Business Continuity Risk Assessment

Most organisations have already identified many of the risks that they face. Some of this information is held formally in, for example, quality management systems, health and safety risk registers and information security risk assessments; but much of it is informal and anecdotal, in terms of people’s experience of previous incidents and near misses.

There are also numerous external resources to help to identify risks, including:

• The UK National Risk Register;
• Community Risk Registers for each area of the UK;
• Government websites such as the HSE and MI5; and
• Media reports of incidents.

Risk analysis involves estimating the likelihood of the events identified as risks to the organisation taking place and the impact on the organisation (and its various stakeholders) if the event should take place.

Frequently these estimates are expressed in the form of a “Likelihood and Impact Matrix”.

However, we would recommend considering the use of quantitative risk analysis techniques; which combine estimates of likelihood and impact in a distribution of potential outcomes.

Having identified, analysed and evaluated the risks to your organisation there are 4 fundamental responses to each risk, known as the “4 T’s”:

• Tolerate the risk as it is (risk acceptance);
• Transfer the risk ie buy insurance to mitigate the financial losses (risk transfer);
• Treat the risk ie take practical steps to reduce the likelihood of the event occurring and/or mitigate the impact if it should occur (risk reduction); or
• Terminate the activity that gives rise to the risk (risk avoidance).

However, the best-intentioned efforts at reducing a risk often simply move the problem elsewhere.

For example in the year after the wearing of crash helmets was made compulsory in the UK, there was an increase in motorcycling fatalities: the positive impact of reducing the specific risk of serious head injuries was offset by people riding more recklessly and therefore sustaining other fatal injuries.

Care must always be taken that the method of risk treatment adopted does not unintentionally create new risks which may be harder to manage.