without this resource
There is low dependency on this resource for the successful provision of critical services or completion of
Low
2 a task; an outage will have minimal material impact; the task can still be successfully completed using
dependency
manual workarounds or alternative resources as a stop gap measure until the resource is available again.
Successful delivery of critical services or completion of a task is occasionally dependant on this resource;
Occasional
3 an outage may cause some inconvenient delays in completion of a task but parts of the task can be
dependency
successfully completed using manual procedures or alternative resources for a period of time.
Successful delivery of a critical service is fully dependant on this resource; resource is used regularly for
High processing; an outage may result in significant knock on effects; there is low tolerance of an outage
4
dependency before the impact becomes unacceptable; limited manual workaround or alternative resource may be
used for a short period of time as a stop gap measure.
Successful delivery of a critical service is fully dependant on this resource; resource is used continuously
Critical for processing or to provide real time feedback/information; resource must be operational 24 x 7; an
5
dependency outage may result in serious knock on effects; there is close to zero tolerance of an outage before it
becomes unacceptable; there are no or very limited manual workaround or alternative resources.
17
Attachment 3 Consolidated Dependencies Assessment – People and Infrastructure (Sample)
People Utilities / Essential services Office equipment and telecommunications Medical equipment Specialised equipment Key consumables
Air-conditioning / Heating
Personal computer
Document scanner
Laptop computer
Medical oxygen
Medical suction
Internet access
Printer (colour)
DECT Phones
Mobile phone
Fax machine
Nursing staff
Clinical staff
Photocopier
Technicians
Desk phone
Natural gas
Medical air
Ventilation
Orderlies
Power
Tablet
(LPG)
Water
Pager
Service Area
Operation Theatre services 5 5 4 2 4 5 5 5 5 5 5 5 5 5 4 2 5 5 3
Central Sterilisation 5 5 5
Services Dept
Day Stay Unit services 5 4 5
Administration and Medical 5 2 5 3 5 4 3 3 3 5 3 3 5
Records
Nursing 5 3
Allied Health 5 5 3 3 5 4
Aged Care Services 5 4 4 4 4 5
Community Mental Health 5 3
Emergency Department 5 5 4 2 3 5 5 5 5 5 5 5 5 5 5 4 3 3 3 5 5 5 5
Inpatient Medical & Nursing 5 5 5
Care
Maternity 5 5 3 2 2 5 4 5 5 5 5
Hospital Management 5 3
Home Nursing Discharge 5 3
Services
Pharmacy and Supply 5 3 5
Food Services 5 5 5 5
Laundry Services 5 5 5 3
18
Attachment 4 Consolidated Dependencies Assessment – Systems and Applications (Sample)
Business areas
Laundry Services
Food Services
Allied Health
# Services System Data
Maternity
Services
Records
Nursing
Level of
Dept
using this offline loss
dependency
application duration duration
Applications
Health Records Management + 9 5 30 mi 0 3 4 4 2 5 5 4 3 1
Scanning and eForms (eHRM)
WebPAS 13 5 30 mi 0 2 2 2 4 5 5 5 3 2 1 1 4 5
Clinical Pathology (Ultra/LIS) 0 5 1h 0
Theatre Management System (TMS) 14 5 3h 0 3 3 2 2 4 5 5 5 3 2 1 1 4 5
Internet 15 5 1h N/A 1 1 2 4 5 5 5 3 2 1 1 4 5 2 4
eReferrals 13 4 6h 0 2 2 4 5 5 5 3 2 1 1 4 5 5
Cardiobase 0 4 4h 1h
Enterprise Bed Management (EBM) 13 4 4h 1d 1 3 3 2 2 4 5 5 5 3 2 1 1
Diet Management 10 4 1d 0 2 4 5 5 5 3 2 1 1 4
HealthPoint (Sharepoint Intranet) 14 3 6h 1d 5 5 5 3 2 1 1 5 5 5 3 2 1 1
Haematology & Oncology Protocols & 9 3 1d 0 2 5 5 5 3 2 1 1
Prescriptions (HOPP)
MS Exchange 9 3 1d 0 5 5 5 3 2 1 1 4 2
WA Nephrology Database (WAND) 0 3 1d 0
Journeyboard 11 3 3d N/A 3 2 1 1 4 2 4 2 1 1 5
ScriptTracker2 8 2 3d N/A 5 5 5 3 2 1 1 5
19
BIA Handbook November 2015
MTPD
Branch / Business Sub Unit Service / activity
2 hrs 4 hrs 8 hrs 1 day 3 days 1 wk 2 wks 1 mth+
Area
20
This document can be made available in alternative formats
on request for a person with a disability.
Copyright to this material is vested in the State of Western Australia unless otherwise indicated. Apart
from any fair dealing for the purposes of private study, research, criticism or review, as permitted under
the provisions of the Copyright Act 1968, no part may be reproduced or re-used for any purposes
whatsoever without written permission of the State of Western Australia.