Purpose
Identify, evaluate and treat disruption risks that could prevent recovery within approved impact tolerances.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Review current BIA | Recovery objectives, incidents, changes, and threat information | Review notes |
| 2 | Identify disruption scenarios | Threat identification: cybersecurity attacks, natural disasters, system failures, regulatory risks, operational dependencies | Scenario register |
| 3 | Analyze single points of failure | Data centers, network providers, key staff expertise, supply chains | SPOF analysis |
| 4 | Identify concentration risks | Concentration, interdependency, and single-point-of-failure risks | Risk register |
| 5 | Assess residual risk | Likelihood, impact, existing controls, and residual risk per scenario | Risk assessment |
| 6 | Assign treatment strategies | For risks outside tolerance: Reduction (preventive controls), Transfer (insurance, outsourcing), Avoidance (cease risky activities), Acceptance (low-impact risks) | Treatment plan |
| 7 | Escalate material risks | Residual risks and overdue treatments escalated to management and Board | Escalation records |
| 8 | Review periodically | At least annually and updated when new threats or dependencies emerge | Review record |
Records
- Continuity risk assessment
- Scenario and dependency analysis
- Treatment plan and risk acceptance
- Escalation and closure evidence
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-003 Ensure Continuity Risks and Treatments Are Current
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual and event-driven
History
- 2026-07-26: Created from section 7 of the approved Business Continuity Manual.