![[Logo] [BCM] Certification Transparent](https://no-cache.hubspot.com/cta/default/3893111/7789ece9-0b11-4cae-9f32-d34d7eb1688a.png)
Naming a threat is not the same as managing it. This chapter examines how Jamiyah Home for the Aged (JHA) could treat each threat in the register, which controls it is assumed to have today, and which further controls would close the gaps.
Introduction
![[BCM] [JHA] [E3] [RAR] [T2] Treatment and Control](https://no-cache.hubspot.com/cta/default/3893111/ff11418b-5bd2-4b2e-81b7-5d8591f230f4.png)
This chapter builds on the 30 threats in the Threat Register in Chapter 3 and applies the same names and order. A threat is the source of disruption. A risk treatment is the overall approach to managing the risk: avoidance, reduction, transference, or acceptance. A control is a specific measure that carries out the treatment. A threat often calls for more than one treatment, for example, reducing the likelihood of a fire while also insuring against its financial consequences.
The presence of a control does not mean the risk is adequately managed. A control must also be adequate, reliable, owned, tested and able to operate during the disruption. JHA's website does not describe its control environment, so every existing control in this chapter is assumed and requires validation. Where a gap is evident, it is translated into an additional planned control with a proposed owner, priority and timeframe. The owner roles, priorities and timeframes are illustrative proposals, and the owner roles do not imply that the home already has such a structure. The planned controls cover physical, people, supply and information technology (IT) threats. Where mentioned, risk acceptance must be approved by the correct authority, monitored, and reviewed.
Risk transference, such as insurance or outsourcing, shares financial or service consequences but does not remove the home's accountability for residents' welfare. The Social Residential Homes Act 2025 and the Code of Practice for Social Residential Homes issued by the Ministry of Social and Family Development (MSF) continue to apply, and the home's incident-notification obligations do not pass to any contractor.
Treatment and control assessment
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
|---|---|---|---|---|---|---|
|
Flash Flood |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Drainage inspection, sandbag or flood-barrier readiness and weather monitoring. Partially implemented; dependent on validation. | Property insurance for flood damage. Not evidenced. | Not evidenced. Acceptance requires approval by the managing agent's senior management once the exposure is assessed. | Weather and rainfall alert monitoring (Detective; assumed, requires validation); Routine drain and gutter clearance (Preventive; assumed, requires validation); Staff call-out and contingency roster guidance (Corrective; assumed, requires validation) | Conduct a flood-exposure survey of ground-level areas and stock flood barriers and pumps; test the arrangement in a drill. Owner: Facilities Manager. Priority: Medium. Timeframe: 3–6 months. |
| Severe Storm and Strong Winds (Denial of Access – Natural Disaster) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Tree and structure inspection, securing of loose items and weather monitoring. Partially implemented; dependent on validation. | Property insurance. Not evidenced. | Acceptance may be appropriate for minor damage within approved risk appetite, subject to approval at Superintendent level and annual review. | Weather alert monitoring (Detective; assumed, requires validation); Routine tree-trimming and structural checks (Preventive; assumed, requires validation); Indoor relocation of resident activities (Corrective; assumed, requires validation) | Add a storm-readiness checklist to the seasonal facilities plan, including securing outdoor furniture and relocating activities. Owner: Facilities Manager. Priority: Low. Timeframe: 3–6 months. |
| Lightning Strike (Denial of Access – Natural Disaster) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Lightning protection and surge protection on key circuits. Dependent on validation of inspection records. | Property and equipment insurance. Not evidenced. | Acceptance of minor equipment damage may be appropriate within approved risk appetite; approval at Superintendent level. | Building lightning protection system (Preventive; assumed, requires validation); Surge protection on electrical and alarm circuits (Preventive; assumed, requires validation); Equipment repair arrangements (Corrective; assumed, requires validation) | Obtain a certified inspection of the lightning protection and surge devices and replace any degraded components. Owner: Facilities Manager. Priority: Medium. Timeframe: 3–6 months. |
| Extreme Heat (Denial of Access – Natural Disaster) |
