3. Evaluating the implications
• For the list of significant vulnerabilities, the third stage in the process is to assess the implications of these relatively high-risk ratings.
• This is a four-stage process that places a value on the size of the risk, its likely duration before it is
likely it can be corrected, the recovery actions that will be needed and the indicative cost of that
recovery.
• There may be more than one recovery action and each should be detailed: e.g. airfreight and alternative supplier.
• Completing these implicationsm pages is the most judgemental part of the whole process as it
relies on knowledge of the company, its customers and suppliers.
• At the end of this process it is possible to see the importance of the risk from stage 2 in the
workbook against the scale of the exposure and the cost to fix.
• A simple ranking of the most critical vulnerabilities in the chain for which there is no mitigation or
contingency becomes available as a result of this analysis.