Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Salesforce business-analysis work — eliciting and documenting requirements, writing and sizing user stories (INVEST, Given/When/Then, MoSCoW), facilitating stakeholder workshops and discovery, mapping current/future-state processes (swimlanes, RACI, RAID), defect triage, and running user acceptance testing to a go/no-go decision. Use when gathering requirements, mapping process, or driving UAT on a Salesforce project. This is the requirements/process discipline — not building the config or code
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-21 | ✗→✓ | ▲ Improved | 285% | 0% |
| case-07 | ✓→✓ | = Same ✓ | 594% | 0% |
| case-06 | ✓→✓ | = Same ✓ | 534% | 0% |
| case-01 | ✓→✓ | = Same ✓ | 480% | 0% |
| case-02 | ✓→✓ | = Same ✓ | 335% | 0% |
Operational playbook for the Salesforce BA discipline. Credential background, study path, and skill orientation: references/study-resources.md.
> Load this skill when… eliciting or documenting requirements for a Salesforce project; writing or reviewing user stories and acceptance criteria; facilitating a discovery or UAT session; mapping as-is/to-be processes including automation implications. > Not this skill: building the declarative config (fields, flows, layouts) → see salesforce-administrator; writing Apex, LWC, or integration code → see salesforce-platform-developer-1 / salesforce-platform-developer-2.
> Deeper context: Study resources live in references/study-resources.md (loaded on demand). For org-specific applications of these rules, see a per-org appendix you maintain in your own project, referenced from a CLAUDE.md. For NPSP/nonprofit-specific guidance, see salesforce-nonprofit-cloud-consultant.
> Verify steps assume nothing about your tooling — use your project's Salesforce MCP connection, the Salesforce CLI (sf), or the Salesforce setup UI, in that order of preference.
Credential logistics and study path: see references/study-resources.md.
[volatile — verify live] items include: BA-201 blueprint topic weights and question counts, specific org edition/license feature availability, and managed-package automation behavior (NPSP, Nonprofit Cloud) across package versions.[volatile — verify live] or [opinion — house style].> Volatile tag index: The specific items tagged [volatile — verify live] in this skill (blueprint weights, NPSP package behavior) are annotated in references/study-resources.md — load that file when verifying exam logistics or planning a study pass.
Map stakeholders before the first workshop, not after. Build a power/interest grid: high-power/high-interest = manage closely (project lead, executive board); high-power/low-interest = keep satisfied (executive sponsor); low-power/high-interest = keep informed (end users whose daily work changes); low-power/low-interest = monitor. Decision rule: the person who can say "no, ship it differently" is a primary stakeholder and must sign off; everyone else is consulted or informed.
Use a RACI matrix to kill the "who decides?" ambiguity. Exactly one Accountable per decision. If two people are Accountable for the same decision, that is a red flag — escalate to make it one. Responsible can be many; Consulted before; Informed after.
Pick the elicitation method to fit the source, not your habit:
| Situation | Method | Why | |---|---|---| | One SME with deep tacit knowledge | 1:1 interview (open questions first, then closed to confirm) | Won't speak up in a group | | Process truth differs from the SOP | Observation / shadowing (process walk) | People describe the ideal, not what they do | | Many stakeholders, conflicting wants | Facilitated workshop (JAD) + dot voting | Surfaces conflict early, builds shared ownership | | Large dispersed user base | Survey / questionnaire | Cheap breadth; weak on "why" | | Existing system or paper artifacts | Document analysis | Free, factual, no scheduling cost |
Anti-patterns / red flags:
Verification step: Before claiming "staff need X," confirm the org reality — inspect existing objects and fields, and run a report or query to check whether the "missing capability" is actually already there. Don't write a requirement for something the org already does.
Write every story in the canonical form: "As a [persona], I want [capability] so that [business value]." The "so that" is mandatory — a story without a value clause is a task, and tasks don't get prioritized against business value.
Apply INVEST to gate a story into a sprint:
| Letter | Test it must pass | Red flag if… | |---|---|---| | Independent | Can be built without waiting on another story | Story can't start until 3 others ship | | Negotiable | Describes the need, not a frozen spec | Story is a UI mockup with pixel coords | | Valuable | Delivers value to a user/business | "Refactor the Lambda" with no user value | | Estimable | Team can size it | Too vague to estimate → split or spike | | Small | Fits in one sprint | "Build the portal" | | Testable | Has acceptance criteria you can pass/fail | "Should be fast/intuitive" |
Write acceptance criteria in Given/When/Then (Gherkin) so they convert 1:1 into UAT test cases. Decision rule: if you can't phrase the criterion as a pass/fail observation, it's not done — rewrite it.
