BUSINESS IMPACT ANALYSIS QUESTIONNAIRE

Description:

A business impact analysis (BIA) is a systematic approach to evaluating the potential effects of disruption to
critical business operations as a result of a disaster, accident or emergency. In other words, a BIA predicts the
consequences of disruption to business functions and gathers information needed to develop recovery strategies.

Risks, threats and potential loss scenarios regarding operations, financial performance, reputation, employees and
supply chains will be identified and outlined. This questionnaire will aid your business continuity team in gathering
information from department heads, preparing a findings report and presenting results to senior management.

Purpose:

Completing a business impact analysis is a crucial part of a successful business continuity plan. The goal of the
BIA is to identify critical business functions and describe the resources needed to recover if a disaster or disruption
were to occur. Information gathered from interviewees will help your business continuity team prioritize available
equipment and resources during and after a crisis.

Objectives:

The objectives of a business impact analysis are as follows:

• To identify business processes and prioritize them according to criticality
• To identify key systems, equipment and applications associated with critical business processes
• To identify anticipated recovery times associated with critical business processes
• To identify the potential impacts to the organization should a disruption occur
• To identify interdependencies associated with the organization, its processes and its stakeholders

Directions for Business Continuity Coordinators:

An essential part of conducting a business impact analysis is to meet with department supervisors and critical staff
members of your organization and review the topics outlined in this questionnaire. These individuals possess the
most knowledge of their disciplines in the event of a crisis.

Begin the meeting by discussing the purpose of business continuity planning. Then, provide each staff member with
a copy of this document. Discuss each page and provide a deadline for staff members to fill out the form.

Note that completing this document will likely take a considerable amount of time, as each section requires
substantial detail and insight. Notify staff that you intend to make yourself available should they need assistance
completing the document. Let staff know that you will be checking in periodically to see how they are progressing.

Participants can work together to discuss each topic. Responses should be recorded in the text boxes provided
below each section. Following the initial meeting, you may find it helpful to send occasional reminder emails and
encourage staff to complete the BIA in a timely manner.

Once you have collected these forms from all participants, your business continuity team will be ready to assemble
an executive summary that prioritizes the most important business functions in your organization, the true impact
of business interruptions, legal and regulatory requirements, and acceptable levels of downtime and losses. Senior
management will review this report to determine disaster recovery strategies that account for maximum permissible
downtime for important business functions and acceptable losses in areas such as data, finances and reputation.

1
 BUSINESS IMPACT ANALYSIS
Date of Interview:
Department:
Department Location (Building, Floor):

Department Participants

Unit Manager/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

Interviewee/Title:

Phone:
Email Address:

2
 BUSINESS IMPACT ANALYSIS QUESTIONNAIRE
Please fill out the following discussion questions to the best of your ability as they pertain to your specific
department or unit. Direct questions to your assigned business continuity coordinator.

Key Business Processes

List key processes in your department (internal and external) that are necessary to continue critical business
functions in the wake of a crisis or disruption. Describe each process in a short, concise phrase.

Notes:

Interdependencies Among Units/Processes

For each key process listed, define any interdependencies between other processes, units, or systems.
Specify if the interdependency is internal or external (such as supply chains or vendors) to the organization.
List dependencies on facilities, IT systems, funding, critical personnel, vendors or suppliers, etc.

Notes:

Criticality and Timeliness of Business Processes

Prioritize key processes using a scale of 1 to 10 (1 = least important, 10 = most important).

How crucial is each process to the success of everyday operations and to the organization?
Determine minimum acceptable recovery time frames for each process.

Notes:

3
Alternative Processes and Resources

State alternate procedures that can be used in lieu of the principal process. Describe alternate procedures for all
business processes, staffing requirements and resources. Examples may include using paper work orders/forms,
temporary staffing, access to alternate operating resources, etc.

Notes:

Work Backlog

In the event of a disruption or crisis, how long would it take (in minutes or hours) to process daily backlogs for each
day or downtime? State a timeframe for each critical business process, application or system.

Notes:

Critical Records

Specify critical business records by name, media type, location and alternate location (as necessary).
Are records stored in a safe location? Are they able to be easily recovered in a natural disaster, like a tornado or flood?
Note: Physical files and records should be scanned and uploaded to a cloud-based document repository for
safekeeping.

