![[Logo] [BCM] Certification Transparent](https://no-cache.hubspot.com/cta/default/3893111/7789ece9-0b11-4cae-9f32-d34d7eb1688a.png)
Once threats have been named and their controls examined, the next question is how much each one matters. This chapter scores the impact and likelihood of the 30 threats that could disrupt Jamiyah Home for the Aged (JHA), calculates a rating for each and estimates how long each might interrupt operations.
Introduction
![[BCM] [JHA] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/1115b558-848b-447d-af32-b2f7dc24a147.png)
This chapter is Part 3 of the Risk Assessment Report (RAR). It builds on the Threat Register in Part 1 and the treatment and control assessment in Part 2, and it keeps the same threat names and order, including the threats to information technology (IT) systems. Assessing both impact and likelihood matters because a threat that is very likely but trivial deserves a different response from one that is rare but devastating. Impact is judged across seven areas because a single event can hurt finances, operations, legal standing, reputation, residents, staff and assets in very different amounts. The calculation uses the highest credible impact score so a serious consequence in one area is not hidden by low scores in others.
The assessment basis is the current exposure after the existing controls described in Part 2, but before the additional planned controls are implemented. Because the existing controls are assumed and require validation, the scores are illustrative. Risk owners and senior management must validate them before using them to commit resources, and should read the numbers alongside professional judgement and the home's risk appetite.
The impact scale runs from 1 to 5: 1 is Insignificant, 2 Minor, 3 Moderate, 4 Major and 5 Severe. The likelihood scale also runs from 1 to 5: 1 is Rare, 2 Unlikely, 3 Possible, 4 Likely and 5 Almost Certain. The Risk Rating is the highest impact score multiplied by the likelihood score. The default bands are 1 to 4 for Very Low or Low, 5 to 9 for Moderate, 10 to 16 for High and 17 to 25 for Very High (Extreme), because the home has not supplied an approved risk matrix.
The impact area Social Responsibility has been reframed for this sector. For a welfare home, it measures harm to the welfare, dignity and safety of vulnerable residents, the home's duty of care and safeguarding obligations, and the trust of the community and donors who support it. It is therefore read as a welfare measure, not as a public-sector regulatory theme.
| Risk Level | Rating band | Number of threats |
|---|---|---|
| Very Low / Low | 1–4 | 3 |
| Moderate | 5–9 | 18 |
| High | 10–16 | 9 |
| Very High (Extreme) | 17–25 | 0 |
Under these illustrative scores, 9 threats are High, 18 are Moderate and 3 are Very Low or Low, and none is rated Very High (Extreme).
Impact assessment
| Threat | Impact Area – Finance | Impact Area – Operations | Impact Area – Legal and Regulatory | Impact Area – Reputation and Image | Impact Area – Social Responsibility | Impact Area – People | Impact Area – Assets, IT Systems and Information | Risk Impact Area – Highest Numeric Score |
|---|---|---|---|---|---|---|---|---|
| Flash Flood (Denial of Access – Natural Disaster) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 3 – Operations; Social Responsibility; People; Assets, IT Systems and Information |
| Severe Storm and Strong Winds (Denial of Access – Natural Disaster) | 2 – Minor | 2 – Minor | 1 – Insignificant | 2 – Minor | 2 – Minor | 2 – Minor | 3 – Moderate | 3 – Assets, IT Systems and Information |
| Lightning Strike (Denial of Access – Natural Disaster) | 2 – Minor | 3 – Moderate | 1 – Insignificant | 1 – Insignificant | 2 – Minor | 2 – Minor | 3 – Moderate | 3 – Operations; Assets, IT Systems and Information |
