---
title: "[BCM] [SAESL] [E1] [C9] Chapter 9: Assessing Risks and Threats for Singapore Aero Engine Services Private Limited"
description: How SAESL can assess risks of disruption under ISO 22301 clause 8.2.3, with rating scales, a risk matrix, a worked example and a sample risk register.
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Building Resilient Operations: Implementing Business Continuity Management at SAESL
![\[BB\] \[SAESL\] \[9\] Jet Engine Inspection in Hangar](https://blog.bcm-institute.org/hs-fs/hubfs/SAESL%20Graphic%20Folder/BB%20SAESL/%5BBB%5D%20%5BSAESL%5D%20%5B9%5D%20%20Jet%20Engine%20Inspection%20in%20Hangar.png?width=1536&height=1024&name=%5BBB%5D%20%5BSAESL%5D%20%5B9%5D%20%20Jet%20Engine%20Inspection%20in%20Hangar.png "[BB] [SAESL] [9] Jet Engine Inspection in Hangar")
# \[BCM\] \[SAESL\] \[E1\] \[C9\] Chapter 9: Assessing Risks and Threats for Singapore Aero Engine Services Private Limited
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9d0ea0f-9f66-4232-97e2-6be3fe001e05)
This chapter explains how SAESL should identify, analyse, evaluate and prioritise the risks of disruption to its prioritised activities and the resources they depend on. It aligns the method with ISO 22301:2019, the expectations of the Civil Aviation Authority of Singapore (CAAS), and other applicable requirements in Singapore. It builds a threat landscape suited to an aero engine maintenance, repair and overhaul (MRO) organisation, provides rating scales and a risk matrix, works one risk through from start to finish, and closes with an illustrative risk register extract in Table 9.
Risk assessment does not stand alone. It works alongside the business impact analysis (BIA) described in Chapter 10: the BIA tells SAESL what matters most and how quickly it must be restored, while the risk assessment tells SAESL what could go wrong and how to reduce the chance or effect of it happening. Together, they provide the evidence on which the continuity strategies and plans in eBooks 2 and 3 will be built.
[![\[Logo\] \[BCM\] Certification Transparent](https://no-cache.hubspot.com/cta/default/3893111/7789ece9-0b11-4cae-9f32-d34d7eb1688a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7789ece9-0b11-4cae-9f32-d34d7eb1688a)
[Moh Heng Goh](https://blog.bcm-institute.org/bcm-v2/author/moh-heng-goh) Nov 14, 2026
## Introduction
Every organisation faces events that could interrupt its work. What separates a resilient organisation from a fragile one is not the absence of threats but a clear, shared understanding of which threats matter most, how likely they are, what they would do, and what is being done about them. For Singapore Aero Engine Services Private Limited (SAESL), whose work keeps Rolls-Royce Trent-powered aircraft flying for customers on six continents, that understanding is essential.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9d0ea0f-9f66-4232-97e2-6be3fe001e05)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a4fa9f02-e184-43b1-8a52-230bf302dd76)
[![\[BCM\] \[SAESL\] \[E1\] \[C9\] Assessing Risks and Threats](https://no-cache.hubspot.com/cta/default/3893111/3b86a4aa-c09b-42b3-a7b9-7c160f07ecec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3b86a4aa-c09b-42b3-a7b9-7c160f07ecec)This chapter explains how SAESL should identify, analyse, evaluate and prioritise the risks of disruption to its prioritised activities and the resources they depend on. It aligns the method with ISO 22301:2019 and the expectations of the Civil Aviation Authority of Singapore (CAAS), as well as other applicable requirements in Singapore. It builds a threat landscape suited to an aero engine maintenance, repair and overhaul (MRO) organisation, provides rating scales and a risk matrix, works one risk through from start to finish, and closes with an illustrative risk register extract in Table 9.
Risk assessment does not stand alone. It works alongside the business impact analysis (BIA) described in Chapter 10: the BIA tells SAESL what matters most and how quickly it must be restored, while the risk assessment tells SAESL what could go wrong and how to reduce the chance or effect of it happening. Together they provide the evidence on which the continuity strategies and plans in eBooks 2 and 3 will be built.
