---
title: "Driving Blind: The Problem with Skipping the Threat and Risk Assessment"
description: Too many go from conducting a Business Impact Analysis to devising recovery strategies and building plans, skipping a Threat and Risk Assessment (TRA).
image: https://bcmmetrics.com/hubfs/Imported_Blog_Media/threat-and-risk-assessment.jpg
---
[Skip to content](https://bcmmetrics.com/blog/threat-and-risk-assessment#main-content)
SOLUTIONS
[PRICING](https://bcmmetrics.com/pricing)
USE CASES
RESOURCES
[ABOUT US](https://bcmmetrics.com/about-bcmmetrics)
Flexible BCM software solutions
[See all solutions →](https://bcmmetrics.com/business-continuity-solutions)
[ **REGULATORY COMPLIANCE** A self-assessment tool to evaluate the level of compliance of your business continuity program](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence)
[ **BUSINESS CONTINUITY PLANNING** A single platform where you can build and share business continuity plans (BCPS) across your entire team](https://bcmmetrics.com/business-continuity-solutions/bcm-planner)
[ **BUSINESS IMPACT ANALYSIS** An everyday business impact analysis (BIA) software to help you prepare and plan for anything](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand)
[ **FACILITIES MANAGEMENT** An intuitive icon-based mapping tool to better manage your facilities around the globe](https://bcmmetrics.com/business-continuity-solutions/bcm-one)
[**INSURANCE** Identify critical systems and create streamlined response plans](https://bcmmetrics.com/industry/insurance)
[**HEALTHCARE** Simplify compliance and risk assessments in one platform](https://bcmmetrics.com/industry/healthcare)
[**FINANCE** Manage audits and meet standards with ease](https://bcmmetrics.com/industry/finance)
[** CASE STUDIES** Learn how others have redefined their BC management with BCMMetrics](https://bcmmetrics.com/business-continuity-case-studies)
[** RESOURCE LIBRARY** Access our collection of free downloadable resources](https://bcmmetrics.com/business-continuity-resources)
[** BLOG** Read along for expert BC advice from our senior consultants](https://bcmmetrics.com/blog)
[LOG IN](https://app.bcmmetrics.com/Portal/login.aspx) [VIRTUAL TOUR](https://bcmmetrics.com/virtual-tour-form) [BOOK YOUR DEMO](https://bcmmetrics.com/demo)
.png)
.png)
Risk Management
# Driving Blind: The Problem with Skipping the Threat and Risk Assessment
Michael Herrera
Published on: April 15, 2021
### Prepare For the Worst with the Best in the Business
Experience capable, consistent, and easy-to-use business continuity management software.
[BOOK YOUR DEMO](https://bcmmetrics.com/demo)
Too many companies go straight from conducting a Business Impact Analysis to devising recovery strategies and building plans, skipping the step of conducting a Threat and Risk Assessment (TRA). In today’s post, we’ll look at what TRAs are and why they are important—and explain why organizations that skip them are driving blind.
>
## The Annual Worldwide Threat Assessment
Did you see that the U.S. intelligence community just published its [Annual Worldwide Threat Assessment](https://abcnews.go.com/Politics/covid-19-fallout-threat-ripple-world-years-intel/story?id=77042854) forecasting likely threats to U.S. security over the coming years? The report found that global fallout from the COVID-19 pandemic will constitute a serious threat moving forward and that Russia, China, and climate change will also pose significant dangers.
The report makes for sobering reading—however, in this post I’m not concerned so much with what it says as with the fact that the people responsible for keeping us safe are obliged to conduct such an assessment every year.
I firmly believe that every organization should conduct just such an assessment of the risks facing them—doing so at least once a year for mission-critical facilities.
## What is a Threat and Risk Assessment?
In business continuity, a Threat and Risk Assessment surveys the risk landscape, identifying threats to the organization, ranking them in terms of probability and impact, and noting any measures that are in place to mitigate each threat.
In tandem with the Business Impact Analysis (BIA), which identifies which business processes are most critical, the TRA provides the organization with a rational foundation for devising its recovery strategies.
The BIA and the TRA go hand in hand.
Conducting a TRA is equivalent to scanning ahead for potential trouble spots when you’re driving down the highway. Skipping the TRA means the organization is driving blind.
[](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLMwjpCG7fEqZcCbIEmF2%2F9nfEdywxyfUPP1eb%2BsIYapmxjm5%2BtcC83yj3SqEtj6rBnoEvs7y8H389lbPCrxwlZzzvVsLvJ%2F2RmFBVNFLV%2BM%2BM1LcxwI2ExLMYcl8%2FIV2pm0BEz5z7c6hzwHrxq4uvvzk%2BwBzBuHtNVxwDu%2BaM2VJ62una6xxATBYhQnPiVnIdwzYMkTBYOBQ%3D%3D&webInteractiveContentId=184720164174&portalId=46578083)
## Companies That Omit the TRA
Unfortunately, many companies skip the step of conducting a TRA. They do a BIA then immediately begin developing their recovery strategies and building their plans—without bothering to analyze the dangers the company is facing.
Why do people omit the TRA? Sometimes they are afraid of what they will find out. Sometimes they are put off by the perceived complexity of doing a TRA (the task is actually pretty straightforward).
Often, management assumes they know what the threats are—even though their assumptions tend to be rooted in the past while the threat landscape is constantly changing.
## The Cost of Skipping the TRA
The reason it’s important to conduct a formal TRA on a regular basis is because things change. The threat matrix and the company’s level of mitigation are both in flux.
