When conducting a business impact analysis (BIA) there are two important words to keep in mind: "business" and "impact".

It may sound obvious but, strangely, this is often forgotten and the BIA gets confused with a risk assessment.

The BIA is the part of the business continuity process that determines the level of pain an organisation would suffer if it were unable to carry out its critical processes.

We're not really interested in all the possible reasons why at this stage - that's what the risk assessment is for. And anyway, if the BIA's done properly, there's enough to think about without trying to do a risk assessment at the same time.

So don't make life more difficult for yourself than it needs to be. Concentrate on business impacts during the BIA, then conduct a separate risk assessment to identify potential risks to the critical processes identified by the BIA. Remember, it's called a business impact analysis - the clue's in the name!