[BCM] [SC] [E2] [C3] Risk Analysis and Review

Chapter 3

As Part of the BCM Planning Methodology for the Judiciary of Singapore and the State Courts

Purpose of Chapter

The purpose of the RAR phase is to identify, assess, and prioritise potential risks that may disrupt judicial operations and to establish appropriate mitigation strategies.

For the Judiciary of Singapore and the State Courts, this means proactively safeguarding court processes, IT infrastructure, public services, and human capital to ensure uninterrupted access to justice.

Overview of the Risk Analysis and Review (RAR) Phase

The RAR phase comprises three key steps:

1. Identify Threats and Vulnerabilities
2. Assess Likelihood and Impact
3. Establish Risk Mitigation and Controls

This phase lays the groundwork for developing robust continuity strategies by translating abstract risks into actionable priorities.

It also ensures a strong alignment between operational risks and strategic business objectives.

Identifying Risks and Vulnerabilities in the Judicial Context

In the judicial environment, potential threats span both natural and man-made disruptions. The identification process should be comprehensive, covering:

• Operational Threats: For example, cyberattacks on the Integrated Case Management System (ICMS) and IT server failures at the State Courts Towers.
• Manpower-Related Threats: Sudden unavailability of judges or key registry staff due to pandemics or industrial actions.
• Physical Infrastructure Risks: Power outages or facility damage resulting from fires or water leaks in courtrooms.
• External Dependencies: Vendor failure for e-Filing or Audio-Visual (AV) equipment breakdowns during virtual hearings.
• Security Risks: Breach of sensitive case files or disruption from high-profile litigants.

Example

In 2020, the COVID-19 pandemic exposed vulnerabilities in traditional court settings. The rapid pivot to remote hearings underscored the importance of scenario-based threat identification, particularly about threats associated with public health emergencies and remote access vulnerabilities.

Assessing Likelihood and Impact

Each identified threat must be analysed by two dimensions: likelihood of occurrence and potential impact. The risk assessment matrix helps determine the severity and prioritisation of each risk.

For instance:

Example

A 2023 simulated tabletop exercise revealed that if the Digital Case File (DCF) system were compromised, it would stall over 80% of court proceedings.

The RAR process identified this as a high-risk scenario, prompting the implementation of enhanced cybersecurity protocols and backup procedures.

Establishing Risk Mitigation and Controls

Based on assessed risks, controls are proposed under the categories of:

• Preventive Controls: e.g., dual internet service providers for redundancy, multi-factor authentication for judicial systems.
• Detective Controls: real-time network intrusion monitoring, automated alerts for AV system faults.
• Corrective Controls: hot-site recovery infrastructure, backup hearing rooms, and contingency plans for case rescheduling.

Example

For courtroom AV systems prone to frequent breakdowns, the State Courts implemented a weekly technical testing regime and provided portable AV kits to facilitate backup arrangements. This mitigated disruption during high-volume hearing days.

Continuous Review

The Judiciary and State Courts must not view the RAR phase as a one-time exercise. It should be embedded within an ongoing risk management lifecycle, supported by:

• Annual BCM Risk Review Workshops
• Post-Incident Analyses (PIA) after major disruptions
• Stakeholder Consultations, including with the AGC, Law Society, and private law firms

Example

Following a ransomware scare that affected a regional court system in Southeast Asia, Singapore’s judiciary conducted a cross-agency risk review. It updated its RAR framework, incorporating ransomware simulation exercises and endpoint isolation controls.

Summing Up ...

The Risk Analysis and Review phase is pivotal to ensuring judicial resilience. For the Judiciary of Singapore and the State Courts, it translates into protecting vital functions — from safeguarding judicial integrity to ensuring public trust.

By proactively identifying and mitigating operational, technological, and external threats, this phase establishes a strong foundation for subsequent continuity planning stages.

Through regular risk reviews and a commitment to continual improvement, the judiciary enhances its ability to anticipate, withstand, and recover from disruptions, ensuring that access to justice in Singapore remains uninterrupted, even in the face of adversity.