Financial Impact in the Business Impact Analysis

At what financial loss level is a business interruption considered minor, moderate, significant, or severe? In many Business Impact Analyses, there is a table with rounded euro amounts, the origin of which no one can explain anymore. This article presents a practical approach: how companies derive the Financial Impact in the BIA from their economic risk-bearing capacity, which financial metrics are suitable for this, and how the duration of the interruption is factored into the assessment – with formulas, a worked example, and an interactive graphic.

It delves deeper into a topic that the article From Geopolitical Risk to Financial Resilience left open as a standalone question.

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

Initial Problem

Why Financial BIA Thresholds Are Often Arbitrary

Financial impact thresholds often arise in practice in one of three ways: they are adopted from a template, carried forward from a previous BIA, or established in a workshop as „reasonable“ amounts. Typical limits include 100,000 euros, 500,000 euros, and one million euros, or blanket percentages like 1 percent or 5 percent of annual revenue.

This leads to methodological issues:

• Lack of economic relevance. A fixed amount says nothing about what it means for the company. The same million can barely affect a corporation and put a subsidiary in financial difficulty.
• Incorrect reference size. Revenue describes business volume, not resilience. Two companies with the same revenue can have completely different results and liquidity reserves.
• No connection to decisions. If a threshold does not trigger a consequence—no escalation, no forecast adjustment, no investment decision—it is meaningless for management.
• Obsolescence. Absolute amounts do not grow with the company and are gradually devalued by inflation.
• Mixing of damage types. Result damage, liquidity needs, and financing risk are combined into one figure, although they answer different questions.

The consequence: Processes are rated too high or too low, recovery objectives cannot be justified, and investments in resilience compete with assessments that no one trusts.

Four Terms

The Methodological Framework

The methodological basis of this article is a distinction that is missing in many BIA frameworks. Financial resilience and financial tolerance are not the same:

A company may be economically capable of withstanding a loss of five million euros. This does not mean it is willing to accept such a loss in a single business process. The impact scale of the BIA therefore translates not resilience, but tolerance into levels—and resilience marks the outer limit that no tolerance determination may exceed.

Normative Foundations

What ISO 22301 and ISO/TS 22317 Actually Require

ISO 22301 requires a Business Impact Analysis in section 8.2.2. The organisation must, among other things, establish the types of impacts and evaluation criteria relevant to its context, assess the impacts of an interruption over time, determine the period after which the impacts would no longer be acceptable, and set prioritised recovery times below this.^[1] These periods are usually referred to as Maximum Tolerable Period of Disruption (MTPD) and Recovery Time Objective (RTO); more on this in the article on RTO, RPO, RTA and SLA.

The standard does not prescribe that financial impacts must be assessed, nor does it specify amounts, percentages, or metrics. It requires that the criteria fit the organisation’s context. ISO/TS 22317 is a Technical Specification with guidelines for conducting the BIA and contains recommendations, not certification-relevant requirements. It treats financial impacts as one of several types of impacts alongside legal, contractual, or reputational consequences.^[2]

For practical purposes, this results in a clear separation:

In Germany, a corporate law framework is added. The board of a public limited company must take appropriate measures to ensure that developments threatening the company’s continued existence are detected early.^[4] Since 2021, § 1 StaRUG obliges the management of legal entities in general to continuously monitor developments that threaten existence and to take countermeasures if necessary.^[5] The audit standard IDW PS 340 n.F. focuses on risk-bearing capacity for the early risk detection system: the maximum extent of damage a company can bear without endangering its continued existence.^[6] A BIA can be linked to this size.

Financial Metrics

Which metric answers which question

No single financial metric meets all requirements. Revenue, contribution margin, EBITDA, EBIT, cash flow, and liquidity describe different economic situations. Therefore, it is helpful not to ask for „the right metric,“ but for the question a metric is supposed to answer:

Why Revenue as a Threshold Basis is Misleading

A blanket threshold of 1 percent of revenue appears objective, but it is not. Two hypothetical companies each achieve 250 million euros in revenue. The first achieves an EBIT margin of 2 percent, or 5 million euros, the second a margin of 15 percent, or 37.5 million euros. One percent of revenue is 2.5 million euros in both cases. For the first company, this corresponds to half of the annual result, for the second just under 7 percent. The same threshold thus describes completely different burdens.

