A business continuity risk assessment has one job: show your executives which disruptions would hurt the business most, so they can decide what to fix, fund, or accept. The risk assessment matrix is a tool for that decision. It is not the deliverable.
Most risk assessments I review miss that. They produce a colorful heat map, and nobody can say which revenue stream sits behind the red squares. The fix is simple: anchor every risk to a revenue stream, a customer commitment, or a critical process. If a risk doesn’t threaten one of those, it doesn’t belong at the top of your matrix.
Here is how to build a business continuity risk assessment matrix that leads to decisions, with the risk examples that belong on it.
| Old View | New View |
| The heat map is the deliverable | The decisions the heat map drives are the deliverable |
| Brainstorm every conceivable threat | Start with what keeps happening, then work outward |
| Plan for causes: hurricane, ransomware, fire | Plan for impacts: loss of a site, people, technology, or a supplier |
| Score impact in the abstract | Score impact against a revenue stream or customer commitment |
| Update it once a year for the auditors | Update it when the business changes |
Don’t Turn It Into Rocket Science
Before founding Bryghtpath, I ran crisis management and business continuity at Target. One division asked us for a detailed threat analysis. Our crisis team pointed out the obvious: “The number one phone call that we get from your division is the power is out. Can we start by having a process to deal with when the power is out?”
They did the analysis anyway. After weeks of work, they concluded that their top risk was power outages at facilities without generators.
That is the trap. As I said on Managing Uncertainty, Episode 63: “You can totally turn this into rocket science. I think that’s a bad route to go.” Start with what you already know. Your incident history, your near misses, and the calls your crisis team keeps getting tell you more than a month of workshops.
What a Business Continuity Risk Assessment Matrix Is
A business continuity risk assessment matrix plots each disruption on two axes: how likely it is, and how badly it would hurt the business if it happened. The product of the two tells you where to spend your attention and your budget first.
Most organizations use a 3×3 or a 5×5 grid. A 5×5 grid looks like this:
| Impact | Likelihood | ||||
|---|---|---|---|---|---|
| Rare (1) | Unlikely (2) | Possible (3) | Likely (4) | Almost Certain (5) | |
| Insignificant (1) | Low | Low | Low | Medium | High |
| Minor (2) | Low | Low | Medium | Medium | High |
| Moderate (3) | Low | Medium | Medium | High | High |
| Major (4) | Medium | Medium | High | High | Extreme |
| Catastrophic (5) | High | High | Extreme | Extreme | Extreme |
The grid is only as good as the definitions behind it. Write them down before anyone scores anything.
Likelihood. Use frequencies your leaders understand, not percentages nobody can defend. A workable starting scale:
- Rare: not expected in the next 10 years
- Unlikely: once in 5 to 10 years
- Possible: once in 2 to 5 years
- Likely: about once a year
- Almost certain: several times a year
Base it on your own incident history first, then your industry’s and your region’s.
Impact. Score impact in business terms. We use four categories in a business impact analysis, and they work here too:
- Financial: lost revenue and added expense. Which revenue stream stops, and for how long?
- Customer and mission: which customer commitments you would miss, and who gets hurt.
- Regulatory and compliance: notification deadlines, licensing, and contract obligations.
- Reputation: how customers, employees, investors, and regulators would see you afterward.
Define what “Major” means in dollars and hours for your company. A four-hour outage of your e-commerce platform and a four-hour outage of your internal wiki are not the same score.
Where Risk Assessment Fits in Business Continuity
Risk assessment is one of the 11 elements of a business continuity program I walked through on Episode 234. It works in a pair with the business impact analysis (BIA). The BIA tells you what matters most and how fast you need it back. The risk assessment tells you what is most likely to take it away. ISO 22301, the international business continuity standard, puts the two side by side in the same clause, and both feed your recovery strategies.
Some industries require it. The Federal Financial Institutions Examination Council (FFIEC) business continuity booklet covers risk assessment alongside the BIA for banks. The Centers for Medicare & Medicaid Services (CMS) emergency preparedness rule requires covered healthcare providers to base their emergency plan on an all-hazards risk assessment.
One correction, because it circulates widely: no US federal law requires every business with more than five employees to document a business continuity risk assessment. That claim comes from a UK workplace health and safety rule: British employers with five or more employees must record the significant findings of their health and safety risk assessment. It is a good practice. It is not a US business continuity mandate.
How to Build Your Business Continuity Risk Assessment
1. Start with the business, not the threats
List your critical processes and the revenue streams and customer commitments each one supports. If you have a current BIA, start there. Every risk you score later should connect to something on this list. That is the discipline I described in Stop Overcomplicating Your Resilience Program: a plan, or a risk, not tied to the business is paperwork.
2. Start with what keeps happening
Work in rings. First, the disruptions you already have: power outages, severe weather, system failures, vendor misses. Then what went badly recently. Then what your regulators and customers require you to address. Only then move outward to the rarer scenarios.
3. Group risks by impact, not cause
A tornado, a fire, and a burst pipe all produce the same problem: you lost a building. Group your risks into four impacts:
- Loss of workplace: a site, office, plant, or distribution center is unavailable.
- Loss of workforce: people can’t work, from illness, weather, transit, or the loss of a key person.
- Loss of technology: a critical system, application, network, or data is unavailable or untrustworthy.
- Loss of a third party: a supplier, vendor, or service provider can’t deliver.
You will never list every cause. You can plan for every impact.
4. Score with the business owners in the room
Your BC team can facilitate. It should not score alone. The leaders who run each process know what a two-day outage would cost and which customers would leave. Their numbers are more credible to your executives than yours.
