Development Framework


Charter Set up a Planning Committee and establish parameters	Risk and Impact Complete a Risk Assessment and Business Impact Analysis	Strategy Document the organisation strategy to BCP

Commentary
Effective risk assessment and subsequent mitigation planning assists in reducing the probability, and minimising the impact of an incident.

Central to performing a business impact analysis is the identification of the critical business processes (CBP). Remember to prioritise these critical business processes with regard to their importance to the organisation as this will assist in identifying the order in which the critical business processes should be recovered in the event of a disaster.

Typical critical business processes within aged care include:

Organisation	Service Head Office
Resident / Client care	Accounts payable
Kitchen	Finance
Cleaning	Payroll
Laundry	Information Technology
Maintenance	Maintaining staff levels
Transportation
Administration
Staffing

The use of a business impact analysis matrix may help to prioritise the actions required to effect recovery. The matrix should include the types of impact under consideration and the anticipated resulting effects. An example matrix (or table) might help here Whilst business impact analyses may help determine quantitative impact, such as potential financial loss, qualitative impact should also be assessed. Some activities may be critical within an hour or less. Consideration should also be given to the time of day, week, and month as criticality may change. The results of a business impact analysis should be used to identify solutions and options that can be used to mitigate the identified risks.

Financial impacts should include, as a minimum:

Loss of revenue	Funding and bond implications	Additional operating costs
Bad debts	Loss of stakeholder value	Penalties (overdraft costs etc)

Non - financial impacts should include, as a minimum:

Damage to reputation	Resident / client care failure	Environmental
Loss of Good Name/Standing	Regulatory / legal issues	Staff morale
Loss of operational capacity		Political
Loss of service quality	Human resources – staff turnover	Contractual

The business impact analysis should be repeated every 12 - 18 months, or in the event of significant changes within the organisation (for example, when there is a change in premises.

The following table is an example of how to summarise the results of the business impact analysis. This table combines both the quantitative and qualitative factors. The qualitative impacts are represented using the colour coding system with the definitions below the table, which are to be customised to reflect the individual service’s/organisation’s/corporation’s resources. The quantitative impacts are represented by including a dollar amount within the table at each time period.

Actions
Identify what assessments and plans have already been undertaken and determine what, if anything can be
integrated into the framework.

Conduct a risk assessment of the hazards to which your organisation is exposed:

Identify all potential emergencies
Identify other hazards which might not constitute an emergency (natural and human made) but which might affect you
Make a list of the existing resources and capabilities available to your organisation to respond to these risks, emergencies and hazards.

Identify those ‘things you do’ that are critical to your operation – critical processes

Ensure staff members involved in critical business processes are included in the identification and exploration of these processes
Prioritise how time sensitive each critical process is – how long before you feel the impact of losing the of the function/process (see Table 9‘Business Impact Analysis Summary’ below)
Map the inter-relationship of critical business processes where they exist
Identify where a single point of failure which might be significant to operations exists

Conduct a business impact analysis and a business impact resource analysis

Identify and map the potential impact of each and every risk identified on your critical processes
Identify actions that can be put in place to mitigate any or all of the risks identified (and identify the responsible staff member if appropriate)

Document a recovery strategy for critical processes

Utilise existing resources and capabilities, where available in recovery planning
Identify and make provision for external resources and capabilities where necessary
Establish your recovery time objectives, that is the maximum acceptable elapsed time to recover minimum service for each critical process
Recovery point objectives (the point in time by which recovery of a fully effective critical process must be achieved).

Use this assessment and analysis to document your continuity strategy and plan.

Back to Development Framework | Back to Top | Back to Commentary

Table - Business Impact Analysis Summary

Table - Example of Completed Risk Matrix

The outcome of the formal risk assessment is a document that details identified risks to critical business systems, evaluates controls and their costs, and guides the corporation/service, in the policies and procedures which are required to manage service delivery, resumption and recovery, in the event of a disaster.

Back to Development Framework | Back to Top | Back to Commentary

Resource: Business Impact Analysis Summary - Risk Matrix
www.anao.gov.au (Business continuity management)
NH Emergency Preparedness & Response Report (PDF Document 1.2Mb)

Help - Instructions for viewing resource and example documents