## Regulatory and Governance Expectations
### CAAS and airworthiness
CAAS approves SAESL as a maintenance organisation under Singapore Airworthiness Requirements Part 145 (SAR-145) \[verify current amendment\]. The airworthiness rules concern how maintenance is performed, controlled, recorded, and certified. They apply in full during a disruption. The risk assessment should therefore treat any threat that could compromise maintenance standards, tooling control, records or certifying staff as a regulatory risk as well as an operational one.
There does not appear to be a CAAS requirement that obliges an approved maintenance organisation to operate a business continuity management system (BCMS) to ISO 22301. SAESL should confirm this with its quality function. Where no formal BCM rule applies, SAESL can treat ISO 22301 as a benchmark and integrate its risk assessment with the safety management system that aviation regulators expect approved maintenance organisations to operate under the International Civil Aviation Organization's (ICAO) safety management framework \[verify how CAAS applies this to SAESL\].
The 12 other authorities that approve SAESL, including the FAA, EASA and CAAC, impose their own conditions. A threat that affects SAESL's ability to meet any one of them could restrict its ability to serve customers in that jurisdiction.
### Cyber, data and third parties
Singapore's Cybersecurity Act 2018 imposes specific duties on owners of designated critical information infrastructure, and aviation is one of the sectors concerned. SAESL is unlikely to be such an owner, but it should verify its status and, in any case, recognise that its customers and partners may be. The Personal Data Protection Act requires organisations to notify the Personal Data Protection Commission and affected individuals of certain data breaches within set timeframes \[verify thresholds and timing\]. A cyber incident that exposes staff or customer data is therefore both a legal and an operational risk.
SAR-145 places conditions on maintenance that an approved organisation subcontracts to others \[verify\]. Where SAESL relies on outside providers for specialist processes, logistics, IT or facilities, the risk assessment should consider whether a failure at that provider could affect compliance as well as capacity.
### Workplace safety
The Workplace Safety and Health Act places duties on employers to protect people at work. Threats such as fire, hazardous substances, heat stress or haze affect staff safety directly, and must be assessed with that duty in mind.
### Board and senior management oversight
As a joint venture between Rolls-Royce Plc and SIA Engineering Company (SIAEC), SAESL is likely to report risk through its own board and, in some form, to both shareholders. The risk assessment should produce outputs suitable for that oversight: a concise summary of the highest risks, the treatments proposed, and any residual risks that require formal acceptance by senior management.
## Aligning with ISO 22301
### Clause 8.2.3 and clause 6.1 are different
ISO 22301 contains two kinds of risk requirements, and confusing them is one of the most common audit findings.
Clause 6.1 concerns risks and opportunities to the BCMS itself: anything that could stop the management system from achieving its intended outcomes. Examples for SAESL might include a lack of management time for BIA workshops, loss of the BCM coordinator, or a change in scope after a reorganisation.
Clause 8.2.3 concerns risks of disruption to the organisation's prioritised activities and the resources they need: fire, cyber attack, supplier failure, pandemic and so on. This chapter is about clause 8.2.3. In paraphrase, it requires SAESL to implement and maintain a process that identifies the risks of disruption to its prioritised activities and their required resources, analyses and evaluates those risks, and determines which require treatment.
### Links to the BIA and to strategy
Clause 8.2.2 (BIA) identifies SAESL's prioritised activities, their timeframes and the resources they depend on. The risk assessment takes those activities and resources as its starting point. Clause 8.3 then requires SAESL to select business continuity strategies and solutions that address both the BIA's requirements and the risk assessment's findings. In simple terms: the BIA says what to protect, the risk assessment says what to protect it from, and the strategy says how.
### Supporting guidance
ISO 31000:2018 provides general guidance on risk management. Its process of establishing context, identifying, analysing, evaluating and treating risk, supported by communication and review, fits naturally with clause 8.2.3. Using ISO 31000 language also helps SAESL connect its BCM risk work to any enterprise risk management framework its shareholders use.
## Setting Scope, Criteria and Appetite
Before identifying risks, SAESL should agree three things.
**Scope:** the activities, sites and resources the assessment covers. This should match the BCMS scope agreed in Chapter 8. If SAESL begins with engine overhaul and the engine test facility, the first risk assessment should focus there and extend as the scope grows.
