Skip to main content

Form library · Quality and compliance

Business impact analysis template

A business impact analysis (BIA) you fill in with each activity owner. List what the activity depends on, from people and IT to suppliers and power, and flag any single point of failure. Rate the financial, customer, legal and reputational impact from 1 to 5 at 4 hours, 24 hours, 72 hours and 1 week, and the form works out the peak impact, when the impact becomes unacceptable and a priority. Then set the maximum tolerable period of disruption, the recovery time and recovery point objectives, the minimum staff and the workaround. The results feed your business continuity plan.

For business continuity leads, operations managers and consultants who need a dated, signed BIA for each activity, with the evidence behind the figures.

Not tied to one country. The form names no legal duty; it follows UK public sector BIA guidance and can be used alongside ISO 22301.

  • One entry per activity, with owner, deputy, busy periods and dependencies flagged as single points of failure
  • Impact rated 1 to 5 for financial, customer, legal and reputational effects at 4 hours, 24 hours, 72 hours and 1 week
  • A calculated peak impact, the point the impact becomes unacceptable, and a priority from 1 to 5
  • MTPD, RTO and RPO in hours, with a red warning when the RTO is not shorter than the MTPD
  • Workarounds with tested status, photos and the GPS of an alternative site, summary tiles and ten review checks
Try it blank ↓See it completed ↓Use it in SiteSurveyDownload the completed form (PDF)

Ready to use from the form library, and every question is yours to edit. Try it for a small trial fee, cancel any time.

Try it on your phone

Try it on this phone

Fill in the business impact analysis on your phone now

See how the business impact analysis looks on your phone

Scan the code with your phone camera. It opens the real form, no sign-up needed.

Open the live example and fill it in, just as your team would on site. No sign-up needed.

See it on this phone

Every question is editable. Add this form to your account, then change the wording, add or remove questions and options, and make it fit your own jobs.

Or start your trial with this form ready →

One email, and we won't add you to a mailing list.

What should a business impact analysis template include?

A BIA is useful when each activity has an owner who agreed the ratings, the dependencies are named down to the single points of failure, and the recovery time objective is shorter than the maximum tolerable period of disruption, with a workaround that has actually been tried.

Last updated . Facts checked by the SiteSurvey team on 28 October 2026 against DWP Departmental Business Continuity Framework, Part 2: Working Guides, guide to business impact analysis (GOV.UK), NHS England Business Continuity Management Toolkit, Appendix 3.1: business impact assessment template and ISO 22301:2019, business continuity management systems: requirements (iso.org).

How to do a business impact analysis

Sit down with each activity owner. Check money figures with finance and recovery times with IT and suppliers.

  1. Set the scope

    Record the unit, sites and services covered, what is out of scope, the continuity lead and the senior sponsor.

  2. List the activities

    Add each activity with its owner and deputy, when disruption would hurt most, and what it depends on. Mark single points of failure.

  3. Rate the impact over time

    Rate financial, customer, legal and reputational impact at 4 hours, 24 hours, 72 hours and 1 week. The form gives the priority.

  4. Set recovery targets

    Enter the MTPD, RTO and RPO in hours, the minimum staff and service level, and the workaround and whether it has been tested.

  5. Review and approve

    Work through the review checks, list actions with owners and dates, and have the sponsor sign.

What makes a business impact analysis useful

Impact over time and the recovery targets

Pick and despatch chilled orders. Customer impact 4 Significant at 4 hours: care homes hold no chilled buffer. Priority 1. MTPD 4 hours, RTO 2 hours, RPO 1 hour. Minimum 6 staff, 3 vans, printed pick lists. Workaround: pick from the 05:00 order report with handwritten labels. Not tested.

Fictional example. Record the actual evidence and approved arrangements for your job.

A common recording mistake

Rating every activity 5 at 4 hours, or setting the RTO equal to the MTPD so there is no time left to recover.

What happens next

Test the untested workarounds in an exercise, fix the single points of failure, and use the priorities and RTOs when you write or review the business continuity plan.

Try the business impact analysis form live

Answer a few questions and watch it adapt. Your answers are not saved, and any photos you add are deleted within the hour.

Live form: Business Impact AnalysisOpen full screen ↗
Fill it in right here

This is the real form as your team would use it: questions appear as you answer, scores work themselves out and you can add photos and signatures. No sign-up needed. Or open a completed example to see every answer, photo and score filled in.

Want to see one filled in? See a completed business impact analysis report (PDF), made by SiteSurvey from a fictional site visit.