Partially Applicable – outdoor activities can be restricted during hot conditions. | Ventilation and cooling, hydration routines and rescheduling of outdoor activity. Partially implemented; dependent on validation. | Not Applicable. | Not appropriate for acceptance at the current exposure for vulnerable residents. | Fans and cooling in resident areas (Preventive; assumed, requires validation); Hydration rounds (Preventive; assumed, requires validation); Heat-stress observation by care staff (Detective; assumed, requires validation) | Introduce a heat-stress protocol with temperature triggers, cooling-room arrangements and extra hydration rounds. Owner: Head of Nursing and Care. Priority: High. Timeframe: 0–3 months. |
| Haze (Denial of Access – Natural Disaster) |
Partially Applicable – outdoor activities and outings can be suspended. | Air-quality monitoring, indoor activity substitution and mask availability. Dependent on validation. | Not Applicable. | Acceptance may be appropriate for short episodes within approved risk appetite, subject to monitoring. | Monitoring of national air-quality advisories (Detective; assumed, requires validation); Suspension of outdoor programmes (Corrective; assumed, requires validation); Stock of masks (Corrective; assumed, requires validation) | Define air-quality triggers for restricting outdoor activity and confirm a stock of masks and air-cleaning options. Owner: Head of Nursing and Care. Priority: Low. Timeframe: 3–6 months. |
| Distant Earthquake Tremors (Denial of Access – Natural Disaster) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Evacuation procedures and post-tremor inspection routine. Dependent on validation. | Not Applicable. | Accepted within approved risk appetite, with monitoring of regional alerts and annual review. | Evacuation plan (Directive; assumed, requires validation); Post-tremor visual inspection routine (Detective; assumed, requires validation) | Add a tremor response step to the emergency procedures, covering reassurance of residents and a structural walk-through. Owner: Safety and Security Officer. Priority: Low. Timeframe: 6–12 months. |
| Fire (Denial of Access – Man- made Disaster) |
Partially Applicable – ignition sources such as smoking and hot work can be restricted on the premises. | Detection, alarm, suppression, evacuation planning and drills. Partially implemented; dependent on validation and testing. | Property and public liability insurance. Not evidenced. | Not appropriate for acceptance at the current exposure. | Fire detection and alarm system (Detective; assumed, requires validation); Fire extinguishers and suppression equipment (Corrective; assumed, requires validation); Evacuation plan and periodic drills (Directive; assumed, requires validation) | Commission a fire risk assessment, add an evacuation plan for non-ambulant residents and run quarterly drills including night shifts. Owner: Safety and Security Officer. Priority: High. Timeframe: 0–3 months. |
| Gas Leak (Denial of Access – Man-made Disaster) |
Partially Applicable – gas use could be reduced or replaced by electric appliances where practical. | Gas isolation valves, leak detection and maintenance. Dependent on validation. | Property insurance. Not evidenced. | Not appropriate for acceptance until the gas installation is verified. | Periodic inspection of gas installations (Preventive; assumed, requires validation); Gas isolation valve (Corrective; assumed, requires validation); Emergency contact list for the gas provider (Directive; assumed, requires validation) | Confirm gas detectors and isolation valves in kitchen areas and add a gas-leak response card. Owner: Facilities Manager. Priority: Medium. Timeframe: 3–6 months. |
| Structural Failure (Denial of Access – Man-made Disaster) |
Partially Applicable – unsafe areas can be closed or relocated pending repair. | Periodic building inspection and maintenance. Dependent on validation of inspection records. | Property insurance. Not evidenced. | Acceptance requires senior management approval and is only appropriate once inspection evidence confirms building condition. | Periodic structural and façade inspection (Detective; assumed, requires validation); Maintenance and repair programme (Preventive; assumed, requires validation) | Commission a structural condition review and add a relocation plan for affected residential areas. Owner: Facilities Manager. Priority: Medium. Timeframe: 6–12 months. |
| Bomb Threat (Denial of Access – Man-made Disaster) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Bomb-threat checklist, visitor controls and evacuation procedures. Dependent on validation. | Not Applicable. | Not appropriate for acceptance at the current exposure. | Visitor registration and screening (Preventive; assumed, requires validation); Bomb-threat telephone checklist (Directive; assumed, requires validation); Evacuation plan (Corrective; assumed, requires validation) | Exercise a bomb-threat scenario and set up a nearby assembly point suitable for frail residents. Owner: Safety and Security Officer. Priority: Medium. Timeframe: 3–6 months. |
| Terrorism Incident Nearby (Denial of Access – Man-made Disaster) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Security awareness, access control and shelter-in-place procedures. Dependent on validation. | Not Applicable. | Acceptance of the residual exposure may be appropriate within approved risk appetite, subject to senior management approval and annual review. | Visitor access control (Preventive; assumed, requires validation); Security awareness briefing for staff (Directive; assumed, requires validation) | Document shelter-in-place and lockdown procedures suitable for frail residents and brief staff. Owner: Safety and Security Officer. Priority: Low. Timeframe: 6–12 months. |
