[CM] [JHA] [E2] [C3] Implementing Crisis Scenario Risk Assessment Phase as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged

A crisis plan can only help with the crises it anticipates. The second phase of the Crisis Management Planning Methodology, Crisis Scenario Risk Analysis and Review (CRA), is where the organisation decides which crises to plan for and in what order. The source blog calls this phase Crisis Scenario Risk Assessment; the two names refer to the same phase, and this eBook uses CRA. This chapter describes the steps for carrying it out at Jamiyah Home for the Aged (JHA).

Introduction

Implementing Crisis Management for Jamiyah Home for the Aged, in the series Crisis Management in Action: A Practical Implementation Guide for Jamiyah Home for the Aged. The work aligns with ISO 22361, which treats understanding the organisation's context and the crises it may face as a foundation for building crisis management capability.

The Project Management (PM) phase in Chapter 2 gave the project a goal, a scope, a team and a statement of risk tolerance. The CRA phase uses those to produce a ranked list of crisis scenarios. The ranking drives every later choice: which response protocols to write first, which functions to protect most closely, and which exercises to run in the first year. A weak ranking sends effort to the wrong places. A good one makes the plan smaller, sharper and easier to use.

Two points of method apply throughout. First, a crisis scenario is not the same as a risk in a general risk register. A risk register entry might read "equipment failure". A crisis scenario describes an event severe enough to threaten the home's objectives, with a recognisable trigger and a defined set of consequences. Second, the scenarios are chosen to be severe but plausible. They should be serious enough to test the plan and realistic enough that the staff accept them as possible.

What the CRA phase involves

The BCM Institute source page for this phase outlines four steps: identify potential crisis scenarios; analyse likelihood and impact; prioritise using a likelihood and impact matrix; and identify the critical business services and operations each crisis would affect. The phase works best as a series of short workshops with people who know the home from different angles, followed by a review by the project sponsor. The people who work nights and weekends often hold knowledge that day staff lack, and they should be in the room.

Steps for implementing the phase

Step 1: Identify potential crisis scenarios

The first step is to brainstorm internal and external threats that could disrupt operations. The source page lists natural disasters, technological disruptions, public relations crises, workplace violence and supply chain disruptions as typical categories, and advises looking beyond the obvious. Useful prompts include: what has gone wrong in the past, what has nearly gone wrong, what has gone wrong at similar homes, and what would be most embarrassing or most damaging if it were reported publicly.

Example for JHA: A workshop with the project team, shift supervisors, and the managing agent's representative might produce a long list, which is then grouped into eight scenarios. These eight are illustrative and would be replaced or extended by the home's own list.

• CS-01, fire or evacuation. A fire or other event forces the evacuation of part or all of the building, with residents who are frail or have limited mobility.
• CS-02, infectious disease outbreak. Illness spreads among residents and staff, affecting care, visiting and activities and placing frail residents at risk.
• CS-03, resident death, serious injury or safeguarding allegation. A serious event involving a resident, including during an outing or a volunteer-led activity, or an allegation of neglect or abuse, attracts attention from families, the managing agent, MSF and possibly the media.
• CS-04, serious medication error. A mistake in medication management or administration causes serious harm.
• CS-05, prolonged failure of utilities or building services. Power, water, lifts or air conditioning fail for an extended period.
• CS-06, records loss, data breach or systems failure. Resident records are lost, exposed or unavailable, or information technology and communications fail.
• CS-07, severe staff shortage. Large-scale absence, from illness, transport disruption, or another cause, leaves shifts below the level needed to supervise residents safely.
• CS-08, adverse publicity, funding or licensing action. A public controversy, a funding problem or action by the regulator threatens the home's standing or its ability to operate.

The list deliberately mixes events that start inside the home, such as CS-04, with events that start outside it, such as CS-05, and events whose main damage is reputational, such as CS-08. A single event can also trigger another. A utilities failure may lead to an evacuation, and a serious incident may lead to adverse publicity. The workshop notes should record such links, because response protocols in Chapter 5 will need to handle them.

Step 2: Analyse likelihood and impact

The second step assesses each scenario. The source page suggests considering past frequency, early warning signs, the severity of the effect on operations and revenue, and reputational damage. For a welfare home, the effect on residents' health, dignity and safety should lead the assessment, with operational, financial, regulatory and reputational effects following. Using a simple scale, such as low, medium and high, with a written description of each level, keeps the discussion consistent from one scenario to the next.

Example for JHA: The team might agree on these descriptions. For likelihood, low means unlikely in the next five years, medium means plausible within that period, and high means expected within a year. For impact, low means a short disruption with no harm to residents, medium means disruption to several functions or minor harm, and high means serious harm to residents or loss of the home's ability to operate normally for an extended time. The team might then assign the ratings in the table below. The ratings are illustrative; the home's own experience and records should determine the actual ratings.

Early warning signs deserve a column of their own in the workshop notes, even if they do not appear in the final table. For CS-02, a cluster of residents with similar symptoms is an early sign. For CS-07, a rising number of last-minute roster changes is one. For CS-08, a growing number of complaints or questions from families is one. Naming these signs now allows the plan to include monitoring and escalation triggers later.