5. Decide what to do with every high risk
Each risk in the High and Extreme zones needs a decision and an owner:
- Reduce it: a second supplier, a generator, a tested backup, a second site.
- Plan for it: a business continuity strategy and plan that keeps the process running while you recover.
- Transfer it: insurance or contract terms, knowing that neither restores operations.
- Accept it: a named executive accepts the risk, in writing, with a date to revisit it.
A red square with no owner and no date is not a managed risk. It is a known surprise.
6. Test it and keep it current
Exercise your top risks. A tabletop exercise built on your highest-scoring impact tells you whether your plans and strategies actually work. Then review the matrix at least once a year, and again whenever the business changes: an acquisition, a new site, a new critical vendor, a new product line.
We built this lifecycle for a major US-based home decor retailer after its board challenged the company to improve resiliency. After a Resiliency Diagnosis® with more than 40 discovery interviews, we led a complete business continuity lifecycle: risk assessment, business impact analysis, business continuity planning, training, and exercises.
Business Continuity Risk Examples
These are the business continuity risks that show up on almost every matrix we review, grouped by impact. Use them as a starting list, then make each one specific to your operations.
Loss of technology: cyberattacks and outages
Technology risk now tops most matrices, and the cost keeps rising. In Uptime Institute’s 2022 outage analysis, more than 60 percent of outages caused at least $100,000 in total losses, up from 39 percent in 2019.
- Ransomware. In March 2018, SamSam ransomware held 3,789 of the City of Atlanta’s computers hostage for a ransom of about $51,000. The city didn’t pay. Municipal courts couldn’t pull up cases, residents couldn’t pay bills online, and police officers wrote reports by hand. Federal prosecutors later said the attack caused millions of dollars in losses.
- Missed warning signs. Ireland’s Health Service Executive was hit by Conti ransomware on May 14, 2021. The attackers got in through a phishing email two months earlier, and antivirus alerts along the way were never escalated to an investigation. The independent review concluded that “opportunities to prevent the successful detonation of the ransomware were missed.”
- A vendor’s technology failure. On July 19, 2024, a faulty CrowdStrike update crashed an estimated 8.5 million Windows devices worldwide. Nobody was attacked, and organizations around the world still went down.
- Human error. A deleted database, a bad configuration change, a skipped step in a change window. Common, and usually underrated on the likelihood axis.
Loss of a third party: supplier and vendor failures
Your matrix should include your critical suppliers, logistics providers, cloud and software vendors, and outsourced services. Tier them by the impact of losing them, not by what you spend with them. A low-cost vendor with no alternative can stop a revenue stream. Our article on supply chain resilience covers how to find those dependencies.
Loss of workplace: facilities, power, and weather
Power outages, fires, floods, severe storms, earthquakes, and a building you can’t enter. These are the “Likely” and “Almost certain” risks for most organizations with physical sites, which is why they belong at the top of your list, not the bottom.
Loss of workforce: people
A pandemic or a bad flu season, a strike, a weather event that keeps people home, or the loss of the one person who knows how a critical process works. Ask: if this team lost half its people for two weeks, which processes stop first?
A simple way to tie each risk to the business
For each risk example on your list, answer three questions in a single row of your risk register:
| Question | Example answer |
| Which revenue stream, customer commitment, or critical process does it threaten? | Online orders, about 30% of revenue |
| How long until the impact becomes unacceptable? | Four hours, from the BIA |
| Who owns the decision to reduce, plan for, transfer, or accept it? | The VP of e-commerce, by March 31 |
That row turns a heat map into a business case.
Common Mistakes in a Business Continuity Risk Assessment
- Spending months on the analysis. You can turn this into rocket science. Don’t. Start with what you know, and refine it every year.
- Scoring without the business. A BC team scoring alone produces numbers executives don’t trust.
- Scoring causes instead of impacts. Twenty weather scenarios on the matrix and one line for “loss of a key supplier.”
- No decisions. Every High and Extreme risk needs an owner, a decision, and a date.
- Set it and forget it. Your risks changed when you opened that new site or signed that new cloud contract. Your matrix should too.
FAQs About Business Continuity Risk Assessment
What is the difference between a business continuity risk assessment and a business impact analysis?
The business impact analysis identifies your critical processes, what they depend on, and how quickly each must recover. The risk assessment identifies what is most likely to disrupt them and how badly. You need both. The BIA tells you what to protect. The risk assessment tells you what to protect it from first.
What is the difference between business continuity and disaster recovery?
Business continuity keeps the business running through a disruption of any kind: lost sites, people, technology, or suppliers. IT disaster recovery restores the technology itself. Your risk assessment should cover both, because a technology outage is usually a business continuity problem before it is fixed. Our Ultimate Guide to IT Disaster Recovery covers the technology side.
What are examples of business continuity risks?
Cyberattacks and ransomware, technology and cloud outages, supplier and vendor failures, power outages, fires, floods and severe weather, pandemics and workforce shortages, the loss of key people, and human error. Group them by impact: loss of workplace, workforce, technology, or a third party.
How often should you update a business continuity risk assessment?
At least once a year, and whenever the business changes in a way that changes your risks: a merger or acquisition, a new site, a new critical vendor, a major system migration, or a serious incident.
A risk matrix that doesn’t change a decision is decoration. Tie every red square to a revenue stream and an owner, and it becomes the case for what to fund next.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Build the lifecycle. Our Business Continuity services run the risk assessment, BIA, plans, and exercises with your team, or for it.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
