Guild News: A Business Impact Analysis Workbook for Practitioners

Crisis Resilience Professionals Guild | Emerging Risks Global

Why recovery priorities must be agreed before a disruption, not during it

Every continuity plan rests on a set of choices about what comes back first. Too often those choices are made in the first hour of a crisis, by whoever happens to be in the room. Loud functions get attention, quiet dependencies get missed and recovery takes longer than it should.

A business impact analysis exists to make those choices in advance. It asks how quickly harm builds when an activity stops, how long the organisation can tolerate that harm and what the activity needs to restart. Done well, it gives a continuity plan its order of play. Done badly, or skipped, it leaves the plan as a list of good intentions.

What the Workbook Does

The Crisis Resilience Professionals Guild has released the first template in its practitioner toolkit: the ERG Business Impact Analysis Workbook. It takes a practitioner from scope to sign-off in eight steps. Activity owners score impacts across six areas at five points in time. The workbook then suggests when disruption becomes unacceptable, checks that each recovery time objective sits inside the agreed tolerance and assigns a priority tier.

A dependencies sheet records the people, premises, technology, information, suppliers and equipment behind each activity. It flags any resource that would take longer to restore than the activity it supports, and any single point of failure. A one-page summary gives the sponsor the figures needed for a decision. Worked examples from a fictional logistics company show the expected level of detail.

Who It Helps

The workbook is written for business continuity, resilience, security and risk leads, for consultants running a BIA with a client and for CRPP learners practising the method.

Standards and Guidance

The workbook is structured with reference to ISO 22301:2019 and its 2024 amendment, ISO/TS 22317:2021 on business impact analysis, BS 65000:2022 on organisational resilience, ANSI/ASIS ORM.1-2017 and Principles B5 and D1 of the NCSC Cyber Assessment Framework v4.0. It is an independent ERG resource. It does not reproduce any standard and does not imply endorsement by ISO, BSI, ASIS or NCSC. Using it does not by itself demonstrate conformity.

How to Get It

The workbook is available to Guild members and ERG clients. To find out more, contact information@emergingrisksglobal.com.