Downloaded 198 times
Uploaded byBCM Institute
Risk Analysis In Business Continuity Management - Jeremy Wong
This document discusses risk analysis and business continuity planning. It explains that risk analysis involves identifying organizational assets, threats, analyzing risks, and evaluating risk levels. Key threats include natural disasters, accidents, and IT/infrastructure failures. The risk analysis process determines impact, likelihood, and risk levels to prioritize risks. It then explores risk treatment strategies like avoidance, reduction, transfer, and acceptance. Business continuity planning is one strategy to reduce risks that could interrupt operations. The overall process involves implementing recommendations, monitoring results, and making adjustments.
More Related Content
Similar to Risk Analysis In Business Continuity Management - Jeremy Wong
Risk Analysis In Business Continuity Management - Jeremy Wong
- 1. Risk Analysis InBusiness Continuity ManagementJeremy WongSenior Vice President GMH Continuity Architects
- 2. GMH Continuity ArchitectsAleading consultancy focusing on business continuity, disaster recovery and crisis management in Asia Pacific since 1999.Our core business is in safeguarding our clients’ businesses through the sound application of proven, business-oriented business continuity methodologies.* GMH is an accredited partner of BCM Institute.
- 3. Jeremy WongPrior AppointmentsNomuraHeadof BCM, South AsiaUnited Overseas BankHead of BCMBax Global
- 4.
- 5.
- 6. BCM Planning MethodologySource: Goh, Moh Heng (2008): Managing Your Business Continuity Planning Project 2nd Edition ISBN: 978-981-05-9767-2
- 7. Risk Analysis &Review
- 8. Identify Assets &ThreatsIdentify Organisational Assets
- 9. Identify ThreatsIdentify OrganisationalAssetsAssets essential to carry out missionExamples: FacilitiesPeopleDataSoftwareApplicationsEquipment
- 10. Identify ThreatsMan-MadeToxic andradioactive contaminationSabotage (both external and internal)Riot, civil disorder and coupFraud and embezzlementAccidental explosion (on and offsite)Water leak and plumbing failureWorkplace violenceTerrorismAircraft crashVandalismArsonPhysical asset theftMisuse of resourcesBuilding and physical security weaknessFireNaturalTornado (wind storm)Thunderstorm and hail stormLightning and electrical stormSnow and winter ice stormTyphoon and hurricaneFlood and other water-based incidentEarthquakeMudslideVolcanic eruption and ash falloutTsunamiLarge natural fireEpidemic and pandemic
- 11. Identify ThreatsBusinessPower outageLabordisputeEmployee turnover and single point of failureUnavailability of key personnelHuman errorGas outageWater outageLoss of transportationSingle source suppliersInformation Technology Voice and data telecommunication failureIT equipment failureHuman error from programmers and usersSecurity vulnerabilityData and software sabotageIn-house developed application failureHVAC failureDefective software
- 12. Analyse RisksIdentify impactor consequence of the threat materializingEstimate the likelihood of occurrenceDetermine risk level
- 13. Risk Analysis ProcessControlsWhatis cost for the Controls to be implemented?What Controls are in place?RiskWhat is the potential loss exposures to business?How does the threat affect business operations?Potentialfor LossWhat is the likelihood that the threat will adversely affect business operations?ThreatsLikelihoodWhat is the effects on people, infrastructure, facilities, and systems?ImpactWhat are the adverse events that can occur?
- 14.
- 15. Risk EvaluationAssess riskrating and prioritized for further treatment
- 16. Evaluation CriteriaCriteria Examples:PeopleProcessesInfrastructureWeightingfor different criteria
- 17.
- 18.
- 19. Risk TreatmentExplore TreatmentStrategies for risks deemed unacceptableDocument reasons for selection of strategy for each risk treatment
- 20. Risk Treatment StrategiesRiskAvoidanceRisk ReductionRisk TransferRisk Acceptance
- 21. Risk Treatment StrategiesAvoidTransferReduce/ Active ControlReduce (if Cost Justifiable)Accept
- 22.
- 23. Risk Analysis andBusiness Continuity PlanningProcessRisk Treatment StrategiesTreatment for risks that could potentially interrupt business operations
- 24. Implement & MonitorPresentRecommendations to management for approval Implement recommendationsMonitor resultsAdjust as necessary
- 25.
- 26.
Editor's Notes
- #2 Good afternoon Ladies and Gentlemen, I’m Jeremy Wong, and I am very pleased to be here this afternoon to share with you on how Risk Analysis can be conducted for BCM.
- #3 First, a quick introduction. I am currently the Senior Vice President of GMH Continuity Architects. GMH is a consulting firm focusing on Business Continuity Management, Disaster Recovery and Crisis Management. Our core business is to help organisations plan and execute their business continuity plans, and I am happy to say that so far we have been very successful in doing just that. We have implemented BCP for organisations, not only in Singapore, but also around the region, in Malaysia, Brunei, Thailand and Philippines. As part of our consulting approach, we help equip clients with the knowledge and skills to continue the BC programme even after we leave. That is why we partner with BCM Institute on education and certification programmes.
