Chapter 5 listed the kinds of crisis that could affect Jamiyah Home for the Aged (JHA). This chapter asks the next question: which of them matter most? No home has unlimited time, money or attention, so preparation has to go where it will do the most good. Risk assessment is the discipline that supports that choice.
A few terms are used throughout.
A simple way to remember the relationship is that a threat is what could go wrong, a vulnerability is why it would hurt, and a risk is how worried we should be.
The threats facing a home for elderly and destitute residents fall into several families. The following list is a starting point, and JHA should expand it based on its own experience.
People threats. Loss of key personnel through resignation, illness, injury or industrial action; shortage of care staff; fatigue; violence or aggression; misconduct; loss of knowledge when long-serving staff leave.
Premises threats. Fire; flooding and water ingress; structural or lift failure; failure of cooling or ventilation; pests; inaccessibility of the building due to nearby incidents.
Utilities and infrastructure threats. Electricity outage; water supply interruption; gas supply issues; telecommunications failure.
Technology and information threats. Cyber attack; loss or corruption of resident records; failure of medication or nurse-call systems; unauthorised disclosure of personal data.
Health threats. Infectious disease outbreaks among residents and staff; food-borne illness; heat stress; medication errors; falls and injuries; deaths in unusual circumstances.
Supply chain threats. Failure of food, medicine, consumables, cleaning, laundry or waste contractors; disruption of transport; shortages of protective equipment.
Financial threats. Decline in donations; funding delay or reduction; unexpected cost increases; fraud; failure to meet the cost of new regulatory requirements.
Regulatory and legal threats. Failure to meet licence conditions or the Code of Practice under the Social Residential Homes Act 2025; breach of data protection obligations; legal claims; enforcement action by regulators.
Reputational and relationship threats. Rumours and misinformation; negative media coverage; loss of confidence among families and supporters; loss of goodwill with the community.
Security and safety threats. Theft; arson; intrusion; terrorism awareness and response; nearby public disorder.
Governance threats. Weak oversight, unclear authority, conflicts of interest, lack of succession planning for senior roles, or inadequate reporting lines to the managing agent.
Most of these map directly to the crisis scenario categories in Chapter 5. The advantage of listing them as threats is that it makes it easier to link each one to a specific vulnerability and a specific action.
Because JHA operates in Singapore, some threats take a particular local form, and some of the regulatory expectations are specific to the sector.
No single government business continuity or crisis management policy applies to JHA in the way a regulated financial institution's requirements apply to a bank. JHA should therefore treat the combination of the Act, the Code of Practice, MOH guidance and the Code of Governance as its practical reference points, supplemented by the group policies of Jamiyah Singapore.
The method has five steps that can be completed in a small series of workshops.
Step 1: Identify. List threats using the families above, plus lessons from past incidents and near misses. Involve people from every area of the home, including night staff, kitchen, cleaning and security. They often know about problems that management does not.
Step 2: Describe. For each threat, write one sentence describing a realistic scenario and note the main vulnerabilities. A good description reads, "A power outage of eight hours during a heatwave leaves residents without cooling and ventilation, and the backup supply covers lighting only."
Step 3: Rate. Judge the likelihood and the impact using agreed scales, such as those below.
| Score | Likelihood (in the next five years) | Impact on residents, operations and trust |
|---|---|---|
| 1 | Rare: would be very surprising | Minor: handled within normal routines |
| 2 | Unlikely: possible but not expected | Moderate: some disruption or distress, quickly resolved |
| 3 | Possible: could happen | Significant: noticeable harm or disruption; regulator informed |
| 4 | Likely: has happened elsewhere, may happen here | Serious: harm to residents or major loss of service |
| 5 | Almost certain: expected to happen | Severe: serious injury or death, loss of licence or long-term loss of trust |
Multiply the two scores to give a rating from 1 to 25. A common convention treats 1 to 5 as low, 6 to 12 as medium, 13 to 19 as high and 20 to 25 as very high. JHA should agree its own bands and record them.
Step 4: Evaluate. Compare the ratings against what the Board is willing to accept. Risks above that line need treatment. The Board's willingness to accept risk, often called its risk appetite, will differ by type. It should be very low for risks to residents' safety and higher, for example, for minor financial inconvenience.
Step 5: Treat and record. Decide what to do about each significant risk, assign an owner and a date, and record the decision in a risk register.
The table below shows what a first assessment might look like. The ratings are illustrative only and do not reflect JHA's actual position. They are included to show the format and to prompt discussion. JHA's own team must rate each item based on its knowledge of the home.
| Threat | Illustrative likelihood | Illustrative impact | Illustrative rating | Typical treatment |
|---|---|---|---|---|
| Prolonged power outage during hot weather | 3 | 4 | 12 (medium) | Backup power for critical areas, cooling plan, resident vulnerability list |
| Infectious disease outbreak among residents and staff | 4 | 5 | 20 (very high) | Infection control programme, isolation plan, staffing and supply reserves, health authority liaison |
| Fire in a resident area | 2 | 5 | 10 (medium) | Detection and suppression upkeep, evacuation plan for non-mobile residents, drills |
| Cyber attack on resident records | 3 | 4 | 12 (medium) | Offline backups, access controls, staff awareness, incident response plan |
| Shortage of night-shift care staff | 4 | 4 | 16 (high) | Cross-training, standby roster, agreements with agencies |
| Allegation of resident mistreatment on social media | 3 | 4 | 12 (medium) | Complaints handling, safeguarding policy, holding statements, social media monitoring |
| Significant decline in donations | 3 | 3 | 9 (medium) | Diversified funding, reserve policy, early warning thresholds |
| Failure to report a notifiable incident on time | 2 | 4 | 8 (medium) | Clear reporting protocol, training, checklist, escalation contacts |
| Key supplier of medication or food fails | 2 | 4 | 8 (medium) | Alternative suppliers, safety stock, supplier assessment |
| Aggression toward staff by resident or visitor | 4 | 3 | 12 (medium) | Risk flags in care plans, training, incident reporting, support for staff |
Two threats stand out in a typical assessment of this kind: infectious disease, because of the combination of frailty and close living, and staffing, because without carers nothing else can work. Many homes find that their highest risks are human, not physical.
A risk register is only useful if it changes what people do. For each significant risk, the team should choose one of four treatments.
Some risks cannot be fully removed. These are the ones for which a crisis plan is essential. A very high residual risk, such as infectious disease, will always require a standing response plan, regular exercises and early warning indicators, topics covered in Chapters 9 and 10.
Responsibility for risk should be shared as follows.
A risk assessment becomes outdated quickly. Review it at least once a year, and after any of the following: a crisis or near miss, a major change in services or premises, a change in law or regulation, or the departure of a key person. Each exercise and each review of a real incident should also feed back into the register, since they often reveal threats and vulnerabilities nobody had thought of.
It is also worth listening for weak signals. Staff comments such as "we always cover for that" or "it has never failed yet" are often early signs of a vulnerability. Leaders who encourage people to speak up about such things learn about problems when they are still cheap to fix.
Risk assessment helps JHA decide where to put its effort. By identifying threats in families, describing realistic scenarios, rating likelihood and impact on simple scales and comparing the results with the Board's appetite, JHA can build a ranked list of the risks that matter most. The Singapore context, including the Social Residential Homes Act 2025, MOH guidance and the Code of Governance for Charities and IPCs, gives the exercise a practical frame.
The risk register is a living document. It feeds the planning methodology, supports early warning and gives the Board a clear basis for oversight. With the threats understood, the next chapter considers who should lead JHA's response by composing the crisis management team.