**Risk criteria:** the scales used to rate likelihood and impact, and the thresholds that decide what needs treatment. The sample scales later in this chapter offer a starting point.
**Risk appetite:** the level of risk senior management is willing to accept. For example, SAESL's leadership might decide that any risk with a potential impact on airworthiness or staff safety must be treated regardless of likelihood, while lower commercial risks can be accepted if they fall in the medium band. Wherever possible, these criteria should align with the risk framework SAESL already uses, so BCM risks can be reported alongside other business risks rather than in a separate silo.
## Identifying Threats and Vulnerabilities
Risk identification should work through the resources that each prioritised activity depends on, as recorded in the BIA. Asking "what could take this resource away?" for each one is more thorough than starting from a generic list of hazards.
- **People:** certifying engineers, test cell operators, Centre of Excellence specialists, planners and quality staff.
- **Premises:** overhaul shops, repair cells, the engine test facility, warehouses and offices.
- **Equipment:** gantries, test cell systems, inspection systems and specialist repair tooling.
- **Technology and information:** maintenance planning and records systems, engineering data, customer status reporting and the networks connecting them.
- **Suppliers and partners:** parts and materials, specialist subcontractors, logistics, utilities and IT providers.
For each resource, the team records the threats that could affect it and the vulnerabilities that would worsen the effect. For example, SAESL might find that its maintenance records system is threatened by ransomware, and that a vulnerability exists if backups are connected to the same network as the live system.
### Single points of failure, concentration and dependencies
Three patterns deserve particular attention.
**Single points of failure** are resources whose loss would halt an activity because no alternative exists. The engine test facility is the clearest example at SAESL: every overhauled engine must pass through it, and a test cell of this scale cannot be replaced quickly.
**Concentration risk** arises when many activities depend on one site, system, supplier or small group of people. If, for example, most of SAESL's component repair capability sat in one building, a single fire could affect several Centres of Excellence at once.
**Group and shared-service dependencies** arise because SAESL works within the Rolls-Royce Trent ecosystem and alongside its shareholders. For example, SAESL might rely on Rolls-Royce for engine design data, approved repair schemes and parts, and might share some services with SIAEC. A disruption at either partner could reach SAESL even if SAESL's own operations were untouched. The risk assessment should record these dependencies explicitly and ask what assurance SAESL has about each partner's own continuity arrangements.
## SAESL's Threat Landscape
The threats below are weighted towards those most relevant to an aero engine MRO organisation in Singapore. Precedents are included where they exist.
### Cyber attacks, ransomware and technology failure
For a modern MRO, the maintenance records system is as essential as any tool on the shop floor. Without records, work cannot be certified, and engines cannot be released. Ransomware that encrypts planning and records systems would therefore stop work as effectively as a fire, and recovery could take weeks if backups were also affected.
Technology failure need not be malicious. On 19 July 2024, a faulty software update from the security firm CrowdStrike disrupted Windows systems worldwide. At Changi Airport, the Ministry of Transport reported that 108 departing flights were delayed by more than 30 minutes, and airlines and ground handlers switched to manual check-in under their continuity plans. The event showed how a single shared supplier can disrupt many organisations at once. SAESL should ask which of its own critical systems depend on widely used third-party software or cloud services, and how it would operate if they failed simultaneously.
### Failure of critical equipment
The engine test facility can test engines up to 140 inches in diameter and 150,000 lbf of thrust. Fire, structural damage or a major control system failure there would stop deliveries of overhauled engines. Specialist repair equipment in the Centres of Excellence, such as systems supporting fan blade or combustion liner repair, may also be difficult to replace quickly.
### Disruption at suppliers and in the OEM ecosystem
Overhaul depends on a steady flow of life-limited parts, materials and approved repair data. Delays in the aerospace supply chain directly lengthen turnaround times. Technical issues in the wider fleet can also reshape demand suddenly. In 2018, problems with intermediate pressure compressor blades on some Trent 1000 engines led the FAA and EASA to require additional inspections; dozens of Boeing 787s were grounded, and Rolls-Royce reported tripling maintenance capacity for affected engines. For an MRO, such events can create a surge in work that exposes any weakness in capacity.
