---
title: "[BCM] [JHA] [E2] [C3] Risk Analysis and Review Phase for Business Continuity Management Planning Methodology for Jamiyah Home for the Aged"
description: How JHA can identify, score and treat ten illustrative risks, R1 to R10, in the ISO 22301 Risk Analysis and Review phase of its BCM planning.
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Sustaining Community Services: Implementing BCM at Jamiyah Home for the Aged
# \[BCM\] \[JHA\] \[E2\] \[C3\] Risk Analysis and Review Phase for Business Continuity Management Planning Methodology for Jamiyah Home for the Aged
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ce18ee1-97ef-4ed4-b16b-5d6ab24cec19)
Chapter 2 set up the business continuity management (BCM) project with a sponsor, steering committee and team. The first analysis the team carries out is the Risk Analysis and Review. It answers three questions: which threats could disrupt JHA, how likely and how serious each one is, and what to do about it. The phase follows four steps: identifying risks, assessing risks, mitigating risks and continuous review. Its main output is a scored risk register that the Business Impact Analysis (BIA) and the strategy phase will draw on.
All scores, owners and controls in this chapter are illustrative. They show the method; JHA must apply it with its own staff and records.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c2dfdab1-7ab0-4a8b-bd31-7876fd39633e)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/bcm-v2/author/dr-goh-moh-heng) Nov 3, 2026
Every business continuity programme rests on an honest view of what could go wrong. For Jamiyah Home for the Aged (JHA), which cares around the clock for residents who are largely elderly, frail and destitute, that view must start with residents' safety and well-being rather than with buildings or systems. This chapter describes the Risk Analysis and Review (RAR) phase in four steps and sets out an illustrative register of ten risks, coded R1 to R10, for later chapters.
## [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ce18ee1-97ef-4ed4-b16b-5d6ab24cec19)
## [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c2dfdab1-7ab0-4a8b-bd31-7876fd39633e)
## Introduction
[![\[BCM\] \[JHA\] \[E2\] \[C3\] Risk Analysis and Review](https://no-cache.hubspot.com/cta/default/3893111/88d9db3b-6d3b-4d4c-9021-de97af0c6601.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/88d9db3b-6d3b-4d4c-9021-de97af0c6601)Chapter 2 sets up the business continuity management (BCM) project with a sponsor, steering committee and team. The first analysis the team carries out is the Risk Analysis and Review. It answers three questions: which threats could disrupt JHA, how likely and how serious each one is, and what to do about it. The phase follows four steps: identifying risks, assessing risks, mitigating risks and continuous review. Its main output is a scored risk register that the Business Impact Analysis (BIA) and the strategy phase will draw on.
All scores, owners and controls in this chapter are illustrative. They show the method; JHA must apply it with its own staff and records.
## Step 1: Identifying Risks
Identifying risks means recognising the potential threats that could disrupt the Home's operations. A practical approach for JHA is a facilitated workshop with care supervisors from both day and night shifts, the senior nurse, the kitchen lead, the person responsible for premises and the administration officer. Participants work through categories of threat one at a time:
- **Natural and environmental:** severe haze, prolonged extreme heat, heavy rain and localised flooding.
- **Health:** outbreaks of infectious disease among residents and staff, such as respiratory infections, gastroenteritis or skin infestations that spread in shared living spaces.
- **Premises and utilities:** fire, power failure, water supply interruption, lift or kitchen equipment failure.
- **People:** sudden staff shortages, loss of key individuals, resident safety incidents such as falls or a resident leaving the Home unaccompanied.
- **Supply chain:** interruption of food, medication, incontinence and hygiene supplies, or laundry services.
- **Information and technology:** loss of resident records, failure of communication systems, cyber incidents and data breaches.
- **Financial and partner:** disruption to funding, donations or the services of key partners.
Past events are a rich source. For example, JHA might review its incident records and recall how it managed the COVID-19 pandemic, any past power trips or water cuts, and any periods when absences left shifts short-staffed. The aim is a long list of credible threats, which is then grouped into a manageable register.