Contribution Margin as Damage Size

For damage calculation, the lost contribution margin is often suitable: sales revenue minus variable costs, limited to services that cannot be recovered. Additional costs of the disruption and contractual consequential costs are added. Revenue loss alone overestimates the damage because variable costs are eliminated, and underestimates it at the same time because additional costs are missing.

EBITDA, Cash Flow and Liquidity as Assessment Criteria

EBITDA and EBIT describe the impact on results. They are important if financing agreements are linked to them, but they are not liquidity metrics. Whether a company can meet its payment obligations is shown by cash flow and available liquidity. This distinction is also relevant for financial reporting: ESMA expects company-specific information on liquidity risks and covenants for the 2026 financial statements.^[7] In the BIA, these metrics should therefore not be included in the impact scale, but should be examined as separate escalation criteria.

Equity

Balance sheet equity shows the loss absorption capacity over a longer period, but it is a stock size and not available liquidity. As the sole reference for assessing individual disruptions, it is too coarse.

Risk-Bearing Capacity

What a company can economically withstand

Financial risk-bearing capacity describes the extent of damage a company can endure within a given period without breaching defined minimum requirements. It can be derived from three buffers:

• Profit Buffer: The gap between the planned profit and the minimum profit that should not be undercut, for reasons such as distributions, ratings, or shareholder requirements.
• Financing Buffer: The decline in EBITDA that contractual financial covenants still allow.
• Liquidity Buffer: Available cash and committed, freely available credit lines minus the minimum liquidity.

Since each of these buffers represents a hard limit, the smallest of them determines the capacity:

RTF = min(P_Profit; P_Financing; P_Liquidity)

The formula assumes that a disruption loss is fully effective on payments and results. If a loss impacts differently, for example, because part of it is tied up in inventories, each perspective is examined with its own amount.

Example: the fictitious Example-Industrie GmbH

The risk-bearing capacity is thus €8 million. The profit buffer is binding. The other buffers remain important: They will be used later as escalation criteria.

The risk-bearing capacity is a measure for all risks of a year, not for a single event. How individual risks consolidate into an overall risk position is described in the contribution to risk aggregation.

Risk Appetite and Risk Tolerance

What a company is willing to accept

ISO Guide 73 describes risk appetite as the extent and type of risks an organisation is willing to take or retain, and risk tolerance as the willingness to bear a risk after its treatment to achieve its objectives.^[3] For the BIA, this means:

• Risk-bearing capacity is a characteristic of the company. It is derived from figures and can be calculated.
• Risk appetite is a strategic stance: What risks does the company consciously accept to seize opportunities?
• Risk tolerance is the operational translation: What burden from a single event is tolerated without the need for additional measures?

The tolerance per event must be significantly below the capacity. A disruption scenario is rarely the only risk of a year; supply chain disruptions, cyber incidents, and market changes can coincide. A simple determination is a tolerance share τ:

R = τ × RTF

For Example-Industrie GmbH, management decides that a single disruption scenario may consume at most half of the risk-bearing capacity. With τ = 50 percent, the reference size of the impact scale is:

R = 0.5 × €8.0 million = €4.0 million

The tolerance share is a management decision. It is not calculated but justified, for example, by the number of significant risk scenarios, their interdependencies, and the desired safety reserve.

Derivation of Thresholds

From the reference size to euro amounts

The boundaries of the impact levels are derived from the reference size. Mathematically, this is straightforward:

S_k = p_k × R

The real work lies in the percentages p_k. They should not be derived from a template but linked to decisions triggered when a level is reached. For the example of Industrie GmbH, three such anchors arise:

This creates the four-level scale:

All percentages are illustrative model assumptions for a fictional company. They are not normative guidelines and cannot be readily transferred to other companies.

Is this scale sensible?

The intervals of the scale are unequal: From €600,000 to €1.8 million, the threshold triples, from €1.8 to €3.0 million, it increases by only two-thirds. This is not an error as long as each threshold is linked to a decision. However, it is worth consciously examining alternatives:

• Equidistant Scale (for example, 25, 50, and 75 percent): easy to explain, but hardly distinguishes in the lower range. Many processes then end up together in level 1.
• Geometric Scale (for example, each factor of 3: around 11, 33, and 100 percent): reflects that damages spread over orders of magnitude and differentiates small and large damages evenly.
• Five-Level Scale: An additional level „existential threat“ above the risk-bearing capacity – in the example from €8 million, i.e., 200 percent of the reference size – makes it visible when a scenario exceeds the company’s limit.

