After completing a business impact analysis, the next step in disaster recovery planning is to complete a risk assessment template.
A business impact analysis (BIA) helps identify an organization's most critical business processes and describes the potential impact of a disruption to those processes, while a risk assessment identifies the internal and external situations that could negatively impact the critical processes. A BIA also attempts to quantify the potential severity of such events and the likelihood of them occurring.
This guide on risk assessments in disaster recovery planning shows how to get started, how to prepare a risk analysis, and how to identify natural and man-made hazards. We've also included a free, downloadable IT risk assessment template you can use in your planning.
Why conduct a risk assessment?
A risk assessment can help you identify events that could adversely impact your organization. This includes potential damage events could cause, the amount of time needed to recover or restore operations, and preventive measures or controls that can mitigate the likelihood of an event occurring. A risk assessment will also help you determine what steps, if properly implemented, could reduce the severity of an event.
To get started with a risk assessment, begin by identifying the most critical business processes from the BIA. You should then gather information on potential threats to your organization.
There are numerous sources available to help you gather threat information, such as:
- company records of disruptive events;
- employee recollection of disruptive events;
- local and national media records;
- local libraries;
- first responder organizations;
- National Weather Service historical data;
- U.S. Geological Survey maps and other documentation;
- experience of key stakeholder organizations;
- experience of vendors doing business with the firm; and
- government agencies, such as the Federal Emergency Management Agency (FEMA), the Department of Homeland Security, the U.S. Department of Energy and so on.
These sources can help you determine the likelihood of specific events occurring, as well as the severity of actual events. You can rule out certain events if there is almost no chance of them occurring. For example, you don't have to plan for earthquakes if U.S. Geological Survey maps indicate your site is not in or near an earthquake zone. Use our risk assessment template to list and organize potential threats to your organization.
An excellent document to assist you in preparing a risk assessment comes from the National Institute for Standards and Technology. The document is Special Publication 800-30, Risk Management Guide for Information Technology Systems.
Understanding threats and vulnerabilities
A risk analysis involves identifying a risk, assessing the likelihood of an event occurring and defining the severity of the event's consequences. It may also be useful to conduct a vulnerability assessment, which can help identify situations in which the organization may be putting itself at increased risk by not performing certain activities. An example may be the increased risk of viruses by not using the most current antivirus software.
Finally, the risk analysis results should be summarized in a report to management, with recommended mitigation activities. It may be useful to look for vulnerabilities while performing a risk analysis.
Types of defensive responses
After the risks and vulnerabilities have been identified, defensive responses can be considered.
- Protective measures: These are activities designed to reduce the chances of a disruptive event occurring; an example is using security cameras to identify unauthorized visitors and to alert authorities before an attacker can cause any damage.
- Mitigation measures: These activities are designed to minimize the severity of the event after it occurs. Mitigation measure examples include surge suppressors to reduce the impact of a lightning strike and uninterruptible power systems to limit the chances of a hard stop to critical systems due to a blackout or brownout.
- Recovery activities: These activities serve to bring back disrupted systems and infrastructure to a level that can support business operations. For example, critical data stored off site can be used to restart business operations to an appropriate point in time.
- Contingency plans: These process-level documents describe what an organization can do in the aftermath of a disruptive event. They are usually triggered based on input from the emergency management team.
The sequence in which these measures are implemented depends to a large extent upon the results of the risk assessment. After you identify a specific threat and its associated vulnerability, you can plan the most effective defensive strategy. Remember that contingency plans must cope with the effects, regardless of the causes.
Types of hazards
Hazards are unique combinations of events and circumstances. The two primary categories are man-made and natural.
Man-made hazards are those in which an individual or multiple persons may be held accountable for contributing to the event(s) that caused a disaster. This could be through deliberate or accidental causes.
Natural hazards are typically considered Acts of God for which there is no one to blame, such as with the weather, earthquakes and fires. If your organization is in an area prone to hurricanes, or if your building has construction vulnerabilities, that should be noted in your risk assessment.