| Extreme Heat (Denial of Access – Natural Disaster) | 1 – Insignificant | 2 – Minor | 1 – Insignificant | 2 – Minor | 3 – Moderate | 3 – Moderate | 2 – Minor | 3 – Social Responsibility; People |
| Haze (Denial of Access – Natural Disaster) | 1 – Insignificant | 2 – Minor | 1 – Insignificant | 2 – Minor | 3 – Moderate | 3 – Moderate | 1 – Insignificant | 3 – Social Responsibility; People |
| Distant Earthquake Tremors (Denial of Access – Natural Disaster) | 1 – Insignificant | 2 – Minor | 1 – Insignificant | 1 – Insignificant | 2 – Minor | 2 – Minor | 2 – Minor | 2 – Operations; Social Responsibility; People; Assets, IT Systems and Information |
| Fire (Denial of Access – Man-made Disaster) | 4 – Major | 5 – Severe | 4 – Major | 4 – Major | 5 – Severe | 5 – Severe | 4 – Major | 5 – Operations; Social Responsibility; People |
| Gas Leak (Denial of Access – Man-made Disaster) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 4 – Major | 2 – Minor | 4 – People |
| Structural Failure (Denial of Access – Man-made Disaster) | 4 – Major | 4 – Major | 3 – Moderate | 4 – Major | 4 – Major | 4 – Major | 4 – Major | 4 – Finance; Operations; Reputation and Image; Social Responsibility; People; Assets, IT Systems and Information |
| Bomb Threat (Denial of Access – Man-made Disaster) | 2 – Minor | 3 – Moderate | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 2 – Minor | 3 – Operations; Reputation and Image; Social Responsibility; People |
| Terrorism Incident Nearby (Denial of Access – Man-made Disaster) | 2 – Minor | 3 – Moderate | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 2 – Minor | 3 – Operations; Reputation and Image; Social Responsibility; People |
| Road Closure and Major Traffic Incident (Denial of Access – Man-made Disaster) | 1 – Insignificant | 3 – Moderate | 1 – Insignificant | 2 – Minor | 3 – Moderate | 2 – Minor | 1 – Insignificant | 3 – Operations; Social Responsibility |
| Infectious Disease Outbreak (Unavailability of People) | 3 – Moderate | 4 – Major | 4 – Major | 4 – Major | 5 – Severe | 5 – Severe | 2 – Minor | 5 – Social Responsibility; People |
| Mass Staff Illness (Unavailability of People) | 2 – Minor | 4 – Major | 3 – Moderate | 3 – Moderate | 4 – Major | 4 – Major | 1 – Insignificant | 4 – Operations; Social Responsibility; People |
| Loss of Key Personnel (Unavailability of People) | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 3 – Moderate | 3 – Moderate | 2 – Minor | 3 – Operations; Legal and Regulatory; Reputation and Image; Social Responsibility; People |
| High Staff Turnover and Skills Shortage (Unavailability of People) | 3 – Moderate | 4 – Major | 3 – Moderate | 3 – Moderate | 4 – Major | 4 – Major | 1 – Insignificant | 4 – Operations; Social Responsibility; People |
| Workplace Violence (Unavailability of People) | 2 – Minor | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 4 – Major | 1 – Insignificant | 4 – People |
| Mandatory Quarantine of Staff (Unavailability of People) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 4 – Major | 1 – Insignificant | 4 – People |
| Critical Supplier Failure (Disruption to the Supply Chain) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 4 – Major | 3 – Moderate | 1 – Insignificant | 4 – Social Responsibility |
| Outsourced Service Provider Failure (Disruption to the Supply Chain) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Operations; Social Responsibility |
| Medication and Medical Supply Disruption (Disruption to the Supply Chain) | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 4 – Major | 4 – Major | 2 – Minor | 4 – Social Responsibility; People |