- #5 Before the break, Dr Goh presented you with a short but concise description of each phase in the BCM Planning Methodology. In the short time we have together this afternoon, I would like to focus on just one particular phase of the BCM Lifecycle – what many of you know as Risk Analysis or Risk Assessment. At this point, we are concerned with gathering and analysing information, and not into drawing up BC plans yet. That comes later in the recovery strategy and plan development phases.In Risk Analysis and Review, we examine the external environment for threats that can negatively impact the organisation. We then look for cost-effective ways to mitigate the risks posed by those threats.
- #6 To simplify, we can breakdown the risk analysis and review process into 5 stages– Identify, Analyse, Evaluate, Treat, and Implement & Monitor. Let’s look at each of these stages...
- #7 First, Identify. Before anything can be done about the risks, we first must be able to identify – the assets we have that we want to protect, and the potentials threats that could severely affect those assets.
- #8 Examples of organisational assets would be facilities, people, data, software, applications and equipment. The outcome is an inventory list of assets.In addition to physical assets, the list may also contain intangible assets like reputation, business relationships.
- #9 We will also need to identify the various threats that might affect our organisations. Here I have listed down 4 categories of threats that you might want to consider. For Natural Threats we have typhoons, floods, earthquakes and pandemics. One of these threats could cause major problems, a combination could be quite devastating. If you recall, in Indonesia last year we had a volcanic eruption and earthquake occuring very close to each other, and that caused huge problems for Indonesia. Natural Threat is a threat resulting from the effect of nature that may cause a disruptive impact to an organization. Man-made Threats are threats resulting from human interventions.
- #10 Business and Information Technology related threats may overlap with “man-made” threats.Information Technology related threats, specifically relate to the failure in IT and infrastructure components.And there could also combinations of threats from 2 or more categories. For example, most of you will remember the Icelandic vulcanic eruption in March last year. Iceland is right across the globe, but because of ash clouds halted hundreds of flights, the effects were felt even in Singapore. Supply chains were disrupted and businesses from many parts of the world were affected.There are many ways you can carry out threat identification. They are : through “walkaround observation”, checklists, research into historical records, brainstorming. At the threat identification stage, you would have narrowed the list down to about 10-15 threats that are most relevant to the organisation.Audits or physical inspections.Accident / Incident reports.Brainstorming.Decision trees.History.Interview / focus groups.Personal or organisational experience.Scenario analysis.Strengths, weaknesses, opportunities and threats (SWOT) analysis.Survey or questionnaires.The purpose of this stage is so that the project team is able to narrow down the list of threats to the relevant handful that is more manageable.
- #11 Once we have listed down the most probable threats, we would then be able to dissect each threat and examine the Impact and likelihood of occurrence.
- #12 We first determine the existing controls and with these controls in mind, we estimate the impact and likelihood of the threats occurring and arrive at a risk level for each threat. For easy reference, we can map the risk level into a matrix. Risk Analysis is the process to identify the risks to an organization; to define the controls in place so as to reduce organization exposure; and to evaluate the cost for the controls to be implemented. Identify the threats.Identify the likelihood of the threat occurring.Estimate the impact on people (both the staff & the customers), assets and information.Identify the threat, likelihood and impact.Identify the controls to be implemented.
- #13 Here I have put in Fire and Pandemic for illustration. Remember that we have already taken into account the existing controls when developing this risk level matrix, so what you see here represents the residual risk after the existing controls have been applied.Some organisations prefer more detail and go for a 5 x 5 matrix rather than the 3 x 3 matrix shown here. That’s fine so long as the organisation is comfortable with the level of complexity.
- #14 Once we are able to locate each threat, we move into the Evaluation stage which is A Screening Process – risks are reviewed against a pre-defined set of criteria and adjusted. Categories of risk may arise which require different responses. You may find that many of the more minor risks are filtered out after due consideration. This screening process helps the organisation focus on the most important risks to tackle. In other words, the Evaluation stage helps us prioritize our risks.This stage may be relatively simple for companies that have just a few threats, but may be more involved for companies that are big, and have more at stake should a major operational disruption occur.
- #15 To do a proper evaluation or prioritization of risk, we need a set of evaluation criteria. The list shows several examples of criteria that can be used to assess and further refine the risk level. To differentiate the significance or importance of criteria, some companies may want to introduce a weighting system, although often this does not contribute much in producing a more accurate analysis.
- #16 In practice, we use a template to collect the information to do this mapping. What you see on the screen is a sample template used to collect risk information.
- #17 So in our illustration, we have 3 risk rating zones – the high risk zone in Red, the low risk zone in green, and the medium risk zone in amber. Not surprisingly, companies would want to tackle the red high risk zone first. Only after that do they work on the medium risk zone.
- #18 Once we have identified and prioritized our risks, we now need to find suitable ways of dealing with these risks.
- #19 There are generally 4 strategies that can be used to treat risk – acceptance, avoidance, transfer and reduction.
- #20 Some reasons why a risk may be acceptable include: The level of RISK IS SO LOW that specific treatment in not suitable given the available resources.There is NO TREATMENT AVAILABLE.The COST OF TREATMENT SO HIGH outweighs the benefit.OPPORTUNITIES PRESENTED OUTWEIGH the threats to such an extent that the risk is acceptable.
- #21 Looking at Risk Reduction in greater detail, we see that there are actually 2 ways to go – we could either reduce the likelihood of a risk occurring (like putting in preventive controls) , or we could reduce the impact of the risk. This is where having a BCP plays an important part in limiting the downside of a disaster and implementing recovery.