| Road Closure and Major Traffic Incident (Denial of Access – Man-made Disaster) |
Partially Applicable – outings can be rescheduled. | Alternative route knowledge and flexible shift handover. Dependent on validation. | Not Applicable. | Accepted within approved risk appetite for short interruptions; reviewed annually. | Staff travel advisories (Directive; assumed, requires validation); Flexible shift handover (Compensating; assumed, requires validation) | Agree alternative delivery and ambulance access routes and record them in the site emergency plan. Owner: Facilities Manager. Priority: Low. Timeframe: 3–6 months. |
| Infectious Disease Outbreak (Unavailability of People) |
Partially Applicable – visits and group activities can be suspended during an outbreak. | Infection-control practices, vaccination encouragement, isolation space and visitor screening. Partially implemented; dependent on validation. | Not Applicable. | Not appropriate for acceptance at the current exposure. | Hand hygiene and cleaning routines (Preventive; assumed, requires validation); Visitor screening (Preventive; assumed, requires validation); Isolation arrangements for symptomatic residents (Corrective; assumed, requires validation) | Prepare an outbreak plan with isolation zones, cohorting rules, staffing triggers and personal protective equipment stock, and test it in a tabletop exercise. Owner: Infection Control Lead. Priority: High. Timeframe: 0–3 months. |
| Mass Staff Illness (Unavailability of People) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Relief roster, overtime, and redeployment from other Jamiyah services where possible. Dependent on validation. | Agency staffing agreement. Not evidenced. | Not appropriate for acceptance at the current exposure. | Call-out and relief roster (Compensating; assumed, requires validation); Staff illness reporting (Detective; assumed, requires validation) | Set minimum safe staffing levels per shift and pre-arrange relief staff from the managing agent and staffing agencies. Owner: Human Resources Lead. Priority: High. Timeframe: 0–3 months. |
| Loss of Key Personnel (Unavailability of People) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Deputising and delegation arrangements. Dependent on validation. | Not Applicable. | Not appropriate for acceptance without documented succession cover. | Deputy arrangements for key posts (Compensating; assumed, requires validation); Documented role responsibilities (Directive; assumed, requires validation) | Document succession cover and cross-train deputies for the Superintendent, nursing lead and facilities lead. Owner: Human Resources Lead. Priority: Medium. Timeframe: 3–6 months. |
| High Staff Turnover and Skills Shortage (Unavailability of People) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Recruitment, training and retention measures. Partially implemented; limited by a known sector-wide constraint. | Agency staffing agreement. Not evidenced. | Not appropriate for acceptance while safe staffing levels are at risk. | Ongoing recruitment (Preventive; assumed, requires validation); Staff training in core and soft skills (Preventive; assumed, requires validation); Overtime and agency cover (Compensating; assumed, requires validation) | Introduce a workforce-risk dashboard with vacancy and attrition triggers and a retention plan, reviewed by senior management quarterly. Owner: Human Resources Lead. Priority: High. Timeframe: 3–6 months. |
| Workplace Violence (Unavailability of People) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | De-escalation training, visitor rules and incident reporting. Dependent on validation. | Workplace injury compensation insurance. Not evidenced. | Acceptance may be appropriate only after additional controls are implemented. | Visitor registration (Preventive; assumed, requires validation); Incident reporting (Detective; assumed, requires validation); Staff training in handling difficult behaviour (Preventive; assumed, requires validation) | Provide de-escalation training and define a lone-working and panic-alarm procedure for night shifts. Owner: Head of Nursing and Care. Priority: Medium. Timeframe: 3–6 months. |
| Mandatory Quarantine of Staff (Unavailability of People) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Relief roster and health-declaration routines. Dependent on validation. | Agency staffing agreement. Not evidenced. | Not appropriate for acceptance at the current exposure. | Staff health declaration (Detective; assumed, requires validation); Relief roster (Compensating; assumed, requires validation) | Pre-agree a split-team model and relief arrangements to be activated when quarantine orders apply. Owner: Human Resources Lead. Priority: Medium. Timeframe: 3–6 months. |
| Critical Supplier Failure (Disruption to the Supply Chain) |