Every question in the business impact analysis template

A business impact analysis (BIA) filled in per activity with its owner: dependencies with single points of failure and an asset tag scan, financial, customer, legal and reputational impact rated 1 to 5 at 4 hours, 24 hours, 72 hours and 1 week, a calculated peak impact, the point the impact becomes unacceptable and a priority, MTPD, RTO and RPO with a warning when the RTO is not shorter than the MTPD, minimum staff and resources, workarounds with tested status, summary tiles, ten review checks, actions and approval. 4 sections and 114 questions. Follow-up questions and guidance appear only when an answer calls for them, so the person on site never sees the ones that do not apply.

Make it your own: every question is editable

This is a starting point, not a fixed form. Once it is in your SiteSurvey account you can reword any question, add or remove questions, sections and answer options, and add your own logo, so it fits the way your team works and the jobs you do.

Details you only enter once

Add this form to a project in SiteSurvey and it fills in what the project already knows, so nobody on site retypes it and every form on the job uses the same names. Anything filled in can still be changed.

  • Project: the project name
  • Site or premises address: the site address, from the space or the project
  • Organisation: the project's customer

Scope of the analysis

  • ProjectShort answer

    Filled in from the project in SiteSurvey.

    Fills in from the project name
  • Site or premises addressShort answer
    Fills in from the site address, from the space or the project
  • OrganisationShort answer
    Fills in from the project's customer
  • Location (GPS)Short answer
  • Date of the analysis*Date
  • Completed by*Short answer
  • BIA reference and version*Short answer
  • Business unit, department or service analysed*Short answer
  • Business continuity lead*Short answer
  • Senior sponsor who approves the resultsShort answer
  • In scope*Notes

    Sites, services, products and teams covered.

  • Out of scope, and whyNotes
  • Reason for this analysisChoose one
    • First BIA for this unit
    • Annual review
    • Review after a change to the service
    • Review after a real disruption
    • Review after an exercise
    • Customer or contract requirement
  • Standard or framework you work toShort answer

    Optional. For example ISO 22301:2019, a customer contract or your own policy.

  • Next review dueDate
  • GuidanceHow this form scores impact. Each activity is rated 1 to 5 (1 Insignificant, 2 Minor, 3 Moderate, 4 Significant, 5 Catastrophic, the scale used in the NHS England BIA template) for four kinds of impact at 4 hours, 24 hours, 72 hours and 1 week. The form treats a rating of 4 or 5 as not acceptable. The first time point that reaches 4 sets the priority: 1 (4 hours) to 4 (1 week), and 5 if no rating reaches 4 within a week. The time points, the threshold and the priority bands are this form's own scoring, not a standard. Change your policy, not the ratings, if they do not fit.
  • CheckThis BIA supports a business continuity management system record. It does not certify conformity with ISO 22301 or any other standard.

Activities

  • GuidanceAdd one entry per activity. Start with the activities customers or the law would notice first.
  • Activities
    Repeat for each entry. Each one asks:
    • Activity*Short answer

      What is done, in a few words, for example "Process customer orders".

    • Product or service it deliversShort answer
    • Activity owner*Short answer
    • DeputyShort answer
    • Where it is doneShort answer
    • Busy periods when disruption would hurt moreNotes

      Times of the day, month or year, for example month-end payroll.

    • Dependencies
      Repeat for each dependency. Each one asks:
      • Type*Choose one
        • People or skills
        • Site or building
        • IT system or data
        • Telephony
        • Supplier or outsourced service
        • Equipment or vehicle
        • Utility (power, water, gas)
        • Another internal activity
      • What it is*Short answer

        For example payroll system, two qualified pharmacists, courier contract.

      • Single point of failure?*Yes or No

        Yes if losing this one thing stops the activity and there is no ready alternative.

      • Alternative or fallbackNotes
      • Scan the asset tag or data plateScan a label: asset number, make, model, serial number

        Optional. For a server, generator, vehicle or machine the activity depends on.

        Shown only when the answers above make it relevant
      • Supplier contact or contract referenceShort answer
        Shown when “Type” is “Supplier or outsourced service”
      • Supplier recovery time stated in the contractShort answer

        As written in the contract or SLA. Leave blank if the contract does not say.

        Shown when “Type” is “Supplier or outsourced service”
    • Single points of failureWorked out by the form
    • CheckThis activity has a single point of failure. Record a fallback for it, or an action to remove it.
      Shown only when the answers above make it relevant
    • GuidanceRate what would happen if this activity stopped completely at its busiest normal time, with no workaround. Ask the activity owner, and check money figures with finance.
    • Financial impact after 4 hours*Choose one

      Lost income, penalties, extra costs.

