In the BCP Phases we found, Phase 2: Perform Risk Analysis and Phase 3 : Perform BIA . Is it mandatory to start with risk analysis or can we start with BIA then go to risk analysis. What is the best way ?
Actually, ISO 22301 allows both approaches, and the choice for one or another will depend on your expectations:
- By doing BIA first you will have a prioritized list of processes and services that can impact the most of your business in case of disruptive incidents, then you can go to assess the most relevant risks for the most critical processes and services.
- By doing risk assessment first you will have a prioritized list of risks your organization is most exposed to, i.e. the most potential disruptive incidents, then you can go to assess the impact on business regarding the processes and services affected by those risks.
Particularly, we prefer to do risk assessment first because this way, you will have a better impression of which incidents can happen (which risks you’re exposed to), and therefore be better prepared for d oing the business impact analysis (which focuses on consequences of those incidents).