Skip to main content

Work with BIA assessments

Record a Business Impact Analysis (BIA) assessment and carry it through its full cycle: draft, submit, confirm, and board decision.

Prerequisites​

  • The BIA Risk Data Type Early Access feature, enabled by an administrator — see BIA risks.
  • A repository administrator has designated risk-relevant objects and set their materiality thresholds — see Configure ICS risks.
  • The risk's Data Type is set to Business Impact Analysis on its Settings tab.
  • Item role permissions on the risk: Add Risk Data to fill in a draft, Submit Risk Data to submit it, and Modify Risk Data to confirm it, send it back, or record the board decision.

Steps​

Fill in a draft assessment​

  1. Open the BIA risk and select the Data tab.
  2. Click Add, pick the Risk-Relevant Object the assessment applies to in the Associate Risk-Relevant Object dialog, and click Confirm. Only objects designated as risk relevant in the repository configuration are offered. To switch to a different object while the assessment is still a draft, click Change Object.
  3. In the Impact Assessment Over Time table, enter a Financial Impact for each of the six time intervals, and set the Regulatory Violation and Reputational Impact ratings to Low, Medium, or High. A value can't be lower than the previous interval's — impact never shrinks as the disruption gets longer — and cells that break that rule, or that still need a value, are highlighted.
  4. Fill in the Business Continuity KPIsKPI A quantitative measure used to evaluate process performance against a target — for example, average throughput time, automation rate, or rework percentage.. RPO, RTO, MBCO, and MTPD are required before you can submit; RPA and RTA are optional. All are hours except MBCO, a percentage from 0 to 100. The table checks the values as you type:
    • Hour-based KPIsKPI A quantitative measure used to evaluate process performance against a target — for example, average throughput time, automation rate, or rework percentage. must be greater than 0.
    • RTO must be less than MTPD.
    • RTA can't exceed RTO, and RPA can't exceed RPO.
    • When RTO is more than 80 percent of MTPD, a warning asks you to review the two values. It doesn't block submission.
  5. Enter a Justification / Comments text for the assessment. It's required before you can submit.

The platform saves the draft as you make changes and shows the save status in the footer. The Risk Owner line there shows who saved it last. A draft keeps its values across sessions, so you and others with the permission can return to it later.

The Financial Impact Indicator row and the criticality chip update as you type — see BIA risks for how they're calculated.

Submit the assessment​

  1. Click Submit. The button stays disabled until every Financial Impact cell is filled, every rating is set, the required KPIsKPI A quantitative measure used to evaluate process performance against a target — for example, average throughput time, automation rate, or rework percentage. are entered, the justification is entered, no highlighted warnings remain, and the latest changes have saved. Its tooltip names what's still missing.
  2. Confirm the dialog. Values are locked until the assessment is confirmed or reverted.

If a value changed significantly from the last board-reviewed assessment — a financial impact that at least doubled or halved, a rating that moved two levels, or an RPO, RTO, or MTPD that changed by more than 30 percent — a Review flagged changes dialog lists the changes first. Click Go back and review to correct them, or provide a justification of at least 20 characters and click Submit anyway; the justification is appended to the Justification / Comments text.

Confirm or send back a submitted assessment​

Review the submitted values, then either:

  • Click Confirm, then confirm the dialog. The assessment becomes an immutable record awaiting the board decision. Anything typed under Reviewer Feedback is discarded — the dialog warns you if the field isn't empty.
  • Enter your notes under Reviewer Feedback, click Revert to Draft, and confirm. The assessment returns to draft showing a Sent Back chip, with your feedback in a Review Comment banner above the table. If you leave the feedback empty, the dialog warns that the author won't know what to change.

Record the board decision​

  1. On the confirmed assessment, go to the Board Decision section.
  2. Select the Decision Outcome. Two options are offered: confirm the calculated criticality or override it to the opposite.
  3. Enter the board's Comments and the Decision Date. The date can't be earlier than the assessment's confirmation date; Entered By is filled in automatically.
  4. Click Finalize and confirm. The assessment is locked as Board Reviewed and the next cycle can begin.

View past assessments and start a new cycle​

  • Use the Select Assessment dropdown to read a confirmed or board-reviewed assessment; pick Current Assessment to return to the one in progress.
  • Click New Assessment to begin the next cycle, then choose New blank assessment or Duplicate latest assessment, which copies the most recent assessment into the new draft. The button appears once the previous assessment completes board review — an assessment still awaiting the board blocks a new one.

Verify​

The assessment's chips show where it stands: its status (Draft, Submitted, Confirmed, or Board Reviewed) and its calculated criticality — red Business-Critical or green Not Business-Critical. Highlighted cells mark what still blocks submission.