BIA Workshop Guide 2026: How to Run One

A BIA workshop is a facilitated session in which process owners and other experts work through the business impact analysis together: identifying activities, estimating impacts over time, setting recovery targets and mapping dependencies. Done well, it produces better data than questionnaires alone, because people challenge each other’s assumptions and share what they know. Done badly, it wastes a day and produces figures nobody trusts. This guide explains how to plan and run a BIA workshop: who to invite, what to prepare, a workable agenda, facilitation techniques, how to handle disagreement and how to record and follow up on the results.

Why hold a BIA workshop

ISO 22301:2019 expects the business impact analysis to identify activities, assess the impacts of disruption over time, set prioritized time frames and identify dependencies. You can view the standard’s listing at ISO 22301:2019 on iso.org. Collecting this through emails and spreadsheets is slow, and answers are often inconsistent, because each owner interprets the questions differently and estimates their own activity as urgent. A workshop lets you agree definitions on the spot, compare estimates across teams and resolve conflicts, such as two departments each claiming that their activity must recover first.

Workshops work best alongside other methods. Use a short questionnaire beforehand to collect basic facts, as described in our guide to the business impact analysis questionnaire, and use the workshop to test and refine them.

Choose participants for the BIA workshop

The quality of the outcome depends on who is in the room. Invite people with real knowledge of the activities and authority to commit to figures.

• Process owners for the activities in scope, who know how the work is done and what depends on it.
• A senior sponsor who can settle priority disputes and confirm the results.
• IT representatives who can describe systems, recovery capabilities and interdependencies.
• Finance to help attach money figures to impacts.
• Procurement or vendor management for suppliers and contracts.
• Legal or compliance for regulatory and contractual deadlines.
• The business continuity manager as facilitator, with a scribe to record results.

Keep the group to a size where everyone speaks, ideally six to twelve people. Run separate sessions for large organizations, grouped by function or site, and a cross-functional session at the end to resolve conflicts.

Prepare before the session

Preparation decides whether the workshop is productive. Send participants a short briefing explaining the purpose, the standard’s requirements in plain language and what they need to bring.

1. Define the scope and the list of activities to be discussed, drawn from process maps, service catalogs and the previous analysis.
2. Agree impact categories and scales in advance: financial, legal and regulatory, customer, safety, reputation and operational, with definitions of minor, moderate, major and severe in each.
3. Prepare the time intervals to be assessed, such as four hours, one day, three days, one week and two weeks.
4. Collect baseline data, including revenue by process, contractual service levels, regulatory deadlines and past incident records.
5. Pre-populate a template with what you already know, so the group corrects and adds instead of starting from nothing.
6. Book adequate time, commonly two to three hours per functional group, and share the agenda.

Set the impact scales before people arrive

Without shared scales, each participant will define a major impact differently, and the results cannot be compared. Put money thresholds, customer numbers and regulatory consequences on the scale, and include an example for each level. Test it with one or two owners beforehand. Our guide to financial impact in the business impact analysis explains how to set money figures.

A workable agenda for the BIA workshop

Segment	Purpose	Typical time
Introduction	Purpose, scope, definitions, scales, ground rules	15 minutes
Activity review	Confirm the list, add missing activities, remove duplicates	20 minutes
Impact over time	Estimate impacts at each interval for each activity	60 minutes
Recovery targets	Set the maximum tolerable period and recovery objectives	30 minutes
Dependencies	Identify people, systems, suppliers and sites	30 minutes
Priorities and conflicts	Rank activities, resolve disputes	20 minutes
Wrap-up	Confirm outputs, actions and next steps	10 minutes

Adjust the times to fit the number of activities. A full day workshop is often better split into two half days, which gives participants time to gather missing data overnight.

Facilitation techniques that improve the data

A good facilitator draws out information and tests it politely. Ask for evidence: when did we last have an outage of that kind and what happened? Work through impact intervals from short to long, and ask at what point the effect changes character, for example from an inconvenience to missing a legal deadline. Ask what people would actually do if the system were unavailable, since workarounds change the impact. Watch for anchoring, where the first number spoken shapes all the others, by asking people to write estimates before discussing them.

Challenge inflation politely. Owners tend to rate their own activities as critical, so ask what would happen at the same interval in other teams’ activities, and use the shared scales to keep the ratings honest. Where an owner insists that no downtime is tolerable, ask what the cost would be of providing that level of resilience, and whether the business would pay it. The answer often moves the figure.

Handling disagreement and gaps

Conflicts are normal. Two activities may compete for the same resources or systems, and each owner may want to be first. Let the sponsor decide priorities after hearing the reasons, and record the decision. Where information is missing, record an action and an owner instead of guessing, and set a date to close it. Where estimates differ widely between people, record the range and the reason, then agree a working figure for planning and note that it needs validation. Never let the loudest voice set the numbers.

Recording outputs of a BIA workshop

Capture results as you go in the template on a shared screen, so that participants can see and correct them. For each activity record the description, owner, impacts by interval and category, the maximum tolerable period, recovery time and point objectives, minimum service levels, peaks and calendar constraints, and dependencies. Our guides to the maximum tolerable period of disruption and business impact analysis dependencies show what to record. Note the assumptions and the open actions.

Follow up after the workshop

Send the draft results to participants within a few days, ask them to confirm or correct within a set time, and chase silence. Consolidate across sessions and check for inconsistencies, such as an upstream activity with a longer tolerable period than a downstream one that depends on it. Present the consolidated results to the sponsor for approval. Then use them to plan strategies, compare with current recovery capability and identify gaps. Our business impact analysis example shows how the finished record looks.

A short worked example

A regional bank runs three BIA workshops, for retail operations, corporate services and technology. Each starts with a pre-populated list of activities and shared impact scales. In the retail session the owners of card services and branch cash management each rate their activity as needing recovery within one hour. The facilitator asks about workarounds: branch cash can continue for half a day using stock on hand, while card authorization cannot. The group agrees on four hours for cash management and one hour for card services, and the sponsor confirms the priority. Dependencies show that both rely on the same network provider, which is recorded as an action for the technology session. After follow-up, the consolidated analysis feeds the recovery strategies.

Common mistakes with a BIA workshop

Organizations invite too many or the wrong people, skip preparation, leave scales undefined, let one participant dominate, accept unsupported figures, fail to record dependencies, do not follow up and never validate results with senior management. Another mistake is running the workshop as a presentation, with the continuity team talking and the owners listening. The value lies in the owners’ knowledge and the challenge between them.

Using a ready structure

If you want ready templates for the session and the outputs, the Business Impact Analysis Report and Workbook provides a structured report and working register that you can project during the workshop and complete as you go. Whichever tool you use, plan the BIA workshop carefully, and record what the group decides.

BIA workshop FAQ

What is a BIA workshop?

It is a facilitated session where process owners and specialists work through the business impact analysis together, estimating impacts over time, setting recovery targets and identifying dependencies.

How long should it last?

Typically two to three hours per functional group. For larger scopes, split the work into several shorter sessions, and hold a final cross-functional session to resolve conflicts.

Who should attend?

Process owners, a senior sponsor, IT, finance, procurement, legal or compliance, and the business continuity manager as facilitator, in a group small enough for everyone to contribute.

Should a questionnaire be used as well?

Yes. Send a short questionnaire beforehand to collect basic facts, then use the workshop to test, refine and reconcile the answers across teams.

How do I stop owners from overrating their activities?

Use shared impact scales, ask for evidence and workarounds, compare across teams and let the sponsor settle priority disputes, recording the reasons for each decision.