Split big stories with a real pattern, never arbitrarily: by workflow step, by data variation (one record type/scenario at a time), by user role, by happy-path-then-exception, by CRUD operation. Each split must keep its own "so that" value.
Backlog hierarchy: Epic → Story → Task. Don't flatten these — prioritization happens at the story level, sizing at the task level.
Prioritize with MoSCoW and mean it: Must (launch blocked without it) / Should (painful to omit, not blocking) / Could (nice-to-have) / Won't (explicitly out, this release). Red flag: everything is a "Must." If >60% of the backlog is Must, the prioritization is fake.
Salesforce-specific story granularity: state the config artifact so an admin vs. developer can estimate. "Add field X (text, max N) to object Y, FLS on permset Z, surface on layout/Quick Action W" is estimable; "make the form capture X" is not. Any story that adds a field also has a downstream chain (schema/validation, UI, security, tests) that must be named to be estimable.
Verification step: Before sizing a story that touches a field, describe the target object to confirm the field's real type, length, and whether it already exists. Stories that "add" an existing field, or assume a wrong type, blow estimates.
Translate vague goals into measurable success criteria before design. "We want less data entry" → "reduce volunteer keying time per record from ~15 min to 0; eliminate transcription errors; give applicants self-service status." If you can't attach a number or a yes/no outcome, keep digging.
Do a real current-state assessment of the actual org — don't assume. Inventory: installed managed packages (note their namespaces), the live data model, active automations (workflow rules, flows, triggers, process builders), integrations, and data quality. Rule: enumerate active automations on any object you plan to write to, because side effects are invisible until they bite — a managed-package workflow rule can silently corrupt data on insert, and only a current-state automation audit catches it.
Categorize every gap (Config / Customization / Third-party / Process change) and prefer config over code over package over custom integration, ascending cost/risk — only escalate when the lower-cost option fails non-functional requirements (volume, security, audit). Choose Apex over Flow when managed-package side effects require it. Full gap-type table and implementation lifecycle phase map (Discovery → Design → Build → Test → Train → Deploy → Operate) with BA ownership per phase: references/change-management.md — load when sizing a discovery or scoping build paths.
Scope discipline: write down what is explicitly out. A scope statement without an out-of-scope list invites scope creep.
Anti-patterns / red flags:
Verification step: List the real object inventory; describe core objects (e.g. Contact) to see real fields and record types before scoping anything that touches them.
Know which artifact you owe, and don't blur them. Requirements = the what (business-owned contract). User stories = the what, from the user's perspective, sized for a sprint. Decision rule: use a formal Business Requirements Document / Functional Spec when the environment is regulated, fixed-price, or audited; use a story backlog when delivery is agile and the team is trusted.
Classify every requirement, because the class determines who validates it:
| Class | Definition | Owner / validator | |---|---|---| | Business | What the org needs to achieve | Sponsor | | Functional | What the system must do | BA + users (UAT) | | Non-functional | How well — performance, security, availability, accessibility | BA + technical + security | | Technical/constraint | Implementation limits (e.g. "must use SSM, not Secrets Manager") | Architect/dev |
Non-functional requirements are where projects live or die — capture them explicitly. Common examples: PII/medical-data handling (no PII in logs, files in object storage only), accessibility for elderly users on shared devices (44px tap targets, no off-viewport buttons), audit trail on every write, and API throttling. A functional requirement that ignores these will pass a demo and fail go-live.
Give every requirement manageable metadata: unique ID, priority (MoSCoW), status, owner, source (which stakeholder/interview), and an acceptance-test reference. Without a source you can't go back and ask "did we hear this right?"; without a test reference you can't prove it's met.
Verification vs. validation — keep them straight:
A solution can pass verification and fail validation — a feature built exactly to spec can still miss the real need that only surfaces by validating against the actual workflow.
Maintain traceability: requirement → user story → test case → defect. When a field changes, you must be able to see everything downstream. A typical concrete trace is: SF field metadata → generated schema constants → validation schema → form field → automated test. Breaking that chain (e.g. hand-editing a generated file) breaks traceability.
Anti-patterns / red flags:
Verification step: Describing an object returns each field's real length, type, picklistValues, and required flag — use it to validate that a documented requirement matches the org, especially max-length and picklist-value requirements.
