Chapter 6 - Risk Assessment

Abstract

The standards allow the selection of a number of quantitative and qualitative methods to systematically assess risk to critical processes, systems, and products identified by the Business Impact Analysis or by independent examination of the risk to organizational and business continuity objectives through the risk assessment process. Departing from a strictly pure risk methodology in its approach to risk assessment, ISO 22301’s suggested use of the ISO 31000 Risk Management Standard enables the analyst to look at speculative risk to these objectives, systems, and processes that include financial and reputational risk. Using an Enterprise Risk Management framework, the context of the analysis is established through communication and consultation. The Risk Assessment then systematically identifies, analyzes, and treats the risk of disruption to the organization’s prioritized activities in accordance with the organization’s risk appetite.