A risk analysis involves identifying the most probable threats to an organization and analysing the related vulnerabilities of the organization to these threats. A business impact analysis involves identifying the critical business functions within the organization and determining the impact of not performing the business function beyond the maximum acceptable outage. Types of criteria that can be used to evaluate the impact include: customer service, internal operations, legal/statutory and financial.

During the risk analysis you must not focus only on the technical risk because many times risks come up from places that you expect the less, like organization, team problems, partnership problems etc. Remember that everything that you do is connected to people, and people can be wrong sometimes. People can also argue and this can seriously affect your project.

The best way to begin a risk analysis is to start with the reward. Analyse this first and after that the goal of the project that can lead to the winning of the reward. And after you do all this, start thinking of the problems that can show up and keep you away from fulfilling your tasks.