Skip to content
Docs

Linking to risks and hazards

The BIA is the bridge between ERM Core and BCP Core. Each critical activity is linked to the RCSA risks that threaten it and to the hazard types its continuity scenarios must cover — and both sides show the link.

Who may do it: the Entity Risk Manager. See Roles and permissions.

BIA links RCSA and BCP CoreA critical activity in the BIA shows the residual score of each RCSA risk that threatens it, and each risk shows that it protects the activity. Hazard types from the group taxonomy name the scenarios to cover. BCP Core reads the approved BIA for the call tree, work status and exercise log.ERM CORE · RCSAERM CORE · BIABCP CORE · READS APPROVED BIAResidual scoreprotects activityscenarios to coverRisk registerresidual scoreprotects critical activityCritical activityMTPD · RTO · RPOcriticality tier (computed)Hazard typesgroup taxonomyCall treecritical teams firstWork statusminimum staff · RTOExercise logscenarios by hazardLEGENDRead from RCSAShown backBCP Core reads
Activity ↔ RCSA risk: each side shows the other. Activity ↔ hazard type: the hazards BCP scenarios must cover. BCP Core reads the approved BIA.

Linking an activity to risks

Section titled “Linking an activity to risks”
  1. Open the activity in the BIA.
  2. Choose which risks threaten this activity from the entity’s risk register.
  3. Save.

Afterwards:

  • the BIA shows the residual score of each linked risk, read from RCSA;
  • each linked risk in the register shows that it protects a critical activity.

Linking an activity to hazards

Section titled “Linking an activity to hazards”
  1. Open the activity in the BIA.
  2. Choose which hazards the BCP scenarios must cover from the hazard types in the group’s risk taxonomy.
  3. Save.

BCP Core reads these links for its scenarios and exercises.

What the system does or refuses

Section titled “What the system does or refuses”
  • The residual score shown in the BIA is read from RCSA. It cannot be typed in the BIA, and it follows the risk’s latest approved score — see Computed, never typed.
  • An activity links only to risks of its own entity. No company links to a sibling’s register — see Down-Only Visibility.
  • Hazard types come from the group’s shared taxonomy, so every company names a hazard the same way.
Section titled “Related”