[BCM] [ALPS] [E2] [C3] Risk Analysis and Review

eBook 2: Chapter 3

Risk Analysis and Review Phase of the BCM Planning Methodology for 

Introduction

Risk Analysis and Review (RAR) is the second phase of the Business Continuity Management (BCM) Planning Methodology and forms the foundation for developing effective business continuity strategies.

Before an organisation can determine how it will continue to operate during a disruption, it must first understand the threats that could disrupt its operations, assess the potential consequences of those threats, and identify appropriate measures to reduce risk to an acceptable level.

For ALPS Healthcare (ALPS), Risk Analysis and Review is particularly important because the organisation serves as Singapore's national healthcare supply chain agency, responsible for the procurement, warehousing, inventory management, and distribution of pharmaceuticals, medical devices, and healthcare consumables supporting the public healthcare system.

Disruptions affecting ALPS can have cascading consequences across hospitals, polyclinics, community healthcare providers, and ultimately patient care.

The risk landscape facing ALPS continues to evolve.

Traditional operational risks such as fires, power failures, equipment breakdowns, and transportation disruptions are now accompanied by increasingly sophisticated cyberattacks, ransomware incidents, supply chain disruptions, geopolitical instability, pandemics, climate-related events, and shortages of critical medical products.

As healthcare supply chains become increasingly interconnected and digitally enabled, the potential for single-point failures affecting multiple healthcare institutions has increased significantly.

The objective of the Risk Analysis and Review Phase is not simply to identify threats, but to understand how these threats may affect ALPS' critical business functions, evaluate the effectiveness of existing controls, determine residual risks, and establish priorities for mitigation.

This enables ALPS to make informed decisions regarding investments in resilience, recovery capabilities, supplier diversification, technology safeguards, and operational improvements.

This chapter presents a practical four-step Risk Analysis and Review methodology specifically tailored to ALPS Healthcare.

The methodology aligns with the principles of ISO 22301 and supports the development of a resilient Business Continuity Management System to protect Singapore's healthcare supply chain.

Purpose of Risk Analysis and Review

The objectives of this phase are to:

• Identify threats that may disrupt ALPS Healthcare's operations.
• Understand vulnerabilities across business functions and supporting resources.
• Assess the likelihood and business impact of identified risks.
• Evaluate the effectiveness of existing preventive and detective controls.
• Determine residual risks requiring further treatment.
• Prioritise risks based on organisational impact.
• Recommend practical mitigation measures.
• Provide input to the Business Impact Analysis (BIA) and Business Continuity Strategy (BCS) phases.
• Support informed management decision-making.
• Promote continual improvement of organisational resilience.

Risk Analysis and Review Framework

The Risk Analysis and Review process consists of four integrated steps.

The four steps form a continuous cycle that ensures ALPS Healthcare's risk profile remains current and responsive to changes in the healthcare supply chain environment.

Step 1 – Identifying Risks

Objective

Identify all credible threats that could disrupt ALPS Healthcare's critical business functions, supporting infrastructure, personnel, suppliers, technology, facilities, and healthcare supply chain operations.

Risk identification should be comprehensive and involve representatives from all business units.

Sources of Risk Identification

ALPS should gather risk information from multiple sources, including:

• Historical incidents
• Internal audits
• Business continuity exercises
• Cybersecurity assessments
• Supplier assessments
• Industry intelligence
• Government advisories
• Regulatory guidance
• Staff workshops
• Lessons learned from previous disruptions

Major Risk Categories

Typical risk categories include:

• Natural hazards
• Facility-related incidents
• Technology failures
• Cybersecurity threats
• Human resource risks
• Supply chain disruptions
• Utility failures
• Third-party service failures
• Regulatory changes
• Public health emergencies

Examples – ALPS Healthcare

Potential risks include:

Step 2 – Assessing Risks

Objective

Evaluate each identified risk by analysing its likelihood of occurrence and its potential impact on ALPS Healthcare's operations.

Risk assessment provides a consistent method for prioritising management attention and resource allocation.