### Natural hazards
Singapore is free of earthquakes and typhoons but is exposed to intense rainfall, lightning, heat and transboundary haze. In June 2010, about 100 mm of rain in two hours, combined with a partly blocked drain, flooded Orchard Road and some basements. Further flash floods have occurred since, including record rainfall in parts of the island in 2021. In September 2015, haze from regional fires pushed the Pollutant Standards Index into the hazardous range, and the government closed all primary and secondary schools for a day. For SAESL, flooding could affect warehouses, basements and site access, while haze and heat affect outdoor work and staff wellbeing. ISO 22301 Amendment 1:2024 also asks SAESL to consider whether climate change makes such hazards more relevant over time.
### Pandemics, transport and telecommunications
COVID-19 showed that a pandemic can affect both the workforce and demand. In March 2020, Changi handled about 70.7% fewer passengers than a year earlier. Border closures affected the movement of engines, parts and visiting specialists. Smaller disruptions, such as public transport breakdowns or telecommunications outages, can also prevent shift staff from reaching site or stop communications with customers.
### Loss of key personnel and scarce skills
SAESL's specialist skills, particularly certifying authority and Centre of Excellence expertise, take years to build. The sudden loss of a small number of people through illness, resignation or an incident could constrain certain capabilities for months.
### Regulatory, legal and reputational shocks
Because SAESL's ability to work depends on its approvals, a serious audit finding that led an authority to suspend or limit an approval would be a major disruption in its own right. A quality escape, such as an engine released with an undetected defect, could cause reputational harm, customer loss and regulatory action, even if it caused no harm in service.
### Sector-specific safety incidents
MRO work involves heavy lifting, high-energy testing, chemical processes and hazardous substances. A serious safety incident could close part of the site pending investigation, and would trigger duties under Singapore's workplace safety laws.
## Analysing Likelihood and Impact
Each identified risk is rated for likelihood and impact on five-point scales. The scales below are illustrative and should be calibrated by SAESL's leadership against its own data and risk appetite.
**Sample likelihood scale (illustrative)**
| **Score** | **Rating** | **Description** |
| --- | --- | --- |
| **1** | **Rare** | **Could occur only in exceptional circumstances; less than once in 20 years** |
| **2** | **Unlikely** | **Not expected, but possible; about once in 10 to 20 years** |
| **3** | **Possible** | **Could occur; about once in 3 to 10 years** |
| **4** | **Likely** | **Expected to occur; about once in 1 to 3 years** |
| **5** | **Almost certain** | **Expected to occur more than once a year** |
**Sample impact scale (illustrative)**
| **Score** | **Safety and airworthiness** | **Customers and turnaround** | **Regulatory approvals** | **Financial** | **Reputation** |
| --- | --- | --- | --- | --- | --- |
| **1 Minimal** | **No safety or airworthiness effect** | **Delays absorbed within planned turnaround** | **No regulatory interest** | **Below 0.5% of annual revenue** | **No external attention** |
| **2 Minor** | **Minor injury; no airworthiness effect** | **A few engines delayed by days** | **Minor finding, easily closed** | **0.5% to 1%** | **Customer complaint** |
| **3 Moderate** | **Lost-time injury; process control lapse caught internally** | **Several customers delayed by one to two weeks** | **Significant finding requiring a corrective action plan** | **1% to 3%** | **Concern raised by key customers** |
| **4 Major** | **Serious injury; non-compliant release caught before service** | **Many customers delayed by weeks; aircraft on ground** | **Restriction on part of an approval** | **3% to 10%** | **Sustained industry or media attention** |
| **5 Severe** | **Fatality or in-service airworthiness event** | **Deliveries halted for an extended period** | **Suspension of an approval** | **Above 10%** | **Loss of major customers or shareholder confidence** |
The overall impact score is the highest score across the five categories. The risk score is likelihood multiplied by impact, giving a range from 1 to 25. SAESL might band scores as follows: Low (1 to 4), Medium (5 to 9), High (10 to 14) and Very high (15 to 25).
