[BCM] [P2] [RAR] [1]: Overview of Risk Analysis & Review

Risk Analysis & Review Phase in the BCM Process

The Risk Analysis & Review (hereafter referred to as RAR) Phase is a significant part of BCM Planning because it is a structured process that assesses a range of factors (assets, threats, vulnerabilities, risks, and controls) and assigns subjective or objective values to each.

The RAR phase forges the direction of the overall BC plan.

RAR is the second phase of the BCM planning process.

However, it is not uncommon to see other models that position Business Impact Analysis (BIA) before RAR.

Although the order is not important in the BCM planning process, it is worth noting that the focus may differ if the BIA is performed before the RAR.

Why Read This RAR Blog Series (Book)?

This RAR Blog Series (Book) will help you prepare and perform a RAR for your organisation.

It will cover all the key components of RAR, and every task required to complete a RAR will be explained in detail. You will learn to:

• Identify the key components of a typical RAR process
• Understand the interrelationships among threats and risks as they relate to BC Planning
• Categorise threats within the organisation
• Tabulate RAR findings
• Prepare RAR Report
• Make a presentation to the Executive Management

Jargons

Before we proceed, it is essential to understand some key components, terms and definitions used in this book. Additional terms can be found in BCMPedia.

• Threat is an indication or warning of a probable man-made or natural situation that can cause disruption to an organisation’s operations or services.
• Risk is a hazard or chance of bad consequence or loss.
• Risk Analysis is the separation of the whole into parts or elements of which it is composed, a detailed examination of those elements, the use of cause-and-effect tools for problem identification, an examination to determine parts or elements of a situation and a statement of examination results.
  
  
• Risk Assessment is to set the amount of damage, loss, or value.
• Risk Likelihood is the probability that a threat will occur.
• Risk Impact is the outcome resulting from a threat that affects an organisation's objectives or assets.
• Risk Rating is the result of the multiplication of the assigned value for Risk Likelihood against the assigned value of Risk Impact.
• Risk Treatment is the selection and implementation of appropriate options to manage risk.
  
  
• Control is any action, procedure or operation undertaken by an organisation to increase the likelihood of containing an identified risk. They are countermeasures for vulnerabilities. Controls may be physical or procedural.
• Residual Risk is the remaining risk that cannot be further defined after the elimination or inclusion of all conceivable quantified risks in a risk assessment.

Views of the Author

This is perhaps the most difficult book in the entire BCM series.

This is because it overlaps with numerous risk disciplines such as risk management, IT security risk assessment and (physical) security risk management.

The scope of this book will focus on Risk Analysis & Review for BCM planning within the broader risk management domain.