The purpose of risk management for business continuity is to find out what problems an organization may face. How should the level of risk for an organization be determined?

The level of risk is a fundamental concept in risk management and is determined by analyzing two key components: the potential consequences (or impact) of an event and the likelihood (or probability) of that event occurring. This combination allows an organization to quantify and prioritize risks, forming the basis for subsequent risk evaluation and treatment decisions within a Business Continuity Management System (BCMS). This approach is explicitly outlined in foundational risk management standards that inform ISO 22301.

B. Importance is a subjective measure, and acceptance is a decision made during risk treatment, not a component used to determine the initial level of risk.
C. Acceptable and tolerable levels are risk criteria against which the determined level of risk is compared during risk evaluation, not inputs for its calculation.
D. Profitability is one of many potential business impacts (a type of consequence) but is not a universal component for calculating all types of risk.

1. ISO 31000:2018, Risk management — Guidelines. Clause 6.4.3, "Risk analysis," states: "Risk analysis provides an input to risk evaluation... The level of risk can be determined by combining the consequences of an event and the associated likelihood."

2. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. Clause 8.2.3, "Risk assessment," mandates a process to "identify, analyse and evaluate the risk of disruption." The analysis phase, as defined by universal risk management principles, involves considering consequences and likelihood.

3. Ruzic-Dimitrijevic, L., & Dacic, D. (2015). Risk Assessment in Higher Education Institutions within the Business Continuity Management System. International Journal for Quality Research, 9(1), pp. 115-128. This paper discusses ISO 22301 implementation and notes on page 121 that "Risk analysis includes risk estimation, which is usually done by combining the probability of occurrence of an unwanted event and its consequences."

4. Cambridge University, Institute for Manufacturing (IfM). (n.d.). Risk Analysis Tools. Courseware from the Engineering Department describes risk as a "function of probability and impact," often visualized in a risk matrix where one axis is Likelihood and the other is Consequence/Impact.