## Step 2: Assessing Risks
Assessing risks means evaluating each threat's likelihood and impact. A simple five-point scale works well for a home of JHA's size. Likelihood ranges from 1 (rare: not expected in the next ten years) to 5 (almost certain: expected at least once a year). Impact ranges from 1 (minimal: no effect on residents, handled within normal routines) to 5 (severe: serious harm to residents, loss of a Tier 1 function beyond its tolerable period, or regulatory action).
The risk score is likelihood multiplied by impact, giving a value from 1 to 25. Illustrative bands are: Low (1 to 6), Medium (8 to 12) and High (15 to 25). High risks need treatment plans approved by the steering committee; Medium risks need named owners and monitoring; Low risks are accepted and reviewed annually.
Judge impact mainly through residents. A two-hour power failure in the office is a nuisance; the same failure at night, affecting lighting, call bells and fans in residential areas, is a different matter. For example, JHA might score fire as likelihood 2 and impact 5: unlikely, given existing fire safety measures, but potentially catastrophic for residents with limited mobility.
## Step 3: Mitigating Risks
Mitigating risks means implementing controls that reduce each risk to an acceptable level. Controls fall into four broad types: avoiding the risk, reducing its likelihood, reducing its impact, or transferring part of it, for example through insurance or contracts. Most of JHA's controls will be of the second and third types.
The workshop first records existing controls, then agrees on further actions. For example, for an infectious disease outbreak, existing controls at JHA might include infection control routines, an isolation room and staff vaccination; further actions might include holding a larger stock of personal protective equipment (PPE) and agreeing in advance how staff can be cohorted to separate care teams. For medication supply disruption, JHA might agree a minimum stock of each resident's regular medication and a second pharmacy supplier. Each action has an owner, a due date and a target residual score.
The Code of Practice for Social Residential Homes already sets several controls that JHA must have, such as maintained fire equipment, unobstructed exits, a fire safety manager overseeing the fire emergency plan, and at least one staff member on site at all times with valid first aid and fire safety certification. Record these as existing controls and check their effectiveness, rather than assuming they exist.
## Step 4: Continuous Review
Continuous review means updating the risk profile as the environment changes. For JHA, change triggers might include a significant change in the resident profile, such as more residents with high care needs as the population ages; a change in staffing model; building works; a new public health advisory; or any incident or near miss. Outside these triggers, review the register at least annually, ideally just before the annual review of business continuity procedures that the Code of Practice requires. The review asks whether each risk is still relevant, whether scores have changed, whether actions are complete and whether new threats have emerged.
## The Illustrative Risk Register
The register below sets out ten risks that fit a welfare home for destitute elderly persons in Singapore. These codes are used throughout this eBook.
- **R1 Fire** in residential or kitchen areas, especially at night.
- **R2 Infectious disease outbreak** among residents and staff.
- **R3 Prolonged power or water failure**.
- **R4 Critical staff shortage** from illness, attrition or sudden absence.
- **R5 Food supply disruption or kitchen failure**, including food safety incidents.
- **R6 Medication supply disruption or medication error**.
- **R7 Severe haze or extreme heat** affecting frail residents.
- **R8 Serious resident safety incident**, such as a fall with injury or a resident leaving unaccompanied.
- **R9 Information technology (IT) failure, cyber incident or data breach** affecting resident records.
- **R10 Funding or key supplier failure**, including disruption to donations or outsourced services.
## Connecting to Existing Risk and Safety Management
BCM at JHA should not create a parallel system. The Home already runs safety arrangements that the risk register must connect with. Fire safety arrangements, including the fire emergency plan and the regular fire drills at varied timings required by the Code of Practice, address R1 directly. Infection control, which the Code requires to follow the relevant regulations and prevailing guidelines, addresses R2; public health direction for communicable diseases now comes from the Communicable Diseases Agency (CDA), a statutory board under the Ministry of Health. Incident management, under which serious incidents are reported to the Ministry of Social and Family Development (MSF) within 24 hours and reviewed for learning, connects with R8 and with every risk that could become an incident.
