[BCM] [SAESL] [E2] [C3] Risk Analysis and Review Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

Introduction

Singapore Aero Engine Services Private Limited (SAESL) depends on specialised people, precise equipment, a steady flow of parts and the trust of airlines and aviation authorities. Each of these can be disrupted in different ways. The Risk Analysis and Review (RAR) phase helps SAESL decide which of those disruptions deserve attention first.

Chapter 2 sets up the BCM project. This chapter covers the second phase of the planning methodology and relates to the risk assessment requirements of ISO 22301. It follows four steps: identifying, assessing and mitigating risks, then reviewing them continuously. All risk ratings and examples are illustrative until SAESL confirms them.

Step 1: Identifying Risks

Identification recognises the potential threats that could disrupt operations. The BCM team looks at the causes of disruption and at the activities and resources that a disruption would affect. It draws on the operating environment analysed in eBook 1, on workshops with business units, and on incidents that have affected similar organisations.

For an engine MRO organisation, the threats fall into several groups. For example, SAESL might list the following, and give each a reference code so that later chapters can refer to it consistently.

• R1, Parts supply interruption: delay or loss of engine parts and materials from the Trent supply chain.
• R2, Test facility failure: loss of the in-house engine test facility needed to test overhauled engines.
• R3, Cyber incident: an attack that disables engineering systems or exposes data.
• R4, Information system outage: failure of the systems that hold work scopes, records and status reports.
• R5, Loss of approval: suspension or restriction of an aviation authority approval.
• R6, Loss of skilled people: a pandemic, mass absence or loss of certifying and specialist staff.
• R7, Premises damage or utility failure: fire, flood, or the loss of power or compressed air services.
• R8, Supplier or sub-contractor failure: insolvency or quality failure of a vendor.
• R9, Logistics disruption: delay in moving engines and components between SAESL and its customers.
• R10, Extreme weather: severe rain or heat affecting staff, sites or transport.

Clause 4 of ISO 22301 asks the organisation to understand its context. For SAESL, R1 and R2 are the most distinctive, because they relate directly to its role as a Trent engine specialist and the facilities that role requires.

Step 2: Assessing Risks

Assessment evaluates the likelihood and impact of each risk. A common method scores both on a scale of one to five and multiplies the results. The BCM team should define what each score means so that different business units rate risks the same way.

For example, SAESL might define an impact score of five as a disruption that would stop engine deliveries for several weeks or put an approval at risk, and a score of one as a disruption absorbed within normal operations. Likelihood scores might range from "not expected within ten years" to "expected within the year".

The assessment looks at a risk as it stands today, taking existing controls into account. This is the residual risk. The team compares it with the level that SAESL's management is prepared to accept, which is the risk appetite. Anything above that level moves to the next step.

Step 3: Mitigating Risks

Mitigation implements controls to reduce risks to an acceptable level. There are four standard responses: avoid the risk, reduce it, share it or accept it. Most continuity risks are reduced or shared.

For example, SAESL might reduce R3 through access control, backup and monitoring, and share part of R7 through insurance. It might reduce R1 by qualifying more than one source for critical parts where the engine manufacturer permits. Whenever a control is added, the BCM team records who owns it, when it will be in place and how its effect will be checked.

Some risks cannot be fully reduced. These remain as residual risks and are the reason business continuity strategies and plans exist. The strategies appear in Chapter 5 and the plans in Chapter 6.

Step 4: Continuous Review

A risk profile ages quickly. A new customer, a new engine variant, a supplier change, or a new regulation can all alter the picture. Continuous review updates the profile in response to changes in the business environment.

SAESL might review its risk register at fixed intervals, for example every year, and also whenever a defined trigger occurs. Typical triggers include a major incident, a new facility or process, a change in an approval and a significant change in the supply chain. Each review should record what changed, who decided, and which plans need updating. Chapter 8 returns to review as part of programme management.

Running the Risk Workshops

The quality of a risk register depends on who is in the room. The BCM coordinator should invite people who understand the daily work, such as shop floor supervisors, planners, buyers and information technology staff, as well as unit heads. Each group sees different threats. A buyer may know that a single supplier provides a critical part, while a supervisor may know that one specialist carries out a certain repair.

The workshop should also ask what has already gone wrong, including near misses. For example, SAESL might ask each unit to describe the last time a delay, failure, or absence disrupted work, and what stopped it from getting worse. The answers show real weaknesses and real strengths, and they are more convincing to management than general lists of threats.

Requirements Specific to SAESL

SAESL operates under the oversight of the Civil Aviation Authority of Singapore (CAAS) and other authorities, and its approvals are central to its business. The risk phase should therefore treat compliance risk as a core category, not as an afterthought. This means recording how each risk could affect SAESL's ability to maintain approvals, retain records and release work.

The risk work should also connect to the safety management system (SMS) that CAAS expects, so the two registers do not contradict each other. For example, SAESL might agree that safety risks stay in the SMS register, while continuity impacts of the same events are logged in the BCM register with a cross-reference.

Summary Table

Table 3: Risk Analysis and Review Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

All SAESL-specific entries are illustrative and must be confirmed by SAESL.

Conclusion

The risk phase gives SAESL a structured view of what could go wrong and how serious each threat would be. Clear definitions, named owners and regular review keep the register useful. Compliance risk deserves its own place, because SAESL's approvals are as important as its equipment.

The next chapter turns to the business impact analysis, which measures what disruption would cost each critical business function over time.

Continue reading: Chapter 4, Business Impact Analysis Phase for Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited, shows how SAESL rates the impact of disruption on its 25 critical business functions.

Building Resilient Operations: Implementing Business Continuity Management at SAESL
eBook 2: Implementing Business Continuity Management
C1	C2	C3	C4	C5
C6	C7	C8	C9	C10