Light Dark

What is Business Impact Analysis? 


Introduction 

 

In the modern world, changes in a business’s strategy can have radical implications. An organization must find a way to see the effect of a change before it takes place. Doing so will future-proof the organization against new innovations and enable a business to make the right decision at the right time. 

This is where Business Impact Analysis (BIA) comes in. BIA is a widely used method for predicting the impacts that an action will have on a business.

 

 

 

What is Business Impact Analysis? 

 


Any firm would love to be able to predict the future, but in the absence of a crystal ball, firms need a way to ensure business decisions won’t have adverse effects on business function. 


Impact Analysis is a common operation in  Enterprise Architecture modeling; taking an item and examining what the potential effects would be of changing that item, based on the dependencies that you have mapped. For example, you might use impact analysis upon a server to understand what the potential impact would be if you needed to take it offline for an upgrade. You could use impact analysis to find out “if we take this server offline, then employees will not be able to submit expense reports”.


The goal of business impact analysis is to see what would happen if a change occurs, which help in making the right decision on the necessity of the change. There are typically sets of metrics that firms are seeking to improve upon, such as Recovery Time objectives (RTOs), recovery points objectives (RPOs) and Maximum acceptable outages (MAOs).


It is often the first step in the development of a business continuity plan, and can be a vital asset in the development of overall business resilience.


There are a variety of different areas that a firm may wish to analyze, though Orbus Software specifically focus on Technology-Business Impact Analysis. A firm might seek to answer questions like: 


  • What is the impact on my business processes if we change this database? 
  • What are the financial impacts of upgrading a technology component? 
  • A certain system software is going out-of-support by the vendor in 6 months’ time, what is the impact on our business operations?

What is the purpose of Business Impact Analysis? 

 


A business will never get anywhere if it does not prepare for risk. Whether it is the more mundane risk associated with supply chain issues, demand crises and technological change, or more exotic dangers such as the recent coronavirus pandemic, the company that is prepared will be in a much stronger long-term position than one that isn’t.  


The classic case for impact analysis is where an organization wishes to understand the potential effect of taking a server offline or bringing an application down. In other words, what are the business functions and business processes that will be affected if a certain part of the IT infrastructure is no longer available (either temporarily, or permanently)?


There are several reasons why this question might be asked. At a tactical level, a software upgrade or preventative maintenance on hardware might involve downtime and an awareness of what the business impact of such downtime would be is of obvious value. At the same time, strategic projects such as application portfolio consolidation initiatives, or datacenter migrations, need to know which business functions will need to be dealt with when they take applications offline.

 

Impact Analysis - Impact analysis of a Server

While most businesses will have some capacity to deal with shocks and plan ahead, an impact analysis has crucial advantages. Formal analysis scenarios and reports can reduce the difficulties faced by novice firms and enterprise architects, while giving key stakeholders a much greater understanding of the process and its outcomes. Traditional business tools such as SWOT analysis are still fine for getting a grip on risk, but a BIA report is clear, quantifiable and detailed.

Research Library

Program Management and Architecture

Enterprise Architecture May 19, 2023

eBook exploring the Architecture value that can be provided at the Program level to deliver on your Application Platforms.

The Program Manager and Program Architect have a delicate balance to achieve between addressing the above questions, delivering Program priorities and meeting Enterprise demands across various stakeholders (business and technology). The roles and delivery process is made more complex if key Architecture inputs such as Target State models are not in place or if there is not a strong governance structure to drive the consensus needed to support effective Program delivery

Program delivery momentum and alignment is driven through a mature set of Enterprise level artefacts in an organization and if that level of visibility and endorsement is not present then the lack of clarity and understanding is permeated through the decision making of the key technology and business teams. Ideally an endorsed Architecture framework that identifies the key Enterprise Platforms required in a target state and the context in which they will operate provides the necessary guidance for Program and Project planning and delivery.

Significant value can be generated by the Enterprise and Program Architect to map out the Program impact and contribution to Application Platforms from each of the Project releases. Without this clarity, these issues are a significant drag on your agility and ability to respond to a changing customer profile and market opportunities.

In this eBook, I will explore the Architecture value that can be provided at the Program level to deliver on your Application Platforms and the Architecture opportunities and challenges that can exist in delivering Program and Project outcomes in your environment.

Login to continnue reading and download the ebook.

program-management-architecture
Enterprise Architecture IT Portolio Management White Paper

Role Redefinition

As described earlier, the basis of impact analysis is to identify the mapping of different elements to each other. These mappings allow the identification of potentially impacted components. It turns out that most process mapping is concerned with identifying the roles that are responsible for performing a given activity.

Impact Analysis - Role Redefinition

What this means is that by taking an overall view across all process maps, a business analyst can then gain a view of all activities that this role performs, across all process maps. By using this implicit mapping, it is possible to understand the impact of a change to a role, by understanding the activities that will be impacted.