| Telecommunications Failure (Disruption to the Supply Chain) | 1 – Insignificant | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 2 – Minor | 3 – Moderate | 3 – Operations; Social Responsibility; Assets, IT Systems and Information |
| Water and Electricity Supply Failure (Disruption to the Supply Chain) | 3 – Moderate | 4 – Major | 3 – Moderate | 3 – Moderate | 4 – Major | 4 – Major | 3 – Moderate | 4 – Operations; Social Responsibility; People |
| Banking and Payment System Disruption (Disruption to the Supply Chain) | 3 – Moderate | 2 – Minor | 2 – Minor | 2 – Minor | 2 – Minor | 1 – Insignificant | 1 – Insignificant | 3 – Finance |
| Ransomware (Equipment and IT-Related Disruption) | 4 – Major | 4 – Major | 4 – Major | 4 – Major | 4 – Major | 2 – Minor | 5 – Severe | 5 – Assets, IT Systems and Information |
| Personal Data Breach (Equipment and IT-Related Disruption) | 3 – Moderate | 2 – Minor | 5 – Severe | 5 – Severe | 4 – Major | 2 – Minor | 5 – Severe | 5 – Legal and Regulatory; Reputation and Image; Assets, IT Systems and Information |
| Network and Internet Failure (Equipment and IT-Related Disruption) | 1 – Insignificant | 3 – Moderate | 2 – Minor | 2 – Minor | 2 – Minor | 1 – Insignificant | 3 – Moderate | 3 – Operations; Assets, IT Systems and Information |
| Care Records System Failure (Equipment and IT-Related Disruption) | 2 – Minor | 4 – Major | 3 – Moderate | 3 – Moderate | 4 – Major | 3 – Moderate | 4 – Major | 4 – Operations; Social Responsibility; Assets, IT Systems and Information |
| Emergency Alarm and Nurse Call Failure (Equipment and IT-Related Disruption) | 2 – Minor | 4 – Major | 3 – Moderate | 4 – Major | 5 – Severe | 4 – Major | 3 – Moderate | 5 – Social Responsibility |
| Lift and Critical Equipment Failure (Equipment and IT-Related Disruption) | 2 – Minor | 3 – Moderate | 2 – Minor | 2 – Minor | 3 – Moderate | 3 – Moderate | 3 – Moderate | 3 – Operations; Social Responsibility; People; Assets, IT Systems and Information |
Likelihood, risk rating and expected disruption
| Threat | Risk Likelihood | Risk Rating | Risk Level | Expected Period of Disruption |
|---|---|---|---|---|
| Flash Flood (Denial of Access – Natural Disaster) | 2 – Unlikely | 3 × 2 = 6 | Moderate | 1–3 days, depending on drainage clearance and access restoration |
| Severe Storm and Strong Winds (Denial of Access – Natural Disaster) | 3 – Possible | 3 × 3 = 9 | Moderate | 4–8 hours, depending on duration of the storm and debris clearance |
| Lightning Strike (Denial of Access – Natural Disaster) | 2 – Unlikely | 3 × 2 = 6 | Moderate | 1–4 hours, depending on equipment resets and any damage to alarms |
| Extreme Heat (Denial of Access – Natural Disaster) | 3 – Possible | 3 × 3 = 9 | Moderate | 1–3 days, depending on duration of the heat episode and cooling capacity |
| Haze (Denial of Access – Natural Disaster) | 2 – Unlikely | 3 × 2 = 6 | Moderate | 1–2 weeks, depending on duration of the regional haze episode |
| Distant Earthquake Tremors (Denial of Access – Natural Disaster) | 2 – Unlikely | 2 × 2 = 4 | Very Low / Low | Less than 1 hour, depending on reassurance and precautionary inspection |
| Fire (Denial of Access – Man-made Disaster) | 2 – Unlikely | 5 × 2 = 10 | High | 1–2 weeks, depending on extent of damage and availability of alternative accommodation |
| Gas Leak (Denial of Access – Man-made Disaster) | 2 – Unlikely | 4 × 2 = 8 | Moderate | 4–8 hours, depending on isolation and clearance by the utility provider |
| Structural Failure (Denial of Access – Man-made Disaster) | 1 – Rare | 4 × 1 = 4 | Very Low / Low | More than 1 month, depending on extent of damage and approvals needed to reoccupy |
| Bomb Threat (Denial of Access – Man-made Disaster) | 2 – Unlikely | 3 × 2 = 6 | Moderate | 4–8 hours, depending on police clearance of the premises |
