# Clause 6.1.1: Determining risks and opportunities

Taking the context issues and interested party requirements already identified, determine which risks and opportunities must be addressed so the BCMS achieves its intended outcomes, prevents or reduces undesired effects, and continues to improve.

Cloud: Determining the risks means asking what would have to fail for a critical activity to stop, and how much of that failure sits outside your control. A single provider carrying two critical services is a different risk from two providers carrying one each.

Evidence: Risk and opportunity register traceable to specific context issues and party requirements; Statement of the intended BCMS outcomes the register is judged against; Review record showing the register is maintained.

Test: Map each critical activity to the providers and regions it needs, then look for shared failure points.

Citation: ISO 22301:2019, clause 6.1.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.