Which risk assessment method fits your organisation?

Before choosing a technique, agree what the assessment must support: setting priorities, comparing controls or examining a particular process. Define the activity, the boundaries and the people who should contribute. A detailed calculation is not automatically more useful than a well-evidenced workshop. The method should reveal assumptions and lead to a decision someone can own.

The book discusses qualitative and quantitative approaches alongside several structured techniques. Use this comparison as a starting point; some operational questions need a combination of methods.

• Qualitative assessment and a risk matrix: useful for a shared first prioritisation. Define the scales and record the reasoning; colour alone is not evidence.
• Quantitative analysis: useful when decisions need numerical estimates and credible data are available. State uncertainty and test how assumptions affect the result.
• Checklists and risk registers: useful for recurring reviews and tracking ownership. They can miss new risks if the team only checks existing items.
• FMEA: useful for examining how components or process steps can fail. It needs people who understand the process and the effects of each failure.
• Bowtie analysis: useful for discussing threats, a central unwanted event, consequences and barriers. Check whether the barriers actually work and who maintains them.
• Scenario analysis: useful for exploring disruption across teams and dependencies. Challenge the scenario with alternative conditions and follow through on the actions identified.

Record the evidence, assumptions, action owner and review date. Connect high-priority findings to continuity arrangements and exercises. Revisit the assessment when operations, suppliers or controls change. A completed register is a working reference, not proof that the organisation is prepared.

Web adaptation based on Mastering Business Continuity in an Uncertain World, Rudy Clonen, 2025, pages 28–45. The original book is in English. This article offers a starting point for discussion; the approach should be adapted to the organisation and the assignment.