Business impact analysis for business continuity for IT systems

It’s a tough job, but somebody has to do it. Understanding the business consequences of IT failure (or, let’s be positive, IT success) on business is essential in order to plan for uninterrupted business activity. A business impact analysis is a first step to achieving business operations that can “take a lickin’ and keep on tickin’ “. The business continuity manager or team has a choice of different tools and techniques for modeling business processes and the IT structures that support them. The goal of BIA is to be able to answer questions like: ‘“Can our business justify spending $5,000 per month on a high availability database system in order to eliminate a 10% chance of yearly database server failure that would cause business losses of $700,000?” Image source: Wikimedia.org

A complex systems universe

Even if IT systems are fundamentally built from ones and zeroes, the levels of complexity they can achieve can be staggering. As IT systems grow, their complexity soon outstrips the knowledge of any one person in the organization. The components of an IT infrastructure interact at different levels (hardware, software, human) and between different levels. Adding resources such as more servers or upgrading software increases this complexity. IT vendors provide some tools for mapping and modeling different IT resources: IBM Topology Editor for datacenter software is one example. Image source: uk.emc.com

Getting started with IT Business Impact Analysis (BIA)

Small changes in an IT infrastructure can have much larger consequences. Analyzing the consequence of failure of one component requires detailed understanding of the interdependencies between that component and the rest of the infrastructure. A BIA must take these aspects into account to help an organization answer questions like:

• Which IT systems and processes are critical to business survival?
• What is the maximum acceptable time (may be zero) that such critical systems can be down?
• In what order and with what rapidity do different IT systems and processes need to be recovered in the event of failure
• What initiatives should justifiably be taken to avoid such outages in the first place?

BIA process steps

If business impact analysis is to be taken seriously by an organization, it needs adequate sponsorship and support from senior management. With this in place, the next step is to identify participants and contributors who can provide and assemble ‘the IT facts, the whole IT facts and nothing but the IT facts – or at least a sufficiently good approximation to it. This is then fed into the analysis step itself, before documentation is done of findings and recommendations presented back to the organization.

Tools for analyzing the business impact of an IT infrastructure

Examples of top-down business impact analysis include allocating points to grade the impact of an activity on business operations, categorizing IT systems and processes as RGS (revenue generating systems) or non-RGS, or ranking them as critical (immediate recovery), vital (next day recovery), important (within three days), and non-essential (can be out for a week or more). Fault-tree analysis can be used to understand how combinations of failures may produce undesirable results, although they do not model the dynamic behavior of IT systems. A stochastic model (a software simulation for example) is better suited to model the interactions between systems, probabilities of failure and the consequences on organizational viability or business profitability. Image source: Texample.net If you’d like to know how Analytica, the modeling software from Lumina, can help you with business impact analysis for IT systems or for business activities in general, then try the free trial of Analytica to see what it can do for you.