Risk Evaluation and Control
Purpose
The risk assessment answers what could happen, how likely, how bad, and what are we doing about it. It feeds strategy selection but is not a substitute for the BIA.
Concepts you must know
- Threat/hazard identification - natural, technological, human-caused, supply chain, cyber.
- Vulnerability - the condition that makes an asset susceptible; risk exists where threat meets vulnerability.
- Likelihood × impact scoring, qualitative (high/medium/low) or quantitative (annualized loss expectancy).
- Inherent vs residual risk - before and after controls.
- Risk appetite and tolerance - how much the organization will accept, set by leadership.
- Control categories - preventive, detective, corrective; plus risk treatment options: avoid, transfer, mitigate, accept.
- Risk register - owner, rating, treatment, due date, review cycle.
Traps in questions
- Substituting a risk assessment for a BIA (risk describes probability; BIA describes impact over time on the business).
- Selecting a recovery strategy from a heat map without impact-time data.
- Forgetting that residual risk is what leadership formally accepts.
- Ignoring interdependent risks across suppliers and utilities.
Rule of thumb
Treat risk in order of preference: avoid > transfer (e.g., insurance) > mitigate > accept, with acceptance documented and owned at the right level of authority.
Worked example: Flooding of a single-site warehouse scores likelihood medium and impact high. Mitigation options include relocation of critical stock, secondary site agreement, and flood barriers. Insurance transfers financial loss but not the operational service gap - so insurance alone is not a BC strategy.