Map as-is before to-be, with SMEs, in a swimlane. Lanes = actors (end user, intake volunteer, data-entry volunteer, Salesforce, staff reviewer). Capture handoffs, bottlenecks, manual workarounds, and the exception paths SOPs never mention (incomplete submission, illegible document, applicant with no email).
Keep the to-be map at the business level. It shows what changes and who benefits, not a click-by-click Salesforce walkthrough — otherwise stakeholders can't read it and it rots the moment a button moves.
Mine the map for configuration requirements:
Decision rule for the automation tool the process implies (the BA should recommend, the admin/dev confirms):
| Need | Tool | Don't use because | |---|---|---| | Block bad data at save | Validation rule | A flow for this is overkill and slower | | No-code record automation, multi-step, async, scheduled | Flow (Record-Triggered / Screen / Scheduled) | Workflow Rules and Process Builder reached end of support Dec 31 2025; no new builds | | Complex logic, bulk DML, callouts, transaction control, managed-package side-effect orchestration | Apex trigger/class | Flow can't safely bulk-orchestrate managed-package side effects | | Multi-stage human sign-off | Approval Process / Flow approval | Hand-rolling status picklists loses audit trail |
Anti-patterns / red flags:
Verification step: Before mapping a "future state" that adds automation, audit what already fires on the object (relationships, record types, existing automations) and confirm with the team — an unmapped existing automation can sabotage the to-be process.
Write a UAT plan with explicit entry and exit criteria. Entry: build is feature-complete, in a representative environment (sandbox), test data loaded, testers trained. Exit: all Must-have scenarios pass; no open blocker/critical defects; known issues documented with agreed workarounds; business sign-off recorded.
UAT is not QA. QA/system testing (verification) is technical: does it match spec? UAT (validation) is the business confirming it solves the real need, performed by real users on real scenarios. The BA facilitates; the business signs.
Derive test cases straight from stories' acceptance criteria. One scenario per story, each covering happy path, sad path, and edge cases. Structure: precondition → steps → expected result → actual result → pass/fail.
Classify defects on two axes and don't conflate them: Severity (technical impact: blocker/critical/major/minor/cosmetic) vs. Priority (business urgency to fix). A cosmetic typo on a consent page can be high priority; a rare edge-case crash can be low. Triage on both.
Prepare test data that exercises business rules without exposing production PII. Use a sandbox (Developer/Developer Pro/Partial/Full), never prod. Include boundary data: a date that looks valid but isn't (e.g. 2026-02-31), max-length strings, and picklist values the form offers vs. the values a restricted picklist actually accepts.
Manage scope during UAT. When a tester says "it should also do Y," decide: is Y a defect (fails an existing acceptance criterion) or a new requirement (change request, separate backlog item)? Logging new requirements as defects is the #1 way UAT slips.
Issue a risk-based go/no-go, not a binary gut call. Aggregate: count open defects by severity, map each known issue to a documented workaround, weigh against launch deadline. Go = no open blockers/criticals, Musts pass, workarounds agreed. No-go = any open blocker, or a Must scenario failing. Record the decision, the residual risks, and who accepted them.
Plan regression awareness: a fix can break a previously passing scenario. After any fix, rerun the impacted scenarios.
Anti-patterns / red flags:
Verification step: After a UAT cycle that created/changed SF records in sandbox, confirm the actual outcome by querying the records — verify they landed with the right field values, role flags, and status, rather than trusting the UI screen the tester saw.
→ gate: a documented need statement with a named stakeholder source, not a solution description.
→ gate: story passes the INVEST gate (Independent, Negotiable, Valuable, Estimable, Small, Testable).
→ gate: story references actual field API names and confirmed data types; no mismatched type assumptions.
→ gate: every criterion can be answered pass/fail with no ambiguity; team confirms criteria are testable.
→ gate: story has a point estimate; no "too big to estimate" verdict remains unresolved.
→ gate: traceability row exists in the tracking artifact before the story enters a sprint.
→ gate: all entry criteria checked off and signed by the BA and project lead.
→ gate: one test case per acceptance criterion; happy path, sad path, and edge cases all have cases.
→ gate: every open item is classified as defect or change request; no unclassified findings remain open.
→ gate: retest result recorded for every defect marked resolved.
→ gate: go/no-go decision recorded with named decision-maker, residual risks list, and date.
