Hazard Vulnerability Assessment

Risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to those threats (an all hazards approach). Risk assessment involves evaluating existing physical and environmental protection and controls and assessing their adequacy relative to the potential threats of the organization.
 
The Business Continuity Institute (BCI) states that the objective of risk evaluation and control within the context of business continuity management is: 

"To determine the events that can adversely affect an organization, the damage that such events can cause, the timescale needed to restore normal operations and the controls that can be implemented to reduce the probability of impact." 

Some possible tasks to consider when developing the scope of the above steps:

1. Asset and Threat Identification

1. Assets

1. List and categorize your assets.
2. Consider both tangible, intangible (e.g. reputation), and transient (e.g. technology lead) assets.

2. Look at areas of risk 

1. Policies and procedures.
2. Manufacturing processes.
3. Physical security of the facility.
4. Personnel issues - recruitment, induction and discipline.
5. Computer systems and networks.
6. Communications.
7. Marketing and/or customer interface.

3. Assess the risks identified

1. Through interviews and observations.
2. Through structured walk-throughs and "what-if" scenarios.
3. Then relate these back to your key assets

2. Quantify Your Potential Losses

1. When possible look at company historical data to estimate losses.
2. Seek outside opinions from others in your sector, consultants, etc.
3. At times, "best guess" estimates are needed to establish losses resulting from having to restore a tarnished reputation.

            RISK = IMPACT x PROBABLITIY 
            This calculation should enable you to rank risks from the most serious to the most trivial in 
            terms of their overall impact to the business.

3. Assessment of Vulnerabilities

1. Use appropriate historical data.
2. Apply commonly used industry formulas.
3. Make subjective estimates.
4. Apply a risk weighting system (there are many available to customize or develop your own).

4. Evaluation of Solutions

Risk control measures fall into one of four categories:

1. Accept the risk - If the impact of a rare event is low it may be reasonable to accept the risk, such as the occasional theft of company property, which is unlikely to jeopardize the business. Some risks fall outside your control, such as governmental policy, and so must be accepted by default.
2. Manage the risk - For frequent low impact risks, The most sensible strategy is to monitor and seek to reduce the risk. An example would be development of new procedures to reduce error.
3. Reduce the risk - A frequent potentially damaging event is a target for reduction measures. The hazardous procedure should be re-engineered or carefully monitored to reduce risk. Alternatively, you might choose to outsource the risk thereby giving it to someone else better equipped to manage it.
4. Planning - Business continuity planning addresses risks which are of low probability, such as fire and flood, but whose potential impact is failure.

Summary: You cannot remove all risk entirely but many businesses fall victim to damaging impacts from risks they had not identified or sought to control.