How much financial loss would a disruption cause, and what can the BIA estimate for the CFO?
The BIA identifies core business processes, assesses the financial loss after a disruption and the maximum tolerable period of disruption (MTPD), and sets the recovery priority; it also maps the people, systems, suppliers and sites each critical activity depends on.
The BIA is the load-bearing wall of the whole system: it decides which activities are critical and how long a disruption can last before it becomes intolerable. The CFO can use the BIA results as the basis for estimating the financial impact of a disruption, instead of picking a tolerable downtime by feel.
Who decides the RTO and RPO, and why does it become an investment decision?
The RTO is how quickly operations must recover and the RPO is how much data can be lost at most; both should be derived from the BIA, decided by management, and then checked against existing backup capability — if that capability cannot meet them, it is an investment decision.
A common mistake is drawing the target after shooting the arrow: copying a good-looking RTO with no capability behind it. The CFO should confirm that every RTO and RPO has:
- a basis derived from the BIA
- matching backup, data backup or alternative supply arrangements
- exercise results showing it can be achieved
How do the annual report, the board and insurers look at operational resilience?
Article 20, item 6 of the annual report regulations requires an analysis of how technology change (including cybersecurity risk) affects the company's finances and business, and the responses; disruption is exactly that kind of impact. ISO 22301 keeps RTO and RPO targets and exercise results on record, which can be used to explain operational resilience to regulators, insurers and investors.
ISO 22301 requires regular exercises and testing; a BCP without exercise records is treated as non-existent in audits and customer reviews. The annual report regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.
Budgeting: what drives the cost of ISO 22301?
According to Winners Consulting's ISO 22301 budget guide:
| Factor | What it affects |
|---|---|
| Scope | The number of critical activities, product lines and sites covered |
| Business impact analysis | The number of units to interview and the complexity of dependencies |
| Technical baseline | Whether existing backup, data backup and disaster recovery can meet the recovery targets |
Closing backup gaps is a separate investment and should be budgeted apart from consulting and certification; under ISO/IEC 17021-1 clause 5.2.5, a certification body and the same legal entity may not provide consultancy. This page lists no fees; Winners Consulting provides an estimate after the free mechanism diagnosis.
Timeline: how long does it take, and which phases cannot be compressed?
As listed on the service page, the four phases usually take 4–7 months, or about 3–5 months with ISO 27001 in place:
- Scope and BIA (4–6 weeks)
- Strategy and plans (4–6 weeks)
- Exercises and revision (4–8 weeks)
- Audit and certification (3–6 weeks), including the internal audit, management review and support through stage 1 and stage 2 audits
The BIA and exercise phases cannot be compressed. ISO 22301:2019 can be certified by a third party, on a three-year certificate cycle.
With ISO 27001 already in place, what does adding ISO 22301 save?
Both share the Annex SL structure, and ISO 27001 controls A.5.29 and 5.30 (security during disruption, ICT readiness) connect directly to ISO 22301; an integrated implementation shares documents and audits, and the standard page notes that the incremental cost is clearly lower than doing them separately. The service page timeline also drops from usually 4–7 months to about 3–5 months.
The same business continuity management system can also answer NIS2 business continuity measures, DORA ICT operational resilience and the supplier backup questions in brand owners' resilience questionnaires.
How does Winners Consulting help a CFO with ISO 22301 business continuity management?
- VP- and director-level consultants lead the work end to end, never outsourced; consultants hold ISO 22301 lead auditor qualifications
- Clause 8 of ISO 22301 is the core, the BIA follows ISO/TS 22317, and backup and ICT readiness documents are shared with ISO 27001
- The BIA is run in ERM risk language and shares a scenario library with the enterprise risk map
- Every project runs at least one tabletop exercise and one functional exercise, and the records serve as certification and customer questionnaire evidence; certification is performed by a third party, with our support
Read more: ISO 22301 consulting, ISO 22301 budget and timeline, Choosing an ISO 22301 consultant, CFO role page. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- CFO implementing ERM: what to prepare for board reports, annual report risk items and the ESG evaluation
- CFO view of ISO 27001: annual report cybersecurity disclosure, ESG bonus points and budgeting
- CFO implementing ISO 37001: financial controls, integrity disclosure and cross-border bribery exposure
- CFO view of trade secrets and ISO 56001: protecting R&D value and earning ESG bonus points
- CFO view of DORA: contract clauses and penalty exposure with EU financial clients
- CFO view of GDPR and ISO 27701: fine provisions, cross-border transfers and budgeting
- CFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- NIS2 for CFOs: fine caps, management liability and provisions
- Digital transformation for CFOs: budget, ROI and capitalisation
- AI transformation for CFOs: ROI, penalty exposure, capitalisation