---
title: [BCM] [GRA] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment
description: [BCM] [GRA] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment
image: https://blog.bcm-institute.org/hubfs/Gambling%20Regulatory%20Authority%20Graphic%20Folder/GRA%20E3%20Morepost/BCM%5D%20%5BGRA%5D%20%5BE3%5D%20%5BRAR%5D%20%5BT3%5D%20Risk%20Impact%20and%20Likelihood%20Assessment.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Implementing Business Continuity Management for the Gambling Regulatory Authority (GRA): A Practical Guide to Organisational Resilience, Service Continuity, and Regulatory Excellence
# \[BCM\] \[GRA\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment
[![\[Full Banner\] Gambling Regulatory Authority](https://no-cache.hubspot.com/cta/default/3893111/19ae41b0-2229-43d0-a2d6-347c7025bf77.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/19ae41b0-2229-43d0-a2d6-347c7025bf77)
[![x eBook Cover \[BCM\] \[GRA\] \[E3\] \[2D\]](https://no-cache.hubspot.com/cta/default/3893111/8df8f6f7-f33c-4c72-882a-0180531975df.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8df8f6f7-f33c-4c72-882a-0180531975df)This chapter forms part of the Risk Analysis and Review (RAR) phase within the eBook **"Implementing Business Continuity Management for the Gambling Regulatory Authority (GRA): A Practical Guide to Organisational Resilience, Service Continuity, and Regulatory Excellence."**
Following the identification of threats and the establishment of risk treatment measures, the next step is to assess the likelihood and potential impact of each threat.
The objective of risk analysis is to determine which threats pose the greatest risk to GRA's ability to perform its regulatory responsibilities and to prioritise resources accordingly.
[![Banner \[BCM\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook/author/moh-heng-goh) Jun 18, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
### [![\[BCM\] \[GRA\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/fbd32178-678a-4274-92db-27247c32d85a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fbd32178-678a-4274-92db-27247c32d85a)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/972f1733-4274-42e5-9fc6-fe3acf70f929)
**[![Banner \[BCM\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1)**
#### Introduction
[![\[BCM\] \[GRA\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/e5ca5611-3aac-456e-9409-537c3d48ec6f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5ca5611-3aac-456e-9409-537c3d48ec6f)
This chapter forms part of the Risk Analysis and Review (RAR) phase within the eBook **"Implementing Business Continuity Management for the Gambling Regulatory Authority (GRA): A Practical Guide to Organisational Resilience, Service Continuity, and Regulatory Excellence."**
Following the identification of threats and the establishment of risk treatment measures, the next step is to assess the likelihood and potential impact of each threat.
The objective of risk analysis is to determine which threats pose the greatest risk to GRA's ability to perform its regulatory responsibilities and to prioritise resources accordingly.
For the purpose of this assessment, a five-point scale is used:
| Score | Impact / Likelihood Description |
| --- | --- |
| 1 | Very Low |
| 2 | Low |
| 3 | Moderate |
| 4 | High |
| 5 | Very High |
**Risk Rating = Highest Impact Score × Likelihood Score**
Risk Levels are defined as:
| Risk Rating | Risk Level |
| --- | --- |
| 1 – 5 | Low |
| 6 – 10 | Moderate |
| 11 – 15 | High |
| 16 – 25 | Extreme |
The assessment below reflects the operational environment, regulatory responsibilities, technology dependencies, and stakeholder expectations of GRA.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cc5424e8-db70-448e-a9f9-67596ef970f6)
Table T3: Risk Impact and Likelihood Assessment
| Threat | Finance | Operations | Legal & Regulatory | Reputation & Image | Social Responsibility | People | Assets / IT Systems / Information | Highest Impact Score | Likelihood | Risk Rating | Risk Level | Expected Period of Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Flood | 2 | 4 | 2 | 3 | 2 | 3 | 3 | 4 | 2 | 8 | Moderate | 1–5 Days |