Partially Applicable – sole-source reliance can be avoided for essential supplies. | Buffer stock and alternative suppliers. Dependent on validation. | Supplier service-level agreements. Not evidenced. | Acceptance of short delivery delays may be appropriate within approved risk appetite. | Buffer stock of essentials (Compensating; assumed, requires validation); Approved supplier list (Preventive; assumed, requires validation) | Map critical suppliers, set minimum stock days for essentials and qualify at least one alternative supplier for each. Owner: Finance and Procurement Lead. Priority: Medium. Timeframe: 3–6 months. |
| Outsourced Service Provider Failure (Disruption to the Supply Chain) |
Partially Applicable – critical functions could be brought in-house where cost-effective. | Service-level agreements and performance reviews. Dependent on validation. | Contractual service levels with penalties. Accountability for resident care remains with the home. | Not appropriate for acceptance without contingency arrangements. | Contractual service levels (Directive; assumed, requires validation); Periodic supplier performance review (Detective; assumed, requires validation) | Add continuity clauses and exit plans to critical outsourcing contracts and identify alternate providers. Owner: Finance and Procurement Lead. Priority: Medium. Timeframe: 6–12 months. |
| Medication and Medical Supply Disruption (Disruption to the Supply Chain) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Buffer stock of key medication within regulatory limits and alternative pharmacy arrangements. Dependent on validation. | Supply arrangements with pharmacies. Not evidenced. | Not appropriate for acceptance at the current exposure. | Medication reconciliation and stock check (Detective; assumed, requires validation); Standing arrangement with pharmacy (Directive; assumed, requires validation) | Agree a secondary pharmacy and an emergency supply procedure, and set reorder points for critical medicines. Owner: Head of Nursing and Care. Priority: High. Timeframe: 0–3 months. |
| Tele- Communi- cations Failure (Disruption to the Supply Chain) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Mobile phones as a fallback and a published emergency contact list. Dependent on validation. | Provider service-level commitments. Not evidenced. | Accepted within approved risk appetite for short interruptions, reviewed annually. | Mobile phones for duty staff (Compensating; assumed, requires validation); Emergency contact list (Directive; assumed, requires validation) | Arrange a second carrier or mobile data backup and test emergency call routes. Owner: Information Technology Lead. Priority: Medium. Timeframe: 3–6 months. |
| Water and Electricity Supply Failure (Disruption to the Supply Chain) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Emergency lighting and an emergency power arrangement for critical loads. Partially implemented; dependent on testing. | Not Applicable. | Not appropriate for acceptance at the current exposure. | Emergency lighting (Corrective; assumed, requires validation); Backup power for life-safety systems (Compensating; assumed, requires validation); Water storage and bottled water stock (Compensating; assumed, requires validation) | Verify load coverage of emergency power, test it monthly under load and arrange priority refuelling and water supply contracts. Owner: Facilities Manager. Priority: High. Timeframe: 0–3 months. |
| Banking and Payment System Disruption (Disruption to the Supply Chain) |
Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Petty cash and dual-bank access. Dependent on validation. | Banking service levels. Not evidenced. | Accepted within approved risk appetite for short delays. | Petty cash float (Compensating; assumed, requires validation); Payment authorisation procedure (Directive; assumed, requires validation) | Maintain access to a second bank channel and a manual payment procedure for salaries. Owner: Finance and Procurement Lead. Priority: Low. Timeframe: 6–12 months. |
| Ransomware (Equipment and IT-Related Disruption) | Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Endpoint protection, patching, backups and staff awareness. Partially implemented; dependent on validation and testing. | Cyber insurance. Not evidenced. | Not appropriate for acceptance at the current exposure. | Endpoint protection (Preventive; assumed, requires validation); Regular backups (Recovery; assumed, requires validation); Staff phishing awareness (Preventive; assumed, requires validation) | Introduce offline immutable backups, multi-factor authentication and an annual restore test. Owner: Information Technology Lead. Priority: High. Timeframe: 0–3 months. |
| Personal Data Breach (Equipment and IT-Related Disruption) | Partially Applicable – unnecessary personal data collection and retention can be avoided. | Access controls, confidentiality undertakings and secure storage. Dependent on validation. | Cyber insurance. Not evidenced. | Not appropriate for acceptance at the current exposure. | Role-based access to records (Preventive; assumed, requires validation); Confidentiality undertakings (Directive; assumed, requires validation); Locked storage for paper records (Preventive; assumed, requires validation) | Appoint a data protection lead, run an access review and prepare a breach-notification procedure. Owner: Data Protection Lead. Priority: High. Timeframe: 0–3 months. |
