← University
Business Impact Analysis: What Gets Disrupted and How Badly
0 of 4

A regional distribution company operating out of southern Alberta had grown steadily over 12 years, expanding from a single warehouse serving local retailers to a network of 3 facilities employing 87 staff and managing inventory for clients across western Canada. The company's general manager had built the operation through practical experience rather than formal planning, and the business had weathered minor disruptions before—a 2-day power outage at one facility, a brief ransomware scare that the IT contractor resolved before any data was encrypted, and the unexpected resignation of the operations supervisor who had managed the Calgary warehouse since its opening.

None of these events had caused lasting harm, but a recent board meeting had changed the general manager's perspective. A director with experience in manufacturing had asked a simple question: if the company's primary warehouse management system went offline for 72 hours during peak season, which clients would be lost permanently, and how much revenue would never be recovered? The general manager could not answer. The financial controller offered estimates but acknowledged they were guesses. The IT contractor, present by phone, noted that the current backup system restored data to a point 48 hours before any failure, but no one in the room could say whether a 48-hour data gap was acceptable or catastrophic.

The board directed management to conduct a formal analysis before the next quarter. The general manager began by listing the company's functions: receiving shipments, updating inventory records, picking and packing orders, dispatching trucks, invoicing clients, processing payroll, maintaining refrigeration for temperature-sensitive goods, and communicating with customs brokers for cross-border shipments. Some of these functions seemed obviously essential, but the interdependencies were unclear. The refrigeration system, for example, depended on continuous monitoring by a contracted technician who worked remotely and whose availability during a regional emergency was uncertain.

The company's largest client, a grocery chain representing 34 percent of annual revenue, had recently added contractual language requiring suppliers to demonstrate business continuity capabilities. The deadline for demonstrating compliance was 90 days away. The general manager now faced the task of determining which functions could tolerate interruption, which could not, what consequences would follow from various disruption scenarios, and what recovery targets the company needed to establish—all before any continuity plan could be written.

Identifying Critical Business Functions: What Cannot Stop and What Can Wait

Every organization, regardless of size or sector, performs dozens of activities daily. Staff answer phones, process invoices, serve customers, manufacture products, file reports, and coordinate with suppliers. When operations run smoothly, these activities blend together into a seamless whole, and most organizational leaders rarely pause to consider which functions truly matter and which could be paused without catastrophic consequences. This distinction becomes critically important when disruption strikes. A power outage, a cyberattack, a key employee's sudden departure, or a supply chain failure forces immediate decisions about where to direct limited resources. Without prior analysis, these decisions happen in chaos, guided by whoever speaks loudest or whichever problem appears most urgent in the moment. The discipline of identifying critical business functions exists precisely to replace panic with planning, ensuring that when disruption arrives, organizational leaders already know what cannot stop and what can wait.

The concept of criticality in business operations draws from decades of emergency management practice and has been formalized through various international and Canadian standards. The International Organization for Standardization published ISO 22301, which establishes requirements for business continuity management systems, and this standard has been widely adopted across Canadian industries. As of the date of authorship, ISO 22301 provides the foundational framework that many Canadian organizations use when developing their continuity programs, though it remains a voluntary standard rather than a regulatory requirement for most sectors. The standard emphasizes that organizations must identify and prioritize activities that deliver key products and services, recognizing that not all organizational functions carry equal weight when resources become constrained. This prioritization process forms the analytical core of business impact analysis, transforming vague assumptions about organizational importance into documented, defensible decisions about resource allocation during disruptions.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $79 course — purchasing unlocks it, or sign in if you already have access.