ISO 22313:2020 - Guidance on Business Continuity Management Systems 8.2.3: 8.2.3 Risk assessment

This clause deals with the risk of disruption to prioritized activities (BCMS effectiveness risks sit in 6.1); the assessment lets the organization judge those risks and act on them. Guidance: set up and keep a formal process that methodically identifies, analyses and evaluates the risk of disruption to prioritized activities and to the processes, systems, information, people, assets, suppliers and other resources behind them, a structured process that examines likelihood and consequence before further treatment is chosen and asks what could happen, how likely it is, what it would lead to and whether anything could soften the consequence or lower the likelihood, taking account of the organization's context and of what interested parties need. The organization learns the threats to and weaknesses of the resources its activities need, above all those behind high-priority activities and those that take longer to replace than the activity's RTO, and chooses a suitable method (ISO 31000 sets out principles and guidance). The usual stages are identification (possible sources of risk to prioritized activities and to the processes, systems, data, people, assets and suppliers behind them, both particular threats such as fire, flood, loss of power, loss or absence of staff, viruses and hardware failure, and disruption flowing from resource weaknesses such as single points of failure, poor fire protection, unstable power, too few staff and weak IT security); analysis (understanding the risk well enough to judge it and pick the best treatment: its causes and sources, the likelihood of good and bad consequences and what drives it, with risk set mainly by likelihood, expected consequence and how well existing controls work; likelihood matters most, and how sure one can be of it, given differing expert views, uncertainty and data quality, is weighed and passed to decision makers; the analysis can be qualitative, semi-quantitative or quantitative); and evaluation (choosing which disruption risks to treat, concentrating on resources behind high-priority activities or slow to replace). The organization knows of any compulsory duty to share the resulting data with financial, regulatory, legislative or government bodies, and sharing at a suitable level of detail can also serve community needs.