## Risk Matrix
The matrix below shows where the illustrative risks in Table 9 fall. References R1 to R12 correspond to the rows of Table 9, and all ratings are illustrative.
| **Likelihood / Impact** | **1 Minimal** | **2 Minor** | **3 Moderate** | **4 Major** | **5 Severe** |
| --- | --- | --- | --- | --- | --- |
| **5 Almost certain** | | | | | |
| **4 Likely** | | | **R4** | | |
| **3 Possible** | | **R12** | **R3, R9** | **R5, R6** | **R2** |
| **2 Unlikely** | | | **R7** | **R8** | **R1** |
| **1 Rare** | | | | | **R10, R11** |
The pattern is typical of an MRO organisation: one very high cyber risk, several high operational risks, and a group of low-likelihood but severe-impact risks (R1, R10, R11) that need attention despite their rarity because they could halt deliveries or affect approvals.
## Evaluating Risks and Deciding on Treatment
Evaluation compares each risk's score with the agreed criteria. For SAESL, a reasonable starting rule might be:
- **Very high:** treat urgently, with a steering committee sponsor and monthly progress reports.
- **High:** treat within the current planning cycle, with a named owner.
- **Medium:** treat where cost-effective; otherwise monitor and review annually.
- **Low:** accept and monitor.
An override should apply to any risk with an impact of 5 on safety, airworthiness or approvals. Such risks require treatment or formal acceptance by senior management, whatever their likelihood.
ISO 31000 describes four broad treatment options.
- **Avoid:** stop the activity that creates the risk, for example by not storing critical spares in a flood-prone basement.
- **Reduce:** lower the likelihood or impact, for example by improving fire detection in the test facility or isolating backups from the live network.
- **Transfer:** share the financial effect, for example through insurance or contract terms. Transfer rarely removes the operational impact, so it should seldom be used alone.
- **Accept:** tolerate the risk, with senior management's informed agreement and a record in the register.
Risk treatment and continuity strategy meet here. Measures that reduce the impact of a disruption once it has happened, such as alternative testing arrangements or manual workarounds, are business continuity solutions under clause 8.3. The risk register should flag these so they are taken forward into eBook 2.
## A Worked Example: Loss of the Engine Test Facility
This example follows one illustrative risk from start to finish.
**BIA context.** The BIA identifies engine testing as a prioritised activity. Every overhauled engine must pass a performance test before release. Suppose, for illustration, that the BIA finds the impact of a testing stoppage becomes severe after about two weeks, as completed engines queue and customer aircraft remain on the ground.
**Threat and vulnerability.** The threat is a fire or major failure of the test cell's structure, control systems or fuel supply. The vulnerability is that SAESL has a single test facility with no ready alternative on site.
**Existing controls.** For illustration, SAESL might already have fire detection and suppression, preventive maintenance, and trained operators.
**Inherent rating.** Taking these controls into account, the team rates likelihood as 2 (unlikely) and impact as 5 (severe), because deliveries would halt for an extended period. The score is 10, in the High band.
**Evaluation.** The risk exceeds SAESL's appetite and carries a severe impact on customers and turnaround, so it requires treatment.
**Treatment.** The team proposes a combination:
- **Reduce likelihood:** review fire protection against current standards and hold critical spares for test cell control systems.
- **Reduce impact:** explore, with Rolls-Royce and other Trent MRO providers, whether engines could be tested elsewhere in an emergency, subject to approval from CAAS and other authorities.
- **Prepare:** develop a procedure for protecting and prioritising engines awaiting test, and for notifying affected customers.
- **Transfer:** confirm that insurance covers both physical damage and business interruption.
**Residual rating.** If these measures are implemented, the team expects likelihood to fall to 1 (rare) and impact to fall to 4 (major), because alternative testing would shorten the halt. The residual score of 4 falls in the Low band. The steering committee formally accepts this residual risk and asks for the alternative testing arrangement to be exercised annually.
## Running the Assessment
Good risk assessment draws on the people who know the work. For SAESL, participants should include the BCM coordinator as facilitator, departmental BC coordinators, the heads of engine overhaul, component repair and testing, the quality manager, and representatives from IT, facilities, safety, supply chain and HR.
