The short answer
A risk assessment asks: what could go wrong, and how likely is it? A business impact analysis (BIA) asks: if a critical activity stopped, how bad would it be, and how quickly do we need it back?
Put simply, a risk assessment starts with the cause, while a BIA starts with the effect. They are different tools that answer different questions, and organizations usually need both.
What is a risk assessment?
A risk assessment identifies and evaluates threats and vulnerabilities, and estimates the likelihood and potential severity of each risk. Threats can include fires, floods, cyber attacks, supplier failure, key person loss, fraud or regulatory change.
A common sequence has these stages, though names vary by source:
- Identify the risks.
- Analyze them, considering likelihood and impact.
- Evaluate and rank them against your tolerance for risk.
- Decide how to treat them, for example reduce, transfer (such as insurance), accept or avoid.
- Record the results, then monitor and review.
Qualitative and quantitative analysis
The two main approaches to risk analysis are qualitative and quantitative. Qualitative analysis uses descriptive ratings such as low, medium and high, often shown on a risk matrix. Quantitative analysis uses numbers, such as estimated financial loss. Many organizations start qualitatively because reliable numbers are hard to obtain.
What is a business impact analysis?
A BIA identifies an organization’s critical activities and measures what would happen if they were interrupted. It is typically cause-neutral: it does not need to know why the disruption happened. Common outputs include:
- a list of critical processes and their dependencies, such as systems, people, suppliers and premises
- the effects of downtime over time, such as lost revenue, extra costs, contractual penalties, and damage to customers or reputation
- a recovery time objective (RTO), the target time to restore an activity
- a recovery point objective (RPO), the amount of data loss that can be tolerated, measured in time
- the minimum resources needed to operate
BIAs are usually done through questionnaires and interviews with department leaders, then summarized for senior management to approve.
Key differences at a glance
| Risk assessment | Business impact analysis | |
|---|---|---|
| Core question | What could happen and how likely is it? | What is the effect if something stops? |
| Starting point | Threats and vulnerabilities | Critical processes and dependencies |
| Focus | Likelihood and severity of events | Consequences of downtime over time |
| Key outputs | Risk register, ranked risks, treatment options | Priorities, RTOs, RPOs, resource needs |
| Main use | Decide which risks to reduce, transfer or accept | Decide what to recover first and how fast |
How do they work together?
They complement each other. A BIA tells you which activities matter most and how little downtime they can tolerate. A risk assessment tells you which threats are most likely to hit those activities and where your weaknesses are. Together they support decisions about controls, insurance, backups and recovery plans.
Order varies. Some organizations run the BIA first to find what matters, then assess risks to those activities. Others do the risk assessment first. What matters is that the results are connected and reviewed regularly.
What is the difference between a BIA and a BCP?
A BIA is an analysis. A business continuity plan (BCP) is the resulting set of actions and procedures. The BIA supplies the priorities and recovery targets, and the BCP describes how you will meet them. Once the plan exists, you should exercise it to see whether it works.
What should a BIA include?
A practical BIA usually covers:
- scope and the departments involved
- critical activities and what depends on them
- the impact of disruption at set intervals, such as hours, days and weeks
- recovery targets
- workarounds that already exist
- sign-off by management
Small business example
A small bakery’s risk assessment might list fire, equipment failure, ingredient supply problems and staff illness, and rate each. Its BIA might find that the ovens are essential and that losing them for more than a couple of days would mean losing key wholesale customers. Together, the two would suggest keeping a service contract on the ovens, identifying a backup baking arrangement and insuring against fire.
Where this fits
Both tools are building blocks of continuity planning and wider risk management. Neither is a one-off task. Review them when your business, systems or suppliers change. Strengthening your day-to-day internal controls can also reduce several of the risks you identify.