[BCM] [ALPS] [E1] [C9] Assessing Risks and Threats

Assessing Risks and Threats

 

 

Introduction

Business Continuity Management (BCM) is founded on the principle that organisations must be prepared for disruptive events that could affect the continuity of their critical business functions.

ISO 22301 requires organisations to understand the internal and external issues that may affect the Business Continuity Management System (BCMS), while the Risk Analysis and Review (RAR) process identifies specific threats that could disrupt business operations.

Understanding these threats enables organisations to develop appropriate prevention, preparedness, response, recovery, and resilience strategies.

For ALPS Healthcare (ALPS), identifying threats is especially important because the organisation supports Singapore's public healthcare sector through strategic procurement, healthcare logistics, inventory management, warehousing, pharmaceutical sourcing, and supply chain coordination.

Disruptions affecting ALPS Healthcare may indirectly affect hospitals, healthcare institutions, clinicians, and patients. Consequently, threat identification must extend beyond traditional facility-related incidents to include supply chain disruptions, cyber threats, public health emergencies, regulatory changes, and failures affecting critical third-party providers.

This chapter introduces the major categories of threats relevant to Business Continuity Management and presents representative crisis scenarios applicable to ALPS Healthcare.

These scenarios provide the basis for the Risk Analysis and Review (RAR), Business Impact Analysis (BIA), Business Continuity Strategy (BCS), and Testing and Exercising phases described in subsequent eBooks.

 

Understanding Key Risk Management Concepts

Business Continuity Threats

A business continuity threat is any event, condition, or circumstance that could disrupt an organisation's ability to deliver its critical products or services.

Examples include:

• Cyber attacks
• Fire
• Flooding
• Pandemic
• Utility failure
• Supplier failure
• Human error

A threat represents the source of potential disruption.

Example – ALPS Healthcare

A cyberattack affecting the Warehouse Management System (WMS) could prevent inventory visibility, delaying the distribution of essential medicines to hospitals.

Relationship Between Threats and ISO 22301

ISO 22301 does not prescribe a standard list of threats. Instead, organisations are required to understand their operating context and identify the risks that may affect business continuity.

Threat identification supports:

• Risk Analysis and Review (RAR).
• Business Impact Analysis (BIA).
• Business Continuity Strategy (BCS).
• Business Continuity Plan (BCP) development.
• Crisis Management.
• Incident Response.
• Testing and Exercising.
• Continual Improvement.

Threats, therefore, become the foundation on which organisational resilience is developed.

 

Major Categories of Business Continuity Threats

Natural Hazards

Natural hazards include environmental events beyond human control.

Examples include:

• Flooding.
• Severe storms.
• Lightning.
• Haze.
• Earthquake (regional impact).
• Tsunami affecting regional supply chains.
• Extreme heat.
• Pandemic-related weather disruptions.

Example – ALPS Healthcare

Regional flooding disrupts inbound shipments of medical supplies from neighbouring countries, delaying replenishment of hospital inventories.

 

Facility and Infrastructure Threats

Threats affecting physical facilities include:

• Fire.
• Explosion.
• Structural damage.
• Building access restrictions.
• Utility failures.
• Water supply disruption.
• Air-conditioning failure.
• Cold-storage failure.

Example

A fire at a warehouse storing critical medical consumables requires activation of alternate warehousing and emergency distribution arrangements.

 

Information and Cybersecurity Threats

Digital threats have become one of the highest risks facing healthcare supply chains.

Examples include:

• Ransomware.
• Malware.
• Data breaches.
• Denial-of-Service (DoS) attacks.
• Insider cyber threats.
• System failures.
• Cloud service outages.
• Telecommunications failures.

Example

A ransomware attack encrypts procurement databases, preventing purchase order processing and supplier communications.

 

Supply Chain Threats

Healthcare organisations depend heavily upon resilient supply chains.

Threats include:

• Critical supplier failure.
• Overseas manufacturing disruption.
• Product shortages.
• Transportation disruption.
• Port congestion.
• Customs delays.
• Supplier insolvency.
• Counterfeit products.

Example

An overseas pharmaceutical manufacturer suspends production due to regulatory issues, prompting ALPS Healthcare to activate alternative sourcing arrangements.

