--- title: "Sample Threat and Risk Assessment: Worked BCM Example | MHA" description: See a sample threat and risk assessment with scope, evidence, control review, residual risk, priorities, and BCM actions. image: https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Imported_Blog_Media/sample-threat-and-risk-assessment.jpg --- [Skip to content](https://mha-it.com/blog/sample-threat-and-risk-assessment#main-content) [![MHA by BCMMetrics - navy](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) Business Continuity Planning # Sample Threat and Risk Assessment: A Worked BCM Example Richard Long Updated on: September 28, 2026 #### Relevant Contents #### Need Tailored Business Continuity Insights? Contact Us Now for Personalized Guidance! [Schedule a Free Consultation](https://mha-it.com/contact) A threat and risk assessment is easier to understand when you can see how the pieces fit together. The example below shows one way a business continuity team could move from scope and evidence to disruption scenarios, risk ratings, control review, residual exposure, and management actions. This is a simplified example. It is not a universal template or scoring model. Every organization should define its own likelihood, consequence, risk, and decision criteria before assigning ratings. **In short** - Define the scope and scoring criteria before assigning ratings. - Use several sources of evidence instead of relying on a generic threat list. - Connect each threat to the people, processes, technology, facilities, or suppliers it could disrupt. - Assess the exposure before assuming existing controls will work. - Evaluate control effectiveness using evidence such as tests, exercises, procedures, and operating records. - Document the residual exposure, required action, owner, and management decision. ## How to Use This Sample Threat and Risk Assessment The purpose of this example is to show what a completed assessment might look like at a practical level. It deliberately does not prescribe a universal risk formula. Organizations use different likelihood scales, impact criteria, matrices, thresholds, and decision authorities. Whatever method is selected should be defined before the assessment begins and applied consistently. If you need the broader process before reviewing the example, see [Risk Assessment: The Best Way to Identify Your Biggest Threats](https://mha-it.com/blog/risk-assessment-identify-threats) and [Risk Management Process: 6 Steps for Business Continuity](https://mha-it.com/blog/risk-management). ## The Sample Organization and Scope Assume a mid-sized organization operates two important facilities: - a corporate and technology office supporting customer service, finance, and core applications - a primary distribution facility responsible for receiving, storing, and shipping customer orders The business impact analysis has identified customer support, order processing, distribution, and several supporting technology services as time-sensitive activities. The scope of the threat and risk assessment is to identify conditions that could interrupt those activities and determine whether current controls and recovery arrangements reduce the exposure to an acceptable level. ## Step 1: Gather Evidence A useful assessment should not start by assigning numbers to a generic list of threats. Start by collecting information about how the organization actually operates. For this sample assessment, assume the team reviewed: - BIA results and recovery requirements - previous incidents and outages - business continuity and disaster recovery plans - application and dependency information - facility and utility dependencies - critical supplier information - exercise and recovery-test results - interviews with Operations, IT, Facilities, Security, Vendor Management, and business leaders - site walkthroughs - relevant external hazard information for the locations being assessed The goal is to identify credible scenarios based on the organization's actual dependencies rather than assume every possible hazard deserves equal attention. ## Step 2: Identify Credible Disruption Scenarios The assessment team identifies six scenarios that warrant closer review. | Scenario | Why It Matters | Potentially Affected Operations | | --- | --- | --- | | **Extended utility power loss** | Both facilities depend on continuous electrical service and supporting building systems. | Distribution, technology, customer support | | **Critical cloud-service outage** | Customer support and order processing depend on one cloud platform. | Customer support, order processing | | **Cyber incident affecting production systems** | Several critical activities depend on shared applications and data. | Technology, order processing, customer service, finance | | **Loss of access to the distribution facility** | Most physical fulfillment activity occurs at one location. | Receiving, inventory, shipping | | **Critical supplier failure** | A time-sensitive component is obtained primarily from one supplier. | Inventory and customer fulfillment | | **Loss of key personnel** | Several activities depend on specialized knowledge concentrated in a small number of employees. | Technology, distribution, financial operations | ## Step 3: Define the Rating Criteria Before Scoring The sample organization uses qualitative ratings of Low, Moderate, and High for likelihood and consequence. These labels are illustrative. Another organization might use five levels, numerical scoring, separate people and financial impact criteria, or another approved method. What matters is that everyone uses the same definitions. For example: - **Likelihood:** How credible is the scenario within the assessment period? - **Consequence:** How significant could the operational, people, financial, customer, contractual, or