5.3 Assess Risks (Task 6.3)

CCBA Certification of Capability in Business Analysis Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Introduction & CCBA Exam Foundation

1.1 CCBA Exam Structure, Eligibility & IIBA Framework 1.2 The Business Analysis Core Concept Model (BACCM™) 1.3 Requirements Classification Schema & Architecture 1.4 CCBA Competency & Proficiency Levels (Level 2 — Skilled)

2 Chapter 2: Business Analysis Planning and Monitoring

2.1 Plan Business Analysis Approach (Task 3.1) 2.2 Plan Stakeholder Engagement (Task 3.2) 2.3 Plan Business Analysis Governance (Task 3.3) 2.4 Plan Business Analysis Information Management (Task 3.4) 2.5 Identify BA Performance Improvements (Task 3.5)

3 Chapter 3: Elicitation and Collaboration

3.1 Prepare for Elicitation (Task 4.1) 3.2 Conduct Elicitation (Task 4.2) 3.3 Confirm Elicitation Results (Task 4.3) 3.4 Communicate Business Analysis Information (Task 4.4) 3.5 Manage Stakeholder Collaboration (Task 4.5)

4 Chapter 4: Requirements Life Cycle Management

4.1 Trace Requirements (Task 5.1) 4.2 Maintain Requirements (Task 5.2) 4.3 Prioritize Requirements (Task 5.3) 4.4 Assess Requirements Changes (Task 5.4) 4.5 Approve Requirements (Task 5.5)

5 Chapter 5: Strategy Analysis

5.1 Analyze Current State (Task 6.1) 5.2 Define Future State (Task 6.2) 5.3 Assess Risks (Task 6.3) 5.4 Define Change Strategy (Task 6.4)

6 Chapter 6: Requirements Analysis and Design Definition — Modeling & Architecture

6.1 Specify and Model Requirements (Task 7.1) 6.2 Verify Requirements (Task 7.2) 6.3 Validate Requirements (Task 7.3) 6.4 Define Requirements Architecture (Task 7.4)

7 Chapter 7: Requirements Analysis and Design Definition — Design & Value

7.1 Define Design Options (Task 7.5) 7.2 Analyze Potential Value and Recommend Solution (Task 7.6) 7.3 Estimation Techniques & Solution Trade-Offs 7.4 Acceptance and Evaluation Criteria Definition

8 Chapter 8: Solution Evaluation

8.1 Measure Solution Performance (Task 8.1) 8.2 Analyze Performance Measures (Task 8.2) 8.3 Assess Solution Limitations (Task 8.3) 8.4 Assess Enterprise Limitations (Task 8.4) 8.5 Recommend Actions to Increase Solution Value (Task 8.5)

9 Chapter 9: Essential BABOK Techniques

9.1 Core Elicitation & Analysis Techniques 9.2 Process, Data & Non-Functional Requirements Modeling 9.3 Financial Analysis & Business Case Techniques 9.4 Prioritization & Scope Techniques 9.5 Root Cause & Decision Analysis Techniques

10 Chapter 10: Underlying Competencies & Perspectives

10.1 Analytical Thinking, Problem Solving & Systems Thinking 10.2 Behavioral Characteristics, Communication & Interaction Skills 10.3 Business Acumen, Solution Knowledge & BA Tooling 10.4 The Five BABOK Perspectives in Practice

11 Chapter 11: CCBA Exam Mastery & Scenario Strategy

11.1 Deconstructing CCBA Scenario Questions & BABOK Logic 11.2 Common Traps, Distractors & Subtle BABOK Distinctions 11.3 Comprehensive 8-Week Study Plan & Exam Day Strategy

5.3 Assess Risks (Task 6.3)

Key Takeaways Explain This Topic AI

Task 6.3 assesses the uncertainty inherent in enterprise change, analyzing the likelihood and consequence of potential positive events (opportunities) and negative events (threats).