| Terrorism Incident Nearby (Denial of Access – Man-made Disaster) | 1 – Rare | 3 × 1 = 3 | Very Low / Low | 1–3 days, depending on police cordons and public-transport status |
| Road Closure and Major Traffic Incident (Denial of Access – Man-made Disaster) | 3 – Possible | 3 × 3 = 9 | Moderate | 1–4 hours, depending on duration of the road closure |
| Infectious Disease Outbreak (Unavailability of People) | 3 – Possible | 5 × 3 = 15 | High | 2–4 weeks, depending on speed of detection and staff availability |
| Mass Staff Illness (Unavailability of People) | 3 – Possible | 4 × 3 = 12 | High | 3–7 days, depending on availability of relief staff |
| Loss of Key Personnel (Unavailability of People) | 3 – Possible | 3 × 3 = 9 | Moderate | 1–2 weeks, depending on time to appoint or train a replacement |
| High Staff Turnover and Skills Shortage (Unavailability of People) | 4 – Likely | 4 × 4 = 16 | High | More than 1 month, depending on recruitment lead time |
| Workplace Violence (Unavailability of People) | 2 – Unlikely | 4 × 2 = 8 | Moderate | 1–4 hours, depending on speed of resolution and police response |
| Mandatory Quarantine of Staff (Unavailability of People) | 2 – Unlikely | 4 × 2 = 8 | Moderate | 1–2 weeks, depending on duration of the quarantine order |
| Critical Supplier Failure (Disruption to the Supply Chain) | 2 – Unlikely | 4 × 2 = 8 | Moderate | 1–3 days, depending on time to engage an alternative supplier |
| Outsourced Service Provider Failure (Disruption to the Supply Chain) | 3 – Possible | 3 × 3 = 9 | Moderate | 3–7 days, depending on time to mobilise a replacement provider |
| Medication and Medical Supply Disruption (Disruption to the Supply Chain) | 2 – Unlikely | 4 × 2 = 8 | Moderate | 1–3 days, depending on pharmacy and clinic availability |
| Telecommunications Failure (Disruption to the Supply Chain) | 3 – Possible | 3 × 3 = 9 | Moderate | 4–8 hours, depending on provider restoration |
| Water and Electricity Supply Failure (Disruption to the Supply Chain) | 3 – Possible | 4 × 3 = 12 | High | 8–24 hours, depending on utility restoration and backup duration |
| Banking and Payment System Disruption (Disruption to the Supply Chain) | 2 – Unlikely | 3 × 2 = 6 | Moderate | 1–3 days, depending on bank restoration |
| Ransomware (Equipment and IT-Related Disruption) | 3 – Possible | 5 × 3 = 15 | High | 1–2 weeks, depending on backup quality and restoration speed |
| Personal Data Breach (Equipment and IT-Related Disruption) | 3 – Possible | 5 × 3 = 15 | High | 1–2 weeks, depending on scope of the breach and notification timelines |
| Network and Internet Failure (Equipment and IT-Related Disruption) | 3 – Possible | 3 × 3 = 9 | Moderate | 1–4 hours, depending on vendor response time |
| Care Records System Failure (Equipment and IT-Related Disruption) | 3 – Possible | 4 × 3 = 12 | High | 1–3 days, depending on restoration time and availability of printed summaries |
| Emergency Alarm and Nurse Call Failure (Equipment and IT-Related Disruption) | 2 – Unlikely | 5 × 2 = 10 | High | 4–8 hours, depending on repair time |
| Lift and Critical Equipment Failure (Equipment and IT-Related Disruption) | 3 – Possible | 3 × 3 = 9 | Moderate | 1–3 days, depending on parts availability and contractor response |
The expected period of disruption is an estimate of how long the threat may interrupt operations in a credible scenario. It is not the Recovery Time Objective (RTO), which is the target time to resume a function, and it is not the Maximum Tolerable Period of Disruption (MTPD), which is the longest period the home can tolerate.
High and Extreme Risk Analysis
Nine threats are rated High. The table summarises the main consequences and weaknesses without repeating the full assessment. It is based on assumed controls, so the weaknesses are hypotheses for validation.
