30/07/2026
Following on from the article prepared by the Engineering area of Mapfre Global Risks in 2025, titled How to ensure business continuity in the event of a disruptive incident, this article aims to address, in a general manner, the establishment, implementation, and maintenance of the Business Impact Analysis (BIA) process within the process of implementing a company’s risk management system.
The development of the Business Continuity Management System (BCMS) is based on two organizational analyses, namely Business Impact Analysis (BIA) and Risk Analysis (RA).
The BIA facilitates an evaluation of the consequences that an activity interruption can have on the organization over time. The results of the analysis form the basis for establishing priorities, defining strategies and recovery plans, as well as determining the resources necessary to guarantee continuity of operations in the event of a business interruption.
Complementarily, RA provides an overview of the threats, vulnerabilities, and risk scenarios that may affect the prioritized activities and essential resources of the organization, by identifying and evaluating the risks that may impact its products, services, processes, and/or activities, and critical resources.
Together, both results (BIA and RA) serve as the basis for the design and implementation of solutions, strategies, and continuity plans within the BCMS. This means that the rigor, quality and reliability of both processes, as well as the conclusions they produce, are critical factors in ensuring the effectiveness and resilience of the organization’s business continuity system.
Why is it so important to prepare a BIA within the BCMS?
A BIA seeks:
- To identify critical business products, services, processes and/or activities.
- To evaluate impacts in case of interruption (financial, operational, legal, reputational).
- To define the relevant recovery times (Recovery Time Objective (RTO), Recovery Point Objective (RPO), and Maximum Tolerable Period of Disruption (MTPD)).
- To prioritize business continuity processes, activities, and resources.
- To support decision-making when designing contingency plans and allocating the necessary resources.
- To facilitate the business continuity plan, which is the basis on which recovery strategies are designed.
BIA concepts and types
BIA is an integral part of the continuous life cycle to confirm the business continuity requirements in an organization, which leads to the identification and selection of business continuity solutions.
BIA considers both the products and services offered by an organization as well as the processes, activities, and dependencies that ensure the provision of same.
Three types of BIA are considered:
- Product and service: identifies and prioritizes products and services.
- Process: determines the process or processes necessary to offer the organization’s priority products and services.
- Activity: identifies and prioritizes the activities that provide the most urgent products and services, and determines the resources and dependencies necessary to ensure continuity of these activities.
Many approaches can be followed to carry out a BIA and organizations don’t have to apply all three types of BIA – they can choose to use them individually or combine them to find the most suitable approach, depending on the size, complexity, and type of the organization, as well as the scope of the BCMS in question. For example, those organizations that are process-oriented (manufacturing sector) typically follow the process BIA, whereas companies that are less focused on processes can skip it and go directly to the activity BIA.
Main phases of the process of preparing a Business Impact Analysis (BIA) study
When developing the BIA, the following phases are considered: (Source: Good Practice Guidelines Edition 7.0)
1. Review of the context and scope of the BIA, due to its strategic nature, must be validated and approved by senior management.
2. Definition and assignation of functions and responsibilities of the people involved in the development of the BIA within the organization, thereby ensuring effective coordination and the proper process development.
3. Development of BIA implementation plan, including the approach adapted to each organization and the methodology to carry out said analysis.
4. Determination of the priorities for products, services, processes, and associated activities, considering the different types of impact (financial, reputational, legal, operational) and their possible internal or external origin.
5. Determine the resources necessary to guarantee continuity of activities after an incident, as well as all other dependencies and interdependencies.
6. Carrying out a final analysis to consolidate the results of the BIA.
7. Obtain approval from senior management on the BIA results, ensuring recognition of the priorities and response times needed in the event of an interruption.
8. Define and include a periodic review of the BIA as part of the continuous improvement strategy.
Recovery times against a business interruption
The determination of recovery times constitutes one of the most relevant results of the BIA as it allows for the establishment of those continuity requirements necessary to ensure the organization’s resilience in the face of an interruption, thereby avoiding unacceptable impacts. Setting down recovery times means the organization has objective criteria to prioritize the recovery of its products, services, processes, and critical activities.
As such, the correct definition and validation of these times is essential to ensure that the BCMS is capable of effectively responding to disruptive incidents, minimizing operational, financial, legal, and reputational impacts, and guaranteeing the continuity of the organization’s critical activities.
The main recovery times considered in the business impact analysis are according to ISO 22300:
• RTO – Recovery Time Objective
Maximum objective time within which an activity, process, service, or system must be restored after an interruption to avoid unacceptable impacts on the organization.
• MTPD – Maximum Tolerable Period of Disruption
Absolute maximum time that an organization can tolerate an activity being interrupted before the consequences seriously compromise its viability, legal compliance, reputation, or operational capacity. (Note: RTO ≤ MTPD)
• RPO – Recovery Point Objective
Maximum loss of acceptable data, expressed as a period of time, after an interruption. This determines how much historical information can be lost without causing unacceptable consequences.
Example:
Telecommunications company with a core operating center in Spain.
Conclusions
In an environment increasingly exposed to risks and disruptions, BIA and RA are essential strategic tools to strengthen organizational resilience. While the BIA enables identification of critical activities, establishing priorities, and defining the recovery requirements necessary to ensure the continuity of products and services, the RA provides an overview of the threats and vulnerabilities that may compromise their operation. The integration of both analyses provides a solid basis for decision-making, efficient allocation of resources, and the design of continuity strategies proportional to the risks and needs of the organization, thus contributing to improving its responsiveness, adaptation, and recovery in any disruptive scenario.
Ultimately, the quality, rigor, and reliability of BIA and RA are critical factors for designing and implementing effective continuity strategies, strengthening organizational resilience, and ensuring responsiveness and recovery in situations of crisis or business interruption.