      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Financial impact after 24 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Financial impact after 72 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Financial impact after 1 week*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Customer and service impact after 4 hours*Choose one

      Customers or service users who cannot be served, missed orders or appointments.

      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Customer and service impact after 24 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Customer and service impact after 72 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Customer and service impact after 1 week*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Legal and regulatory impact after 4 hours*Choose one

      Statutory duties, licence conditions, contracts and regulator reporting.

      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Legal and regulatory impact after 24 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Legal and regulatory impact after 72 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Legal and regulatory impact after 1 week*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Reputational impact after 4 hours*Choose one

      Complaints, social media, press, loss of trust.

      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Reputational impact after 24 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Reputational impact after 72 hours*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Reputational impact after 1 week*Choose one
      • 1 Insignificant
      • 2 Minor
      • 3 Moderate
      • 4 Significant
      • 5 Catastrophic
    • Highest impact at 4 hoursWorked out by the form
    • At 24 hoursWorked out by the form
    • At 72 hoursWorked out by the form
    • At 1 weekWorked out by the form
    • Peak impact (1 to 5)Worked out by the form
    • Priority (1 highest)Worked out by the form
    • Impact becomes unacceptableWorked out by the form
    • Latest hour the ratings allowWorked out by the form
    • Maximum tolerable period of disruption (hours)*Number

      The longest this activity can be stopped before the impact cannot be accepted.

    • Recovery time objective (hours)*Number

      Target time to resume the activity at its minimum level.

    • Recovery point objective (hours of data)Number

      Optional. How much recent data, in hours of work, could be lost and re-keyed.

    • WarningThe recovery time objective is not shorter than the maximum tolerable period of disruption. Set a shorter RTO that leaves time to complete recovery (DWP business impact analysis guide).
      Shown only when the answers above make it relevant
    • CheckThe MTPD is longer than the point where the ratings above reach 4 Significant. Check the ratings or the MTPD.
      Shown only when the answers above make it relevant
    • Staff normally doing thisNumber
    • Minimum staff to run it at the minimum level*Number
    • Minimum acceptable level of serviceNotes

      For example urgent orders only, 50% of appointments.

    • Minimum premises, IT, information and suppliesNotes
    • Workaround while normal resources are lost*Notes

      For example paper order forms, a second site, a reciprocal agreement, staff working from home.

    • Workaround tested?*Choose one
      • Tested in an exercise
      • Used in a real disruption
      • Not tested
      • No workaround
    • WhenDate
      Shown only when the answers above make it relevant
    • CheckThe workaround has not been tested, so the RTO is an assumption. Plan an exercise.
      Shown only when the answers above make it relevant
    • Photos of the workaround kitPhotos

      Optional. For example the grab bag, paper forms, the fallback phone.

    • Uses an alternative site?Yes or No
    • Alternative siteShort answer
      Shown when “Uses an alternative site?” is Yes
    • Alternative site location (GPS)Short answer
      Shown when “Uses an alternative site?” is Yes
    • Assumptions and evidenceNotes

      Where the figures came from, and what has not been checked.

Summary and review

  • Activities analysedWorked out by the form
  • Priority 1 or 2 (unacceptable within 24 hours)Worked out by the form
  • RTO not shorter than MTPDWorked out by the form
  • Workarounds not testedWorked out by the form
  • Single points of failureWorked out by the form
  • Highest peak impactWorked out by the form
  • Recovery order agreedNotes

    The activities in the order they will be restored, highest priority first.

  • GuidanceCheck the analysis before it is approved.
  • Every activity has a named owner who agreed the ratingsChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Financial ratings checked with financeChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Legal, regulatory and contract duties checked with whoever holds themChoose one

    For example licence conditions, customer SLAs, reporting deadlines.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • IT has confirmed it can restore the systems within each RTOChoose one

    Compare each RTO with the IT recovery plan or the supplier contract.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Key suppliers' own recovery times are known and fit the RTOsChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Busy periods and seasonal peaks consideredChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Dependencies between activities recordedChoose one

    For example despatch needs order processing.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Single points of failure have a fallback or an actionChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Results compared with the current business continuity planChoose one

    Plan strategies must meet the RTOs found here.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Results approved by the senior sponsorChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Review checks needing actionWorked out by the form
  • AcceptableWorked out by the form
  • Not checkedWorked out by the form

