[BCM] [CAS] [E3] [RAR] [T2] Treatment and Control

Part 2: RAR – Treatment and Control

Children’s Aid Society

Risk Assessment and Review (RAR) is a fundamental component of the Children’s Aid Society’s Business Continuity Management (BCM) framework.

Following the identification of threats in Part 1, this section focuses on the treatment and control measures that the organisation has in place, as well as additional measures planned to strengthen resilience. Risk treatment strategies include four main approaches: risk avoidance, risk reduction, risk transference, and risk acceptance.

Each threat category is assessed to determine the most appropriate treatment, supported by existing controls and complemented by planned improvements. The objective is to ensure that the Society can sustain critical residential care operations and other essential services, even in the face of disruptive incidents.

Table: Risk Treatment and Control

Threat	Existing Risk Treatment - Risk Avoidance	Existing Risk Treatment - Risk Reduction	Existing Risk Treatment - Risk Transference	Existing Risk Treatment - Risk Acceptance	Existing Controls	Additional (Planned) Controls
Denial of Access – Natural Disaster (e.g., Flood, Fire, Severe Storms)	Selection of facility locations in areas with low flood and fire risks	Regular maintenance of drainage, fire detection and suppression systems; emergency drills	Property insurance coverage; fire insurance	Accept residual risk of minor disruptions	Fire alarms, sprinklers, evacuation procedures, and emergency shelter tie-ups	Explore relocation arrangements with partner organisations; enhance flood barriers; implement early warning systems
Denial of Access – Man-made Disaster (e.g., Civil Unrest, Terrorist Attack)	Avoid hosting events in high-risk locations	Security protocols, staff training, and controlled access to premises	Insurance covering damage from man-made events	Accept residual risk due to low likelihood	Security cameras, access control systems, liaison with local police	Strengthen physical security barriers; establish mutual aid agreements for temporary relocation
Unavailability of People (e.g., Pandemic, Staff Illness, Mass Resignation)	Avoid dependency on single individuals for critical functions	Cross-training, remote work capability, and health and safety protocols	Group insurance and medical coverage	Accept residual risk of short-term manpower shortages	Staff succession planning, HR policies for leave and health management	Expand volunteer support pool; formalise remote learning/working arrangements; develop pandemic response plan
Disruption to the Supply Chain (e.g., Food, Utilities, Medical Supplies)	Diversify suppliers to avoid over-dependence	Maintain a buffer stock of essential items; regular supplier audits	Supplier contracts with service level agreements (SLA) and penalties	Accept low-level risk for non-essential supplies	Inventory management system, standing arrangements with preferred vendors	Establish alternative supply chain partners; regional supplier collaboration; long-term framework agreements
Equipment and IT-Related Disruption (e.g., Server Crash, Network Failure, Power Outage)	Avoid outdated and unsupported systems	Regular system maintenance, data backup, power surge protection, and redundancy	IT insurance and extended warranty contracts	Accept risk of short outages	Cloud-based data storage, backup power generators, and IT support contracts	Develop secondary data centre or cloud failover system; upgrade cybersecurity measures

Notes to Populate the Table

Threat: Use the exact wording from your "Part 1: RAR – List of Threats."
Existing Risk Treatment (Avoidance / Reduction / Transference / Acceptance): Mark each treatment that’s already being applied (e.g., you might denote with "Yes" or brief notes).
Existing Controls: Describe what’s already implemented (like systems, protocols, physical controls).
Additional (Planned) Controls: Propose enhancements or future controls that would further mitigate the threat, aligning with strategic goals.

Summing Up ...

The treatment and control strategies outlined above reflect the Children’s Aid Society’s commitment to safeguarding its critical services against potential threats. While existing measures provide a robust foundation for continuity, continuous improvement through planned controls ensures that emerging risks are addressed proactively.

By balancing avoidance, reduction, transference, and acceptance, the Society builds resilience into its operations while ensuring that the welfare of its beneficiaries remains uncompromised.

This structured approach to risk treatment positions the organisation to respond effectively to crises, minimise operational disruptions, and maintain trust with stakeholders.

Resilience in Service: BCM Implementation for Children’s Aid Society
eBook 3: Starting Your BCM Implementation
MBCO	P&S	RAR T1	RAR T2	RAR T3	BCS T1	CBF

CBF 1: Residential Care Operations
DP	BIAQ T1	BIAQ T2	BIAQ T3	BCS T2	BCS T3	PD

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].