Chat with our experts on Business Impact Analysis (BIA)

You’re not alone. Business Impact Analysis (BIA) forms the cornerstone of effective Business Continuity Management (BCM), helping organizations identify critical processes, dependencies, and potential risks that could disrupt operations. BIA goes beyond a simple checklist, providing structured insights that allow companies to plan, prepare, and respond effectively to incidents, ensuring continuity when it matters most.

To help bring clarity, we sat down with our KPMG BCM specialist: Olivier Demeyer.
In this edition, he breaks down what BIA really entails in practice, explains how KPMG supports organizations through the process, and shares his experience working on real-world continuity projects: from conducting structured analyses of critical processes to translating findings into actionable business continuity plans tailored to each client’s operational environment.

One of the main challenges in conducting a BIA project is ensuring alignment and engagement across the organization. BIA is often initiated by management or second-line teams, and operational staff often face competing priorities and limited availability due to day-to-day responsibilities. In practice this often means that you need to ensure additional buy-in from the business by focusing on what's in it for them.

BIA can also be triggered by past incidents, requests from auditors or insurers, or as a preventive measure. Assessing potential impacts can be complex, particularly for scenarios that haven’t been experienced before. For instance, if a core SAP system were to go offline, it can be challenging to estimate the effect on processes or service delivery. In these situations, it’s essential to work collaboratively, critically evaluate dependencies, and apply creative thinking to understand and prioritize risks effectively.

Olivier Demeyer, Manager Advisor, Enterprise Risk Services

One standout project was in the public sector, which presented a truly unique set of challenges. Many processes were highly decentralized, and operations were spread across multiple geographical regions, meaning there was no uniform approach or single playbook to follow. Each region operated with a different level of maturity, which required extra effort in engaging the multiple stakeholders. Additionally, some regions had well-established practices, while others were just beginning to formalize their operational procedures, which added layers of complexity to the assessment.

This diversity meant that every critical process had to be evaluated in context, considering local dependencies, systems, and workflows. Collaborating across regions required clear communication, adaptability, and the ability to tailor approaches to different teams while maintaining a consistent overall methodology. While the project was challenging, it was also highly rewarding. It pushed the team to think creatively and critically about how to assess and prioritize risks in a complex, distributed organization, ultimately providing valuable insights that would strengthen resilience across the entire entity.

The most interesting projects are often those that follow an actual incident. In these cases, the BIA process goes beyond theoretical exercises and allows the team to backtrack and analyze what went wrong, how the organization responded, and which processes were most affected. It also provides the opportunity to examine decision making under pressure, identify gaps in preparedness, and explore what could have been done differently to minimize the impact.

Because the analysis is grounded in real events, engagement and buy-in from the business tend to be stronger. Operational teams and management can see firsthand the consequences of disruption, making the importance of business continuity tangible rather than abstract. This approach not only highlights vulnerabilities but also uncovers practical insights and lessons that purely hypothetical assessments often miss. Ultimately, these projects help organizations build resilience by turning past challenges into actionable improvements, fostering a culture of preparedness and continuous learning.

I’ve been with KPMG for about four years and it was my first job after graduating. I formally joined the Enterprise Risk & Assurance team, which focuses on risk management and internal audit. I applied to multiple organizations to find the best personal and professional fit, and the interviews with KPMG went really well. My background is in Risk & Finance as a business engineer, and I was particularly drawn to the risk side because it exposes you to different processes and companies, providing rapid learning and varied experiences.

The culture at KPMG is excellent, with really fun and supportive colleagues. It’s an open environment where you see a wide range of organizations, projects, and processes in a short time. You’re rarely on one long project; instead, you get exposure to multiple clients and assignments simultaneously. They provide significant responsibility when you’re ready, but at your own pace, which makes it a fantastic place for professional growth and learning.