Use cases for business impact analysis
Summarize
Summary of Use Cases for Business Impact Analysis
The Business Continuity Management (BCM) application in ServiceNow enables organizations to assess the impact of downtime on business services, processes, and technical entities like datacenters and applications. Business Impact Analysis (BIA) is a critical step in managing business continuity by identifying critical processes, minimizing disruptions, and guiding improvements for protecting financial and technical assets. The use cases presented are generic scenarios intended to help customers understand potential implementations, which may vary based on individual environments.
Show less
Categories of Impact Analysis
- Business Impact Analysis: Focused on business users managing services or processes, helping to prepare for process changes, identify issues, and mitigate risks related to unexpected events.
- Technical Impact Analysis: Targeted at IT managers or application owners, this analysis evaluates the impact of downtime on applications and IT systems, helping to plan for changes and understand affected areas.
Goals and Methods for Business and Technical Impact Analysis
Business Impact Analysis: Business users analyze the criticality of processes and the organization's tolerance for downtime. Key assessment questions include the impact on customers, revenue, reputational damage, penalties, costs, and dependencies on supporting systems.
Technical Impact Analysis: IT owners determine application criticality, survival timelines without the application, and backup frequencies. Assessment questions focus on business impact due to application failure, employee and customer impact, data types, and data change frequency.
Using the Business Impact Analysis Workflow in BCM
ServiceNow BCM users can perform BIA using a structured workflow based on pre-defined templates configured by BCM administrators. These templates provide assessment questionnaires tailored to organizational needs. BCM leads and program managers respond to these questionnaires, which drive key outputs such as recovery time objective (RTO), recovery point objective (RPO), recovery tiers, and dependency assessments.
- Assess recovery tiers for processes or applications.
- Identify recovery time and recovery point objectives.
- Determine dependencies including people, facilities, applications, and vendors.
Outcomes Delivered by BCM Impact Analysis
Upon completion, the BCM application calculates and displays key results on the business impact analysis record, including:
- Recovery Tier: Classification of process criticality (e.g., critical or non-essential).
- Recovery Time Objective (RTO): The allowable downtime duration for survival without the process.
- Adjusted RTO: Option to modify the RTO based on practical considerations, with recorded justification.
- Dependencies: Identification of essential supporting systems and resources required for normal operations.
These outcomes enable ServiceNow customers to prioritize recovery efforts effectively and build resilient business continuity plans.
You can use the Business Continuity Management application to assess the impact of a downtime on your business services or processes and technical entities such as datacenters or applications. For creating a business impact analysis for your organization, you can refer to the common use cases that are used for managing the business continuity tasks.
Importance of performing the impact analysis
- Prevents and minimizes unintended disruptions to your normal business functions.
- Helps you identify the critical business processes for your organization and develop strategies to prevent future issues.
- Assists in planning for the protection of your financial and technical assets.
- Offers guidance and support about the areas of improvement in future.
Categories of impact analysis
- Business impact analysis
- If you are a business user who mainly manages the business services or processes, you want to determine the impact of a downtime on your services and processes. Performing a process-related business impact analysis can help
your business to achieve the following objectives:
- Prepare for the changes to a process or procedure.
- Identify the issues that are associated with a process.
- Mitigate for the risks that you may face due to an unexpected event.
- Technical impact analysis
- If you are an application user or the IT manager who mainly manages a datacenter or IT systems, you want to determine the impact of a downtime on your data and applications. Performing a technical impact analysis can help you to analyze the impact of technical changes in the deployed product or application. It gives the information about the areas of the information system that may be affected due to a change in the particular section or features of an application.
Goal and method for creating the business impact analysis
Business impact analysis is typically performed by the business users to analyze a business service or business process. For example, if you are a financial analyst, you can perform the business impact analysis to estimate the impact of the downtime of a business process or service.- Goal
- The goals of performing a business impact analysis are to determine the following information:
- Determine the criticality of the process.
