Subject Area 2: Risk Evaluation and Control
What you must understand
Risk evaluation feeds the BIA. Know the risk assessment process: identify threats, assess likelihood and impact (vulnerability), and determine risk treatment. Understand the difference between a threat (event), a vulnerability (weakness), and risk (likelihood × consequence). Candidates should recognize common threat categories: natural, technological, human-caused (accidental and intentional), and supply-chain/third-party. Understand risk appetite/tolerance and the treatment options: avoid, mitigate, transfer, accept.
Traps in questions
- Confusing risk assessment with BIA: risk asks "what could happen and how bad," BIA asks "what must we recover and how fast."
- Treating a control as a treatment: a control mitigates; insurance transfers; neither eliminates.
- Assuming low-likelihood/high-impact events can be ignored; they often drive continuity strategy.
- Overlooking interdependencies (utilities, telecom, key suppliers) and single points of failure.
Worked example / rule of thumb
A facility sits in a flood plain; likelihood is moderate, impact is severe. Mitigation (elevation, barriers) reduces likelihood/impact; insurance transfers financial loss but not operational disruption. Rule of thumb: transfer the financial risk, but plan for the operational risk - continuity strategy must still exist. When a question pairs a threat with an existing control, ask whether residual risk is within appetite; if not, treat it.