← University
Business Impact Analysis: What Gets Disrupted and How Badly
0 of 4

A regional distribution company operating out of southern Alberta had grown steadily over 12 years, expanding from a single warehouse serving local retailers to a network of 3 facilities employing 87 staff and managing inventory for clients across western Canada. The company's general manager had built the operation through practical experience rather than formal planning, and the business had weathered minor disruptions before—a 2-day power outage at one facility, a brief ransomware scare that the IT contractor resolved before any data was encrypted, and the unexpected resignation of the operations supervisor who had managed the Calgary warehouse since its opening.

None of these events had caused lasting harm, but a recent board meeting had changed the general manager's perspective. A director with experience in manufacturing had asked a simple question: if the company's primary warehouse management system went offline for 72 hours during peak season, which clients would be lost permanently, and how much revenue would never be recovered? The general manager could not answer. The financial controller offered estimates but acknowledged they were guesses. The IT contractor, present by phone, noted that the current backup system restored data to a point 48 hours before any failure, but no one in the room could say whether a 48-hour data gap was acceptable or catastrophic.

The board directed management to conduct a formal analysis before the next quarter. The general manager began by listing the company's functions: receiving shipments, updating inventory records, picking and packing orders, dispatching trucks, invoicing clients, processing payroll, maintaining refrigeration for temperature-sensitive goods, and communicating with customs brokers for cross-border shipments. Some of these functions seemed obviously essential, but the interdependencies were unclear. The refrigeration system, for example, depended on continuous monitoring by a contracted technician who worked remotely and whose availability during a regional emergency was uncertain.

The company's largest client, a grocery chain representing 34 percent of annual revenue, had recently added contractual language requiring suppliers to demonstrate business continuity capabilities. The deadline for demonstrating compliance was 90 days away. The general manager now faced the task of determining which functions could tolerate interruption, which could not, what consequences would follow from various disruption scenarios, and what recovery targets the company needed to establish—all before any continuity plan could be written.

Assessing Disruption Consequences: Financial, Operational, and Reputational Impact

Every organization depends on interconnected systems, relationships, and resources that function in relative harmony during normal operations. When disruption strikes, whether through a cyberattack, a supply chain failure, a natural disaster, or the sudden loss of key personnel, the consequences ripple outward in ways that are not always immediately apparent. Understanding the full scope of these consequences requires more than identifying what might go wrong; it demands a rigorous assessment of how badly things can deteriorate across financial, operational, and reputational dimensions. This assessment forms the analytical heart of any business impact analysis and serves as the foundation for prioritizing recovery efforts and allocating resources during a crisis.

The practice of assessing disruption consequences has its roots in both emergency management and financial risk analysis. In Canada, organizations increasingly recognize that business continuity planning is not merely a technical exercise but a strategic imperative that touches every aspect of organizational performance. The Canadian Standards Association published CSA Z1600, which as of the date of authorship provides a comprehensive framework for emergency and continuity management programs applicable across Canadian jurisdictions. This standard emphasizes the importance of identifying critical functions and assessing the impacts of their disruption over time. Similarly, organizations operating in regulated sectors must consider requirements under federal legislation such as the Personal Information Protection and Electronic Documents Act, which imposes obligations regarding the protection and availability of personal information that carry significant consequences when breached. In Quebec, the Act respecting the protection of personal information in the private sector establishes parallel requirements within that province's civil law framework, with its own enforcement mechanisms and penalty structures that organizations must understand when assessing potential disruption consequences.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $79 course — purchasing unlocks it, or sign in if you already have access.