| Threat | Highest impact area | Main consequences | Likelihood driver | Expected disruption period | Most significant existing control | Principal control weakness | Urgent additional mitigation? |
|---|---|---|---|---|---|---|---|
| Fire | Operations; Social Responsibility; People | Evacuation of residents with limited mobility and loss of premises | Ignition sources in a building with many occupants | 1–2 weeks | Detection and alarm system | Evacuation of non-ambulant residents is untested at night | Yes: start within 3 months |
| Infectious Disease Outbreak | Social Responsibility; People | Illness among frail residents, restricted visits and staff absence | Communal living and frailty | 2–4 weeks | Hygiene and visitor screening | No tested outbreak plan with isolation and staffing triggers | Yes: start within 3 months |
| Mass Staff Illness | Operations; Social Responsibility; People | Reduced supervision and care capacity on shifts | Seasonal illness and reliance on a small workforce | 3–7 days | Call-out and relief roster | No defined minimum safe staffing level | Yes: start within 3 months |
| High Staff Turnover and Skills Shortage | Operations; Social Responsibility; People | Gaps in staffing, fatigue and loss of know-how | Sector-wide labour shortage | More than 1 month | Ongoing recruitment and training | Limited ability to change the external labour market | Planned programme (3–6 months) |
| Water and Electricity Supply Failure | Operations; Social Responsibility; People | Loss of cooling, lifts, water and kitchens | Reliance on external utility networks and on-site equipment | 8–24 hours | Emergency lighting and backup power | Backup duration and load coverage not verified | Yes: start within 3 months |
| Ransomware | Assets, IT Systems and Information | Loss of records, rosters and finance systems | Rising ransomware activity across sectors | 1–2 weeks | Endpoint protection and backups | Backups not proven immutable or recently restored | Yes: start within 3 months |
| Personal Data Breach | Legal and Regulatory; Reputation and Image; Assets, IT Systems and Information | Exposure of resident data and regulatory action | Sensitive data and increasing attacker interest | 1–2 weeks | Access controls and confidentiality undertakings | No rehearsed breach-notification procedure | Yes: start within 3 months |
| Care Records System Failure | Operations; Social Responsibility; Assets, IT Systems and Information | Delayed handovers and medication checks | Software faults and data corruption | 1–3 days | Backups and paper copies of medication charts | Restoration not tested and printed summaries not routine | Yes: start within 3 months |
| Emergency Alarm and Nurse Call Failure | Social Responsibility | Residents unable to summon help, especially at night | Equipment age and maintenance quality | 4–8 hours | Weekly call-bell test | No fallback when alarms fail | Yes: start within 3 months |
For 8 of the 9 High threats the proposed planned controls should start within the first three months. The remaining threat needs a longer programme because it depends on workforce changes that cannot be completed quickly.
Analysis by Impact Area
| Impact area | Threats scoring 4 or 5 | Threats scoring 5 | Threats with the highest scores (up to four) | Recurring theme |
|---|---|---|---|---|
| Finance | 3 | 0 | Fire; Structural Failure; Ransomware | Recovery and replacement costs, particularly after fire, ransomware and a personal data breach. |
| Operations | 9 | 1 | Fire; Structural Failure; Infectious Disease Outbreak; Mass Staff Illness | Loss of staff, power or records interrupting 24-hour care. |
| Legal and Regulatory | 4 | 1 | Personal Data Breach; Fire; Infectious Disease Outbreak; Ransomware | Duties under the Social Residential Homes Act 2025, incident notification and personal data protection. |
| Reputation and Image | 6 | 1 | Personal Data Breach; Fire; Structural Failure; Infectious Disease Outbreak | Public and donor confidence after incidents involving vulnerable residents or data. |
| Social Responsibility | 12 | 3 | Fire; Infectious Disease Outbreak; Emergency Alarm and Nurse Call Failure; Structural Failure | Harm to frail residents and the home's duty of care. |
| People | 11 | 2 | Fire; Infectious Disease Outbreak; Gas Leak; Structural Failure | Injury, illness, fatigue and absence of staff and residents. |
| Assets, IT Systems and Information | 5 | 2 | Ransomware; Personal Data Breach; Fire; Structural Failure | Premises damage, loss of records and system outages. |
Social Responsibility has the greatest concentration of Major or Severe scores, with 12 threats scoring 4 or 5. Several threats affect many areas simultaneously, so investment in their prevention benefits many functions at once.
Threats scoring 4 or 5 in four or more areas are: Fire, Structural Failure, Infectious Disease Outbreak, Ransomware, Personal Data Breach, Emergency Alarm and Nurse Call Failure. Dependencies can amplify consequences: shared reliance on power, records, relief staff and the managing agent means that one failure can spread. Some impacts emerge after a delay, such as regulatory scrutiny after a data breach or fatigue after a prolonged staffing shortfall, and some continue after operations resume, such as reputational damage and recovery costs. This view helps decide where to invest across functions, for example in a single resilient power and records solution rather than separate fixes.
Likelihood and Expected Disruption Analysis
- Highest likelihood: High Staff Turnover and Skills Shortage.