After the risks have been identified, you'll want to identify the potential effects, symptoms and consequences resulting from the event.
Basic effects: There are five basic effects that can have disastrous consequences:
- denial of access;
- data loss;
- loss of personnel;
- loss of function; and
- lack of information.
Symptoms: The perceived symptoms might be a loss (or lack of):
- access or availability;
- data integrity;
- personnel (temporary loss);
- system function;
- control; and
Consequences: Secondary effects or consequences might include:
- interrupted cash flow;
- loss of image;
- brand damage;
- loss of market share;
- lower employee morale;
- increased staff turnover;
- high costs of repair;
- high costs of recovery;
- penalty fees; and
- legal fees.
Types of risk assessments
Risk assessments generally take one of two forms: quantitative, which seeks to identify the risks and quantify them based on a numeric scale (e.g., 0.0 to 1.0 or 1 to 10); and qualitative, which is based on gaining a general impression about the risks so as to qualify them. The process uses subjective terms like low to medium, high to poor, and good to excellent, instead of numeric values.
Quantitative methods, which assign a numeric value to the risk, usually require access to reliable statistics to project the future likelihood of risk. As mentioned earlier, qualitative methods often include subjective measures, like low, medium and high. However, sometimes the qualitative approach is more acceptable to management. In our risk assessment template, you will find columns that enable you to assign qualitative terms to each of the risks to your organization.
A basic formula, Risk = Likelihood x Impact, is typically used to compute a risk value. This formula is also known as a risk assessment matrix. By weighing the likelihood of an event against the level of damage it could cause, the risk assessment matrix is an illustrative tool for management to use to plan for possible disasters.
For example, we can use a scale of 0.0 to 1.0, in which 0.0 means the threat is not likely to occur and 1.0 means the threat will absolutely occur. The impact 0.0 means there is no damage or disruption to the organization, whereas 1.0 could mean the company is completely destroyed and unable to further conduct business. Numbers in between can represent the result of a statistical analysis of threat data and company experience. The downloadable risk assessment template uses this approach.
Using the quantitative range 0.0 to 1.0, you may decide to assign qualitative terms to results (e.g., 0.0 to 0.4 = low risk, 0.5 to 0.7 = moderate risk, and 0.8 to 1.0 = high risk).
Once all the relevant risks have been analyzed and assigned a qualitative category, you can then examine strategies to deal with only the highest risks or you can address all the risk categories. The risk management plan will depend on management's risk appetite, which is their willingness to deal appropriately with risks. The strategies you define for risks can next be used to help design business continuity and disaster recovery strategies.
Conducting your risk assessment: Who, what, when
An appointed project manager and their team are typically in charge of conducing a risk assessment and risk management plan. Personnel may be involved when it comes to actions that may need to be performed at that level in the future.
Depending on the number of effects, symptoms and consequences, the level of detail in a risk assessment will vary by organization. There is no set number of risks to look for in a general risk assessment, so that is up to the discretion of the company performing the assessment. In our risk assessment template, there are fields for more than 50 potential hazards, both man-made and natural.
A risk assessment is a key activity in a business continuity or disaster recovery program. The process can be relatively simple; for example, if you elect to use a qualitative approach. They can be more rigorous when using a quantitative approach, as you may want to be able to substantiate your numerical factors with statistical evidence.
How often you carry out a risk assessment is also up to your discretion. However, results should be updated periodically to determine if any changes to the risks (e.g., likelihood and impact) have occurred. Regardless of the methodology used, the results should map to the critical business processes identified in the business impact analysis and help define strategies for responding to the identified risks. If a risk assessment is out of date, so are the strategies used to combat potential hazards.
Study our primer on enterprise risk management
Should a risk assessment strategy include cyber insurance?
Risk assessment list vetting should include internet of things concerns