By completing Step 2, you will learn how to initiate and conduct an initial risk assessment and how to conduct a business impact analysis. Resources are available, linked in the text as well as accessible in the “Resources” section, to guide you through Step 2: Identify & Assess. Remember, these guidelines are basic knowledge and you are encouraged to tailor them to meet your specific business’s needs.

How to initiate and conduct an initial risk assessment

• Work with local emergency management officials to identify what community hazards, natural and man-made, to consider.
• Assess physical capacities, talk with an insurance agent to see what is financially covered.
• Identify the critical functions the business needs. This includes essential business functions & staff that is needed to carry out the identified functions. Remember to include suppliers, vendors, and others integral to the processes of the function.
• Identify what resources are and would be available to you before, during, and after a disaster.

How to conduct a business impact analysis

• Using the identified hazards, create scenarios to illustrate the highest probably threats to the business. These scenarios should be written in narrative form. Possible narrative prompts may include damage to buildings, damage to machinery, electrical power outage, loss of essential employee, etc.
• Give these narratives to managers to read and ask them, “What effect will this scenario have on my unit’s ability to function?” Have them consider and fill out a worksheet addressing the following impacts:
  • What services would be interrupted?
  • What is needed to resume functioning?
  • What is our recovery time objective?
  • Who would be my main contacts/stakeholders?
• Make sure to consider where and how vital records would be able to be accessed under current preparedness levels, as well as how communications, logistics, and other employee requirements would be accessed. Note gaps and unknowns.

Continue to Step 3: Plan

                                                       

Recovery time objective: the point in time when a function or process must be recovered, before unacceptable consequences could occur. [Source: Ready.gov]