- Low likelihood but severe consequences (likelihood 2 or lower, highest impact 4 or 5): Fire, Gas Leak, Structural Failure, Workplace Violence, Mandatory Quarantine of Staff, Critical Supplier Failure, Medication and Medical Supply Disruption, Emergency Alarm and Nurse Call Failure.
- Short, intense disruption (up to 8 hours): 10 threats, including Severe Storm and Strong Winds, Lightning Strike, Distant Earthquake Tremors, Gas Leak.
- Capable of prolonged disruption (2 weeks or more): Structural Failure, Infectious Disease Outbreak, High Staff Turnover and Skills Shortage.
- Dependent on external agencies or suppliers: Water and Electricity Supply Failure, Telecommunications Failure, Medication and Medical Supply Disruption, Critical Supplier Failure, Outsourced Service Provider Failure.
- Expected disruption beyond the Corporate MTPD of 2 hours: 29 of 30 threats. For these, the home cannot wait for recovery and needs alternatives, such as relief staff, backup power or manual procedures.
- Early warning is most useful for: Flash Flood, Severe Storm and Strong Winds, Extreme Heat, Haze, Infectious Disease Outbreak.
- Scenario-specific response and recovery plans are advised for the 9 High threats.
A threat with moderate likelihood can still need urgent attention when the consequences are severe or the disruption would be prolonged. Infectious disease outbreak is rated Possible, but the harm to frail residents and the length of disruption justify early action. Equally, structural failure and fire are rated Rare or Unlikely, yet their severity means they should not be dismissed.
Risk prioritisation
Threats are ranked by risk level, then rating, then severity of legal, safety or social consequences, then expected disruption period. Structural failure is rated Very Low or Low because it is rare, but its consequences are severe, so it is placed immediately after the High threats and flagged for further assessment rather than ranked on its number alone.
| Priority Rank | Threat | Highest Impact Area | Likelihood | Risk Rating | Risk Level | Expected Disruption Period | Recommended Management Response |
|---|---|---|---|---|---|---|---|
| 1 | High Staff Turnover and Skills Shortage | Operations; Social Responsibility; People | 4 – Likely | 16 | High | More than 1 month | Detailed Business Continuity Strategy (BCS) |
| 2 | Infectious Disease Outbreak | Social Responsibility; People | 3 – Possible | 15 | High | 2–4 weeks | Crisis Management scenario development |
| 3 | Personal Data Breach | Legal and Regulatory; Reputation and Image; Assets, IT Systems and Information | 3 – Possible | 15 | High | 1–2 weeks | Detailed BCS |
| 4 | Ransomware | Assets, IT Systems and Information | 3 – Possible | 15 | High | 1–2 weeks | IT Disaster Recovery enhancement |
| 5 | Mass Staff Illness | Operations; Social Responsibility; People | 3 – Possible | 12 | High | 3–7 days | Detailed BCS |
| 6 | Care Records System Failure | Operations; Social Responsibility; Assets, IT Systems and Information | 3 – Possible | 12 | High | 1–3 days | IT Disaster Recovery enhancement |
| 7 | Water and Electricity Supply Failure | Operations; Social Responsibility; People | 3 – Possible | 12 | High | 8–24 hours | Immediate mitigation |
| 8 | Fire | Operations; Social Responsibility; People | 2 – Unlikely | 10 | High | 1–2 weeks | Immediate mitigation |
| 9 | Emergency Alarm and Nurse Call Failure | Social Responsibility | 2 – Unlikely | 10 | High | 4–8 hours | Immediate mitigation |
| 10 | Structural Failure | Finance; Operations; Reputation and Image; Social Responsibility; People; Assets, IT Systems and Information | 1 – Rare | 4 | Very Low / Low | More than 1 month | Further assessment |
| 11 | Loss of Key Personnel | Operations; Legal and Regulatory; Reputation and Image; Social Responsibility; People | 3 – Possible | 9 | Moderate | 1–2 weeks | Detailed BCS |
| 12 | Outsourced Service Provider Failure | Operations; Social Responsibility | 3 – Possible | 9 | Moderate | 3–7 days | Supplier continuity assurance |
| 13 | Extreme Heat | Social Responsibility; People | 3 – Possible | 9 | Moderate | 1–3 days | Detailed BCS |
| 14 | Lift and Critical Equipment Failure | Operations; Social Responsibility; People; Assets, IT Systems and Information | 3 – Possible | 9 | Moderate | 1–3 days | Detailed BCS |