Risk is quantified using the fundamental formula: Risk Exposure = Probability (Likelihood) x Impact (Consequence).

Stakeholder risk tolerance varies across Risk-Averse, Risk-Neutral, and Risk-Seeking attitudes, establishing enterprise risk thresholds and governance escalation criteria.

Response strategies for negative risks (threats) are Avoid, Mitigate/Reduce, Transfer, and Accept; response strategies for positive risks (opportunities) are Exploit, Enhance, Share, and Accept.

The direct output of Task 6.3 is Risk Analysis Results, captured and managed continuously in an enterprise Risk Register.

Last updated: August 2026

5.3 Assess Risks (Task 6.3)

Quick Summary: Change inherently involves uncertainty. In BABOK v3 Task 6.3 ( Assess Risks ), the business analyst identifies, analyzes, and manages uncertainties surrounding the current state, future state, and change strategy. By evaluating Probability and Impact , analyzing Stakeholder Risk Tolerance , and devising actionable Risk Response Strategies for threats and opportunities, the BA produces Risk Analysis Results that safeguard value realization.

Purpose and Strategic Role of Task 6.3

The purpose of Assess Risks is to understand the undesirable consequences of internal and external forces on the enterprise during a transition, as well as the uncertainty surrounding the ability to deliver value through a change. In business analysis, risk is not exclusively negative: it represents any uncertain event or condition that, if it occurs, has an effect on the business goals.

Key areas of uncertainty evaluated in Task 6.3 include:

Will the future state deliver the expected potential value?

What unintended negative side effects might the solution introduce?

Does the enterprise possess the organizational capacity and technical competence to execute the transition?

How will external market, regulatory, or competitor shifts disrupt the initiative? +-----------------------------------------------------------------------------------+

| BABOK Task 6.3 Structure |
+-----------------------------------------------------------------------------------+
| INPUTS: |
| * Business Objectives (From Task 6.2) |
| * Current State Description (From Task 6.1) |
| * Future State Description (From Task 6.2) |
| * Requirements / Designs (Prioritized or unprioritized) |
| * Change Strategy (From Task 6.4, if iteratively refined) |
| |
| ELEMENTS: |
| 1. Unknowns and Uncertainties (Identifying potential risk events) |
| 2. Constraints, Assumptions, and Dependencies (Evaluating risk drivers) |
| 3. Negative Impact to Value (Threats) & Positive Impact to Value (Opportunities) |
| 4. Risk Tolerance (Averse, Neutral, Seeking) & Thresholds |
| 5. Recommendation (Risk Response Strategies) |
| |
| OUTPUT: |
| * Risk Analysis Results (Identified risks, ratings, owners, response plans) |
+-----------------------------------------------------------------------------------+
The Core Risk Formula and Analysis Dimensions

In business analysis, the severity or exposure level of any risk is determined by two foundational dimensions: Risk Exposure Level = Probability (Likelihood of Occurrence) × Impact (Consequence / Severity) \text{Risk Exposure Level} = \text{Probability (Likelihood of Occurrence)} \times \text{Impact (Consequence / Severity)} Risk Exposure Level = Probability (Likelihood of Occurrence) × Impact (Consequence / Severity)

1. Qualitative Risk Analysis

Qualitative analysis evaluates risks using subjective descriptive scales (e.g., Low, Medium, High, Critical) and maps them onto a Probability and Impact Matrix (Heat Map) :

Probability \ Impact Very Low (1) Low (2) Moderate (3) High (4) Critical (5)
Almost Certain (5) Moderate (5) High (10) High (15) Critical (20) Critical (25)
Likely (4) Low (4) Moderate (8) High (12) High (16) Critical (20)
Possible (3) Very Low (3) Low (6) Moderate (9) High (12) High (15)
Unlikely (2) Very Low (2) Low (4) Low (6) Moderate (8) High (10)
Rare (1) Very Low (1) Very Low (2) Very Low (3) Low (4) Moderate (5)
2. Quantitative Risk Analysis

Quantitative analysis assigns numerical financial values and probabilistic modeling to calculate statistical exposure:

Expected Monetary Value (EMV): Calculated as EMV = Probability (%) * Financial Impact ($) . For example, a 20% probability of a data center outage causing $500,000 in lost transactions produces an EMV of $500,000 * 0.20 = $100,000 .