| Network and Internet Failure (Equipment and IT-Related Disruption) | Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Paper forms and mobile phones as workarounds. Dependent on validation. | Provider service-level commitments. Not evidenced. | Accepted within approved risk appetite for short interruptions. | Paper downtime forms (Compensating; assumed, requires validation); Support contract with IT vendor (Corrective; assumed, requires validation) | Test paper downtime procedures and add a secondary internet connection for the office. Owner: Information Technology Lead. Priority: Medium. Timeframe: 3–6 months. |
| Care Records System Failure (Equipment and IT-Related Disruption) | Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Periodic backup and paper copies of critical information. Dependent on validation. | Vendor support agreement. Not evidenced. | Not appropriate for acceptance until downtime procedures are validated. | Backup of records (Recovery; assumed, requires validation); Paper copy of medication charts (Compensating; assumed, requires validation) | Print a daily emergency resident summary and test restoration of the records system. Owner: Information Technology Lead. Priority: High. Timeframe: 0–3 months. |
| Emergency Alarm and Nurse Call Failure (Equipment and IT-Related Disruption) | Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Maintenance and weekly alarm checks. Dependent on validation. | Maintenance contract. Not evidenced. | Not appropriate for acceptance at the current exposure. | Weekly call-bell test (Detective; assumed, requires validation); Maintenance contract for alarm systems (Preventive; assumed, requires validation); Night-time rounding (Compensating; assumed, requires validation) | Introduce hourly rounding when alarms are down and hold spare portable call devices. Owner: Safety and Security Officer. Priority: High. Timeframe: 0–3 months. |
| Lift and Critical Equipment Failure (Equipment and IT-Related Disruption) | Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required. | Preventive maintenance and service contracts. Dependent on validation. | Maintenance and warranty contracts. Not evidenced. | Accept short outages within the approved risk appetite. | Preventive maintenance schedule (Preventive; assumed, requires validation); Service contract with response times (Corrective; assumed, requires validation) | Hold critical spares, record service response times, and define a resident-movement plan during lift outages. Owner: Facilities Manager. Priority: Medium. Timeframe: 3–6 months. |
What the assessment shows
Avoidance is rarely realistic. For 20 of the 30 threats, the threat cannot be fully avoided, and for 10 it can be partly avoided, for example by suspending outdoor activities in hot conditions or by avoiding sole-source dependence on suppliers. Reduction is therefore the dominant approach, which is why the table concentrates on preparedness. Acceptance is not appropriate at the current exposure for 16 threats, so do not assume acceptance until the controls have been validated.
| Priority | Number of planned controls | Proposed timeframes (number of controls) |
|---|---|---|
| High | 11 | 0–3 months: 10; 3–6 months: 1 |
| Medium | 13 | 3–6 months: 11; 6–12 months: 2 |
| Low | 6 | 3–6 months: 3; 6–12 months: 3 |
There are 30 planned controls, one per threat, with 11 at high priority, 13 at medium priority and 6 at low priority. 8 proposed functional roles own them: Data Protection Lead, Facilities Manager, Finance and Procurement Lead, Head of Nursing and Care, Human Resources Lead, Infection Control Lead, Information Technology Lead, and Safety and Security Officer. The controls are specific and testable, and each one should be tracked with a named owner, a completion date and evidence of completion.
Next steps for validation
- Confirm which existing controls are in place, and gather evidence such as inspection certificates, test records and contracts.
- Assess whether each control is tested, resourced and able to operate during the disruption.
- Confirm or change the proposed owners, priorities and timeframes with the managing agent's senior management.
- Document any risk acceptance, with the approving authority, review frequency and the trigger for reconsideration.
Conclusion
Treatment and control analysis shows where the home's defences rest on assumptions and where they are most likely to fail under pressure. It prepares the ground for Chapter 5, which scores the likelihood and impact of each threat using the existing controls as the basis, and for the mitigation strategies in Chapter 6. Because the existing controls are assumed and unvalidated, the next step is to test them and record evidence so the later scores are grounded in what the home can actually do.
Next step: validate the existing controls with their owners and agree the planned controls, then continue to Chapter 5, Risk Impact and Likelihood Assessment for Jamiyah Home for the Aged.