regulatory effects be? - **Inherent risk:** What is the exposure before current controls and recovery measures are considered? - **Residual risk:** What exposure remains after current controls and recovery measures are considered? The overall rating should follow the organization's approved risk criteria rather than a formula copied from another company. ## Step 4: Assess the Inherent Exposure The team first considers the scenarios without assuming that current safeguards will perform as expected. | Scenario | Likelihood | Consequence | Illustrative Inherent Risk | | --- | --- | --- | --- | | Extended utility power loss | Moderate | High | High | | Critical cloud-service outage | Moderate | High | High | | Cyber incident affecting production systems | Moderate | High | High | | Loss of access to the distribution facility | Moderate | High | High | | Critical supplier failure | Moderate | High | High | | Loss of key personnel | Moderate | Moderate | Moderate | The ratings above are examples, not recommendations. A real assessment should use evidence and the organization's approved definitions. ## Step 5: Evaluate Existing Controls Next, identify what is already in place and determine whether there is evidence that those measures work. A control should not receive credit simply because it appears in a policy or plan. | Scenario | Existing Controls | Evidence and Gaps | | --- | --- | --- | | **Utility power loss** | Backup generator and UPS protection | Generator is tested, but extended operation and fuel replenishment have not been exercised. | | **Cloud-service outage** | Vendor service agreement and manual workaround | Workaround exists but has not been exercised at realistic volume. Essential customer information is not available outside the platform. | | **Cyber incident** | Security controls, backups, incident-response procedures | Backup completion is monitored, but full restoration of critical services has not recently been demonstrated. | | **Distribution facility loss** | Remote work for office functions and limited third-party fulfillment capability | Office work can move remotely, but full distribution volume cannot currently be transferred within the required recovery time. | | **Supplier failure** | Safety stock and informal alternate-source list | Alternate suppliers have not been fully qualified and lead times could exceed the business tolerance. | | **Key-person loss** | Cross-training and documented procedures | Some alternates exist, but several lack system access or recent hands-on experience. | ## Step 6: Determine Residual Risk and Required Action After current controls are considered, reassess what exposure remains. This is where the assessment begins to support management decisions. | Scenario | Illustrative Residual Risk | Next Action | Owner | | --- | --- | --- | --- | | Utility power loss | Moderate | Exercise an extended generator scenario and confirm fuel arrangements. | Facilities | | Cloud-service outage | High | Create alternate routing, maintain essential offline data, and exercise the workaround. | Operations / IT | | Cyber incident | Moderate to High | Perform an end-to-end recovery test for critical services and address identified gaps. | IT / Security | | Distribution facility loss | High | Develop and test an alternate fulfillment strategy capable of supporting priority orders. | Operations | | Supplier failure | High | Qualify an alternate supplier and reassess inventory requirements. | Vendor Management / Operations | | Key-person loss | Moderate | Complete cross-training, access provisioning, and procedure validation. | Business Process Owners | These residual ratings are illustrative. The organization should compare its actual results with its approved risk criteria and determine whether additional treatment, escalation, or formal acceptance is required. For more on this distinction, see [Inherent Risk vs. Residual Risk](https://mha-it.com/blog/inherent-risk-vs-residual-risk). [![New Logo White](https://no-cache.hubspot.com/cta/default/46330580/interactive-211051877732.png)](https://mha-it.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIwO5jx%2BXxZs16opDdIPKIUNRxEjgLDD3VA6%2FkFiYM6jOy2yTvMrW6ay%2FPEsMRI8h6M1eKtb6v85mXwDR07DdtsixYVOZ4NPxIng87l23mILeIF5182T%2FoKGBXQbFTIXMhJqZO6suuJz%2FTAqOrEOGN3RKJ7lh1kd3JEOJ6Jc3KZL29I3S6iEJkrlw2BOa5oPS8%3D&webInteractiveContentId=211051877732&portalId=46330580) ## How the Assessment Should Change BCM Decisions The assessment is not finished when the risks are ranked. The findings should influence the continuity program. ### Recovery Strategies If a time-sensitive activity has no viable recovery option, the risk assessment should make that exposure visible and support a decision about what needs to change. ### Business Continuity Plans Plans should reflect the disruption scenarios and dependencies the assessment shows are credible, particularly where a workaround or alternate process is part of the risk treatment. ### Disaster Recovery If the BIA requires a technology service to recover within a certain timeframe, the organization should compare that requirement with actual recovery capability and testing evidence. ### Exercises High-priority assumptions should become exercise scenarios. If the assessment depends on a manual workaround, alternate supplier, generator, recovery environment, or remote-work process, test whether it performs as expected. ### Investment and Management Decisions Some risks cannot be corrected by the BC team alone. They may require funding, a technology change, a supplier decision, additional staffing, or formal acceptance by someone with appropriate authority. This is where a useful threat and risk assessment moves beyond documentation. It gives management a clearer view of which exposures require action and