# Business Impact Analysis (BIA)

> Conduct structured Business Impact Analyses per ISO 22301. Guides interviews, maps process dependencies, determines RTO/RPO targets, and validates consistency across the dependency chain with automated tools that flag timing conflicts and circular dependencies.



Tags: Business Continuity, Risk Management, ISO 22301, Compliance


## Example Prompts

- Run a Business Impact Analysis for our organization following ISO 22301
- Validate our BIA data — check RTO/RPO consistency across process dependencies
- Check our BIA for circular dependencies between departments
- Determine RTO and RPO targets for our critical business processes

URL: https://rakenne.app/skills/bia-rto-calculator/index.md

Try this skill: https://rakenne.app/a/?skill=bia-rto-calculator



## Overview

Conduct structured Business Impact Analyses per ISO 22301. The skill guides the agent through structured interviews with process owners, builds a dependency map across departments, determines RTO and RPO targets, and validates everything with automated tools that catch timing conflicts and circular dependencies before they become real problems.

## Getting Started

Activate the *Business Impact Analysis (BIA)* skill and tell the agent which business units or processes are in scope. The agent will walk you through structured interviews for each process, populate a machine-readable data file, and run automated validation checks.

## Example Conversation

> **You:** We need a BIA for our main business units — Sales, IT Infrastructure, HR, Finance, and Support. Start with the critical processes.

> **Agent:** I'll start by gathering information for each department. Let's begin with Sales — what are the key processes, and what happens financially if Order Processing goes down for 4 hours?

> **You:** Order Processing is critical — we lose about $50k per hour. It depends on the ERP system in IT.

> **Agent:** Got it. I've added Order Processing as PROC-001 (critical, Sales). Now let me ask about the ERP system and the rest of the dependency chain...

After collecting all process data, the agent runs validation:

> **Agent:** I've run both validation tools on the BIA data. Here's what I found:
> - **ERROR**: Order Processing claims RTO of 2h but depends on ERP System which has RTO of 8h — it can't recover before its dependency
> - **WARNING**: Payroll is rated 'high' criticality but has a 48h RTO, which exceeds the typical 24h threshold for that tier
> - **Circular dependency detected**: Reporting Dashboard and Data Warehouse depend on each other — this must be resolved
>
> Let's fix these one by one. Should we adjust the ERP System's RTO or Order Processing's?

## What the Tools Validate

The skill includes two automated validation tools that run against the structured BIA data:

**`bia_rto_calculator`** checks five consistency rules:
- No process claims an RTO shorter than its slowest upstream dependency
- No RPO shorter than the RPO of data-providing dependencies
- Critical processes stay within expected tier thresholds (critical ≤ 4h, high ≤ 24h, etc.)
- RPO does not exceed RTO without explicit justification
- High-criticality processes do not silently depend on lower-criticality ones

**`dependency_loop_checker`** validates the dependency graph:
- Detects circular dependencies that would make RTO calculations meaningless
- Reports unknown or broken dependency references
- Maps cross-department dependency links for coordination planning

## Output Excerpt

The final BIA report includes a process inventory, impact-over-time matrix, validated dependency map, and actionable recommendations:

```
| ID       | Process          | Dept  | Criticality | RTO  | RPO   |
|----------|-----------------|-------|-------------|------|-------|
| PROC-001 | Order Processing | Sales | Critical    | 8h   | 1h    |
| PROC-002 | ERP System       | IT    | Critical    | 8h   | 1h    |
| PROC-003 | Database Cluster | IT    | Critical    | 1h   | 0.25h |
| PROC-004 | Payroll          | HR    | High        | 24h  | 4h    |
```

All RTO/RPO values are validated against the dependency chain — no process claims a recovery time its dependencies can't support.


---

Back to [Skill Library](https://rakenne.app/skills/index.md)