Skip to content
Docs

BIA overview

The BIA is the annual analysis of which activities the company cannot afford to lose, and how fast each must come back. It is desk work in ERM Core: the risk function prepares it, the entity’s own approver signs it off, and BCP Core reads the result.

Who uses it: the Entity Risk Manager and the BCP head; unit heads and Risk Champions draft their own team’s activities. See Roles and permissions.

What a BIA is for

Section titled “What a BIA is for”

The BIA serves ISO 22301 cl. 8.2.2. For every activity that delivers the company’s products and services, it records how long the company can live without it and how fast it must recover — so that continuity plans, call-tree priorities and exercises are built around what matters most. See Standards mapping.

The annual cycle

Section titled “The annual cycle”
  1. Prepare. Each team lists its activities with their recovery times and minimum staffing — Critical activities.
  2. Map dependencies. The people, sites, systems, suppliers and data each activity relies on, with single points of failure flagged — Dependencies.
  3. Link. Each activity is tied to the RCSA risks that threaten it and the hazards its scenarios must cover — Linking to risks and hazards.
  4. Approve. The entity’s own Entity Risk Manager or BCP head approves the BIA, which creates a new version — Approval and versions.
  5. Use. BCP Core reads the approved version.
BIA links RCSA and BCP CoreA critical activity in the BIA shows the residual score of each RCSA risk that threatens it, and each risk shows that it protects the activity. Hazard types from the group taxonomy name the scenarios to cover. BCP Core reads the approved BIA for the call tree, work status and exercise log.ERM CORE · RCSAERM CORE · BIABCP CORE · READS APPROVED BIAResidual scoreprotects activityscenarios to coverRisk registerresidual scoreprotects critical activityCritical activityMTPD · RTO · RPOcriticality tier (computed)Hazard typesgroup taxonomyCall treecritical teams firstWork statusminimum staff · RTOExercise logscenarios by hazardLEGENDRead from RCSAShown backBCP Core reads
The BIA sits between RCSA and BCP Core: it reads residual scores from RCSA, and BCP Core reads its critical activities, RTO and minimum staffing.

How BCP Core uses the result

Section titled “How BCP Core uses the result”
BCP Core readsFor
Critical activities and their criticality tierWhich teams the call tree reaches first
RTOHow fast each activity’s team must be back at work
Minimum staffingWork-status planning during an incident
Activities and their hazardsWhich scenarios exercises must cover

Pages in this section

Section titled “Pages in this section”
IDPageFor
B5.2Critical activities — MTPD, RTO, RPO, minimum staff; the computed criticality tierEntity Risk Manager, unit heads
B5.3Dependencies — five kinds; single points of failureEntity Risk Manager, unit heads
B5.4Linking to risks and hazards — activity ↔ RCSA risks, activity ↔ hazard typesEntity Risk Manager
B5.5Approval and versions — the entity’s own approval; every version keptEntity Risk Manager, BCP head
Section titled “Related”