The OGO Blog

Business Continuity Planning (BCP) and Business Impact Analysis (BIA)

Business continuity plans aid in your credit union’s ability to recover from disaster and maintain operations for members. Clearly, it’s an important set of contingencies to keep in mind. Part of business continuity planning is having a business impact analysis (BIA). But what is a business impact analysis? And does your credit union need one?

Business impact analyses are sets of data that form the foundation of a strong business continuity plan. These sets of information concern various effects and setbacks that might affect different business processes. As the name suggests, performing a business impact analysis serves to assess what type of impact a particular issue will have on a one of your business processes. 

Now, does your credit union need a business impact analysis? In short, yes. The BIA is the cornerstone of all of your credit union’s planning. The data you receive from it allows you to better understand exactly how long the specific system or process will be affected and what effect that will have on any related or interconnected systems. A comprehensive evaluation of threats--and what impact those threats might have--is the key to building an efficient pathway back to peak productivity.

Your credit union might be impacted in several ways, so it’s best to gauge repercussions over several areas. Try to ask questions about different areas.

  • How will a disaster impact members?
  • How will it impact facilities?
  • How might it affect operations?
  • Will this increase our exposure to fraud?
  • Is IT able to recover quickly?

Speaking of recovery, recovery time is one of the most important things to be aware of when estimating business impact. Often, it may be easy to look at one aspect of recovery and then apply that specific recovery time to everything else that relies on it. For example, if the server is down, maybe you can get the server back up quickly. However, just because the server is back up doesn’t mean that the entire system is back online and ready to serve members, or that the staff is prepared. A reasonable recovery time objective has a broader valence: it encompasses one particular business function recovering all aspects of that business function.

As with all things related to business continuity, business impact planning is always better when it’s tested. If you’ve ever cooked a meal, you’ll know that best results come from persistent testing of the recipe. You don’t want to over-salt, nor under-season, or leave something on the burner too long. Even tried-and-true recipes benefit from a little tweaking here and there to better fit the palates of the diners. If you wait until you serve the food to sample it, you may find that not everything tastes as you’d expect and it may not be to your liking. Similarly, with business impact planning, your credit union will be well served to test impact and recovery as you go. If you expect a certain impact and recovery to take four hours, run a test to see how long it really takes. If you can’t hit that four hour time, not only will you gain valuable insight as to what all you need to take into account in recovery, but you can also adjust your practices to reach your desired recovery timetable.

Business impact analysis is extremely valuable for any credit union looking to best serve their members in any emergency event. By accurately profiling what effect various problems might have, you’ll get a clearer picture and build a better plan for recovery.

Learn more about Business Impact Analysis:

10 Common Mistakes Made When Developing Your Credit Union Business Impact Analysis

How to Interpret Your Credit Union Business Impact Analysis Results