I have been working on revising our Business Continuity/Disaster Recovery Plan and in addition to addressing the most common disasters, identifying our various teams and each teams responsibilities, emergency service levels, document reetrieval, electronic services, pandemic flu, evacuation procedures, plan implementation, and testing, I have addressed financial considerations and various other effects of a disaster on the bank; however, in a recent audit (in addition to a Risk Analysis), we were told we must have a separate Business Impace Analysis, with the various risk areas scored. I had not reviously heard of this. Where can I obtain more information about this requirement?

I'm auditing this area for our Bank and am using the FFIEC IT Examination Handbook as a resource. It has a section on the Business Impact Analysis (BIA) and its recommended elements.

Our Bank's business impact analysis identifies key employees for recovery teams, identifies the business functions performed by each department, determines impacts of business interuptions, recovery timelines and impacts (revenue, reputation, legal, and workflow)

Hope that helps!

Come up with an assumption for each of your bus. units to work through. For example, assume 50% of staff will not be available for the first 3 days of a disaster. Then, each unit should determine which critical tasks the remaining 50% should work on (should be high priority tasks); and what will be pushed aside. Follow Dbanker27's information as you work through this. We also did a separate impact analysis assuming a pandemic which presents very different challenges, such as large absenteeism and long periods of time.

Excellent information - thanks.

Thanks so much for the information.