The conducting of a BIA should ideally be the first phase of disaster recovery planning. The results of BIA are important in gaining senior management support for emergency preparedness. The analysis puts the consequences of disasters and disruptions in financial terms that senior executives understand best.

No organization has the time or the resources to recover every functional area following a major disaster. The fact is that not all systems are absolutely critical. Sheer cost will likely prohibit incorporating each and every system in your DRP.

BIA aims to evaluate the bottom line effect (in dollar terms) of a systems disaster or outage on your business. Each functional area is evaluated to determine the cost to the company for as long as that function is not restored.

A properly conducted BIA should answer critical questions, such as:

• What are the costs in lost revenue, market share, goodwill, and penalties you can expect if your computer system goes down for an hour, a day, or a week?
• How fast do you need to recover without incurring intolerable loss?
• How much data loss can you tolerate? 1 second, an hour, or 24 hours of data?
• How should you prioritize your functional systems during an actual disaster? What must be recovered first, second, and third, and what can wait until later?

Thus a BIA helps you to determine what are known as the "recovery point" and the "recovery time" for each of your functional systems.

• Recovery Point refers to the amount of acceptable information loss in the event of computer system failure. A recent recovery point is most important in data-centric operations where the loss of data is unacceptable, such as back office applications like inventory management, general ledger accounting or payroll. Such operations can withstand some downtime; however, when the interruption is concluded the data had better not be lost. Activity must pick up from exactly where it left off.
• Recovery Time (also called recovery window) refers to the length of interval that is acceptable between the time the incident affects the system and the time the system returns to operation. A short recovery time is most important in transaction-centric operations where real-time continuity is key, such as banks, airline reservation systems, and dot-com companies.

All businesses and systems share both of these concerns, but ordinarily one is more dominant than the other depending upon the type of business and the type of system within an organization.