Risk Assessment and Impact Analysis

[All Actors]
1. Context Establishment: Systematically identify vulnerabilities and critical dependencies within AI systems and establish realistic recovery objectives aligned with business impact assessments.Document interdependencies to prevent cascade failures and maintain clear communication across organizational boundaries.

2. Threat Landscape Analysis:Evaluate likelihood based on historical data and emerging trends. Consider both general technology risks and AI-specific challenges. Conduct evaluations to identify vulnerabilities across the AI solution ecosystem and business impact assessments to determine critical functions and acceptable interruption thresholds.

3. Vulnerability Identification: Catalog potential weaknesses in current continuity provisions.Examine cascade scenarios where initial disruptions may trigger subsequent failures, also consider resilience limitations in specialized hardware or computational resources.

4. Impact Determination: Quantify financial implications including both direct costs and opportunity losses along with unquantifiable costs such as reputational effects from service unavailability or degraded performance or due to different disruption scenarios.

5. Risk Evaluation and Treatment: Prioritize identified risks and determine appropriate risk responses (accept, mitigate, transfer, or avoid). Develop control measures for risks requiring treatment and monitor for changing risk profiles.

1. Business Impact Analysis and Risk Assessment: Confirm that the organization performs a Business Impact Analysis (BIA) to identify critical business processes and the potential effects of disruptions, explicitly considering the critical dependencies such as applications, IT systems, infrastructure, vendors, and human resources. These dependencies play a crucial role in understanding the impact of business disruptions. Verify that the BIA quantifies impacts in terms of financial loss, reputational damage, operational downtime, regulatory non-compliance, and other relevant metrics. Ensure that risk assessments identify both internal and external threats that could lead to business disruptions, explicitly including any risks related to AI systems, cloud infrastructure, and third-party vendors. Check that risks are analyzed in terms of likelihood, impact, and existing controls to gauge residual risk and the effectiveness of current mitigation strategies.

2. Establishing Impact Criteria for Strategies: Verify that clear criteria are established based on the BIA and risk assessment outcomes. Criteria may include Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), financial thresholds (e.g., cost implications of downtime), criticality of business functions and interdependencies, compliance and regulatory implications, stakeholder expectations and service level agreements (SLAs), and risk appetite. Ensure that the organization has defined its risk appetite, which will guide decisions on accepting certain and risks versus the cost of implementing risk treatment plans. Assess how the impact criteria are used to determine the prioritization of business continuity strategies and resilience capabilities, confirm that criteria help in deciding which functions require immediate restoration versus those that can be scheduled for later recovery, check that the criteria are embedded within a broader operational resilience framework, ensuring alignment with overall business strategy and risk management, review documented methodologies that connect risk levels with tailored resilience strategies (e.g., scaling up resources, alternative service delivery, backup systems).

3. Governance and Continuous Improvement: Ensure that senior management is involved in establishing and approving the impact criteria and associated resilience strategies. Verify that there are documented discussions or meeting minutes demonstrating management’s role in this process. Confirm that the impact criteria and related strategies are reviewed periodically or whenever significant changes (internal or external) occur, especially considering the changing technology landscape (e.g., AI systems, cloud architecture). Check for evidence of feedback loops from past incidents, tests, or drills that inform updates to the criteria and risk treatment strategies.

4. Evidence and Observations Checklist: Business Impact Analysis (BIA) reports and risk assessment records: policy documents outlining criteria for evaluating business disruption impacts, detailed methodologies linking disruption impacts to resilience strategies, management approval documents and review meeting minutes, change logs or update records reflecting periodic reviews and revisions, and risk appetite documentation specifying thresholds for acceptable risk.

From CCM:
1. Examine the policy to determine business impact and the criteria for developing business continuity.
2. Evaluate the process to review and approve the policy.