[CM] [OCBC] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment

Part 3: Risk Impact and Likelihood Assessment for OCBC Bank

Introduction

In this chapter, we assess the risks identified in Part 1: List of Threats / Crisis Scenarios using the BCM Institute’s RAR (Risk Analysis & Review) framework. The goal is to evaluate both the impact and the likelihood of each threat or crisis scenario, so that OCBC Bank can prioritize its risk treatment efforts.

Following BCMpedia’s Part 3: Risk Impact and Likelihood Assessment methodology, we classify impact across seven areas (finance; operations; legal & regulatory; reputation & image; social responsibility; people; assets/IT/information) and assign numeric scores.

We also assess the probability (likelihood) of each crisis occurring, compute a risk rating, and derive a risk level. Finally, we estimate the expected period of disruption, considering existing controls. 

This structured assessment helps OCBC’s BCM (Business Continuity Management) and Crisis Management teams to:

1. Identify which risks pose the greatest threat to the bank’s resilience.
2. Allocate resources (people, controls) effectively;
3. Plan for response and recovery (e.g., how long operations may be disrupted).

Table: Risk Impact and Likelihood Assessment 

Here is a sample table using representative crisis types from BCMpedia + hypothetical assessment for OCBC Bank. (You should adjust scores, likelihood, and disruption durations based on OCBC’s internal risk analysis.)

In summary, this risk impact and likelihood assessment (Part 3) provides a structured, quantitative way to prioritize crisis scenarios for OCBC Bank.

By mapping each identified threat to its probable impact across multiple domains and combining that with the likelihood of occurrence, OCBC can clearly see which risks demand urgent mitigation, which require monitoring, and which are acceptable given current controls.

Moving forward, OCBC should use the outputs of this analysis to:

1. Develop or refine risk treatment plans – For “Very High” and “High” risks (e.g., IT failure, cyberattack, flooding), allocate resources to strengthen controls (e.g., redundant infrastructure, incident response, crisis communications).
2. Integrate into BCM and Crisis Management strategies – Ensure that business continuity plans, crisis communication plans, and recovery strategies are aligned with the highest-priority risks.
3. Regularly review and update – As OCBC’s operating environment, technology, and threat landscape evolve, this risk assessment should be revisited (e.g., annually or after major incidents).
4. Train and test – Use tabletop exercises and simulations for the critical scenarios (especially high-risk risks) to validate assumptions (e.g., expected disruption times) and build organizational readiness.