A business continuity risk assessment should answer a specific management question: which credible disruptions could prevent a priority activity or service from meeting its continuity requirement, and what must be done about that exposure? It complements the BIA. The BIA establishes the consequence and time sensitivity of disruption; risk assessment examines scenarios, vulnerabilities, existing controls and residual exposure.
1. Start with the service and its continuity requirement
Assess risk against an identified service, process or critical activity rather than an abstract hazard list. Record the required recovery outcome, important time threshold, locations, technology, people, information and third parties. This prevents a high-level enterprise risk register from being mistaken for a continuity assessment.
2. Build disruption scenarios, not single-word hazards
A usable scenario describes the initiating event, affected assets or dependencies, likely duration, geographic or technical scope and any conditions that make recovery harder. “Power failure” is too broad. “Loss of utility power and generator refuelling access at the primary site for 36 hours” is testable because teams can examine alternate work locations, generator autonomy, fuel contracts and remote-access capacity.
3. Assess inherent exposure and vulnerability
Before crediting controls, consider how the scenario could interrupt the service. Look for single points of failure, capacity constraints, concentration of staff or suppliers, inaccessible recovery assets, identity dependencies, unavailable data, contractual limitations and correlated failures. Probability alone should not hide a scenario whose consequence exceeds an approved disruption tolerance.
4. Test control effectiveness
Do not mark a control effective because a plan or contract exists. Seek evidence that the control can operate at the required scale and speed. Examples include generator load tests, successful restoration results, alternate-site capacity, current call-tree tests, supplier response evidence, recovery exercises and proof that required credentials work from the recovery environment.
5. Rate residual continuity risk
After controls are considered, rate the remaining exposure using the organization’s approved risk criteria. Record the reasoning as well as the score. A useful record states the scenario, affected service, continuity requirement, vulnerabilities, controls, control evidence, residual rating, owner and treatment decision. This makes the result reviewable instead of turning the assessment into a coloured heat map with no operational meaning.
6. Convert the result into a treatment decision
| Finding | Decision | Evidence of closure |
|---|---|---|
| Recovery depends on one unavailable specialist | Cross-train and authorize deputies | Competence record and exercise result |
| Supplier recovery commitment exceeds required RTO | Renegotiate, diversify or accept risk | Contract/evidence plus approved residual risk |
| Alternate platform exists but capacity is unproven | Run representative load/recovery test | Measured test result against requirement |
Worked example
A customer service function must restore priority enquiries within four hours. Its telephony platform is resilient across two zones, but identity authentication relies on a single regional service. The assessment therefore treats identity loss as the dominant scenario, checks cached/offline access and alternate authentication, and records the measured recovery result. If the fallback takes six hours, the residual risk is not closed simply because the telephony platform is redundant.
Review and acceptance checks
- Every material scenario is tied to a defined service or activity and continuity requirement.
- Controls are supported by current evidence, not existence statements.
- Shared and correlated dependencies are considered.
- Residual ratings explain why the remaining exposure is acceptable or requires treatment.
- Treatments have accountable owners, dates and closure evidence.
- Material changes, incidents and exercise findings trigger reassessment.
Relationship to the wider BCM lifecycle
Use business impact analysis to establish priority and disruption tolerance, then use the risk assessment to challenge whether credible scenarios can breach those limits. Feed material gaps into continuity strategy and verify important controls through the BCM exercise program. Management should explicitly accept any residual exposure that remains above tolerance.
Translate scenarios into decision-grade exposure
A useful continuity risk assessment does more than list threats. For each scenario, define the disrupted service, initiating condition, affected locations or suppliers, likely duration, control assumptions and the point at which approved disruption tolerance would be exceeded. Separate inherent exposure from residual exposure so management can see which controls actually change the outcome. Avoid multiplying arbitrary likelihood and impact numbers without documenting what the score means for a recovery decision.
Challenge control effectiveness with evidence
Rate a control as effective only when evidence shows that it can operate under the scenario being assessed. Evidence can include generator endurance tests, alternate-site capacity results, supplier recovery exercises, restore tests, staffing simulations or verified emergency-contact performance. A policy statement is design evidence, not operating evidence. Where evidence is stale, partial or based on a different operating model, record uncertainty and apply a conservative residual-risk judgement until the control is revalidated.
Use explicit treatment and acceptance gates
For every material residual exposure, choose a treatment: reduce the probability, reduce the consequence, improve recoverability, transfer part of the exposure, avoid the activity, or formally accept it. The treatment record should name the owner, due date, target capability and verification method. Acceptance should state the maximum period for which the exposure is tolerated and the trigger for reconsideration, such as a major technology change, supplier renewal, new site, failed exercise or revised BIA requirement.
Worked challenge example
Assume a customer service has an approved twelve-hour disruption tolerance, while a regional telecom failure could remove both primary connectivity and the voice provider. The existing control is a secondary circuit, but it uses the same carrier aggregation point. The assessment should not mark connectivity as redundant merely because two circuits exist. It should record the common dependency, estimate the credible outage against the twelve-hour tolerance, define an independent communications workaround, and require an exercise that proves staff can activate it within the required time. The residual exposure is accepted only after that evidence is reviewed.