A practical format combines short preparatory interviews with a facilitated workshop for each service line. Interviews collect facts and concerns in private. Workshops then test and rate risks together, which builds shared ownership. The facilitator should challenge optimism, ask for evidence and record dissenting views. Workshops of two to three hours, with no more than 10 to 12 participants, tend to work best.
### Threat-identification checklist
- Fire, explosion or structural failure at each site, including the test facility
- Ransomware, malware or unauthorised access to planning, records or engineering systems
- Failure of a shared third-party software, cloud or network service
- Prolonged loss of power, water, compressed air or telecommunications
- Flash flooding, lightning, extreme heat or transboundary haze
- Pandemic or infectious disease affecting staff availability or border movement
- Public transport disruption affecting shift attendance
- Delay or failure in the supply of parts, materials or repair data
- Failure of a specialist subcontractor or logistics provider
- Fleet-wide technical issues creating a surge in demand
- Loss of certifying staff or other scarce specialists
- Suspension or restriction of a regulatory approval
- A quality escape or in-service event linked to SAESL's work
- Serious workplace safety incident or hazardous substance release
- Disruption at a shareholder or shared-service provider
## Maintaining the Risk Register
Each risk belongs in a register that records its reference, description, affected activities and resources, existing controls, inherent and residual ratings, treatment actions, owner, due dates and status. Every risk needs a named owner who is senior enough to make sure treatments happen.
The register should be reviewed in full at least once a year, as part of the management review, and whenever a significant change occurs. Examples of such changes include a new engine programme, a new building, a major IT change, a change of key supplier, or a significant event elsewhere in the industry. High and very high risks merit a quarterly progress check by the steering committee.
## Presenting Results to the Board
Senior leaders need a clear picture, not the full register. A good board or risk committee paper for SAESL would:
- Open with a one-page summary of the top five to ten risks, using the risk matrix as a visual
- Show, for each top risk, the current rating, the proposed treatment, its cost and the expected residual rating
- Ask explicitly for decisions: approval of treatments, allocation of resources and acceptance of residual risks
- Show trends since the last report, so the board can see whether exposure is rising or falling
- Identify dependencies on shareholders or partners that may need discussion at shareholder level
## Summary Table
**Table 9: Assessing Risks and Threats for Singapore Aero Engine Services Private Limited**
Illustrative risk register extract. All ratings are illustrative (likelihood × impact = score).
| **Ref** | **Threat category** | **Example scenario** | **Affected activities or resources** | **Current rating** | **Existing controls (illustrative)** | **Proposed treatment** | **ISO 22301 clause or regulatory link** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| **R1** | **Critical equipment** | **Fire or major failure in the engine test facility** | **Engine testing; release of overhauled engines** | **2 × 5 = 10 (High)** | **Fire detection and suppression; preventive maintenance** | **Critical spares; alternative testing arrangement; customer procedure** | **8.2.3; 8.3; CAAS approval conditions** |
| **R2** | **Cyber** | **Ransomware encrypts planning and maintenance records systems** | **All service lines; certification and release** | **3 × 5 = 15 (Very high)** | **Endpoint protection; backups** | **Isolated backups; restore testing; manual records procedure** | **8.2.3; PDPA; airworthiness records requirements** |
| **R3** | **Technology** | **Failure of a widely used third-party software or cloud service** | **Planning, records, customer reporting** | **3 × 3 = 9 (Medium)** | **Vendor support contracts** | **Map shared dependencies; manual workarounds** | **8.2.3; 8.3** |
| **R4** | **Supplier and OEM** | **Delay in supply of life-limited parts or repair materials** | **Engine overhaul; component repair** | **4 × 3 = 12 (High)** | **Supply planning with OEM** | **Critical parts review; supplier continuity assurance** | **8.2.3; 8.3; subcontract control** |
| **R5** | **Sector technical** | **Fleet-wide directive creates a surge beyond capacity** | **Engine overhaul; testing; specific repair lines** | **3 × 4 = 12 (High)** | **Capacity planning** | **Surge plan; prioritisation rules agreed with customers** | **8.2.3; 4.1** |
