A BIA impact matrix defines the impact categories, time bands and severity descriptions used to assess how disruption becomes more serious over time. The matrix should create consistent conversation and evidence. It should not hide important legal, safety or customer consequences behind a single averaged score.
Choose impact categories that reflect real decisions
Common categories include customer/service, financial, legal/regulatory, safety, operational, reputation and strategic impact. Do not add categories merely because a template contains them. Each category should have evidence sources and thresholds that make sense for the organization.
Example impact matrix
| Severity | Customer / service | Financial | Legal / regulatory |
|---|---|---|---|
| 1 — Minor | Short internal delay with no committed service missed | Absorbable operational cost | No reportable issue |
| 2 — Moderate | Limited customer delay; workaround available | Material departmental cost | Internal control exception requiring review |
| 3 — Major | Priority customers or service commitments affected | Material business loss or penalty exposure | Potential notification or contractual breach |
| 4 — Severe | Widespread or prolonged service failure | Severe loss affecting business objectives | Confirmed serious breach, enforcement or license impact |
The words in the matrix matter more than the numbers. Participants should be able to explain why an impact meets a threshold and provide evidence or an assumption that can later be reviewed.
Add time bands
Impacts usually change over time. A payroll process may be low impact for several days and become severe near the payroll cut-off. A payment or emergency service may become material within minutes. Use time bands appropriate to the organization, such as 1 hour, 4 hours, 8 hours, 24 hours, 3 days and 1 week. Avoid forcing every service into time bands that do not match its operating cycle.
Worked example
A customer payment service has limited impact in the first 30 minutes because transactions queue safely. By two hours, priority payments miss service commitments. By eight hours, settlement and regulatory consequences become unacceptable. The BIA records the evidence for that escalation. The organization may therefore identify an eight-hour MTPD/MAO and set an RTO comfortably inside that boundary, subject to dependency capability and strategy.
Do not let weighted scores hide a red-line impact
Averaging a severe regulatory impact with several low impacts can produce a misleading medium score. If a category contains a non-negotiable legal, safety or contractual threshold, treat it as a trigger rather than allowing arithmetic to dilute it. Scoring can help prioritize workshops, but accountable judgment should remain visible.
Questions for workshop facilitators
- What customer or citizen commitment is missed at this time?
- What financial consequence is actually expected and how was it estimated?
- Does a law, regulation, contract or safety obligation create a hard deadline?
- Can work queue safely, or does backlog itself create additional impact?
- Does impact change during month-end, payroll, market hours or seasonal peaks?
- Which upstream or downstream services are affected?
- What evidence supports the selected severity?
Impact matrix design checklist
- Categories are defined in language business owners understand.
- Severity thresholds include measurable examples.
- Time bands reflect real operating patterns.
- Hard legal/safety triggers are not diluted by averages.
- Workshop notes retain rationale and evidence.
- Recovery objectives are derived after impact discussion, not before.
- Matrix changes are version controlled because they can change criticality results.
Use the free Impact Matrix Builder, then take the result into the BCM System Playground to see how impact informs MAO/MTPD and RTO.