Step 3: Prioritise with a likelihood and impact matrix

The third step plots the scenarios on a matrix so planning can focus first on the high-likelihood, high-impact events. The matrix is as much a communication tool as an analytical one: it shows the sponsor and the managing agent, at a glance, where the exposure lies and why the plan starts where it does.

Example for JHA: Using the illustrative ratings above, the matrix would look as follows.

Reading the matrix, the team might group the scenarios into three priorities. Priority A includes scenarios that are both plausible and severe: CS-02, CS-03, and CS-07. Their protocols are written first, and they feature in the first exercises. Priority B holds CS-01 and CS-04, which are unlikely but so serious that the home cannot leave them unplanned, and CS-05 and CS-06, which are more likely and less severe but could trigger other scenarios. Priority C holds CS-08, which is handled mainly through the communication plan and the managing agent's governance.

One rule of thumb prevents a common error. A scenario with low likelihood and high impact must not drop out of the plan simply because it sits in a low-priority cell. For a residential home, fire and serious medication harm sit in exactly that cell, and both would be among the most serious events the home could face. The matrix sets the order of work, not the decision on whether to plan.

Step 4: Identify critical business services and operations

The fourth step asks which essential functions each crisis would affect most, so that targeted response protocols can keep those functions running. This step links the CRA phase to the Business Impact Analysis (BIA) phase. In this methodology, the Business Continuity Management (BCM) team manages and completes the BIA, so the output of this step is a map that the BCM team and the crisis team share, not a detailed analysis.

Example for JHA: The project team has a list of 25 critical business functions, numbered CBF-01 to CBF-25, which Chapter 4 sets out in full. For each scenario, the team might identify the most exposed functions, as shown below.

Patterns appear at once. Personal care and 24-hour supervision (CBF-01) and crisis and next-of-kin communications (CBF-24) are touched by most scenarios, suggesting they deserve the strongest protection and the clearest protocols. Medication management (CBF-03) appears in four scenarios and is a function where any gap carries immediate risk. Programmes and activities such as CBF-12 appear in none of the most-affected lists, which fits the earlier statement of risk tolerance: the home can accept the temporary suspension of those programmes while it protects care and safety.

The regulatory setting

MSF states that its Code of Practice for social residential homes has five domains, including incident management, and that the Social Residential Homes Act came into operation on 1 July 2026. The pages read for this eBook do not set out what the incident management domain requires, nor whether it asks homes to assess particular scenarios. The project team should read the Code and record any scenario or reporting requirement it contains, then check the scenario list in this chapter against it [verify]. If the Code names an event that the list omits, the list should be extended.

Reviewing the results

The phase closes with a review. The sponsor and the managing agent's representative should read the ranked list, challenge the ratings and agree on the scenarios the plan will cover first. The review should also record what the team did not include and why, so that the exclusion is a decision, not an oversight. Finally, the ranking should be given a review date. Ratings change as the home changes: a new programme, a change in resident profile, a new building system or a regulatory change can all move a scenario from one cell to another.

Scenario ownership and monitoring

A ranked list stays useful only if someone looks after it. Each scenario should have a named owner, a role rather than a person, who is responsible for watching its early warning signs, for keeping its description current and for raising a change in rating at the next review. At JHA, the owner of CS-02 might be the care and nursing lead, the owner of CS-05 the facilities representative, the owner of CS-06 the information technology representative, and the owner of CS-08 the managing agent's representative. The Superintendent might own CS-03, because decisions on serious resident events rest at the top of the home.

Owners should report to the project sponsor at set intervals, even if only to say nothing has changed. A short standing item on the agenda of the home's management meeting is enough. This habit keeps the scenarios in front of the people who run the home day to day and prepares the ground for the Program Management phase, where the same list is reviewed on a regular cycle.

Outputs of the phase

• A list of crisis scenarios, CS-01 to CS-08, with descriptions and triggers.
• Likelihood and impact ratings, with the scales written down.
• A likelihood and impact matrix and a priority grouping.
• A map from each scenario to the critical business functions it affects most.
• A list of early warning signs for the priority scenarios.
• A review date for the ranking.

Conclusion

The CRA phase turns a general concern about "what could go wrong" into a short, ranked list that the home can act on. For JHA, the illustrative result is eight scenarios, three at the top of the list, and a clear picture of which functions most scenarios touch. The next phase examines those functions in detail. Chapter 4 explains how the BCM team's BIA identifies the home's critical functions, dependencies and recovery objectives, and how the crisis management team uses those findings.

Sources

• BCM Institute, CM Phase 2: Crisis Scenario Risk Assessment
• MSF, Regulatory Requirements Under SRHA
• MSF, About the Social Residential Homes Act
• ISO 22361:2022 listing, AFNOR

Continue reading: Chapter 4, Implementing Business Impact Analysis Phase as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged, shows how the BCM team's findings on critical functions and recovery objectives feed the crisis plan.