why. ## What This Sample Does Not Mean This example should not be copied as a universal scoring template. A real threat and risk assessment should reflect: - the organization's approved likelihood and consequence criteria - its business model and critical operations - its facilities, geography, technology, people, and suppliers - applicable contractual, regulatory, and internal requirements - evidence about whether current controls work - its approved risk tolerance and decision authority The value of the sample is in the sequence: define the scope, gather evidence, identify credible scenarios, assess the exposure, evaluate controls, determine what remains, and turn the result into action. ## Frequently Asked Questions ### What is a threat and risk assessment? A threat and risk assessment identifies credible events and conditions that could disrupt the organization, evaluates their likelihood and potential consequences, reviews current controls, and helps determine what exposure remains. ### What should a threat and risk assessment include? A useful assessment should document its scope, information sources, risk criteria, disruption scenarios, affected operations, likelihood and consequence ratings, current controls, evidence of control effectiveness, residual risk, required actions, owners, and review triggers. ### How should threats be scored? The organization should define its scoring criteria before the assessment begins. There is no single likelihood, impact, or risk-scoring formula that applies to every organization. The method should be applied consistently and support the organization's decision process. ### What is the difference between inherent and residual risk? Inherent risk is the exposure before current controls and treatments are considered. Residual risk is what remains after those measures are taken into account. ### What happens after a threat and risk assessment is completed? Significant findings should lead to decisions. The organization may need to strengthen controls, change recovery strategies, update plans, exercise important assumptions, assign corrective actions, escalate the issue, or formally accept the remaining risk. ## Further Reading - [Risk Assessment: The Best Way to Identify Your Biggest Threats](https://mha-it.com/blog/risk-assessment-identify-threats) - [The Missing Piece: Why You Need a Risk Assessment for Operations](https://mha-it.com/blog/operational-risk-assessment) - [Risk Management Process: 6 Steps for Business Continuity](https://mha-it.com/blog/risk-management) - [Inherent Risk vs. Residual Risk](https://mha-it.com/blog/inherent-risk-vs-residual-risk) - [Risk Mitigation in Practice: 4 Strategies Explained](https://mha-it.com/blog/four-types-of-risk-mitigation) --- ![](https://mha-it.com/hubfs/Richard%20Long-MHA-Consulting.png) #### Richard Long Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements. ## Start building a stronger future ##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera. [Schedule your consultation](https://mha-it.com/contact) ## Other resources you might enjoy ![Know Your Gaps: Manage Residual Risk to Keep Your Company Safe](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/managing-residual-risk.jpg?height=245&name=managing-residual-risk.jpg) #### [Know Your Gaps: Manage Residual Risk to Keep Your Company Safe - MHA Consulting](https://mha-it.com/blog/manage-residual-risk) [Read More](https://mha-it.com/blog/manage-residual-risk) ![Dancing in the Dark: The Hidden Costs of Shadow IT](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Blog%20images/November-December%202024/IT%20Crisis%20Management%20Best%20Practices.webp?height=245&name=IT%20Crisis%20Management%20Best%20Practices.webp) #### [Dancing in the Dark: The Hidden Costs of Shadow IT](https://mha-it.com/blog/hidden-costs-shadow-it) [Read More](https://mha-it.com/blog/hidden-costs-shadow-it) ![Business leaders reviewing a residual risk and risk acceptance decision](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/photo10.jpg?height=245&name=photo10.jpg) #### [Risk Acceptance vs Residual Risk Explained](https://mha-it.com/blog/risk-acceptance-strategy) [Read More](https://mha-it.com/blog/risk-acceptance-strategy) ## Ready to start focusing on higher-level challenges? [![MHA by BCMMetrics - White](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/) Business continuity consulting for today’s leading companies. #### Company - [Who We Are](https://mha-it.com/who-we-are) - [Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [News](https://mha-it.com/news) - [Blog](https://mha-it.com/blog) - [Contact](https://mha-it.com/contact) #### Services - [Business Continuity](https://mha-it.com/business-continuity) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [Crisis Management](https://mha-it.com/crisis-management) - [BCaaS](https://mha-it.com/bcaas) - [Training & Awareness](https://mha-it.com/training-awareness) - [Program Augmentation](https://mha-it.com/program-augmentation) © 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://mha-it.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://mha-it.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Sample Threat and Risk Assessment: A Worked BCM Example", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Richard Long", "url" : "https://mha-it.com/blog/author/richard-long" }, "dateModified" : "2026-09-28T21:29:17.476Z", "datePublished" : "2024-09-18T19:45:51.000Z", "headline" : "Sample Threat and Risk Assessment: Worked BCM Example | MHA", "image" : [ "https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Imported_Blog_Media/sample-threat-and-risk-assessment.jpg" ], "mainEntityOfPage" : { "@id" : "https://mha-it.com/blog/sample-threat-and-risk-assessment", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg" } } } ```