Notes:

Reporting Requirements

What specific internal/external reporting is required within your unit on a day-to-day basis?
Does your unit have regulatory reporting requirements? If so, specify.
Include the report name, author(s), recipient(s), frequency, delivery requirements, variances allowed and penalties (if any).

Notes:

4
Potential Recovery and Restoration Issues

Define any potential recovery issues in terms of 1) difficulty to recover operations, 2) time needed to recover and 3)
resources needed to recover. Define any potential restoration issues in terms of difficulty to restore operations to an
as-normal or near-normal state.

Notes:

Outage Tolerances

If a crisis were to occur (such as the destruction of the organization’s headquarters), how many hours or days
could your business unit, system or application remain unusable before its loss would significantly impact the
organization, its stakeholders, suppliers and regulators? Discuss and clarify below.

Notes:

Maximum Disruption Time Allowed

Determine the maximum amount of time (i.e. hours, days, weeks, months) that your unit’s functions, processes,
systems, employees and office space could remain unavailable before the organization would experience significant
loss of business, market share, revenues and customers.
List maximum disruption time for all business functions, processes and systems.

Notes:

Disruption Impact by Timeframe

Define the impact to your unit and the organization if a crisis were to occur at specific times of the year, or on
certain days of the month. Would specific time frames, days, weeks, months or holidays contribute to additional
disruptions in productivity? State any busy or time-sensitive occurrences.

Notes:

5
Disruption Impact by Incident Type

List and discuss various outages and disruption types (i.e. tornado, flood, power outage, active shooter or intruder,
bomb threat, compliance breach, theft, cyberattack, employee injury, a sudden change in the chain of command, etc.)
Based on the information provided in this document, specify the degree of severity each disruption would have on
your unit’s productivity and ability to function.

Notes:

Disruption Impact by Operation

Define operational impacts to your unit if a crisis were to occur. Examples include impacts to cash flow, competitive
position, public image, reputation, staff morale, employee hiring and retention, financial reporting, stakeholder
perceptions and shareholder perceptions.

Notes:

Financial Impacts

If a disaster were to occur, determine the estimated impact to your department’s earnings, profits, expenses, etc. in
a variety of time frames, such as days, weeks and months.

Notes:

Minimum Acceptable Staffing Levels

Specify the minimum number of people needed for your unit to operate as-normal or near-normal following a crisis,
disruption or unanticipated event.

Notes:

6
Minimum Number of Systems and Tools Needed

Specify minimum number of physical systems to resume limited operations following a crisis. List the number of
servers, routers, switches, workstations, laptops, phones, electronics, tools and copiers needed.
Specify minimally necessary operating systems, databases, applications, utilities, etc. needed for employees and
operations.

Notes:

Minimum Infrastructure Requirements

Specify such items as power, HVAC, voice and data communications, water supplies, food supplies and medical
equipment needed in case of an emergency.

Notes:

Minimum Acceptable Workspace Requirements

Specify such items as office supplies, furniture, lighting, phone/data connections and electrical outlets needed
following a crisis.
Is there a possibility that your unit can continue to function by working in an alternative location? If so, where?

Notes:

7
Anticipated Changes to Business

Provide details on special situations that may affect the organization’s recovery (i.e. mergers, acquisitions, planned
physical moves, etc.)

Notes:

Additional Information

Specify any other issues or concerns that may affect the ability of your unit or organization to recover after a crisis.

Notes:

Note: This document is intended to foster discussion amongst supervisory staff and leadership in your organization.
It is not intended to be an all-inclusive questionnaire. Your organization may choose to add to, remove or edit these
questions to meet its specific needs.

8
The Ultimate Software for Safety, Security and
Risk Management in Your Organization’s Buildings
AkitaBox is the leading facility management software provider dedicated to improving the
way people manage and interact with the buildings they occupy. Founded in 2015, AkitaBox
currently supplies facility management software and implementation services to over 250
million square feet of educational, commercial, healthcare and governmental organizations
in the United States.

Our mission is to empower building teams to make data-driven decisions that impact the
places we live, work and play. As a one-stop shop for data collection, location-based asset
mapping, preventive maintenance management, document management and work order
management, you are sure to find a solution that meets your needs.

With an à la carte service offering, AkitaBox works with you to identify the best solutions to
meet your individual facility’s needs. With custom-tailored training and support, our team of
success managers will guide you through the entire process from start to finish in as little as
90 days.

To learn more, visit AkitaBox.com.