This document provides an overview of the risk assessment process as outlined in the British Standard BS25999-2:2007. It describes the key steps in risk assessment including identifying vulnerabilities, threats, potential damages, scoring severity and likelihood, evaluating current mitigation measures, and calculating a risk magnitude score. The document uses a risk assessment model and provides examples of how to analyze risks using criteria for scoring severity, likelihood, mitigation, and determining appropriate risk treatment actions. The goal is to understand risks to critical assets and activities, prioritize them, and determine actions to reduce risks to an acceptable level.

1. Risk Assessment
Clause 4.1.2 Requirements
Of BS25999-2:2007

2. Executive Summary
This document attempts to The standard does not prescribe
provide an understanding of the any specific method of doing the
Risk Management process risk assessment
The British Standard, BS25999- This document provides an
2:2007 requires Risk example method of doing risk
Assessment to be done as a assessment which borrows
part of the ‘Understanding the heavily from Failure Modes and
organisation’ Effects Analysis (FMEA)
A flow chart illustrates the flow Using the concepts from FMEA
of the RM process per Clause helps in a couple of ways:
FMEA has been in use for quite some time
4.1.1 of the standard and also now and the writer assumes that the
deals with ‘Determining choices’ knowledge of using FMEA is prevalent
It provides numerical values for easy
– 4.1.3 prioritisation and action.
02/08/2010 Dipankar Ghosh 2

3. Section 4.1.1 Of BS25999-2:2007
4.1.2 Risk Assessment
4.1.2.1 There shall be defined, documented and appropriate
method of risk assessment that will enable the organisation
to understand the threats to and vulnerabilities of its critical
activities and supporting resources, including those provided
by suppliers and outsource partners
4.1.2.2 The organisation shall understand the impact that would
arise if an identified threat became an incident and caused a
business disruption
02/08/2010 Dipankar Ghosh 3

4. Risk Management Flow Chart
02/08/2010 Dipankar Ghosh 4

5. Risk Management Flow Chart
02/08/2010 Dipankar Ghosh 5

6. Risk Assessment Model
RMS After Actions
Taken
11
Identified Potential Potential Severity Likelihood of Current Mitigation Risk Recommended Responsibility S L M R
Vulnerabili- Threats Damages Of Occurrence Mitigation Score Magnitude Actions and Target Date M
ties Damages Score (1-5) Measures (1-5) Score (1-125) S
Score [
(1-5) S
X
[S] [L] [M] L
[RMS=SxLxM] X
M
]
1 2 3 4 5 6 7 8 9 10
1. Identified Vulnerabilities – These are weaknesses that has been identified which can result in a potential damaging impact on the
business. (e.g. Fuel storage near electrical substation). Vulnerabilities are ‘internal’ to the ‘system’.
2. Potential Threats – These are ‘external’ causes which can exploit vulnerabilities to cause damage. (e.g. electrical short circuits and
sparks can ignite the fuel nearby resulting in a fire)
3. Potential Damages – These are the effects or damages that are inflicted on the business and its assets. (e.g. loss of life due to fire,
loss of building, equipment etc. due to fire). Note that risk exists only if an external threat exploits an internal vulnerability to cause
damage or loss to your asset. You may have an empty house (no asset to be damaged/lost) with an unlocked door (vulnerability) and
a thief lurking around (threat). But you face no risk!
02/08/2010 Dipankar Ghosh 6

7. Risk Assessment Model
4. Severity Of Effects Score – This is a score on a scale of 1-5 which reflects the assessment of the seriousness of the damages listed
in 3. This is based on the Severity Score Criteria listed in the table below. Higher the severity higher is the score. Note that the criteria
in this and the following tables are not sacrosanct and are for example purposes. Practitioners may want to adapt these according to
their experience.
Severity Of Effects Severity Score Criteria Score
Hazardous or Catastrophic 1. May cause loss of lives, buildings or sites 5
2. The duration of recovery is very long
Very high 1. May cause severe injuries 4
2. May lead to severe damage to buildings,
equipment and goods
3. May cause severe hardships to customers,
employees and suppliers and may lead to severe
financial losses for all of them and the company
4. The duration of recovery is long
High 1. May cause major injuries 3
2. May lead to major damage to buildings,
equipments and goods
3. May cause hardships to customers, employees
and suppliers and may lead to financial losses for
all of them and the company
4. The duration of recovery is quite long
Moderate 1. May cause minor injuries 2
2. May lead to moderate damage to buildings,
equipments and goods
3. May cause moderate hardships to customers,
employees and suppliers and may lead to some
financial losses for all of them and the company
4. The duration of recovery is moderate
None or Minor 1. No injuries caused 1
2. None or minor damage to buildings, equipments
and goods
3. Insignificant hardships caused to customers,
employees and suppliers and may lead to minor
financial losses for all of them and the company
4. The duration of recovery is short
02/08/2010 Dipankar Ghosh 7

