[BCM] [ARC] [E3] [RAR] [T2] Treatment and Control

Threat

Existing Risk Treatment – Risk Avoidance

Existing Risk Treatment – Risk Reduction

Existing Risk Treatment – Risk Transference

Existing Risk Treatment – Risk Acceptance

Existing Controls

Additional (Planned) Controls

Denial of Access – Natural Disaster (e.g. Flood)

Not selecting flood-prone areas for new centres

Raised flooring, flood barriers, and regular inspection of drainage systems

Insurance coverage for flood damage

Acceptance of low probability, minor disruptions in non-essential services

Structural reinforcements, flood response plan, and remote working SOP

Relocation plan for critical services, periodic drills simulating natural disaster scenarios

Denial of Access – Man-made Disaster (e.g. Fire, Terrorism)

Avoiding operations in high-risk areas (e.g. near high-security or protest-prone zones)

Fire drills, fire suppression systems, reinforced entry points, and staff training on emergency evacuation

Property and casualty insurance

Acceptance of short-term suspension for non-critical services

Fire extinguishers, CCTV surveillance, emergency response team

Engagement with SCDF for joint fire safety audits, adoption of digital visitor logs for faster evacuation management

Unavailability of People (e.g. Pandemic, Mass Resignation)

Avoid scheduling key programs during peak illness seasons or public holidays

Cross-training of staff, succession planning, hybrid work arrangements, and health monitoring

Employee insurance coverage, engagement of part-time/agency staff for critical roles

Limited services during outbreak periods, reduced in-person sessions

Split-team arrangements, virtual therapy platforms, staggered shifts

Expanding volunteer program, developing internal staff wellness programme to improve retention and morale

Disruption to the Supply Chain (e.g. Delay in Special Education Materials)

Avoiding reliance on single-source vendors for essential materials

Identifying alternate suppliers, maintaining minimum inventory levels, and proactive vendor communication

Outsourcing some logistics and procurement to third-party service providers

Acceptance of delayed delivery for non-essential materials

Supplier evaluation process, minimum stock levels, pre-negotiated SLAs

Establishing regional/local supplier partnerships, procurement contingency strategy

Equipment and IT-Related Disruption (e.g. System Crash, Hardware Failure)

Avoid reliance on outdated legacy systems or a single critical IT component

Regular maintenance, cybersecurity protocols, data backups, and implementation of cloud-based systems

IT infrastructure insured; cloud services with built-in redundancy

Acceptance of occasional downtime for non-critical systems

Firewalls, antivirus software, two-factor authentication, and regular penetration testing

Migration to full cloud architecture, implementing business continuity IT recovery plan (BCP for IT), and staff training on digital platforms