Process criticality: rate the damage if it fails

Key takeaways

A process criticality assessment rates how much damage a process would cause if it failed for a day, a week or a month. Critical processes can still be outsourced, but they need tighter controls, tested continuity plans and a provider you can audit. Criticality is about the impact of failure, not how important the process feels.

• Rate impact on customers, cash, compliance and reputation.
• Ask what breaks after one day, one week and one month.
• Critical does not mean keep; it means control.
• Critical processes need tested continuity plans.

How do you identify critical business processes?

For each process, ask what would happen if it stopped for one day, one week and one month. Rate the impact on customers, cash, legal compliance and reputation as low, medium or high. A process that causes high impact within a week is critical. Payroll, customer payments and regulated reporting are usually critical; filing and internal reports rarely are.

• Customers: would they notice, and leave?
• Cash: would money stop arriving or go out wrongly?
• Compliance: would you miss a legal deadline?
• Reputation: would it become public?

• Which business processes should you outsource?
• A business continuity plan for a small business

Can you outsource a critical process?

Yes. Many firms outsource payroll and payments precisely because a specialist runs them more reliably. The FCA's SYSC 8 rules, for example, allow regulated firms to outsource critical or important functions, provided the firm keeps responsibility and the ability to oversee them. The same principle suits any SME: outsource the work, keep the oversight.

• Regulated processes: outsource the work, keep the duty
• Business continuity for outsourced operations

What extra controls does a critical process need?

A critical process needs more than a standard service agreement. Agree a recovery time, test the provider's continuity plan, keep the method and data accessible to you, and review output more often. Keep the final approval step in-house where money or legal filings are involved.

• Agreed recovery time if the provider has an outage.
• A continuity plan you have seen tested.
• Your own copy of the method and data.
• Weekly sampling, not monthly.
• Final approval kept in-house.

• BPO SLA examples you can adapt
• An outsourcing risk register for each process

When should criticality keep a process in-house?

When you cannot get the controls above, or when failure would be irreversible and the provider cannot show a track record in that process. A critical process with no written method also stays until it is documented, because you cannot oversee what you cannot describe.

• When not to outsource
• Document your processes before you outsource

What does this look like in practice?

A pattern we see: owners rate almost everything as critical at first. Asking what breaks after one day rather than one month usually leaves three or four genuinely critical processes, which makes the control work manageable.

• See client work
• BPO Solutions for UK businesses

Criticality checklist

Record these for each process.

• Impact after one day, one week and one month.
• Which of customers, cash, compliance, reputation is hit.
• A criticality rating: low, medium or high.
• For high: recovery time and continuity test date.
• Who approves output before it goes out.

• A business process register: map every process once
• The process selection score: outsource, split or keep?

Next step

Rate your top ten processes for criticality and send us the ones you marked high. We will tell you what controls each would need if outsourced.