Impact Analysis - Tasks the Impact Manager Performs

Challenges for Impact Analysis

 

Predicting the future is always going to be easier said than done. There are a number of common problems a firm may face when starting an impact analysis:

  • Picking the right question: Performing an effective business impact analysis will in part depend on the question you are trying to answer, and the data you have available. Questions with a very wide scope will be much harder to analyze.
  • Inaccurate or unavailable data: A prediction is only as good as the facts you are basing it on. Data issues can take a wide range of forms, from internal problems with a lack of documentation or poorly managed archives, to external issues relating to untrustworthy sources or a lack of research.
  • Lack of procedures: Though impact analysis sounds simple on the surface, creating reports and analysis with no experience is not easy. Having pre-defined templates and reports can speed up the analysis process massively.
  • Domain specific problems: Different business areas that are subject to impact analyses can have specific issues related to each area. For example, a technology impact analysis will struggle if cross layer links between IT and Business architecture are not clear. 
  • Stakeholder buy-in: This can be an issue for any business initiative, and business impact analysis is no different. A properly conducted impact analysis can encompass an entire organization, and if any parts are not on board, this can cause issues for data collection, reporting or even post-analysis implementations.

Download report

How to Architect Enterprise Resilience

Everyone is talking about business resiliency, but too often, we see organizations lack the ability to address business and technology resiliency in a strategic, comprehensive and integrated manner across lines of business.

Document Tracing

 

A second area that process maps often consider is which documents are updated by the fulfilment of certain activities.

Impact Analysis - Input and Output documents

This mapping exercise is useful in itself but as we have already seen, having these mappings also opens the door to understanding what process activities might be affected by a change to a document. A common example of this would be how a change in law can require the update of a quarterly report to an industry regulator.

Impact Analysis - Activities affected by the Compliance Report

We have considered some of the ways that the techniques of impact analysis, although more commonly used by the more technical parts of the enterprise, can deliver significant value by building on the process mapping activities undertaken at the business level. Taking advantage of impact analysis does require that the necessary mappings between items exist (or that there is resource available to perform the mapping), but such mappings are already commonly performed in process mapping exercises, in which case it makes sense to take maximum advantage of the corporate intellectual property that has been developed in this way.</

How to succeed with an impact analysis

 

In order to carry out an impact analysis the organization must first map functions and how they depend on applications, how applications depend on physical hardware...and then trace through from end to end. This can be a manual process, where an architect looks back through historical models to understand this information. Alternatively, many modeling tools have some form of impact analysis functionality.

Orbus Software’s iServer365 tool has built-in impact analysis capabilities, with the central repository containing technology assets, process models and mapping relationships between them, enabling rapid identification of how external events might spread.

More broadly, there are a few general actions that a firm can take to perform a successful impact analysis. Partly this will involve solving some of the common challenges described above; a lot can be solved by properly consulting stakeholders and maintaining control of IT architecture. 

When addressing the scope of a business impact analysis, the widely used SMART method can help to rein in excessive analysis, notably with regards to timing and specificity. 

Having a convenient and reliable method of collecting information is another wise choice. IServer solves this through the central repository model, but even without such a tool there are solutions such as cloud-based storage and automated data collection through forms.

Summary

 

As the events of 2020 have demonstrated, businesses need to be prepared to face a huge number of different challenges. While there will always be certain events outside of a firm’s control, what can be prepared for should be prepared for. Business Impact Analysis, whether for technological change, process change, organization change or product change, can offer protection from significant impacts and ensure business continuity.

 

Further reading

Research Library

Program Management and Architecture

Enterprise Architecture May 19, 2023

eBook exploring the Architecture value that can be provided at the Program level to deliver on your Application Platforms.

The Program Manager and Program Architect have a delicate balance to achieve between addressing the above questions, delivering Program priorities and meeting Enterprise demands across various stakeholders (business and technology). The roles and delivery process is made more complex if key Architecture inputs such as Target State models are not in place or if there is not a strong governance structure to drive the consensus needed to support effective Program delivery

Program delivery momentum and alignment is driven through a mature set of Enterprise level artefacts in an organization and if that level of visibility and endorsement is not present then the lack of clarity and understanding is permeated through the decision making of the key technology and business teams. Ideally an endorsed Architecture framework that identifies the key Enterprise Platforms required in a target state and the context in which they will operate provides the necessary guidance for Program and Project planning and delivery.

Significant value can be generated by the Enterprise and Program Architect to map out the Program impact and contribution to Application Platforms from each of the Project releases. Without this clarity, these issues are a significant drag on your agility and ability to respond to a changing customer profile and market opportunities.

In this eBook, I will explore the Architecture value that can be provided at the Program level to deliver on your Application Platforms and the Architecture opportunities and challenges that can exist in delivering Program and Project outcomes in your environment.

Login to continnue reading and download the ebook.

program-management-architecture
Enterprise Architecture IT Portolio Management White Paper

Business Impact Analysis for Process Improvement

 

At Orbus, we see noticeably less usage of impact analysis in the context of the business process environment. But as we will argue, the technique of impact analysis is equally useful when applied to processes, and for the same reasons.

As described, impact analysis is a common problem faced at the application and technology levels. But the technique of impact analysis is equally useful at the business process levels, e.g. understanding who is using which forms, which roles perform certain decisions...all help to understand the best way to process.

Modeling a process in a notation such as BPMN provides a firm foundation for carrying out this type of impact analysis—particularly if existing processes are well-managed and stored in a common repository. Having a clear view of the "as is" allows us to clearly see where the changes would apply, and allows us to see the areas that will be impacted.  Of course, the model will rarely give us a full picture of impacts—but it will signpost where we should look and will guide our further analysis and discussions.

Let’s consider some specific examples that show how impact analysis is useful in the business process arena.