Activity IMPACT ANALYSIS (AIA)

For an organisation as large and diverse as the College it is usual for, every year, a number of department activities to experience some disruption for a plethora of reasons. Normally these disruptions are of limited scope and duration, but occasionally they can be extensive and/or prolonged. In extreme cases the disruption may affect substantial areas of College activity and persist for several months or even years; typically in the UK, one or two universities experience such an event every year.

PURPOSE
The purpose of Business Continuity Planning is to assist departments with protecting their activities from such disruptions. Whilst, generally the impact of these incidents on the overall College are small, for the activity disrupted the impact can be large. To protect against this, the College has response and recovery processes to manage an incident should it occur. However, the impact of an incident can often be significantly reduced and recovery significantly enhanced by prior application of simple resilience measures. These may be identified by completion of an Activity Impact Analysis which will assist Heads of Department, Principle Investigators, Project Directors and others responsible for department activities or projects with identifying appropriate measures to provide resilience to those activities, in the event of disruption.

METHODOLOGY
In order to assist recovery from an incident those responsible for department activities should complete an Impact Analysis form. This identifies the critical activities[1] undertaken by the department and the impact if they were to be disrupted. The reason for the disruption does not need to be considered, only the impact if the disruption was significant in extent and/or duration.

It is then necessary to consider how long before the impact of the disruption becomes intolerable. e.g. within 24hrs; a week; a month or longer. The point to which the activity should be recovered is then identified. Ideally the activity would be recovered to the condition it was at when it was disrupted, but in some cases this may not be necessary.

Once the recovery time has have been identified, it is possible to consider whether additional simple mitigation might significantly improve this, sometimes at minimal cost (e.g. back up of records, exam databases, or other necessary data; dispersed storage of essential supplies; cross training of staff). These risk mitigations should be recorded and an agreed owner assigned to ensure timely implementation. It is also for consideration that the recovery time could be considerably improved if a temporary lower level of service was accepted. It may thus be possible to achieve a more rapid recovery if a minimum service level can be agreed and appropriate measures put in place to allow this to occur. This minimum service level should be recorded for future reference. In some instances recovery times may vary through the academic year and this may influence what mitigations are considered appropriate e.g. Staff availability and/or call out at certain times of year.

Finally, it may be worth considering the priority in which activities and services are restored. In the early stages of an incident, service providers will use their own judgement in the restoration of activities and services. However, during a prolonged disruption, an early assessment of the priority which the user would wish activities and services to be restored may be helpful and this is best assessed before any disruption occurs, although that view may be modified in the light of an actual event.

[1] Critical Activities: Vital functions without which an organization or group will either not survive or will lose the capability to effectively achieve its critical objectives.

Activity Impact Analysis Template