Risk assessment

Where a BIA asks "what matters, and what does it depend on," a risk assessment asks "what could realistically go wrong, and how likely and severe is it."

Common categories of threat

Cyber attacks and IT failure, fire, flood and other physical damage to premises, power and utility outages, pandemic or public health disruption, loss of a key supplier, and loss of key personnel, whether through illness, departure, or unavailability.

Prioritising

Not every risk deserves equal attention. A simple approach is scoring each risk by likelihood and by impact, then focusing planning effort on the risks that score highest on both, rather than spreading effort thinly across every conceivable scenario.