| **R6** | **Pandemic** | **Significant staff absence and border restrictions** | **All prioritised activities** | **3 × 4 = 12 (High)** | **Pandemic experience from COVID-19** | **Updated pandemic plan; cross-training; split teams** | **8.2.3; workplace safety duties** |
| **R7** | **Natural hazard** | **Flash flooding affects warehouse, basement or access** | **Stores; site access** | **2 × 3 = 6 (Medium)** | **Site drainage** | **Drainage review; relocate critical stock** | **8.2.3; 4.1 (climate change)** |
| **R8** | **Utilities** | **Prolonged power or compressed-air outage** | **Precision repair processes; testing** | **2 × 4 = 8 (Medium)** | **Utility supply agreements** | **Assess process tolerance; standby supply for critical loads** | **8.2.3; 8.3** |
| **R9** | **People** | **Loss of key certifying staff or scarce specialists** | **Certification; Centres of Excellence** | **3 × 3 = 9 (Medium)** | **Training programme** | **Succession and cross-authorisation plan** | **8.2.3; 7.2** |
| **R10** | **Regulatory** | **Suspension or restriction of an approval after audit** | **Release of work for affected jurisdiction** | **1 × 5 = 5 (Medium)** | **Quality system; internal audits** | **Regulatory change monitoring; audit readiness** | **8.2.3; CAAS and other authorities** |
| **R11** | **Quality and reputation** | **Quality escape on a released engine** | **Customer trust; approvals** | **1 × 5 = 5 (Medium)** | **Inspection and quality controls** | **Incident response and customer communication plan** | **8.2.3; 8.4** |
| **R12** | **Environmental** | **Transboundary haze or extreme heat** | **Outdoor work; staff wellbeing** | **3 × 2 = 6 (Medium)** | **Safety procedures** | **Haze and heat response procedure** | **8.2.3; 4.1 (climate change); workplace safety** |
## [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b5945536-415f-4c64-9e05-c7b4d4f26c76)
## Conclusion
Risk assessment gives SAESL a disciplined view of what could disrupt its work and what to do about it. Several points stand out. The method must address risks of disruption under clause 8.2.3, kept separate from risks to the BCMS under clause 6.1. It should start from the prioritised activities and resources identified in the BIA. It must recognise the threats that matter most to an aero engine MRO in Singapore: cyber attack on maintenance records, loss of the test facility, OEM and supply chain disruption, fleet-wide technical surges, pandemics and the effects of a changing climate. Treatment decisions should feed directly into the continuity strategies developed in eBook 2.
As immediate next steps, SAESL might:
1. Approve the risk criteria and appetite statement
2. Run risk workshops for engine overhaul and the engine test facility first
3. Build the risk register and assign owners
4. Present the top risks to the steering committee with proposed treatments
The risk assessment tells SAESL what to protect its activities from. The next chapter turns to which activities matter most.
## Sources
- [SAESL: Company profile](https://www.saesl.com.sg/about-us/company-profile/)
- [SAESL: Quality (approvals)](https://www.saesl.com.sg/about-us/quality/)
- [SAESL: Engine overhaul and test facility](https://www.saesl.com.sg/our-services/engine-overhaul/)
- [Ministry of Transport: Written reply on flights affected by the CrowdStrike outage](https://www.mot.gov.sg/news-resources/newsroom/written-reply-to-parliamentary-question-on-flights-affected-by-crowdstrike-outage-and-enhancing-resilience-of-singapore-s-air-hub-status-in-face-of-such-threats/)
- [AIN Online: Rolls-Royce steps up efforts to fix troubled Trent 1000 engines (May 2018)](https://oldain.ainonline.com/aviation-news/air-transport/2018-05-30/rolls-royce-steps-efforts-fix-troubled-trent-1000-engines)
- [Changi Airport Group: Operating indicators for March 2020](https://www.mynewsdesk.com/sg/changiairport/pressreleases/operating-indicators-for-march-2020-2991479)
- [Floods in Singapore (overview of 2010 Orchard Road flood and later events)](https://en.wikipedia.org/wiki/Floods_in_Singapore)
- [The Star: Singapore schools close as haze hits hazardous levels (September 2015)](https://thestar.com.my/news/regional/2015/09/25/singapore-schools-close-1st-time-haze)
- [ISO 22301:2019/Amd 1:2024 Climate action changes](https://www.iso.org/standard/88412.html)
**Continue reading:** Chapter 10, *Identifying Critical Business Functions for Singapore Aero Engine Services Private Limited*, shows how SAESL can determine which activities to protect and restore first.
