Study guide
5.3 Assess Risks
CBAP Certified Business Analysis Professional Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Introduction & BACCM Framework
1.1 CBAP Exam Structure, Eligibility & Study Plan 1.2 The Business Analysis Core Concept Model (BACCM) 1.3 Key Concepts, Terms & Requirements Classification 1.4 Business Analysis Governance & Stakeholder Engagement Principles
2 Chapter 2: Business Analysis Planning and Monitoring
2.1 Plan Business Analysis Approach 2.2 Plan Stakeholder Engagement 2.3 Plan Business Analysis Governance 2.4 Plan Business Analysis Information Management 2.5 Identify Business Analysis Performance Improvements
3 Chapter 3: Elicitation and Collaboration
3.1 Prepare for Elicitation 3.2 Conduct Elicitation 3.3 Confirm Elicitation Results 3.4 Communicate Business Analysis Information 3.5 Manage Stakeholder Collaboration
4 Chapter 4: Requirements Life Cycle Management
4.1 Trace Requirements 4.2 Maintain Requirements 4.3 Prioritize Requirements 4.4 Assess Requirements Changes 4.5 Approve Requirements
5 Chapter 5: Strategy Analysis
5.1 Analyze Current State 5.2 Define Future State 5.3 Assess Risks 5.4 Define Change Strategy 5.5 Business Case Development & Financial Analysis
6 Chapter 6: Requirements Analysis and Design Definition
6.1 Specify and Model Requirements 6.2 Verify Requirements 6.3 Validate Requirements 6.4 Define Requirements Architecture 6.5 Define Design Options 6.6 Analyze Potential Value and Recommend Solution 6.7 Data Modeling & Process Modeling Techniques 6.8 Use Cases, User Stories & Acceptance Criteria Definition 6.9 Non-Functional Requirements & Solution Constraints
7 Chapter 7: Solution Evaluation
7.1 Measure Solution Performance 7.2 Analyze Performance Measures 7.3 Assess Solution Limitations 7.4 Assess Enterprise Limitations 7.5 Recommend Actions to Increase Solution Value
8 Chapter 8: Underlying Competencies, Techniques & Perspectives
8.1 Analytical Thinking, Problem Solving & Business Knowledge 8.2 Behavioral Characteristics & Interaction Skills 8.3 Core BABOK Techniques Master Review 8.4 Business Analysis Perspectives
5.3 Assess Risks
Key Takeaways Explain This Topic AI
Risk assessment in Strategy Analysis evaluates uncertainties surrounding current operations, proposed future states, and the change strategy required to achieve them.
Risks are defined as uncertain events or conditions that, if they occur, have a positive (opportunity) or negative (threat) effect on business objectives.
Risk analysis measures two primary dimensions: Probability (likelihood of occurrence) and Impact (severity of consequence).
Negative risk responses include Avoid, Mitigate, Transfer, and Accept; positive risk responses include Exploit, Enhance, Share, and Accept.
An organization's risk tolerance, risk appetite, and risk threshold dictate which risks require active mitigation versus passive acceptance.
Last updated: August 2026
- 5.3 Assess Risks
- Purpose of Risk Assessment in BABOK v3
The primary purpose of Assess Risks (BABOK Guide v3 Task 6.3) is to understand the uncertainties associated with achieving the future state, evaluating the potential impacts of those uncertainties, and recommending appropriate risk response strategies.
Risk is inherent in all organizational endeavors. When analyzing strategy, business analysts must assess risks across three distinct dimensions:
Current State Risks: Risks associated with maintaining existing legacy operations (e.g., system failure risk, technical debt, operational burnout).
Future State Risks: Risks associated with operating in the target state (e.g., market adoption risk, new compliance liabilities).
Change Strategy Risks: Risks associated with executing the transition path itself (e.g., resource availability, implementation delays, organizational change resistance).
Risk Fundamentals: Problems vs. Risks
A critical conceptual distinction in BABOK v3 is the difference between an issue/problem and a risk :
Problem / Issue: A condition or event that has already occurred or is currently taking place. It is a known reality requiring immediate resolution or management.
Risk: An uncertain event or condition that has not yet occurred, but if it does occur, will exert a positive or negative effect on enterprise goals and objectives.
Risks are defined by two key parameters:
Probability (Likelihood): The estimated percentage chance that the uncertain event will materialize (scaled quantitatively from 0% to 100%, or qualitatively as Low, Medium, High).
