How to prepare a risk management plan and business impact analysis January 11, 2018

The process of identifying risks, assessing risks and developing strategies to manage risks is known as risk management. A risk management plan and a business impact analysis are important parts of your business continuity plan. By understanding potential risks to your business and finding ways to minimise their impacts, you will help your business recover quickly if an incident occurs.

Risk Management Planning

You need to manage the risks to your business by identifying and analysing the things that may have an adverse effect on your business and choosing the best method of dealing with each of these identified risks.

The questions to ask yourself are:

What could cause an impact?
How serious would that impact be?
What is the likelihood of this occurring?
Can it be reduced or eliminated?

Before a business continuity plan (BCP) is created, a firm must conduct a risk assessment in order to identify the areas of exposure and all possible threats that could potentially cause a business interruption.

Types of threats that should be considered include natural, manmade, technological, loss of utilities, and pandemic in nature. Threats should be analyzed to determine the likelihood of their occurrence and the level of impact to the organization if they were to occur. Consideration should also be given to what mitigation steps have been taken to lessen the likelihood of occurrence and/or impact.

Threats that result in high risk ratings should be reviewed with management to determine the need for additional mitigation strategies to lessen the possibility of the threat causing a business outage.

Business Impact Analysis (BIA)

As part of the Business Continuity Plan business owners should undertake a Business Impact Analysis which will use the information in your Risk Management Plan to assess the identified risks and impacts in relation to critical activities of your business and determine basic recovery requirements.

Critical activities may be defined as primary business functions that must continue in order to support your business.

You need to identify:

Your critical business activities
What the impact to your business would be in the event of a disruption
How long your business could survive without performing this activity

The first step to conducting a BIA is to list all business functions and determine how important they are to normal daily operations. Next, it is important to figure out how long a company can wait after a business interruption before getting these crucial processes up and running again.

This involves documenting what impact the company would experience during the time these functions were not recovered. Would the company suffer significant financial consequences? Would there be regulatory fines imposed? What reputational risk would the company endure if they were not able to operate under “business as usual” circumstances? The processes that would incur the most impact if not recovered would be prioritised as the first to be recovered after a business interruption.

Looking for financial risk management training? Why not find out more about the FRM course we offer? Contact us to find out more about our financial risk management course.