Business Continuity Management | BCM

[BCM] [P2] [RAR] [3] What is Risk Analysis & Review?

Written by Moh Heng Goh | Mar 19, 2021 3:42:52 PM

 

What is Risk Analysis & Review?

RA is the detailed analysis of risks, vulnerabilities (exposures), and probabilities (likelihood) and is a major component of the risk assessment.

The end result of this RAR exercise is not to give organisations the impression that disaster can be avoided.

The RA and the Business Impact Analysis (BIA) are key fundamental elements of an organisation’s BCM Program.

The RAR is not the “end game” but rather a starting point in the BCM planning process.

It is an industry-recognised, proven approach to help the organisation determine which events they are vulnerable to, how to address these vulnerabilities, and where they can maximise the value of their BCM spend. 

The real purpose of a RAR is to mitigate or minimise risks and threats to the people and assets.

 

Objectives

The objectives of the Risk Analysis and Review are to:

  • Identify internal and external threats which may disrupt key organisational processes or operations.
  • Estimate the likelihood that threats will materialise based on historical information and the judgment of a knowledgeable individual.
  • Identify and rank the value, sensitivity, and criticality of assets that could be affected should a threat materialise.
  • Estimate the potential losses or damage that could occur if a threat materialised.
  • Identify cost-effective actions to mitigate or reduce the risk. These actions can include implementing new policies, procedures, and technical or physical controls.
  • Get approval on the recommendation of controls and move forward to BIA.

 

Tasks

The tasks to complete within the Risk Analysis & Review phase include:

  • Identify exposure to internal and external threats and the likelihood of their occurrence.
  • Recommend preventive responses and escalation procedures in conjunction with crisis management implementation.
  • Evaluate findings and prepare a status report and recommendation on safety/ prevention (if needed).

 

Expected Deliverables

The deliverables in a typical RAR phase are:

  • Develop a comprehensive risk and threat profile of the organisation.
  • Provide recommendations for:
    • Controls
    • Immediate response procedures
    • Security Risk Review

      to be implemented to minimise the risks.

  • Establish Key Disaster Scenario.
  • Prepare a summary report of recommendations agreed with the Executive Management.

 

What Does Risk Analysis & Review Entail?

It is important that the risks and threats to an organisation be analysed and the controls implemented.

The major considerations in the RAR process include:

Main Stages for RA Implementation

  • Stage 1: Risk Identification
  • Stage 2: Risk Analysis
  • Stage 3: Risk Evaluation
  • Stage 4: Risk Treatment
 

 

Reference

Goh, M. H. (2021). Analyzing & Reviewing the Risks for Business Continuity Planning. Business Continuity Management Planning Series (3rd ed.). Singapore: GMH Pte Ltd.

Extracted from "Chapter 3: What is Risk Analysis & Review?"

 

More Information About Blended Learning BCM-5000 [BL-B-5]

To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org.  They are the BL-B-3 Blended Learning BCM-300 ISO22301 BCMS Implementer and the BL-B-5 Blended Learning BCM-5000 ISO22301 BCMS Expert Implementer.

Please feel free to send us a note if you have any questions.
 
 
 
View full post