Assessment Criteria

Each risk should be evaluated based on:

• Likelihood of occurrence
• Operational impact
• Financial impact
• Regulatory consequences
• Healthcare service impact
• Reputational damage
• Recovery complexity
• Existing control effectiveness

Example Risk Assessment Matrix

Example – ALPS Healthcare

A ransomware attack targeting the procurement and inventory management systems may be assessed as:

• Likelihood: Likely
• Operational Impact: Major
• Healthcare Impact: Severe
• Financial Impact: Major
• Overall Risk Rating: Extreme

This assessment indicates that immediate mitigation and recovery planning are required.

Step 3 – Mitigating Risks

Objective

Implement preventive, detective, corrective, and recovery controls to reduce identified risks to an acceptable level.

Risk mitigation should balance operational effectiveness, cost, regulatory expectations, and organisational resilience.

Risk Treatment Options

ALPS may choose to:

• Avoid the risk.
• Reduce the likelihood.
• Reduce the consequences.
• Transfer the risk.
• Accept the residual risk.

Categories of Mitigation Measures

Governance Controls

• Policies
• Procedures
• Management oversight
• Internal audits

Operational Controls

• Standard operating procedures
• Inventory management
• Supplier qualification
• Workforce cross-training

Technology Controls

• System redundancy
• Data backups
• Multi-factor authentication
• Network segmentation
• Endpoint protection

Supply Chain Controls

• Multiple suppliers
• Strategic inventory buffers
• Supplier continuity assessments
• Alternate logistics providers

Physical Controls

• Fire protection systems
• Access controls
• Environmental monitoring
• Cold-chain monitoring
• Warehouse security

Example – ALPS Healthcare

To reduce the risk of pharmaceutical shortages resulting from supplier failure, ALPS may implement:

• Multiple approved suppliers for essential medicines.
• Strategic safety stock for critical products.
• Regular supplier resilience assessments.
• Regional sourcing alternatives.
• Emergency procurement procedures.
• Long-term framework agreements with key manufacturers.
• Continuous monitoring of supplier financial health.

Step 4 – Continuous Review

Objective

Maintain an accurate, up-to-date understanding of organisational risks by regularly reviewing changes affecting ALPS Healthcare's operating environment.

Risk management is an ongoing process rather than a one-time exercise.

Review Triggers

The risk profile should be reviewed following:

• Major organisational changes.
• New healthcare services.
• Technology implementation.
• Supplier changes.
• Regulatory updates.
• Cybersecurity incidents.
• Natural disasters.
• Exercise findings.
• Internal audits.
• Actual disruptions.

Periodic Reviews

Regular reviews should include:

• Risk Register updates.
• Emerging threat analysis.
• Control effectiveness reviews.
• Management reporting.
• Internal audit findings.
• Business continuity exercise outcomes.

Example – ALPS Healthcare

Following the implementation of an automated warehouse management system and robotics, ALPS updates its Risk Register to include:

• Automation system failures.
• Robotics software defects.
• Cybersecurity risks affecting warehouse automation.
• Integration failures with procurement systems.
• Increased dependency on cloud services.

Mitigation measures are reviewed and updated to reflect the changing operational environment.

Developing the ALPS Healthcare Risk Register

The Risk Register serves as the central repository for documenting and monitoring organisational risks.

Typical information includes:

Example Entry

Roles and Responsibilities

Effective risk management requires collaboration across the organisation.

Success Factors for ALPS Healthcare

The effectiveness of the Risk Analysis and Review Phase depends on several key success factors:

• Strong executive commitment.
• Organisation-wide participation.
• Comprehensive risk identification.
• Reliable risk assessment methodology.
• Integration with enterprise risk management.
• Regular supplier resilience assessments.
• Continuous monitoring of emerging threats.
• Timely implementation of mitigation measures.
• Effective communication of significant risks.
• Commitment to continual improvement.

Relationship with the Business Impact Analysis

The outputs of the Risk Analysis and Review Phase directly support the next phase of the BCM Planning Methodology—the Business Impact Analysis (BIA).

Specifically, the RAR Phase:

• Identifies the threats that may disrupt business functions.
• Highlights vulnerabilities requiring detailed analysis.
• Supports prioritisation of critical business functions.
• Provides input for determining recovery objectives.
• Informs the development of appropriate business continuity strategies.

By understanding the risks facing ALPS Healthcare, the organisation can focus its Business Impact Analysis on the business functions and dependencies that are most critical to maintaining the continuity of Singapore's healthcare supply chain.