BC must identify all business functions within an organization, and then assign a critical level to each of them. A business impact and risks analysis should be the primary method for gathering this information and, in most cases, it's part of the design phase. Each risk should be assigned a reasonable and critical means to minimize its impact and define a correct recovery point objective, a recovery time objective, and of course, an entire plan to handle this risk.

BIA can be used to identify the extent and timescale of the impact on different levels of an organization. For instance, it can examine the effect of disruption on the operational, functional, and strategic activities of an organization. Aside from current activities, the disruptive effects of major business changes, such as introducing new product or services, can also be determined by BIA.

Most standards require that a business impact analysis should be reviewed at defined intervals appropriate for each organization and whenever any of the following occur:

• Significant changes in the internal business process, location, or technology
• Significant changes in the external business environment—such as market or regulatory change

BIA has several intersections with other business and technology related processes such as:

• Security management: Security must be one of the top priorities when managing IT.
• Document management: Documentation is the knowledge of your environment and should include not only the technical references but also the high-level decision and design concepts.
• Change management: Regulations require that all changes to business functions must be documented and tracked for auditing purposes and for change control.
• Audit management: All modern business functions should be designed to automatically generate the requisite audit compliance information and documentation while conducting day-to-day business. This dramatically reduces the time and cost associated with manually producing this information.