A recommendation can be derived from this: The uppermost threshold should be oriented towards tolerance, the intermediate levels towards escalation and decision thresholds. Where scenarios can reach the bearing capacity, a separate level for this belongs in the scale.

Escalation Criteria for Liquidity and Financing

The impact scale assesses the economic damage. Liquidity and financing risks are additionally examined and can override the classification. For the example of Industrie GmbH, the following applies:

• If the cash outflow of a scenario exceeds the liquidity buffer of €14 million within 30 days, the scenario is classified as severe regardless of the damage.
• If the EBITDA decline endangers the covenant, i.e., a decline of more than €10 million, the same applies.
• Likewise, if the solvency of a single entity is endangered or necessary refinancing is no longer possible.

This keeps the scale consistent, and critical liquidity or financing events are still recorded separately.

Time-Dependent Financial Impact

How Damage Curves Arise

A financial loss is not a fixed number but a function of the duration of the disruption. For a process, the cumulative damage at time t can be described simply as follows:

D(t) = DB_lost(t) + C_additional(t) + V(t)

Here, DB_lost(t) is the lost contribution margin of non-recoverable services, C_additional(t) is the sum of additional costs (troubleshooting, overtime, express procurement), and V(t) is the sum of contractual consequential costs such as penalties. Avoided costs and catch-up effects have already been deducted. The components grow differently: additional costs arise immediately, the contribution margin is only lost when inventory is depleted, and penalties are triggered by contractual deadlines.

For a production outage of the example of Industrie GmbH, the following fictional breakdown results:

Read against the scale, the disruption after 24 hours is moderate at 800,000 euros (20 percent of the reference size), significant after 72 hours at 2.7 million euros (67.5 percent), and severe after seven days at 4.5 million euros – it then even exceeds the tolerance of 4 million euros but remains below the capacity of 8 million euros.

The graphic makes these relationships adjustable. Adapt risk-bearing capacity, tolerance per event, and stage limits, and choose RTO and MTPD: The damage curve remains the same, the classification changes.

What the Curve Means for MTPD and RTO

Connected between the observation points, the curve crosses into the „severe“ category after approximately 88 hours and the tolerance threshold after just under six days. From a financial perspective, an MTPD of 72 hours would be justifiable: Up to that point, the damage remains significant, after which it becomes severe. An RTO of 48 hours, at 1.6 million euros, still falls within the moderate range and allows room for recovery.

However, the MTPD should not be derived solely from the financial curve. Regulatory, contractual, security, or reputational impacts may make an earlier interruption unacceptable. The financial curve provides the economic justification, while other impact types may shorten the time limit.

Group and Subsidiary

On Which Level Thresholds Apply

Financial thresholds can be set at group, company, site, or process level. Each level has advantages and disadvantages:

An example illustrates the problem: A subsidiary of Beispiel-Industrie GmbH has its own risk-bearing capacity of 1.5 million euros, with the same tolerance share, thus a reference size of 750,000 euros. A disruption with 800,000 euros damage after 24 hours is moderate at the group level, but for the subsidiary, it already exceeds its tolerance.

A two-tier approach has proven effective:

• Uniform Methodology: Damage calculation, formulas, and percentages apply group-wide.
• Reference Sizes per Company: Each legal entity with its own liquidity and financing receives its own risk-bearing capacity and tolerance.
• Double Evaluation, Higher Level Applies: A process is evaluated against the scale of its company and against the group scale; the higher classification is decisive.

Processes and sites do not receive their own thresholds. Their damages are measured against the scale of the company to which they belong.

Operational Risk Management

Connecting Damage Amount and Probability

The BIA answers how high the damage is for a specific interruption duration. Operational Risk Management complements this by assessing how likely a scenario is and how long the interruption is expected to last. Both are connected through the expected loss:

EL = p × Σ_i (q_i × D(t_i))

Here, p is the probability of the scenario occurring per year, q_i is the probability that the disruption in the event reaches the duration t_i, and D(t_i) is the damage from the BIA curve. For the scenario „failure of a critical spare part“ of Beispiel-Industrie GmbH, the following fictitious assumptions apply:

With a probability of occurrence of 5 percent per year, this results in an expected loss of 0.05 × 2.02 million euros = 101,000 euros per year. This value is not sufficient for management: if the event occurs, the damage can reach 4.5 million euros and thus exceed the tolerance. Therefore, expected loss and extreme damage are always considered together.

