A BIA exists to decide the order you recover things in when you cannot recover everything at once. That makes the useful output a ranked list, not a document, and ranking requires scoring impact at several time horizons, because impact is rarely linear.
Score impact at four horizons, not once. Rate the impact at 4 hours, 1 day, 1 week, and 1 month. Payroll is trivial for three weeks and catastrophic on the fourth. A single rating hides exactly the processes whose urgency changes sharply.
Interview process owners, not IT. IT knows what systems exist; only the process owner knows there is a manual workaround that holds for two days, or that a regulatory filing falls on the 14th. Those details change the ranking more than any technical input.
Capture non-system dependencies. A process can be blocked by one named person, a supplier, a physical location, or a paper record. Recovery plans that only restore systems leave these failure modes untouched.
Flag peak periods explicitly. Many processes have a window where impact multiplies: month-end, year-end, open enrolment, Black Friday. Record it, because a DR plan tested in a quiet week may be invalid in the week it is needed.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Score 1-5 at each horizon. The shape across the row matters more than any single number.
| Business process | Owner | Impact @4h | Impact @1d | Impact @1w | Impact @1m | Peak period | Manual workaround | Workaround holds for |
|---|---|---|---|---|---|---|---|---|
| Customer checkout | Head of Ecommerce | 5 | 5 | 5 | 5 | Nov-Dec | None | - |
| Payroll | Head of People | 1 | 1 | 3 | 5 | Monthly, 25th-28th | Repeat last month's run | 1 cycle |
More free templates IT teams use alongside this one.
RTO and RPO are usually set by asking the business what it wants, which reliably returns 'zero'. This worksheet sets them the other way round: measure what you can currently deliver, price the gap, and let the business choose knowingly.
Most DR plans are written to satisfy an auditor and are unusable in an actual disaster: too long, structured by system rather than by sequence, and assuming the authors are available. This one is ordered the way the event unfolds.
Disaster recovery restores the systems. Business continuity answers what people do in the meantime, and that gap is where most organisations have nothing written down, because it belongs to departments rather than to IT.
An assessment of what happens to the business when each process is unavailable, scored over time, together with the dependencies each process relies on. Its output is a ranked recovery order used to drive continuity and disaster recovery planning.
Because impact is often non-linear. Payroll is trivial for three weeks and severe in the fourth; checkout is severe immediately. A single rating collapses these into the same category even though they need opposite recovery priorities.
The business process owners, not IT. Only they know about manual workarounds, regulatory deadlines, peak periods, and which single person holds critical knowledge, and those facts change the recovery ranking more than technical input does.