- Determine the time that a business can survive without the business service or process.
- Method to perform the business impact analysis
- As a business user, you want to analyze the business service or process by estimating responses to few of the following assessment questions:
- What are the Impact categories or factors that affect the business service or process?
- What is the impact of the downtime of the business process or service?
- How many customers are affected?
- What is the revenue impact of the downtime for the organization?
- Are there additional penalties that the organization may incur?
- Is there a reputational damage for the organization?
- What is the additional cost to repair the damage such as media coverage of the estimated downtime?
- What supporting systems are required on a normal day so that the business processes run efficiently?
As the BCM lead or manager, when you respond to these assessment questions, it helps you to define the goals of creating a business impact analysis.
Goal and method for creating the technical impact analysis
Technical impact analysis is typically performed by the IT owners to analyze the applications or systems that house the data. For example, if you are an IT owner of a financial organization, you can perform the technical impact analysis to determine the criticality and timelines for the applications and frequency to back up the data.- Goal
- The goals of performing a technical impact analysis are to determine the following information:
- Criticality of the application.
- Timeline that the organization can survive for without the application.
- Frequency to back up the data
- Method to perform the technical impact analysis
- As a business user, you can perform the business impact analysis by estimating the responses to the following sample assessment questions:
- What is the impact on the business if the application is non-functional?
- How many employees are impacted?
- Is the application external facing?
- How many customers are impacted, if the application is external facing?
- What kind of data does the application process?
- How frequently does the data change?
As the business user, when you respond to these assessment questions, it helps you to define the goals of the technical impact analysis.
Using the business impact analysis workflow
If you are a user of the BCM application, you can use the business impact analysis workflow to perform the business impact analysis.
- Assess the recovery tier for the business processes or applications that are based on the pre-defined templates.
- Identify the recovery point objective.
- Identify the recovery time objective.
- Identify the dependencies such as vendors, applications, facilities, and other foundational elements.
As a pre-requisite to the business impact analysis workflow, the BCM administrator of your organization sets up the BIA template in the BCM application. The template offers a survey-type user experience in the form of an assessment questionnaire.
If you are the BCM administrator, you can set up the questions that are relevant to your organization and scenario in the BIA template. For more information on setting up the BIA template with the BCM administrator role, see Configure BIA templates with legacy assessment.
If you are the BCM lead or BCM program manager, you can respond to the assessment questionnaire on the Assessments tab of the business impact analysis record. If you mainly use the business services and processes, your answers serve as key data points for the recovery time objective assessment and dependency assessment. Based on your responses, the criticality of the business process or service and recommended timelines are determined.
If you are the BCM lead or BCM program manager who handles the IT systems, data, and applications, your answers serve as key data points for the recovery point objective assessment. Based on the responses received to the questionnaire, the application calculates the criticality of the business process or service and the recommended timelines.
Outcome of the impact analysis in BCM
After receiving responses to the questionnaire, the BCM application calculates the results of the business impact analysis. The results are displayed in the Results section on the Details tab in the business impact analysis record as shown in the following example.
- Recovery tier
- The BCM application determines the criticality of the process. It is known as the recovery tier. For example, a recovery tier can be non-essential or critical for your business.
- Recovery time objective
- The BCM application helps you to determine the time that the organization can survive without the business process that is the recovery time objective (RTO).
- Adjusted RTO
- The business impact analysis owner can adjust the recovery time objective value for practical reasons. The adjusted value is displayed in the Adjusted RTO field in the Results section. If you are the business impact analysis owner and you have adjusted the RTO value with a reason during the assessment, the reason for the adjustment is displayed in the Reason for adjusted RTO field.
- Dependencies
- The BCM application helps you to determine the supporting systems or dependencies that are required on a normal day so that the business processes run efficiently. For example, you can
have the following dependencies for your business:
- People
- Facility
- Application
- Vendors
For more information on the recovery time objective, recovery point objective, and recovery tiers, see RTO, RPO, and recovery tiers.