yurolaitsalbert - Fotolia
How do a business impact analysis and risk assessment differ?
When it comes to disaster recovery strategy, business impact analyses and risk assessments both play key roles. Make sure you include them in your DR planning.
Risk assessments and business impact analyses are two key elements of a disaster recovery plan. Both involve assessing disruptive events and use the results to strengthen a disaster recovery strategy, but they are not interchangeable. In order to have an airtight DR plan, an organization should conduct both a business impact analysis and risk assessment.
At first glance, a business impact analysis and risk assessment may seem to perform a similar purpose, but each one addresses a different critical aspect of DR planning. Risk assessments analyze potential threats and their likelihood of happening, a business impact analysis explains the effects of particular disasters and their severity.
To understand the differences between a business impact analysis and risk assessment, it helps to know the reason behind each process, as well as how and when each is performed.
What is a risk assessment?
A risk assessment seeks to identify situations that might be disruptive to the business. Risk assessments are often performed for the business as a whole, but IT-specific risk assessments are also common.
Risk assessment reports usually identify risks in a wide variety of areas, including cybersecurity, telecommunications failures and geopolitical incidents. Natural disasters are a common area of concern addressed in risk assessments. An organization in a coastal area might be at risk of having a hurricane disrupt the business disrupted. The hurricane could potentially cause a long-term power failure or even flooding of the data center.
Risk assessment reports also commonly include human-error based actions. These risks might be accidental, such as a user deleting a file, or they might be deliberate actions such as a disgruntled employee who infects the organization with malware.
Sometimes risk assessments even include risks that are not directly tied to the business. For example, a large-scale terrorist attack in the area might prevent a company from being able to do business for a period of time, even if the company was not a direct target of the attack.
Risk assessment vs. business impact analysis
Conversely, a business impact analysis is a study that seeks to determine how the disruption of key business processes will affect the business.
The contents of the business impact analysis will be different for every organization, because the report reflects heavily on the nature of the business. For example, one factor that a healthcare organization would likely address in a business impact analysis report would be HIPAA violations.
In contrast, a manufacturing company would not be subject to HIPAA, but there might be other industry-specific incidents and regulations that must be considered.
One of the most common factors in business impact analysis reports is lost revenue due to the inability to service clients. Another consideration is increased costs due to things such as IT overtime hours, emergency hardware acquisitions or cloud costs. Depending on the incident's nature, the organization might also lose customers who have lost trust in the organization. Additionally, an organization might suffer penalties and legal fees related to a failure to meet its contractual obligations.
For all practical purposes, a business impact analysis and risk assessment should be considered discrete processes; they are far from unrelated. A business impact analysis report is essentially an extension of a risk assessment report. Whereas a risk assessment report seeks to identify risk factors, a business impact analysis report tries to predict how any identified risks will actually affect the business if they occur.
