A shared assessment basis.
The matrix set out the criteria behind a rating. A reviewer can challenge the likelihood and consequences against that reference, instead of relying on the label alone.
Enterprise risk and continuity · Selected work
A shared language
for risk.
Risk-assessment criteria and business-impact templates for a food and grocery retailer.
Two working tools connect how risk is assessed with what disruption would mean for the business.
A food and grocery retailerRisk assessment and business continuityDraft working tools
Risk assessment
Make judgements
comparable.
The assessment matrix combines five likelihood levels with five impact levels, giving teams a shared format for assessing the severity of an exposure.
The structure of the work
A shared assessment basis
- 01
Likelihood
Assess how plausible the event is, using agreed criteria.
- 02
Consequence
Examine the effects on people, operations and business objectives.
- 03
Priority
Use a common severity scale to guide the response.
- Likelihood
- From Rare to Almost certain.
- Impact
- From Insignificant to Severe.
- Classification
- Low, Medium, High or Critical.
The matrix provides a common reference for the discussion. The quality of the assessment still depends on the evidence and judgement behind each rating.
Business impact
Understand what
interruption means.
Risk severity is one question. The consequences of disruption are another.
The business-impact template brings process ownership, operating context, disruption tolerance and recovery objectives into a structured set of inputs.
The questions behind the fields
Six fields from the working template, with the discussion each is intended to frame.
- Process and owner
- Which activity is being assessed, and who is responsible for it?
- Sites and peak periods
- Where does the activity take place, and when is disruption most consequential?
- Impact over time
- How do the consequences change as the interruption continues?
- Maximum tolerable period of disruption
- How long can the activity remain disrupted before the consequences become unacceptable?
- Recovery time objective
- Within what target time should the activity be restored?
- Recovery point objective
- To what point in time must information be recovered?
What the work provides
Make the judgement
open to examination.
The tools made two different judgements explicit: how severe an exposure is, and what a disrupted activity requires to recover. The criteria behind a severity label and the assumptions behind a recovery objective were available for separate examination.
A structured recovery discussion.
The template separated the maximum tolerable disruption from the intended recovery time and the required point of data recovery. Process ownership and peak-period context were included, making the assumptions behind recovery priorities available for review.
These formats established a basis for consistent assessment and a more specific recovery discussion. Their operational effectiveness depends on adoption, sound evidence and exercises that test the proposed response.
Start a conversation