Actions and approval

  • Items needing actionWorked out by the form
  • ResultWorked out by the form
  • Actions
    Repeat for each action. Each one asks:
    • Action*Notes
    • PriorityChoose one
      • Before approval
      • Within 1 month
      • Before the next review
      • At the next exercise
    • Who will do it*Short answer
    • Due byDate
    • Status*Choose one
      • Open
      • In progress
      • Done, checked
    • Photo when donePhotos
      Shown when “Status” is “Done, checked”
  • Actions still openWorked out by the form
  • Decision*Choose one
    • Approved: use these results in the continuity plan
    • Approved once the listed actions are done
    • Not approved: redo the analysis
  • Date of the next reviewDate
  • Summary for the sponsorNotes
  • Business continuity lead nameShort answer
  • Business continuity lead signature*Signature
  • Senior sponsor nameShort answer
  • Senior sponsor signatureSignature

See it filled in

A completed business impact analysis report, made by SiteSurvey from a fictional site visit: every answer, the photos, the guidance that applied and the sign-off, ready to send as a PDF.

See completed form (PDF) ↗

Business impact analysis FAQs

What is the difference between MTPD and RTO?

The maximum tolerable period of disruption (MTPD) is the longest the organisation can manage without the activity. The recovery time objective (RTO) is the target time for getting it running again. The DWP business impact analysis guide on GOV.UK says recovery time objectives must be shorter than the MTPD and leave enough time for recovery actions to be completed. The form warns in red when an RTO is not shorter than its MTPD.

Source: DWP Departmental Business Continuity Framework, Part 2: Working Guides, guide to business impact analysis (GOV.UK).

How does the form score impact and priority?

Each activity is rated 1 Insignificant to 5 Catastrophic, the scale used in the NHS England BIA template, for four kinds of impact at four time points. The form treats 4 or 5 as not acceptable, and the first time point that reaches 4 sets the priority: 1 if within 4 hours, down to 4 at 1 week, and 5 if nothing reaches 4 within a week. The time points, threshold and bands are the form's own scoring, not a standard, and the form says so.

Source: NHS England Business Continuity Management Toolkit, Appendix 3.1: business impact assessment template.

What dependencies should a BIA record?

UK government guidance lists people, premises, technology including telephony, key suppliers and partners, and supplies, plus the minimum number of people needed to keep the activity going. The form adds utilities and other internal activities, flags any single point of failure, and lets you scan the asset tag of a server, generator or vehicle the activity relies on.

Source: DWP Departmental Business Continuity Framework, Part 2: Working Guides, guide to business impact analysis (GOV.UK).

Is this an ISO 22301 business impact analysis?

It is written to support a business continuity management system such as one built on ISO 22301:2019, which ISO lists as published and due to be revised. It does not quote the standard, and filling it in does not show conformity or lead to certification. If you are certified, check the requirements in your own copy of the standard and with your certification body.

Source: ISO 22301:2019, business continuity management systems: requirements (iso.org).

Should seasonal peaks change the ratings?

Rate the impact at the activity's busiest normal time, and record the busy periods. The NHS England template asks whether prioritised activities vary at different times of the month or year, and the DWP guide says some tasks are more critical at certain times. Month-end payroll and pre-Christmas despatch are typical examples.

Sources: NHS England Business Continuity Management Toolkit, Appendix 3.1: business impact assessment template and DWP Departmental Business Continuity Framework, Part 2: Working Guides, guide to business impact analysis (GOV.UK).

Is a BIA the same as a business continuity plan?

No. The BIA works out which activities matter most, how quickly they must be back, and what they need. The business continuity plan sets out how you will respond and recover. Use the results here, the priorities and RTOs, when you write or review the plan, and test the workarounds in an exercise.

Related

Audit management softwareBusiness continuity plan templateRisk assessment templateIT risk assessment templateEmergency action plan templateAll forms in the library

Related templates

Templates that go with the business impact analysis form

Internal audit checklist

Internal audit of a quality, health and safety or environmental management system, a 5S area or a procedure, with findings, corrective actions and sign-off.

7 sections · 92 questions · See every question →
Non-conformance report template

Record a non-conformance, contain it, find the root cause with 5 whys, set corrective actions with owners and dates, then verify and close.

5 sections · 52 questions · See every question →
Gemba walk checklist

Structured walk of a work area: what you saw against the standard, the eight wastes, conversations with the people doing the work, observations and actions.

4 sections · 33 questions · See every question →
Supplier evaluation form

Approve or re-evaluate a supplier or subcontractor: insurance, certificates and competence checks, scored performance, audit findings and a decision with conditions.

5 sections · 42 questions · See every question →

Browse all 428 forms in the library

Use this business impact analysis form with your team

Add it from the form library in one click, change any question, and every completed form becomes a branded PDF report.

Start your trial →