If I had brought up some of today’s biggest threats even a few short years ago, I would have been laughed out of the room.
A global pandemic? That’s science fiction. Ransomware? Rolling blackouts? Out-of-control wildfires? Supersized hurricanes? Civil unrest? A barge blocking the Suez Canal and plugging up the global supply chain?
That’s all Hollywood stuff… But here we are in 2021, and those things aren’t Hollywood, they’re the headlines.
Companies that don’t conduct threat assessments run the risk of being impacted by dangers they haven’t anticipated and are not prepared for.
## How to Conduct a TRA
Conducting a TRA is actually pretty straightforward. There are many ways to quantify the results, but here are the basic steps:
1. Brainstorm to come up with the list of relevant threats (natural, human and technological) facing your company. Seek input from a small number of savvy, knowledgeable people throughout the organization.
2. You don’t have to evaluate the threats to every single facility; look at the threats to your most mission-critical locations.
3. Rank threats based on the probability of the threat occurring (low, medium, or high)
4. Score threats based on the potential impact to the company (people, operations, technology) if the threat did occur.
5. Score the mitigation controls (emergency plans, business continuity, backup power, etc.) that are in place against each threat, consulting the relevant departments (facilities, security, IT, etc.) as necessary.
6. Crunch the numbers to arrive at a risk score for each threat.
7. Identify your top five threats (based on risk scores).
8. Present your findings to management, explaining the steps the company should take to further mitigate the primary threats.
9. Ask management to [choose a risk mitigation strategy](https://mha-it.com/blog/dont-just-hope-choosing-strategies-to-mitigate-risk) for each of the main threats (e.g., accepting, transferring, limiting, or avoiding the risk).
10. Update your TRA annually (at least) for critical facilities and at a minimum of every two years for less critical locations.
In conducting a TRA, it’s important to be realistic and use common sense.
The goal is not to make all risks disappear forever and ensure that your company never receives an unpleasant surprise. That’s impossible. The goal is to understand the probabilities, take rational steps to protect the organization, and make conscious decisions about dealing with likely threats, rather than having the company go through life with its head in the sand.
## Driving with Your Eyes Open
Just as the U.S. intelligence community conducts an annual assessment of threats to U.S. national security, every organization should conduct regular assessments of the threats to its people, processes, and technology.
Conducting a Threat and Risk Assessment is fairly straightforward. It involves identifying the threats facing the organization, scoring them based on probability, impact, and existing mitigation controls, and consciously choosing a strategy to deal with the remaining risk.
It’s unfortunate that many companies skip conducting a TRA because by doing so they are driving blind through their organization’s threat landscape. It’s far better to drive with the eyes open.
## "Business resilience means adapting swiftly, turning challenges into stepping stones for success."
Michael Herrera
---
#### Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
## Other resources you might enjoy
#### [When the Going Gets Tough, the Tough Get Resilient](https://bcmmetrics.com/blog/get-resilient)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/get-resilient)
#### [The 5 Best Business Continuity Software Solutions for 2026](https://bcmmetrics.com/blog/best-business-continuity-software)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/best-business-continuity-software)
#### [Say It Isn’t So: Some Companies Pressure Their BCM Staff to Conceal the Truth](https://bcmmetrics.com/blog/concealing-truths)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/concealing-truths)
## Ready to start focusing on higher-level challenges?
### 
3820 W Happy Valley Road
Glendale, AZ 85310
USA
[SOLUTIONS](https://bcmmetrics.com/business-continuity-solutions)
- [Regulatory Compliance](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence)
- [Business Impact Analysis](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand)
- [Business Continuity Planning](https://bcmmetrics.com/business-continuity-solutions/bcm-planner)
- [Facilities Management](https://bcmmetrics.com/business-continuity-solutions/bcm-one)
PRICING
- [Our Pricing Model](https://bcmmetrics.com/pricing)
RESOURCES
- [Case Studies](https://bcmmetrics.com/business-continuity-case-studies)
- [Resource Library](https://bcmmetrics.com/business-continuity-resources)
- [Blog](https://bcmmetrics.com/blog)
COMPANY
- [About us](https://bcmmetrics.com/about-bcmmetrics-old)
- [Contact](https://bcmmetrics.com/demo)
- [MHA Consulting](https://www.mha-it.com/)
© 2026 BCMMetrics. All rights reserved. [Privacy Policy](https://bcmmetrics.com/privacy-policy)
```json
{
"@context" : "",
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://bcmmetrics.com",
"name" : "Home",
"position" : 1
}, {
"@type" : "ListItem",
"item" : "https://bcmmetrics.com/blog",
"name" : "Blog",
"position" : 2
}, {
"@type" : "ListItem",
"name" : "Driving Blind: The Problem with Skipping the Threat and Risk Assessment",
"position" : 3
} ]
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Michael Herrera",
"url" : "https://bcmmetrics.com/blog/author/michael-herrera"
},
"dateModified" : "2025-01-09T22:39:19.875Z",
"datePublished" : "2021-04-15T08:00:30.000Z",
"headline" : "Driving Blind: The Problem with Skipping the Threat and Risk Assessment",
"image" : [ "https://bcmmetrics.com/hubfs/Imported_Blog_Media/threat-and-risk-assessment.jpg" ],
"mainEntityOfPage" : {
"@id" : "https://bcmmetrics.com/blog/threat-and-risk-assessment",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://bcmmetrics.com/hubfs/Group%201171274345.svg"
}
}
}
```