The standard for study and control of electronic signals produced by various types of electronic

The identification of other, more obscure risks might take a little creativity on the part of the BCP team. Risks come in two forms: natural risks and man-made risks. The following list includes some events that pose natural threats: Violent stormshurricanestornadoesblizzards Earthquakes Mudslidesavalanches Volcanic eruptions Man-made threats include the following events: Terrorist actswarscivil unrest Theftvandalism Firesexplosions Prolonged power outages Building collapses Transportation failures Remember, these are by no means all-inclusive lists. They merely identify some common risks that many organizations face. You may wish to use them as a starting point, but a full list- ing of risks facing your organization will require input from all members of the BCP team. The risk identification portion of the process is purely qualitative in nature. At this point in the process, the BCP team should not be concerned about the likelihood that each type of risk will actually materialize or the amount of damage such an occurrence would inflict upon the continued operation of the business. The results of this analysis will drive both the qualitative and quantitative portions of the remaining BIA tasks. Likelihood Assessment The preceding step consisted of the BCP team drawing up a comprehensive list of the events that can be a threat to an organization. You probably recognized that some events are much more likely to happen than others. For example, a business in Southern California is much more likely to face the risk of an earthquake than that posed by a volcanic eruption. A business based in Hawaii might have the exact opposite likelihood that each risk would occur. To account for these differences, the next phase of the Business Impact Assessment identifies the likelihood that each risk will occur. To keep calculations consistent, this assessment is usu- ally expressed in terms of an annualized rate of occurrence ARO that reflects the number of times a business expects to experience a given disaster each year. The BCP team should sit down and determine an ARO for each risk identified in the previous section. These numbers should be based upon corporate history, professional experience of team members, and advice from experts, such as meteorologists, seismologists, fire prevention professionals, and other consultants, as needed.