| 15 | Telecommunications Failure | Operations; Social Responsibility; Assets, IT Systems and Information | 3 – Possible | 9 | Moderate | 4–8 hours | Supplier continuity assurance |
| 16 | Road Closure and Major Traffic Incident | Operations; Social Responsibility | 3 – Possible | 9 | Moderate | 1–4 hours | Risk acceptance approval |
| 17 | Severe Storm and Strong Winds | Assets, IT Systems and Information | 3 – Possible | 9 | Moderate | 4–8 hours | Risk acceptance approval |
| 18 | Network and Internet Failure | Operations; Assets, IT Systems and Information | 3 – Possible | 9 | Moderate | 1–4 hours | Detailed BCS |
| 19 | Mandatory Quarantine of Staff | People | 2 – Unlikely | 8 | Moderate | 1–2 weeks | Detailed BCS |
| 20 | Critical Supplier Failure | Social Responsibility | 2 – Unlikely | 8 | Moderate | 1–3 days | Supplier continuity assurance |
| 21 | Medication and Medical Supply Disruption | Social Responsibility; People | 2 – Unlikely | 8 | Moderate | 1–3 days | Supplier continuity assurance |
| 22 | Gas Leak | People | 2 – Unlikely | 8 | Moderate | 4–8 hours | Detailed BCS |
| 23 | Workplace Violence | People | 2 – Unlikely | 8 | Moderate | 1–4 hours | Detailed BCS |
| 24 | Haze | Social Responsibility; People | 2 – Unlikely | 6 | Moderate | 1–2 weeks | Risk acceptance approval |
| 25 | Flash Flood | Operations; Social Responsibility; People; Assets, IT Systems and Information | 2 – Unlikely | 6 | Moderate | 1–3 days | Routine monitoring |
| 26 | Bomb Threat | Operations; Reputation and Image; Social Responsibility; People | 2 – Unlikely | 6 | Moderate | 4–8 hours | Routine monitoring |
| 27 | Banking and Payment System Disruption | Finance | 2 – Unlikely | 6 | Moderate | 1–3 days | Supplier continuity assurance |
| 28 | Lightning Strike | Operations; Assets, IT Systems and Information | 2 – Unlikely | 6 | Moderate | 1–4 hours | Routine monitoring |
| 29 | Distant Earthquake Tremors | Operations; Social Responsibility; People; Assets, IT Systems and Information | 2 – Unlikely | 4 | Very Low / Low | Less than 1 hour | Risk acceptance approval |
| 30 | Terrorism Incident Nearby | Operations; Reputation and Image; Social Responsibility; People | 1 – Rare | 3 | Very Low / Low | 1–3 days | Routine monitoring |
Management validation
- Ask threat owners and function owners to review the scores and the assumptions behind them.
- Seek specialist input from information technology, security, facilities, human resources and procurement on control strength.
- Confirm whether the existing controls exist, are tested and would work during the disruption.
- Compare the scores with incident logs, exercise results and available threat intelligence.
- Validate financial assumptions and confirm the legal and regulatory consequences with the managing agent and advisers.
- Allow Enterprise Risk Management and Business Continuity Management (BCM) specialists to challenge the scores before senior management approves them.
- Record any disagreements or overrides and the reason for them.
- Reassess at least annually and after incidents, exercises or major changes, such as a change in licence conditions or service model.
The final scores should be approved through the risk governance process of the managing agent and aligned to the home's risk appetite.
Conclusion
Impact and likelihood assessment turns the Threat Register into prioritised risk information. Considering seven impact areas shows the full reach of an event, and using the highest impact with likelihood produces a rating that can be compared across threats. The numbers support professional judgement and do not replace it. Of the 30 threats, 9 are rated High, and these, together with the rare but severe threats, should drive mitigation and continuity investment in BCS, crisis management and information technology disaster recovery. Scores must be reviewed as threats, controls and conditions change. An effective RAR shows not only which threats may occur but also the scale of their consequences, their credible likelihood and the period for which they could disrupt the essential services of JHA.
Next step: have risk owners validate these scores, then continue to Chapter 6, Mitigation Strategies for Jamiyah Home for the Aged.