In NOVELEDGE’s risk model, the impact level of the BIA flows into the assessment of resources as an effect; from this, process and corporate risk are aggregated. The risk calculator shows this calculation interactively. It is important that the impact scale of the BIA and the impact scale of risk management use the same boundaries. Otherwise, both disciplines assess the same damage differently.

Approach Model

The complete scale in six steps

In summary, an approach model in six steps emerges, which companies can use for the development or review of their financial BIA assessment:

Those who document the scale should record for each step which data were used, who made the decision, and which assumptions apply. Only this documentation makes the thresholds verifiable.

Governance

Who bears which responsibility

The key is the separation between calculation and determination: Controlling, Treasury, and Risk Management provide figures, while Executive Management decides on tolerance and scale. BCM ensures that the scale is applied consistently in every BIA.

Validation and Updating

When thresholds need to be reviewed

If thresholds are defined as a proportion of a reference size, they adjust with each recalculation of the reference size. Nevertheless, they should be reviewed at regular intervals and on specific occasions:

• Annually with corporate planning: New planning results and liquidity planning alter the buffers.
• During inflation: Absolute amounts lose significance; proportional thresholds must be checked against current cost and price levels.
• During growth, acquisitions, or sales: New entities require their own reference sizes.
• With changed financing: New loan agreements and covenants shift the financing buffer.
• After incidents: The actual damage is compared with the BIA curve. Significant deviations indicate where assumptions were incorrect.
• With changed risk appetite: A new strategy or new shareholder directives can alter the tolerance level.

Conclusion

Making financial criticality comprehensible

Financial thresholds in the BIA become robust when they are not set as round figures but derived from the company’s situation. The foundation is the distinction between four terms: risk-bearing capacity describes what the company can withstand, risk tolerance what it is willing to accept, the BIA impact what damage occurs, and criticality how this damage is to be classified.

This leads to a comprehensible path: determine buffers, establish capacity, set tolerance, link stage boundaries to decisions, supplement liquidity and financing as escalation criteria, and evaluate damage curves over time. A scale justified in this way can be reviewed, updated, and applied uniformly across the group – and it provides the economic rationale for recovery objectives and resilience measures.

Frequently Asked Questions

Brief answers for practical use

Further Reading

In-depth exploration of BIA and financial resilience

• From Geopolitical Risk to Financial Resilience
• Business Impact Analysis: Basics and Approach
• Risk Aggregation: From Resource Risk to Corporate Risk
• NOVELEDGE Risk Calculator
• RTO, RPO, RTA and SLA in Business Continuity Management
• BIA Template 2.0 – Excel Template for Business Impact Analysis
• Training on Business Impact Analysis

Sources

The information in this article is based on the following sources. No direct quotations are taken from paid standards and norms; their contents are paraphrased. All company data and numerical examples are fictional.

1. ISO 22301:2019 – Security and resilience – Business continuity management systems – Requirements, Section 8.2.2 (Business Impact Analysis). Available for purchase through standards trade. iso.org ↑
2. ISO/TS 22317:2021 – Security and resilience – Business continuity management systems – Guidelines for business impact analysis. Available for purchase through standards trade. iso.org ↑
3. ISO Guide 73:2009 – Risk management – Vocabulary, Terms risk appetite and risk tolerance. Available for purchase through standards trade. iso.org ↑
4. § 91 para. 2 Aktiengesetz (AktG), Early detection of developments endangering the continued existence. gesetze-im-internet.de ↑
5. § 1 Unternehmensstabilisierungs- und -restrukturierungsgesetz (StaRUG), Crisis early detection and crisis management. gesetze-im-internet.de ↑
6. Institut der Wirtschaftsprüfer (IDW): IDW PS 340 n.F. – Audit of the risk early detection system, adopted on 27.05.2020, applicable for financial years starting from 01.01.2021. Available for purchase; Summary at Forvis Mazars ↑
7. European Securities and Markets Authority (ESMA): European common enforcement priorities for 2026 corporate reporting, Public Statement dated 13.10.2026, ESMA32-2064178921-9738. esma.europa.eu ↑