 

Workforce Threats

People-related disruptions include:

• Pandemic.
• Loss of key personnel.
• Industrial action.
• Labour shortages.
• Workplace accidents.
• Infectious disease outbreaks.
• Staff absenteeism.
• Skills shortages.

Example

A widespread infectious disease significantly reduces warehouse staffing, requiring cross-trained personnel to support critical operations.

 

Technology and Equipment Threats

Operational technology failures may include:

• ERP failure.
• Warehouse Management System failure.
• Inventory system outage.
• Hardware failure.
• Network failure.
• Data corruption.
• Telecommunications outage.
• Equipment malfunction.

Example

Failure of automated warehouse retrieval systems delays order fulfilment for critical healthcare products.

 

Logistics Threats

Transportation disruptions include:

• Vehicle breakdown.
• Fuel shortages.
• Airport disruptions.
• Shipping delays.
• Road closures.
• Third-party logistics failure.
• Cold-chain transport failure.

Example

Closure of a major expressway requires emergency rerouting of deliveries to public hospitals.

 

Regulatory and Governance Threats

Examples include:

• Regulatory changes.
• Product recalls.
• Healthcare compliance failures.
• Procurement governance failures.
• Contractual disputes.
• Legal injunctions.

Example

A regulatory recall affecting multiple pharmaceutical products requires rapid withdrawal and redistribution of replacement stock.

 

Reputation Threats

Reputational events include:

• Product contamination.
• Media scrutiny.
• Public misinformation.
• Supply shortages.
• Ethical failures.
• Procurement integrity issues.

Example

Media reports on shortages of essential medicines heighten public concern and stakeholder scrutiny.

 

Representative Threat Register for ALPS Healthcare

The following table illustrates representative threats applicable to ALPS Healthcare.

Threat Category	Representative Threat	Potential Operational Impact
Natural Hazard	Flood	Warehouse operations disrupted
	Pandemic	Workforce shortages
Facilities	Fire	Warehouse closure
	Building access restriction	Staff unable to access operations
Technology	ERP failure	Procurement disruption
	Warehouse Management System failure	Inventory visibility lost
Cybersecurity	Ransomware	Procurement systems unavailable
	Data breach	Exposure of sensitive operational data
Supply Chain	Critical supplier failure	Medicine shortages
	Overseas manufacturing disruption	Delayed procurement
Logistics	Third-party logistics failure	Delivery delays
	Cold-chain transport failure	Product spoilage
Utilities	Power outage	Cold-storage disruption
	Telecommunications outage	Communication failure
Human Resources	Loss of key personnel	Operational delays
Governance	Product recall	Emergency redistribution required
External	Geopolitical conflict	Supply interruption
	Port congestion	Shipment delays

 

Understanding Crisis Scenarios

A crisis scenario is a realistic event describing how one or more threats may affect the organisation.

Unlike individual threats, crisis scenarios examine:

• Escalation.
• Interdependencies.
• Decision-making.
• Recovery priorities.
• Stakeholder communications.
• Resource requirements.

Scenario development supports Business Continuity Planning and crisis exercises.

 

Representative Crisis Scenarios for ALPS Healthcare

Scenario 1 – National Pandemic Resurgence

Situation

A rapidly spreading infectious disease causes:

• High workforce absenteeism.
• Extraordinary demand for PPE.
• Medicine shortages.
• Transportation disruption.
• Supplier delays.

Expected BCM Response

• Activate Crisis Management Team.
• Prioritise healthcare institutions.
• Increase emergency procurement.
• Activate remote working.
• Coordinate with healthcare agencies.

Scenario 2 – Major Warehouse Fire

Situation

A fire renders the primary warehouse inoperable.

Expected BCM Response

• Activate alternate warehouse.
• Relocate inventory.
• Continue critical deliveries.
• Notify healthcare institutions.
• Coordinate emergency logistics.

Scenario 3 – Ransomware Attack

Situation

Cyber criminals encrypt procurement, inventory, and warehouse systems.

Expected BCM Response

• Activate Cyber Incident Response.
• Restore systems from backups.
• Implement manual procurement procedures.
• Communicate with suppliers.
• Continue priority distribution.

Scenario 4 – Global Pharmaceutical Supply Shortage

Situation

Several international manufacturers suspend production simultaneously.

