BUSINESS IMPACT ASSESSMENT (BIA)

1. List your organisation’s Key Functions in priority order.

Key Functions
1.
2.
3.
4.
5.
6.

2. Using the guidance set out below undertake a Business Impact Analysis of your department, filling in your answers to the following questions on the blank BIA Proforma sheet under the relevant headings:

PEOPLE PREMISES PROCESSES PROVIDERS PROFILE

Key Staff:
What staff do you require to carry out your key functions?
Buildings:
What locations do your department’s key functions operate from? (Primary site, alternative premises)
IT:
What IT is essential to carry out your key functions?

Reciprocal Arrangements:
Do you have any reciprocal agreements with other organisations?

Reputation:
Who are your key stakeholders?

Skills / Expertise / Training:
What skills / level of expertise is required to undertake key functions?

Facilities:
What facilities are essential to carry out your key functions?

Documentation:
What documentation / records are essential to carry out your key functions, and how are these stored?

Contractors / External Providers:
Do you tender key services out to another organisation? If so – to whom and for what?

Legal Considerations:
What are your legal, statutory and regulatory requirements?

Minimum Staffing Levels:
What is the minimum staffing level with which you could provide some sort of service?
Equipment / Resources:
What equipment / resources are required to carry out your key functions?
Systems & Communications
What systems and means of communication are required to carry out your key functions?

Suppliers:
Who are your priority suppliers and whom do you depend on to undertake your key functions?

Vulnerable Groups:
Which vulnerable groups might be affected if your organisation fails to carry out key functions?

BIA PROFORMA FOR YOUR DEPARTMENT (Function…………………………………………..…….)

PEOPLE PREMISES PROCESSES PROVIDERS PROFILE

Key Staff:

Buildings:

IT:

Reciprocal Arrangements:

Reputation:

Skills / Expertise / Training:

Facilities:

Documentation:

Contractors / External Providers:

Legal Considerations:

Minimum Staffing Levels:

Workstations:

Systems & Communications

Suppliers:

Vulnerable Groups:

CONSIDERATIONS FOR INCREASING YOUR ORGANISATION’S RESILIENCE

PEOPLE PREMISES PROCESSES PROVIDERS PROFILE

Key Staff:
Can staff be contacted out of hours?

Could extra capacity be built into your staffing to assist you in coping during an incident?

Buildings:
Could you operate from more than one premise?

Could you relocate operations in the event of a premise being lost or if access to the premise was denied?
IT:
Is data backed-up and are back-ups kept off site?

Do you have any disaster recovery arrangements in place?

Reciprocal Arrangements:
Do you have agreements with other organisations regarding staffing, use of facilities in the event of an incident?

Reputational Damage:
How could reputational damage to your organisation be reduced?

How could you provide information to staff and stakeholders in an emergency (e.g. press release)?

Skills / Expertise / Training:
Could staff be trained in other roles?

Could other members of staff undertake other non-specialist roles, in the event of an incident?

Facilities:
Are any of your facilities multi-purpose?

Are alternative facilities available in the event of an incident?

Documentation:
Is essential documentation stored securely (e.g. fire proof safe, backed-up)?

Do you keep copies of essential documentation elsewhere?
Contractors / External Providers:
Do you know of alternative contractors or are you reliant on a single contractor?

Do your contractors have contingency plans in place?

Could contractors be contacted in the event of an incident?
Legal Considerations:
Do you have systems to log decisions; actions; and costs, in the event of an incident?

Minimum Staffing Levels:
What is the minimal staffing level required to continue to deliver your key functions at an acceptable level?

What measures could be taken to minimise impacts of staff shortfalls?
Equipment / Resources:
Could alternative equipment / resources be acquired in the event of an incident / disruption?

Could key equipment be replicated or do manual procedures exist?
Systems & Communications:
Are your systems flexible?

Do you have alternative systems in place (manual processes)?

What alternative means of communication exist?
Suppliers:
Do you know of suitable alternative suppliers?

Could key suppliers be contacted in an emergency?
Vulnerable Groups:
How could vulnerable groups be contacted / accommodated in the event of an incident?

USING BUSINESS IMPACT ANALYSIS TO BUILD A PLAN

BIA
Identifies your requirements for continuing your key functions Business Continuity Plan
Documents how your requirements identified in the BIA can be achieved
PEOPLE o Key Staff
o Key Skills
o Expertise / competence required
o Minimum staffing levels required to continue / recover key functions
o Notification / invocation procedure / protocol
o Management structure for dealing with an incident
o Information and advice to staff (response procedures)
o Key staff / contact list (including out of hours details)
o Multi skill training in key areas
o Reciprocal Arrangements to cover staff short falls
o Home working
o Staff welfare issues
PREMISES o Key facilities
o Key Equipment
o Key Resources
o Specialist Equipment
o Security / restrictions
o Alternative sites
o Alternative facilities o Loss / damage assessment
o Site security
o Relocation arrangements / protocol
o Inventories of equipment/ resources and details of how to recover these
o Salvage, site clearance and cleaning arrangements
PROCESSES o Key processes
o Critical periods
o Key IT systems / applications
o Key documentation / data
o Record keeping requirements
o Key communication requirements o Action cards for recovery of key processes
o Checklists
o Copies / Back-ups / safe storage (recovery procedure)
o Contingency procurement arrangements
o Documented manual procedures
o Data recovery procedures
PROVIDERS o Key dependencies (supply and receipt)
o Key suppliers
o Key contractors / service providers / suppliers
o Reciprocal arrangements in place with other organisations
o Contact details for key providers / contractors / suppliers / support services
o Alternative suppliers (required for key functions)
o Alternative providers (required for key functions)
o Alternative contractors (required for key functions)
o Resilience capability of suppliers / provider / contractors to business disruption
o Third party business continuity arrangements
PROFILE o Key stakeholders
o Legal / statutory / regulatory requirements
o Vulnerable groups
o Communication strategy / plan / procedures
o Stakeholder liaison (regulator, clients, unions)
o Media liaison
o Public information / advice
o Notification of at risk groups / alternative care arrangements

CMS March 26 2019