Decision Tree Analysis: Evaluates alternative strategic pathways under uncertain probabilistic outcomes.

Monte Carlo Simulation: Runs thousands of computer simulations to generate a probability distribution for project cost and schedule outcomes.

Stakeholder Risk Tolerance and Thresholds

Different stakeholders and organizations exhibit distinct psychological and cultural attitudes toward uncertainty. The business analyst must evaluate stakeholder Risk Tolerance to ensure proposed change strategies align with executive appetite: +-----------------------------------------------------------------------------------+

| Stakeholder Risk Attitudes |
+-----------------------------------------------------------------------------------+
| [ RISK-AVERSE ] | [ RISK-NEUTRAL ] | [ RISK-SEEKING ] |
| * High reluctance to risk | * Objective evaluation | * High willingness |
| * Prefers certainty | * Balances cost/benefit | * Pursues high return |
| * Invests in safeguards | * Evaluates EMV directly | * Tolerates volatility|
+-----------------------------------------------------------------------------------+
Comparison of Risk Attitudes

Risk Attitude Definition & Behavioral Characteristics Typical Enterprise Manifestation

Risk-Averse An individual or organization with low tolerance for uncertainty. Prefers known outcomes, avoids volatility, and is willing to pay substantial premiums (mitigation costs) to avoid negative outcomes. Financial compliance departments, nuclear safety systems, healthcare medical device engineering.

Risk-Neutral An organization that evaluates risks purely on mathematical expected monetary value (EMV). Decisions are based on objective cost-benefit trade-offs without emotional bias. Mature corporate capital allocation committees, diversified investment funds.

Risk-Seeking An individual or organization willing to accept high uncertainty and potential losses in exchange for the potential of superior competitive advantages or outsized returns. Tech startups, venture capital incubators, disruptive innovation labs.

Note

Risk Threshold: The specific, quantifiable boundary of risk exposure beyond which an organization will not tolerate uncertainty without triggering mandatory risk response interventions (e.g., "Any risk with a potential financial loss exceeding $250,000 or any safety breach must be escalated to the Executive Steering Committee").

Risk Response Strategies: Threats vs. Opportunities

The BABOK® Guide v3 categorizes risk response strategies into two groups depending on whether the risk event is negative ( Threat ) or positive ( Opportunity ).

1. Strategies for Negative Risks (Threats)

Strategy Mechanism Enterprise Case Example

Avoid Modify the change strategy, architecture, or scope to entirely eliminate the risk or protect the objective from its impact. Canceling a high-risk custom algorithmic development and using proven off-the-shelf software instead.

Mitigate (Reduce) Take early, proactive actions to reduce the probability of occurrence, reduce the severity of impact, or both. Conducting rigorous security code audits and automated penetration testing to reduce the probability of data breaches.

Transfer (Share) Shift the financial or operational impact and ownership of the risk to a third party. Purchasing a comprehensive $10M cyber liability insurance policy; signing a fixed-price SLA contract with an outsourced vendor.

Accept Acknowledge the risk without taking proactive architectural action.; • Passive Acceptance: Deal with consequences if they occur (workaround).; • Active Acceptance: Establish a contingency reserve (budget/time). Setting aside a $50,000 contingency budget for minor currency exchange fluctuations during overseas hardware procurement.

2. Strategies for Positive Risks (Opportunities)

Strategy Mechanism Enterprise Case Example

Exploit Eliminate uncertainty to ensure that the opportunity definitely happens (100% probability). Assigning top senior software engineers to a pilot to guarantee early release before competitors.

