If Information Technology is not your organization’s core line of business, your organization may be unaware of what and how much impact you have on its costs, revenues and profitability. Your audit and finance departments might treat IT as a cost, and their budgeting decisions will be based on that premise. It is therefore important that you carry out a Business Impact Analysis (BIA), which can bring you two benefits -

1.It will tell your internal and external auditors how your department is performing financially; and,
2.It will help you determine the level to which IT governance is critical to your organization.

BIA helps an organization know which units, operations and processes it has in place are really critical to the business’ survival. In times of difficulty, the BIA will help the organization chart the way forward, and the IT department’s participation, as custodian of the organization’s knowledge, will be critical.

A good BIA will tell you how much each unit and process costs to maintain, and how much revenue depends on it, directly or indirectly. It will also help you identify essential business units and/or processes that must return to full operation following a disruption. The BIA delineates the business impact of disaster scenarios on your company’s ability to deliver products and services to its customers.

Some of the areas that you will have to cover in your analysis include:-

1.The regulatory agencies you have to report to
2.The critical records you must maintain
3.The processes under your charge
4.The risk to business caused by a potential disruption (increased costs, reduced revenues)
5.The cost of recovery
6.The manpower and time required to make up

The IT Governance and Compliance toolkit includes a specimen questionnaire that you can use carry out the analysis. It will help you define each IT process, and assign a priority score to it.

Once done, you can use the BIA to align each critical process with the IT governance policies, bringing everything into compliance with the regulations.