8. Risk Assessment Model
5. Likelihood Of Occurrence Score – This score measures on a scale of 1-5 the likelihood of occurrence of the identified risk event
arising from the potential cause based on the guideline provided in the table below. More the likelihood more is the score.
Likelihood of Occurrence Probability Score Criteria Score
>90% chance of happening Almost Certain 5
70%-90% chance of happening Likely 4
50%-70% chance of happening Possible 3
30%-50% chance of happening Unlikely 2
0%-30% chance of happening Rare 1
6. Current Mitigation Measures – Risk mitigation is a three-pronged weapon to alleviate the effects of risks.
Firstly, there need to be Prevention measures in place so that the risk event is prevented from occurring. (e.g. in the case of
fire because of short circuit there could be prevention measure of having adequate air gaps between conductors, the best
class of insulators may be provided etc.)
Next, there need to exist Detection measures, in case the risk event occurs, or better still if the possible occurrence of the
event can be detected even before the event occurs. (e.g. in the case of fire, fire and smoke detectors may be installed for
early detection)
And finally, there needs to be a Response mechanism in place, in case the event does occur. (e.g. availability of fire fighting
equipment, trained personnel who know how to handle fires, ready availability of fire tenders nearby and above all a well
documented and tested plan to handle the situation). A well tested business continuity plan is also a part of the response
mechanism.
02/08/20010 Dipankar Ghosh 8

9. Risk Assessment Model
7. Mitigation Score – This score measures on a scale of 1-5 the assessment of availability of mitigation measures for the identified risk
event based on an evaluation criteria provided by the table below. Weaker the current measures in place higher is the score.
Current Mitigation Mitigation Score Criteria Score
Measures
Highly Ineffective 1. Prevention is impossible or prevention measures are not in place 5
2. No known detection method is available or even if available it has
not been implemented
3. No response mechanism, in case of the event occurring, has
been put in place
Ineffective 1. Prevention is possible but prevention measures are not in place, 4
or even if in place they are not effective
2. Known detection method(s) is/are available but it/they have not
been implemented, or even if implemented they do not work
effectively or work only sporadically.
3. Response mechanism is in place but is not effective
Moderately Effective 1. Prevention measures in place and are somewhat effective 3
2. Detection methods have been implemented and are somewhat
effective
3. Response mechanism is in place and is somewhat effective
Effective 1. Prevention measures in place and are quite effective 2
2. Detection methods have been implemented and are quite
effective
3. Response mechanism is in place and is quite effective
Very Effective 1. Prevention measures in place and are very effective 1
2. Detection methods have been implemented and are very effective
3. Response mechanism is in place and is very effective
02/08/2010 Dipankar Ghosh 9

10. Risk Assessment Model
8. Risk Magnitude Score (RMS) – This is the score obtained by multiplying the three scores – Severity (S), Likelihood (L) and
Mitigation(M). That is: RMS = S X L X M
The RMS value can range from 1 to 125 and helps rank the identified risk events and the causes in order of priority. Higher scores
will generally require higher priority in terms of actions to be taken.
9. Recommended Actions – This column specifies the actions that are recommended to be taken to bring down the RMS of the
identified risk event. These actions should be directed towards reducing the severity of effects, towards reducing the likelihood of
occurrence and also towards bringing in mitigation measures of prevention, detection and response.
10. Responsibility and Target Date – This column contains the names of persons charged with the responsibility of completing the
recommended actions and the target date of completion.
11. RMS After Actions Taken – Once the actions have been taken a re-assessment of the risk is done and the new RMS score is
obtained. Needless to say, if the actions taken have been effective then the score would come down.
02/08/2010 Dipankar Ghosh 10

11. Risk Assessment Model
Criteria For Risk Treatment
It may be noted that not all Risks will require mitigating measures to be adopted. Based on the RMS score a risk may be:
Tolerated or Accepted – in case of low risk
Transferred (e.g. to insurance companies) – in case of medium to high risk, especially if it makes financial sense to transfer
rather than mitigate from the return of investment point of view
Mitigated (using controls for prevention, detection and response as discussed earlier) – in case of medium to high risk
Take urgent corrective actions – in case of very high risks
The table below provides the evaluation criteria which may be used to decided if a risk will be tolerated/accepted, transferred or
mitigated. Please note that this is only indicative and practitioners must apply their own judgment when creating their own criteria table.
RMS Score Treatment RMS
Score
90-125 Take urgent actions 90-125
27-90 Mitigate or Transfer 27-90
0-27 Tolerate/Accept 0-27
02/08/2010 Dipankar Ghosh 11