In practice, JHA might keep one combined register, with BCM risks flagged, rather than separate lists. Incident reviews feed the risk register; the risk register feeds BCM; and BCM findings feed back into safety procedures. If Jamiyah Singapore keeps an organisation-wide risk register, JHA's high risks should also be reported upward so that the managing agent sees them.
## Summary Table
| Code | Risk | Likelihood (1-5) | Impact (1-5) | Score | Band | Example existing or planned control |
| --- | --- | --- | --- | --- | --- | --- |
| **R1** | **Fire** | **2** | **5** | **10** | **Medium** | **Fire emergency plan, drills at varied timings, certified staff on every shift** |
| **R2** | **Infectious disease outbreak** | **4** | **4** | **16** | **High** | **Isolation room, PPE stock, staff cohorting plan** |
| **R3** | **Prolonged power or water failure** | **3** | **4** | **12** | **Medium** | **Emergency lighting, stored water, contractor call-out arrangement** |
| **R4** | **Critical staff shortage** | **4** | **4** | **16** | **High** | **Relief pool, cross-training, mutual aid with sister homes** |
| **R5** | **Food supply disruption or kitchen failure** | **3** | **4** | **12** | **Medium** | **Dry food reserve, alternative caterer** |
| **R6** | **Medication supply disruption or error** | **3** | **5** | **15** | **High** | **Minimum stock levels, second supplier, double checks** |
| **R7** | **Severe haze or extreme heat** | **3** | **3** | **9** | **Medium** | **Masks, cooled rest areas, hydration rounds** |
| **R8** | **Serious resident safety incident** | **4** | **3** | **12** | **Medium** | **Fall prevention, night checks, missing resident procedure** |
| **R9** | **IT failure, cyber incident or data breach** | **3** | **3** | **9** | **Medium** | **Backups, printed emergency resident list** |
| **R10** | **Funding or key supplier failure** | **2** | **4** | **8** | **Medium** | **Reserves policy, alternative suppliers** |
All scores are illustrative. Three risks (R2, R4 and R6) fall in the High band and seven in the Medium band.
## [](https://cta-redirect.hubspot.com/cta/redirect/3893111/64d16cdc-b532-47f6-af61-7b33f5b500a3)
## Conclusion
The Risk Analysis and Review phase gives JHA a shared, scored picture of the threats it faces and the controls it relies on. Its four steps turn general concern into a register with owners, actions and review dates. Three illustrative risks stand out as High: an outbreak, a staff shortage and a medication failure, each of which would fall immediately on residents. The next phase looks at the same Home from the other direction, asking not what could happen but what would hurt most if it stopped.
## Sources
- [Code of Practice for Social Residential Homes (First Edition)](https://www.msf.gov.sg/api/media/93ce9c5e-b2dd-4916-9b65-97484987f21a.pdf)
- [Communicable Diseases Agency, Who We Are](https://www.cda.gov.sg/about-cda/who-we-are/)
**Continue reading:** Chapter 4, *Business Impact Analysis Phase for Business Continuity Management Planning Methodology for Jamiyah Home for the Aged*, measures how quickly harm grows when each of JHA's twelve critical business functions stops.
---
## **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/bcm-v2/author/dr-goh-moh-heng"
},
"dateModified" : "2026-11-03T08:42:09.981Z",
"datePublished" : "2026-11-03T08:28:21.000Z",
"headline" : "[BCM] [JHA] [E2] [C3] Risk Analysis and Review Phase for Business Continuity Management Planning Methodology for Jamiyah Home for the Aged",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/bcm-v2/bcm-jha-e2-c3-risk-analysis-and-review-phase-for-business-continuity-management-planning-methodology-for-jamiyah-home-for-the-aged",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```