→ gate: SOQL confirms records have correct status, role flags, and field values as expected.
> Full step-by-step workflow in references/change-management.md — load that file when running a process-mapping session. Key gates: observation over SOP, two exception paths on the as-is map, automation audit before any to-be design, exactly one Accountable per RACI row, to-be map version-controlled alongside requirements.
Five original scenarios. Scenarios 3–5 are in references/scenarios.md — load them for UAT defect-vs.-new-requirement classification, requirement phrased-as-solution rewrites, or to-be process verification examples.
Scenario 1 — Automation audit before writing a requirement (Customer Discovery)
> This scenario illustrates the general "automation audit before requirements" rule (§3 / Quick Reference 11) using NPSP as a concrete example. The same principle applies to any managed-package org; see [salesforce-nonprofit-cloud-consultant](../salesforce-nonprofit-cloud-consultant/SKILL.md) for NPSP details.
> Situation: A stakeholder asks the BA to write a requirement: "When a volunteer applicant is approved, create a Contact in Salesforce." The BA has assessed the org and confirmed it runs NPSP. The developer says "a flow that calls Contact.insert is straightforward."
> Competent move: Before writing or sizing any story, the BA runs an automation audit on the Contact object in the org — listing active workflow rules, flows, process builders, and triggers. In an NPSP org this will surface at minimum the npe01__PreferredPhone__c workflow rule and Household Account auto-creation logic. The requirement is then written to include these side effects as constraints: "Creating a Contact triggers Household Account creation and managed-package phone-copy logic; the implementing solution must account for these and must not disable managed-package rules to work around them."
> Tempting-but-wrong: Accepting the developer's estimate and writing the requirement as "insert a Contact" — treating NPSP as if it were a clean org. The managed-package workflow rule fires on every Contact insert, silently copying Phone to MobilePhone, and Household Account creation adds unintended records.
> Verify: In the target org, open Setup → Process Automation → Workflow Rules, filter by Contact, confirm which rules are Active. Also open Flow Builder, filter trigger type = Record-Triggered, object = Contact. List what fires before writing the requirement.
Scenario 2 — MoSCoW prioritization is fake (User Stories)
> Situation: The BA has facilitated a backlog grooming session. The team has labeled 38 of 45 stories as "Must." The project sponsor confirms: "They all need to be in the first release."
> Competent move: Flag the prioritization as non-functional. When >60% of the backlog is Must, the MoSCoW exercise has produced a wish list, not a priority order. The BA facilitates a forced-ranking re-prioritization: present the sprint capacity (e.g. 40 story points per sprint, 3 sprints before launch), show the 38 "Must" stories' point totals, and ask the sponsor to choose which 38-minus-N to defer if the team hits the wall. This converts abstract "Must" labels into a real launch scope decision that the sponsor owns.
> Tempting-but-wrong: Accepting the sponsor's word that everything is Must and carrying 38 Must stories into the sprint plan. When the team can't complete them all, the BA has no agreed deferral list — leading to a chaotic last-week triage where the team (not the business) decides what ships.
> Verify: Count Must stories, sum their estimates, divide by sprint velocity. If Must stories exceed capacity before go-live, the prioritization is arithmetically impossible — document that calculation and present it to the sponsor before sprint planning begins.
Read this first. Each rule is imperative and concrete.
For NPSP/nonprofit-specific operational guidance, see salesforce-nonprofit-cloud-consultant.
Using this skill and hit a wall? If you find a claim contradicted by the live system or official docs, a missing rule that cost you a wrong attempt, or a decision this skill gave no criteria for — append an entry in the moment to .skill-feedback/salesforce-business-analyst.md at the project root (create it if absent):
date | skill last-reviewed | claim or gap | what you observed instead | evidence (error text / doc URL / query output) | suggested fix
These are harvested back into the skill via the learning loop. When the live system and this file disagree, trust the live system.
[volatile — verify live] marks, executable workflows, tool-agnostic verify steps, and the feedback protocol above. Exam logistics relocated to references/study-resources.md; last-reviewed set to 2026-06-09.Independent educational content to upskill AI agents. Not affiliated with or endorsed by Salesforce, Inc.; all trademarks — including "Salesforce," "Salesforce Certified Business Analyst," and related marks — belong to their respective owners. Content is provided as guidance only; verify all details against official Salesforce documentation, the current exam guide, and your live org before acting. No certification outcome is implied or guaranteed.
Other measured skills in the registry, with their headline benchmark lift.