Expected BCM Response

• Activate alternative suppliers.
• Prioritise allocation.
• Coordinate with healthcare institutions.
• Monitor inventory levels.
• Support national healthcare priorities.

Scenario 5 – Cold-Chain Failure

Situation

Power failure affects refrigerated pharmaceutical storage.

Expected BCM Response

• Transfer inventory.
• Activate backup generators.
• Monitor product temperatures.
• Replace compromised inventory.
• Notify affected stakeholders.

Scenario 6 – Simultaneous Multi-Site Disruption

Situation

A cyberattack coincides with transportation disruptions and supplier delays.

Expected BCM Response

• Activate Crisis Management Team.
• Prioritise Critical Business Functions.
• Coordinate enterprise recovery.
• Escalate executive decision-making.
• Maintain stakeholder communications.

 

Relationship Between Threats and Critical Business Functions

Threat analysis should consider how disruptions affect each Critical Business Function (CBF).

 

Critical Business Function	Representative Threats
Strategic Procurement	Supplier failure, cyberattack
Pharmaceutical Procurement	Product shortages, manufacturing disruption
Medical Supplies Procurement	Transportation delays
Supplier Management	Supplier insolvency
Supply Planning	ERP failure
Inventory Management	Warehouse Management System outage
Warehouse Operations	Fire, flooding
Cold-Chain Logistics	Refrigeration failure
Distribution Operations	Logistics disruption
Supply Shortage Management	Pandemic, geopolitical conflict
Procurement Information Systems	Ransomware
Data Analytics	Database corruption
Quality Assurance	Product contamination
Finance	Payment system disruption

 

Using Threats Throughout the BCMS

Threat identification supports every stage of Business Continuity Management.

 

BCMS Activity	Use of Threat Information
Risk Analysis and Review	Evaluate likelihood and consequences
Business Impact Analysis	Determine operational impacts
Strategy Development	Select appropriate resilience measures
Plan Development	Prepare response procedures
Crisis Management	Develop escalation arrangements
Testing and Exercising	Design realistic exercise scenarios
Internal Audit	Review threat coverage
Continual Improvement	Update threat register based on emerging risks

 

Key Takeaways

• Threat identification is a fundamental component of ISO 22301 and provides the basis for Business Continuity Management planning.
• ALPS Healthcare faces a diverse range of threats, including natural hazards, facility disruptions, cyber incidents, supply chain failures, workforce shortages, technology outages, logistics disruptions, regulatory events, and reputational challenges.
• Crisis scenarios combine one or more threats into realistic events that enable the organisation to evaluate decision-making, coordination, and recovery capabilities.
• Threat analysis should be integrated with the organisation's Critical Business Functions to ensure continuity strategies focus on the areas of greatest operational importance.
• Regular reviews of the threat landscape and realistic scenario testing will help ALPS Healthcare strengthen organisational resilience and maintain continuity of essential healthcare supply chain services.

 

Understanding the threats that may disrupt organisational operations is a prerequisite for developing an effective Business Continuity Management System.

For ALPS Healthcare, the threat landscape extends well beyond traditional emergencies and includes cyberattacks, supply chain disruptions, pandemics, logistics disruptions, regulatory changes, technology outages, and failures affecting critical suppliers and service providers.

Given ALPS Healthcare's strategic role in supporting Singapore's public healthcare system, these threats could affect not only organisational performance but also the continuity of healthcare services nationwide.

This chapter has introduced the principal categories of business continuity threats, illustrated representative threats relevant to ALPS Healthcare, and demonstrated how these threats can be translated into realistic crisis scenarios for planning and exercising purposes.

By analysing how different threats may affect people, facilities, technology, suppliers, logistics, and governance, ALPS Healthcare can establish a comprehensive understanding of its operational risk environment and identify where resilience measures are most needed.

The threat categories and crisis scenarios presented in this chapter provide the foundation for the Risk Analysis and Review (RAR) phase described in the next eBook, Implementing Business Continuity Management for ALPS Healthcare.

There, each threat will be assessed based on its likelihood, potential consequences, and impact on Critical Business Functions.

This systematic approach enables ALPS Healthcare to develop appropriate continuity strategies, validate recovery capabilities through exercises, and continually enhance its resilience in alignment with the principles and requirements of ISO 22301.