--- title: Structured workflows for Business Impact Analysis description: Business impact analysis helps you to predict the consequences of a disruption on a business process or business function. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/structured-workflows-bia.html release: australia topic_type: concept last_updated: "2026-03-12" reading_time_minutes: 4 breadcrumb: [Using BCM Classic Workspace, Manage, Business Continuity Management, Governance, Risk, and Compliance] --- # Structured workflows for Business Impact Analysis Business impact analysis helps you to predict the consequences of a disruption on a business process or business function. A business process is a set of tasks done by a business organization to deliver a business service or product to customers. When a business process is disrupted, the impact to the organization can be huge in terms of revenue and reputation. Business impact analysis $BIA$ is performed to identify and prioritize critical processes, quantify or qualify the impacts, and identify recovery dependencies. Ideally, business impact analysis on critical processes must be performed annually. The assessment of a business critical process disruption helps you to estimate the consequential impact on your business revenue, legal issues, workforce disruption, or business reputation. It also enables you to identify the dependencies of your business process on business applications, technology, or vendors that might be affected. This analysis gathers the information needed to develop recovery strategies. \[Omitted image "BIAImpactAssessmentView.png"\] Alt text: Business impact analysis overview ## Impact ratings for your business impact analysis The Business Continuity Management $BCM$ administrator of your organization defines the impact ratings for your business impact analysis $BIA$ and decides if the impact is tolerable for your business process. For more information on the impact ratings, see [Configure an impact rating to assess an impact category](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/configure-impact-rating-bcp.md). According to the configuration set up by BCM administrator, the questions are displayed in the **RTO Impact Assessment** tab. Consider the example where BCM administrator has configured an intolerable impact rating for the Revenue impact category. BCM administrator has defined what qualifies to be an intolerable impact. As a BIA owner, you must identify the timeline at which the revenue impact may go beyond $1M. ## Multiple impact ratings for an impact category If BCM administrator has configured the assessment questionnaire to include multiple impact ratings for an impact category, the impact category ratings are displayed in the Impact Category view.\[Omitted image "impact-category-admin-view.png"\] Alt text: Administrator view for the impact category. BCM administrators specify a threshold of non-tolerance for the impact ratings, per impact category. The disruption duration for the first non-tolerable impact category is selected for the recovery time objective $RTO$. The impact ratings have the specified values: - Low = 1 - Moderate = 2 - High = 3 See the example for the sample RTO calculation. \[Omitted image "BIAImpactCategoryResults.png"\] Alt text: An example to show the calculation of impact category results.

Scenario	Non-tolerable impact	Description
Scenario 1	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that Low regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective $RTO$. In this example, the disruption duration for the 01 - Low impact rating is set to 4 hours. Therefore, the recovery time objective $RTO$ for the impact category is above 4 hours. Even if the moderate impact disruption duration is shorter, the calculation will select the value from the first alphanumerically sorted impact rating that has the Tolerable field set to false.
Scenario 2	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that Moderate regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective $RTO$. In this example, the disruption duration for 02 - Moderate impact is set to 24 hours. Therefore, the recovery time objective $RTO$ for the impact category is above 24 hours.
Scenario 3	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that High regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective $RTO$ as shown in the example. \[Omitted image "impact-category-admin-view.png"\] Alt text: Administrator view for the impact category. In the tabular example, the disruption duration for 03 - High impact is set to 72 hours. Therefore, the recovery time objective for the impact category is above 72 hours.
Scenario 4	The Tolerable field for the Low, Moderate, and High impact ratings is set to true.	If the administrator has set all the impact ratings as tolerable, the value specified in the Maximum RTO value field in the template is selected as the recovery time objective $RTO$. In the example, the administrator has set all the impact ratings as tolerable. Therefore, the recovery time objective $RTO$ is one month as per the value specified in the Maximum RTO value field.\[Omitted image "maximum-rto-value.png"\] Alt text: Maximum RTO value.

- **Calculation of category score from impact analysis questions for an impact category that contributes to Recovery Point Objective $RPO$** If the impact category contributes to **RPO**, then evaluate each impact analysis question in that RPO category based on data value. You can check business critical, operation critical, business essential, or operation essential. The maximum value among all the questions of that RPO is considered as the Category Score of that Impact Category. It is then stored in the Impact Category Results table \[sn\_bia\_category\_result\]. - **Calculation of overall impact assessment result for a BIA** When you update the **Disruption Duration** of an impact category, the RTO of the BIA is automatically updated. The RTO of the BIA is set as the lowest tolerable downtime from each impact category. For example, consider a BIA having four impact categories – Legal, Reputation, Workforce, and Regulatory. When you update the legal impact category disruption duration, the BIA RTO value is recalculated based on the lowest tolerable disruption duration from each impact category. The Recovery Tier varies from organization to organization and is set based on the recalculated RTO value. |RTO value|Recovery Tier| |---------|-------------| |Immediate|Mission Critical| |1 Hour|Mission Critical| |4 Hours|Mission Critical| |8 Hours|Business Critical| |24 Hours|Business Critical| |72 Hours|Essential| |1 Week|Essential| |2 Weeks|Non-Essential| |1 Month|Non-Essential|

Scenario	Non-tolerable impact	Description
Scenario 1	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that Low regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective \(RTO\). In this example, the disruption duration for the 01 - Low impact rating is set to 4 hours. Therefore, the recovery time objective \(RTO\) for the impact category is above 4 hours. Even if the moderate impact disruption duration is shorter, the calculation will select the value from the first alphanumerically sorted impact rating that has the Tolerable field set to false.
Scenario 2	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that Moderate regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective \(RTO\). In this example, the disruption duration for 02 - Moderate impact is set to 24 hours. Therefore, the recovery time objective \(RTO\) for the impact category is above 24 hours.
Scenario 3	In the Impact Ratings table, the Tolerable field is set to false.	If the administrator has specified that High regulatory impact is non-tolerable, its corresponding disruption duration is set as the recovery time objective \(RTO\) as shown in the example. \[Omitted image "impact-category-admin-view.png"\] Alt text: Administrator view for the impact category. In the tabular example, the disruption duration for 03 - High impact is set to 72 hours. Therefore, the recovery time objective for the impact category is above 72 hours.
Scenario 4	The Tolerable field for the Low, Moderate, and High impact ratings is set to true.	If the administrator has set all the impact ratings as tolerable, the value specified in the Maximum RTO value field in the template is selected as the recovery time objective \(RTO\). In the example, the administrator has set all the impact ratings as tolerable. Therefore, the recovery time objective \(RTO\) is one month as per the value specified in the Maximum RTO value field.\[Omitted image "maximum-rto-value.png"\] Alt text: Maximum RTO value.