Business Impact Analysis Explained for CISA and CISM
A business impact analysis (BIA) is the foundation of continuity and recovery planning. Both exams test what it produces and who owns it.
What a BIA does
A BIA identifies the organization's critical processes and measures how the impact of their disruption grows over time. From that, it sets recovery priorities and objectives.
Key outputs
- A list of critical business processes, ranked.
- Impact over time — financial, operational, regulatory, contractual, safety and reputational.
- Maximum tolerable downtime for each process.
- Recovery time and recovery point objectives.
- Dependencies — systems, data, suppliers and key people.
- The minimum service level acceptable during disruption.
Who provides the inputs
Business process owners. They understand what an outage really costs. IT contributes dependency information, but a BIA built by IT alone is a classic exam trap.
How the BIA is used
- Recovery strategies are chosen to meet each process's objectives at a justified cost.
- Restoration order follows criticality and recovery objectives.
- Incident severity is informed by the business impact the BIA describes.
- Gaps between required and actual recovery capability are reported to the owner for a decision on investment or acceptance.
When to update it
Periodically, and whenever the business changes significantly — new products, acquisitions, reorganizations or new dependencies. An outdated BIA leads to the wrong priorities.
BIA versus risk assessment
- A BIA asks: if this process stops, how bad is it over time?
- A risk assessment asks: how likely are the events that could stop it, and how should we treat them?
Both are needed; they answer different questions.
Exam patterns
- Who sets the RTO? → The business owner, based on the BIA.
- A process with low revenue but strict regulatory deadlines → can still be critical.
- Conflicting department priorities → escalate to executive management to arbitrate.
Related on Auditor Path
Sources
ISACA CISA exam content outline, Domain 4 Part B — Business Impact Analysis; ISACA CISM exam content outline, Domain 4 Part A.