Enhance Take proactive steps to increase the probability of occurrence or magnify the positive impact. Increasing digital marketing budget by 10% to capture higher viral adoption rates during launch.

Share Form a joint venture, partnership, or consortium with a third party to capture mutual value from an opportunity. Partnering with a regional logistics provider to rapidly scale fulfillment capacity in a new country.

Accept Take advantage of the opportunity if it arises, but do not actively pursue it with dedicated capital. Accepting unexpected server price drops from a vendor without modifying procurement schedules.

Residual Risk vs. Secondary Risk

When evaluating risk response strategies, the business analyst must analyze two downstream risk phenomena:

Residual Risk: The remaining risk level that persists after mitigation strategies have been implemented (e.g., after installing firewalls and multi-factor authentication, a 2% residual risk of phishing breaches remains).

Secondary Risk: A brand-new risk that is directly created as a consequence of implementing a risk response strategy (e.g., outsourcing core server management to a cloud vendor transfers hardware maintenance risk, but creates a secondary risk of vendor lock-in and dependency on external cloud network latency).

Realistic Enterprise Case: Skyline Airways

Context: Skyline Airways prepares to replace its 25-year-old Passenger Service System (PSS) handling reservations, baggage check-in, and flight departure control across 40 airports. System failure on cutover day would ground flights at a cost of $3.8M per hour.

The BA's Risk Assessment Approach:

Risk Identification: BA logs critical threats: (a) airport ground staff unable to operate new interface; (b) baggage reconciliation API timeouts during peak holiday traffic; (c) legacy database data corruption during live cutover.

Qualitative & Quantitative Analysis: Baggage API failure rated: Probability = 30%, Impact = $6.0M. Expected Monetary Value (EMV) = $1.8M (Critical Risk).

Response Formulation:

Threat Mitigation: Deploy dual redundant fiber lines at all 40 airports and run 4 simulated high-volume load tests.

Threat Avoidance (Phasing): Switch cutover strategy from a "Big Bang" overnight launch to a regional phased rollout starting at 3 secondary airports.

Secondary Risk Management: The phased approach creates a secondary risk of maintaining data synchronization between the old and new systems. The BA specifies a real-time data integration bridge as a mandatory transition requirement.

Key BABOK v3 Techniques for Task 6.3

Brainstorming: Engaging cross-functional teams to identify potential failure modes and threats.

Decision Analysis: Using decision trees and Expected Monetary Value (EMV) to evaluate alternative risk response paths.

Financial Analysis: Quantifying financial exposure and calculating cost-effectiveness of mitigation reserves.

Interviews and Surveys: Querying domain experts and external vendors about technical vulnerabilities.

Lessons Learned: Analyzing past enterprise transformations to avoid repeating historical risk blind spots.

Risk Analysis and Management: The foundational technique for categorizing, rating, treating, and monitoring risks.

Exam Tips & Common Traps for CCBA Candidates

Important

Inputs and Outputs of Task 6.3:

Inputs: Business Objectives , Current State Description , Future State Description , Requirements (prioritized or unprioritized) , Change Strategy .

Output: Risk Analysis Results (the formal assessment of uncertainty, likelihood, consequence, and mitigation strategy).

Common CCBA Traps:

❌ Trap 1: Believing risk is solely negative. In BABOK v3, risks encompass both negative threats and positive opportunities. Recognize the distinct response verbs: Avoid/Mitigate/Transfer for threats vs. Exploit/Enhance/Share for opportunities.

❌ Trap 2: Confusing Transfer with Mitigation. Mitigation reduces probability or impact through direct operational action (e.g., adding automated unit tests). Transfer shifts ownership and financial consequence to a third party (e.g., insurance, vendor contracts) without necessarily reducing the probability that the event occurs.

❌ Trap 3: Forgetting that Risk Assessment is continuous. Risk assessment is not a one-time gate at project kickoff; it must be revisited iteratively as requirements evolve, assumptions are tested, and transition states unfold.