How do a BIA and risk assessment work together in ISO 22301?

In an ISO 22301 BCMS, the business impact analysis (BIA) and the risk assessment are two complementary exercises that are often confused. The BIA aims to understand what must be protected first: critical activities, products and services, dependencies, tolerances to interruption, and the impacts of an outage. It gives a clear hierarchy and continuity objectives, making resource allocation easier.

The risk assessment, by contrast, focuses on the scenarios that could cause disruption: threats, vulnerabilities, internal or external causes, and possible effects. It estimates likelihood and helps choose prevention and mitigation measures. Where the BIA answers 'what matters most', the risk assessment answers 'what can happen, and why'.

The two come together when defining continuity strategies and solutions. The BIA sets priorities and recovery objectives, while the risk assessment helps choose proportionate measures: redundancy, workaround procedures, fallback solutions, response organisation and intervention plans. Decisions must account for cost, feasibility and time constraints.

Operationally, it helps to keep documentary consistency: an activity repository, a dependency map, a risk register and a justification of strategy choices. This traceability is essential for continual improvement and for certification-audit readiness.