[BCM] [Damanat] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment

Assessment Objectives

The Risk Impact and Likelihood Assessment has several important objectives:

• evaluate the current exposure of Damanat to each approved threat;
• determine the potential severity of business disruption should a threat materialise;
• establish a consistent basis for prioritising Business Continuity planning activities;
• identify threats requiring additional mitigation or recovery strategies;
• support Business Impact Analysis (BIA) by understanding credible disruption scenarios;
• facilitate informed decision-making by senior management; and
• provide documented evidence supporting regulatory and governance requirements.

The assessment is not intended to predict future incidents. Rather, it provides a structured estimate of credible business risks based on current operating conditions, existing controls and professional judgement.

Assessment Basis

The assessment presented in this chapter is based on the following assumptions:

• the approved threat register developed in RAR Part 1;
• the existing treatment measures and controls documented in RAR Part 2;
• Damanat's current organisational structure;
• current operating environment within the Kingdom of Saudi Arabia;
• publicly recognised financial-sector threats;
• reasonable assumptions regarding mortgage guarantee operations where detailed internal information is unavailable.

The assessment represents current residual risk after considering existing controls.

It does not represent:

• inherent risk before controls; or
• future residual risk after planned improvements.

Final risk ratings should be reviewed and approved by business owners and the organisation's Risk Management Committee.

Approved Threat Coverage

The approved threats collectively address all major Business Continuity disruption categories.

The detailed assessment continues to use the specific threat names rather than the broader categories.

Risk Impact Assessment Methodology

Each threat is assessed against seven impact areas.

Each impact area is scored using the following five-point scale.

Likelihood Assessment Methodology

Likelihood estimates consider:

• historical industry experience;
• current threat intelligence;
• operating environment;
• exposure of business processes;
• effectiveness of existing controls;
• dependency upon suppliers;
• maturity of ICT controls;
• cybersecurity threat landscape; and
• environmental and geopolitical factors.

Likelihood is assessed independently from impact.

Risk Rating Methodology

The overall Risk Rating is calculated using the following formula:

Risk Rating = Highest Impact Score × Likelihood Score

The resulting Risk Level is determined using the following matrix.

Where multiple impact areas receive the same highest score, all applicable impact areas should be identified.

Expected Disruption Period

For each threat, an indicative disruption period is estimated after considering existing controls.

This estimate reflects:

• expected interruption duration;
• restoration complexity;
• supplier dependency;
• alternate workplace arrangements;
• ICT disaster recovery capability;
• availability of replacement resources; and
• external agency response.

The disruption period should not be confused with either the Recovery Time Objective (RTO) or the Maximum Tolerable Period of Disruption (MTPD), both of which will be established during the Business Impact Analysis.

Risk Impact and Likelihood Assessment

The following table provides an illustrative implementation assessment based on recognised financial-sector threats and should be validated against the approved threat register and existing controls documented in RAR Parts 1 and 2.

Table T3: Risk Impact and Likelihood Assessment 

Overall Assessment

The assessment indicates that Damanat's highest residual risks are associated with disruptions affecting information technology, cybersecurity and critical business applications.

These threats have the potential to interrupt mortgage guarantee operations, affect regulatory reporting, delay customer services and impact relationships with financial institutions.

Business disruptions arising from workforce unavailability and critical third-party failures also pose significant operational challenges, as many mortgage guarantee processes depend on specialist expertise, external service providers, and secure digital platforms.

Although natural hazards generally have a lower likelihood in the Kingdom of Saudi Arabia than cyber-related threats, they remain credible scenarios that should be incorporated into continuity planning due to their potential impact on facilities, staff accessibility, and operational resilience.

The assessment further demonstrates that many risks can be significantly reduced through strong governance, resilient ICT architecture, effective incident response procedures, supplier resilience arrangements, workforce succession planning and regular Business Continuity exercises.

Validation Requirements

The indicative assessment contained within this chapter should be validated through structured workshops involving:

• Executive Management;
• Enterprise Risk Management;
• Business Continuity Management;
• Information Technology;
• Information Security;
• Human Resources;
• Facilities Management;
• Procurement;
• Legal and Compliance; and
• representatives from each Critical Business Function.

During validation, participants should confirm:

• impact scores;
• likelihood estimates;
• effectiveness of existing controls;
• disruption duration assumptions;
• risk ratings;
• ownership of risks; and
• priority improvement initiatives.

Any amendments approved during these workshops should be reflected in the final Risk Assessment Report before progressing to the Business Impact Analysis phase.