| Building Resilient Operations: Implementing Business Continuity Management at SAESL | | | | | |
| --- | --- | --- | --- | --- | --- |
| **eBook 1: Understanding Your Organisation** | | | | | |
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** |
| [![\[BCM\] \[SAESL\] \[E1\] \[C1\] Overview of BCM Case Study](https://no-cache.hubspot.com/cta/default/3893111/450a4d77-0206-4ce4-a98f-5e71af6950da.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/450a4d77-0206-4ce4-a98f-5e71af6950da) | [![\[BCM\] \[SAESL\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/c1325405-e10a-4b33-be2d-609691a1d95a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c1325405-e10a-4b33-be2d-609691a1d95a) | [![\[BCM\] \[SAESL\] \[E1\] \[C3\] Establishing Organisational Goals](https://no-cache.hubspot.com/cta/default/3893111/f6b87584-5a0b-45ff-9668-851e889e24ea.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f6b87584-5a0b-45ff-9668-851e889e24ea) | [![\[BCM\] \[SAESL\] \[E1\] \[C4\] Establishing Business Continuity Objectives](https://no-cache.hubspot.com/cta/default/3893111/40bd7e34-edd8-4af1-934b-823c9e2d7806.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/40bd7e34-edd8-4af1-934b-823c9e2d7806) | [![\[BCM\] \[SAESL\] \[E1\] \[C5\] Determining BC Assumptions](https://no-cache.hubspot.com/cta/default/3893111/41c902ee-5f7a-4669-b54f-76e23501b7ba.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/41c902ee-5f7a-4669-b54f-76e23501b7ba) | [![\[BCM\] \[SAESL\] \[E1\] \[C6\] Composing BCM Team](https://no-cache.hubspot.com/cta/default/3893111/3a8585db-df63-44d6-b4e8-ad5d962c7b46.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3a8585db-df63-44d6-b4e8-ad5d962c7b46) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12** |
| [![\[BCM\] \[SAESL\] \[E1\] \[C7\] Analysing Operating Environment](https://no-cache.hubspot.com/cta/default/3893111/a99d7cc3-a42a-40ea-9f03-271f8bad042e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a99d7cc3-a42a-40ea-9f03-271f8bad042e) | [![\[BCM\] \[SAESL\] \[E1\] \[C8\] Implementing the BCM Planning Methodology](https://no-cache.hubspot.com/cta/default/3893111/e35d2c13-2432-42e5-9c92-3df273c4669f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e35d2c13-2432-42e5-9c92-3df273c4669f) | [![\[BCM\] \[SAESL\] \[E1\] \[C9\] Assessing Risks and Threats](https://no-cache.hubspot.com/cta/default/3893111/3b86a4aa-c09b-42b3-a7b9-7c160f07ecec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3b86a4aa-c09b-42b3-a7b9-7c160f07ecec) | [![\[BCM\] \[SAESL\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/35676644-c1ae-416d-aab0-5da1a3695a80.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/35676644-c1ae-416d-aab0-5da1a3695a80) | [![\[BCM\] \[SAESL\] \[E1\] \[C11\] Summary](https://no-cache.hubspot.com/cta/default/3893111/c8066dcf-c95f-4b06-9815-218c9dfeaf65.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c8066dcf-c95f-4b06-9815-218c9dfeaf65) | [![\[BCM\] \[SAESL\] \[E1\] \[C12\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/c14472c5-9955-453a-8bfd-806956bfdcbc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c14472c5-9955-453a-8bfd-806956bfdcbc) |
| | | | | | |
---
## **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/bcm-v2/author/moh-heng-goh"
},
"dateModified" : "2026-11-14T05:51:53.780Z",
"datePublished" : "2026-11-14T05:51:53.000Z",
"headline" : "[BCM] [SAESL] [E1] [C9] Chapter 9: Assessing Risks and Threats for Singapore Aero Engine Services Private Limited",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/bcm-v2/bcm-saesl-e1-c9-chapter-9-assessing-risks-and-threats-for-singapore-aero-engine-services-private-limited",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```