Report and Present Risk Analysis and Review Findings to Executive Management

Reporting and Presenting Risk Analysis Findings to Executive Management

As part of the BCM-5000 Module 3 Pre-reading List, this section prepares you to compile and present the Risk Analysis and Review (RAR) Report to Executive Management—a critical step in ensuring your organization’s risk landscape is well understood and proactively managed.

Upon completing BCM-300 or BCM-5000 Module 2, you will have gained the competencies of a Business Unit (BU) BCM Coordinator, including hands-on experience with the RAR questionnaire.

This process allows you to identify potential threats, assess their impact, and understand the risk assessment challenges at the business unit level.

In Modules 3 and 4, your role expands to that of an Organisation BCM Coordinator. You must consolidate, analyse, and effectively present the RAR findings in a structured report for Executive Management’s review and approval.

This content is adapted from the BCM Planning Series: Analysing & Reviewing the Risks for Business Continuity Planning. It provides a structured approach to risk analysis and presents best practices.

 

Report on RAR Findings

• Serve as the vehicle for presenting the findings of the RAR process and recommendations
• Provide the organisation with the information needed to make intelligent and well-informed decisions about the threat issues.

• Be forwarded to the Executive Management for prompt review, approval and action
• Include only the summary information
• Contain working papers and detailed analyses that support the findings and recommendations outlined in the report for reference purposes and as a resource for future RAR exercises.
• Be considered sensitive information and be protected accordingly
• Not be intended for general distribution

Report Preparation & Distribution

• Prepare a draft report containing initial findings and issues
• Issue draft report to participating BU BCM Coordinators and BU Heads for their feedback
• Schedule a meeting and/or workshop to discuss the initial findings

Circulation of Draft Report

• Be allowed to review the materials during the preparation of the report
• Confirm that the content is accurate
• Review the organisational-wide information and recommendations
• See how each piece of the organization is interdependent
• Allow them to become familiar with the information
• Feel ownership
• Provide input on how to present this report to Executive Management best

This report should also be available to the BCM team members and BCM Steering Committee. This step is essential to the Organisation BCM Coordinator and the organisation's long-term success.

It is crucial to distribute the RAR report because the action items, controls, and most of its elements are the responsibility of many different areas of the organization. Those responsible should be kept informed early in the report's writing.

As an Organisation BCM Coordinator, you do not want to assume anything. Confirm with the team the most effective approach to ensure all participants and their BU Heads have reviewed the information.

This may be as simple as a follow-up meeting to discuss feedback, suggestions, and edits or as complex as conducting a facilitated session with the team.

The key deliverables are the sign-off and consensus on the RAR findings and the subsequent report that will be submitted to the decision-makers.

Report Design

• What is the mission?
  • What are the organisation’s objectives?
  • What are the deliverables?
  • What are the RAR planning assumptions?

• What is the organisation protecting?
• What is the outage Risk Level?
• How do we establish support for implementing the RAR recommendations?

In the documentation of the BIA report, it is essential to note that granular information is not required in the executive summary but should be contained in the detailed text or appendices of the reports.

One of the key outcomes of the RAR report is identifying the organization’s assets and areas of concern. The RAR report should also address the following.

Risk Consequence of the Threat

The consequence of a risk or a threat should the organization’s assets be compromised or be rendered unavailable.

Participation of Stakeholders

The findings report should summarize the configuration of the involvement of any team or key personnel in the research and data analysis effort.

It is essential to convey that these stakeholders participated in the entire process, including supporting the findings and final report.

Layout of Report

Executive Overview

• Scope
• Objectives
• Approach taken

Priority of Presentation

When preparing the report, the most significant Risk Level should be stated first before proceeding in order of magnitude to the medium and lesser Risk Levels. Quantitative and qualitative Risk Levels should be included to convey the difference and not confuse the target audience.

Two sections should also explain the quantitative and qualitative Risk Levels on a scale of most significant to least.

Conclusion

• A realistic review and commentary, supported by the input of the executive management, recognises the positive capabilities, competencies, and efforts already in place.
• A cross-reference to similar projects discovered by the BCM Team through the RAR data gathering efforts. These should be limited to projects, activities, or efforts similar to, complementary to, or associated with the BCM program.
• Specific areas of concern that need attention are not current areas of strength for the organization.

Recommendation

• Provide alternatives
• Costing of alternatives

Priority Action Items

Areas of Concern

If a BCm Team examines an area of concern discovered during the RAR, this should be included explicitly in the RA report.

When briefing decision makers, the Organisation's BCM Coordinator must confirm that there is an exposure and that it has been addressed or is being addressed.

Next Steps

• Acceptance of RAR findings
• Approval to conduct the BIA phase (if it is not completed)
• Approval to proceed with any identified action items or requested controls

Appendices

• List of participants who had participated in the RA exercise
• Consolidated recommendations list
• Detailed research notes (optional if the content is too complicated to be presented as a report)

RAR Presentation

Follow-up After the Report

More Information About Business Continuity Management Courses

 

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

 

	Please feel free to send us a note if you have any questions.