Impact (Severity): The magnitude of financial, operational, strategic, or reputational consequence if the risk occurs. Risk Exposure Score = Probability × Impact \text{Risk Exposure Score} = \text{Probability} \times \text{Impact} Risk Exposure Score = Probability × Impact
Organizational Risk Attitude, Appetite, and Tolerance
An organization's governance culture dictates how risks are evaluated and managed. CBAP candidates must master three key risk posture concepts:
Risk Appetite: The overall amount and type of risk an enterprise is willing to pursue or accept in pursuit of strategic value and business objectives.
Risk Tolerance: The acceptable level of variation that an enterprise can endure relative to the achievement of a specific objective.
Risk Threshold: A specific quantitative trigger level or baseline point above which a risk must be escalated or actively managed with a formal response strategy.
Risk Attitude Category Behavioral Profile Decision-Making Impact
Risk-Averse Unwilling to accept significant uncertainty; prioritizes capital preservation and operational stability over high-return opportunities. Prefers conservative, proven solution options; requires extensive mitigation plans.
Risk-Neutral Evaluates decisions purely on expected financial value, balancing risk and reward without inherent bias. Accepts medium risk if calculated Return on Investment (ROI) justifies potential exposure.
Risk-Seeking (Risk-Taker) Eager to adopt high-uncertainty initiatives in pursuit of market disruption or maximum enterprise value. Willing to pursue unproven, cutting-edge technology solutions; tolerates high implementation risk.
Negative Risk Response Strategies (Threats)
When addressing risks that carry adverse consequences for the enterprise, the BABOK v3 Risk Analysis and Management technique and standard risk-management practice use four negative risk response strategies:
Avoid: Modify the change strategy, solution scope, or project approach to eliminate the risk condition entirely or protect the objective from its impact (e.g., canceling a high-risk custom software feature and using a standard off-the-shelf module).
Mitigate: Take proactive actions before the risk occurs to reduce the probability of occurrence, the impact severity, or both (e.g., conducting extensive automated testing and pilot releases to lower the probability of system deployment failure).
Transfer: Reallocate the financial liability, operational responsibility, or ownership of the risk to a third party (e.g., purchasing performance insurance, securing service-level guarantees, or outsourcing specialized infrastructure management to a cloud provider).
Accept: Acknowledge the risk condition without taking active structural steps to alter its probability or impact before it occurs. Acceptance can be:
Passive Acceptance: Document the risk in the risk register and monitor it.
Active Acceptance: Establish a financial contingency reserve or backup procedure if the risk materializes.
Positive Risk Response Strategies (Opportunities)
Risk is not exclusively negative. BABOK v3 explicitly treats uncertain events with a positive impact to value as risks the BA must analyze. The four opportunity responses below come from mainstream risk-management practice and are the set CBAP preparation material uses:
Exploit: Take proactive steps to ensure that the positive opportunity definitely occurs, eliminating uncertainty surrounding its realization (e.g., assigning the enterprise's top technical architects to guarantee early platform launch).
Enhance: Take targeted actions to increase the probability of occurrence, the magnitude of positive impact, or both (e.g., increasing marketing expenditure during a competitor's product delay to maximize market share capture).
Share: Partner with an external third party or consortium to share investment costs and capabilities, allocating a portion of the positive upside (e.g., forming a joint venture to co-develop new AI algorithms).
Accept (Opportunity): Willingness to take advantage of an opportunity if it arises spontaneously without actively investing resources to force its occurrence.
Maintaining the Risk Register and Ongoing Assessment
Risk assessment is not a one-time event during project kickoff. Senior business analysts establish a continuous risk management loop:
Identification: Brainstorming, workshops, risk breakdown structures, lessons learned reviews.
Analysis: Qualitative scoring (matrices) and quantitative modeling (Monte Carlo simulation, decision tree analysis).
Evaluation: Ranking risks against organizational risk thresholds.
Monitoring: Tracking risk triggers—warning signals indicating that a risk event is imminent.
CBAP Exam Tips & Strategic Guidance
Distinguishing Responses: If an exam scenario describes purchasing cloud insurance or vendor SLAs, select Transfer . If it describes adding technical code reviews to prevent bugs, select Mitigate . If it describes changing scope to remove a feature, select Avoid .
Negative vs. Positive: Pay close attention to whether the question stem describes an adverse threat or a favorable opportunity before selecting the response strategy!