Continuity risk decisions are vulnerable to this because of the very low This implies that risk
likelihoods associated with potentially catastrophic events, where the use of
values and probabilities is not always rational or shared between decision
recommendations are made with
makers. The implication is that without a strong policy statement, continuity risk
decisions may rely on senior managers’ individual risk appetites.
awareness of what the organisation
is willing to pay to treat exposures,
Benchmark analysis
The BCI Benchmark asks participants to indicate their agreement with the
but without clear guidance
statement that “Risk Assessment re-states and takes into full account the
organisation’s tolerance or appetite for continuity risks”. Analysis indicates a
spread of response with 17% indicating disagreement and 27% registering total Risk appetite can be expressed using familiar terms
agreement. The middle ground accounts for the remaining 56%, suggesting and plain language, supported by clear graphics. It
that the majority recognise risk appetite as a concept but have not embraced it should be reflected or referred to in BCM policy and
as an effective or useful part of BCM. This implies that risk recommendations included in impact analyses and risk assessments.
are made with awareness of what the organisation is willing to pay to treat A quantified risk matrix or graph provides a way of
exposures, but without clear guidance. achieving this, mapping risk register entries against
appetite and so highlighting exposures, acceptance,
treatment options, marginal costs and prioritisation.
27% Agree
23% Mostly agree
The BCI Benchmark suggests that whilst most
participants recognise risk appetite as a concept,
only a minority embrace and use it as a formal BCM
10% Completely disagree
component. Others ignore it altogether. This represents
an opportunity or perhaps a realisation that controls
7% Somewhat disagree can be further refined and governance improved as a
33% Partly agree
result.
Our discussion here suggests that many organisations could benefit from JoHn RoBinSon FBCi
a clear expression of continuity risk appetite, and that it offers protection
John robinson is managing director of iNoNi limited and
to management and certainty for stakeholders that their interests are being
author of the bci benchmark.
accurately represented. This supports proactive risk management, indicating
working limits for cost and risk acceptability, and making proposals easier to
info@inoni.co.uk
cccad 20/9/07 13:04 Page 1
position with better chance of acceptance. It tells us the levels of continuity risk www.inoni.co.uk
the organisation is willing to accept and what it is prepared to spend.
inspired
empowered
invigorated
The training venue of choice for
three out of four BCI-Approved
courses in the UK
Cotswold Conference Centre Ltd
Farncombe Estate Broadway
Worcestershire WR12 7LJ
Telephone: 0845 230 8580
email: enquiries@cotswoldconferencecentre.com
web: www.cotswoldconferencecentre.com
2  Continuity  November/December 2009
Cont Nov/Dec 09_insides.indd 12 27/11/09 14:12:36