Business Impact Analysis Calculator
Cost an outage for a BIA: lost margin, idle staff, penalties, recovery and reputational uplift, tested against the MTPD and the proposed RTO.
Inputs
Total Modelled Impact
$342,623
Impact per Hour of Outage
$42,828
Lost Contribution Margin
$117,600
Idle Staff Cost
$52,000
Penalties Accrued
$8,333
Reputational Uplift
$44,690
Impact at the Full MTPD
$1,027,870
Recovery Tier
Tier 2 — business critical, recovery in a few hours with a warm standby
MTPD Check
The modelled outage sits inside the MTPD
RTO Check
Proposed RTO leaves healthy headroom below the MTPD
Step by step
Values used
Revenue dependent on the process = 42,000 $/hour; Contribution margin on that revenue = 35 %; Loaded cost of staff left idle = 6,500 $/hour; One-off recovery, rework and overtime cost = 120,000 $; Contractual or regulatory penalty per day = 25,000 $/day; Outage duration being modelled = 8 hours; Maximum tolerable period of disruption = 24 hours; Proposed recovery time objective = 4 hours; Reputational and churn uplift on direct losses = 15 %
Business Impact Analysis
Total impact = (lost margin + idle staff cost + penalties + one-off recovery cost) × (1 + reputational uplift), where lost margin = revenue per hour × outage hours × contribution margin.
MTPD exposure
Impact at the full MTPD = impact per hour × maximum tolerable period of disruption, which is the number that justifies the recovery tier.
Total Modelled Impact
= 342,623
Impact per Hour of Outage
= 42,828
Lost Contribution Margin
= 117,600
Idle Staff Cost
= 52,000
Penalties Accrued
= 8,333
Reputational Uplift
= 44,690
How it works
Only the contribution margin on interrupted revenue is a real loss, since the variable cost of serving it was never incurred, and deferred revenue that customers pay later should not be counted at all. Idle staff, pro-rated penalties and one-off recovery work are added at cost, then a reputational uplift stands in for churn — a blunt instrument, but better than the usual practice of pretending the number is zero. The recovery tier and the RTO both have to be paid for, and this is the figure that decides whether active-active infrastructure is prudent or theatre. Treat it as a planning estimate: the inputs are forecasts, so the output is a range dressed up as a number.
Formulas
Business Impact Analysis
Total impact = (lost margin + idle staff cost + penalties + one-off recovery cost) × (1 + reputational uplift), where lost margin = revenue per hour × outage hours × contribution margin.
- marginLoss
- Revenue is not loss — only the contribution margin is
- penalty
- Daily penalty pro-rated across the outage hours
- reputational
- Percentage uplift applied to direct losses to stand in for churn and brand damage
MTPD exposure
Impact at the full MTPD = impact per hour × maximum tolerable period of disruption, which is the number that justifies the recovery tier.
- mtpd
- Maximum tolerable period of disruption, the point beyond which the damage is irreversible
- lossPerHour
- Total impact divided by outage hours
Frequently Asked Questions
How is Business Impact Analysis calculated?
Total impact = (lost margin + idle staff cost + penalties + one-off recovery cost) × (1 + reputational uplift), where lost margin = revenue per hour × outage hours × contribution margin. Only the contribution margin on interrupted revenue is a real loss, since the variable cost of serving it was never incurred, and deferred revenue that customers pay later should not be counted at all. Idle staff, pro-rated penalties and one-off recovery work are added at cost, then a reputational uplift stands in for churn — a blunt instrument, but better than the usual practice of pretending the number is zero.
Why does Business Impact Analysis matter?
The recovery tier and the RTO both have to be paid for, and this is the figure that decides whether active-active infrastructure is prudent or theatre. Treat it as a planning estimate: the inputs are forecasts, so the output is a range dressed up as a number.
What values do I need to enter?
This calculator takes 9 inputs: Revenue dependent on the process, Contribution margin on that revenue, Loaded cost of staff left idle, One-off recovery, rework and overtime cost, Contractual or regulatory penalty per day, Outage duration being modelled, Maximum tolerable period of disruption, Proposed recovery time objective, Reputational and churn uplift on direct losses. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I use revenue or margin?
Margin. Losing an hour of revenue does not cost you the revenue, it costs you the profit on it, and using gross revenue is the single most common way a BIA overstates impact by a factor of three. Where revenue is merely deferred rather than lost, exclude it and note the working capital effect instead.
How do I justify the reputational uplift?
Anchor it to something observable — historical churn after past incidents, the discount you have given as a service credit, or the cost of the retention campaign you ran afterwards. If you have nothing, state the assumption in the BIA and run it at two values so the decision is visibly sensitive to it.
You might also need
- Disaster Recovery RTO CalculatorCommonly used together
- Business Continuity CalculatorCommonly used together
- Risk Appetite CalculatorCommonly used together
- Security Investment ROI CalculatorAlso in Compliance & GRC
- ISO 27001 Compliance CalculatorAlso in Compliance & GRC
- Residual Risk CalculatorAlso in Compliance & GRC