| Pandemic / Infectious Disease Outbreak | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 4 | 20 | Extreme | Several Weeks to Months |
| Severe Haze Incident | 2 | 3 | 1 | 2 | 3 | 3 | 1 | 3 | 3 | 9 | Moderate | Several Days |
| Extreme Weather Event | 2 | 3 | 2 | 2 | 2 | 2 | 2 | 3 | 3 | 9 | Moderate | 1–3 Days |
| Fire | 4 | 5 | 3 | 4 | 3 | 4 | 5 | 5 | 2 | 10 | Moderate | Several Days to Weeks |
| Terrorist Incident | 4 | 5 | 5 | 5 | 5 | 5 | 4 | 5 | 2 | 10 | Moderate | Several Days to Weeks |
| Civil Disturbance | 2 | 3 | 2 | 3 | 3 | 3 | 1 | 3 | 2 | 6 | Moderate | 1–3 Days |
| Building Structural Failure | 4 | 4 | 2 | 3 | 2 | 3 | 3 | 4 | 2 | 8 | Moderate | Several Weeks |
| Hazardous Material Incident | 3 | 4 | 3 | 3 | 4 | 4 | 2 | 4 | 2 | 8 | Moderate | Several Days |
| Loss of Key Personnel | 2 | 4 | 4 | 3 | 2 | 5 | 1 | 5 | 3 | 15 | High | Several Weeks |
| Travel Restrictions | 2 | 3 | 2 | 2 | 2 | 3 | 1 | 3 | 3 | 9 | Moderate | Several Days to Weeks |
| Mass Casualty Incident | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 2 | 10 | Moderate | Several Weeks |
| Telecommunications Provider Failure | 3 | 5 | 4 | 4 | 3 | 3 | 5 | 5 | 3 | 15 | High | Several Hours to Days |
| Cloud Service Provider Outage | 3 | 5 | 4 | 4 | 2 | 2 | 5 | 5 | 4 | 20 | Extreme | Several Hours to Days |
| Power Supply Failure | 3 | 5 | 3 | 3 | 2 | 2 | 5 | 5 | 3 | 15 | High | Several Hours to Days |
| Vendor Failure | 3 | 4 | 3 | 3 | 2 | 2 | 4 | 4 | 3 | 12 | High | Several Days |
| Data Centre Outage | 4 | 5 | 4 | 4 | 2 | 2 | 5 | 5 | 3 | 15 | High | Several Hours to Days |
| Cyberattack / Ransomware | 4 | 5 | 5 | 5 | 4 | 3 | 5 | 5 | 5 | 25 | Extreme | Several Days to Weeks |
| Data Breach | 4 | 4 | 5 | 5 | 4 | 2 | 5 | 5 | 4 | 20 | Extreme | Several Days to Weeks |
| Network Failure | 2 | 5 | 3 | 3 | 2 | 2 | 5 | 5 | 4 | 20 | Extreme | Several Hours |
| Hardware Failure | 2 | 4 | 2 | 2 | 1 | 1 | 5 | 5 | 3 | 15 | High | Several Hours to Days |
| Software Failure | 2 | 4 | 3 | 3 | 1 | 1 | 5 | 5 | 4 | 20 | Extreme | Several Hours to Days |
| Database Corruption | 3 | 5 | 4 | 4 | 2 | 1 | 5 | 5 | 4 | 20 | Extreme | Several Hours to Days |
| Insider Threat | 4 | 4 | 5 | 5 | 4 | 3 | 5 | 5 | 3 | 15 | High | Several Days to Weeks |
| AI-Enabled Threats | 4 | 4 | 5 | 5 | 4 | 2 | 5 | 5 | 4 | 20 | Extreme | Several Days |
| Distributed Denial of Service (DDoS) Attack | 3 | 5 | 4 | 4 | 2 | 1 | 5 | 5 | 4 | 20 | Extreme | Several Hours to Days |
| Failure of Regulatory Information Systems | 4 | 5 | 5 | 5 | 4 | 2 | 5 | 5 | 4 | 20 | Extreme | Several Hours to Days |
#### **Highest Risk Threats for GRA**
The following threats are assessed as **Extreme Risks** and should receive priority management attention:
| Threat | Risk Rating | Risk Level |
| --- | --- | --- |
| Cyberattack / Ransomware | 25 | Extreme |
| Pandemic / Infectious Disease Outbreak | 20 | Extreme |
| Cloud Service Provider Outage | 20 | Extreme |
| Data Breach | 20 | Extreme |
| Network Failure | 20 | Extreme |
| Software Failure | 20 | Extreme |
| Database Corruption | 20 | Extreme |
| AI-Enabled Threats | 20 | Extreme |
| DDoS Attack | 20 | Extreme |
| Failure of Regulatory Information Systems | 20 | Extreme |
These threats have the greatest potential to disrupt GRA's critical regulatory functions and therefore require enhanced controls, continuity strategies, and recovery planning.
#### **Key Risk Analysis Observations**
##### **Technology and Information Risks Dominate**
The assessment indicates that the highest risks arise from:
- Cybersecurity incidents.
- Regulatory system outages.
- Data integrity failures.
- Cloud and telecommunications dependencies.
##### **Regulatory Impact is Significant**
Any prolonged disruption affecting:
- Licensing functions.
- Regulatory monitoring.
- Enforcement operations.
- Regulatory intelligence activities.
may result in significant regulatory and reputational consequences.
##### **Third-Party Dependencies Increase Exposure**
Reliance on:
- Telecommunications providers.
- Cloud service providers.
- Data centre operators.
- Technology vendors.
creates additional operational resilience challenges that must be managed proactively.
##### **Workforce Resilience Remains Important**
Although technology risks dominate, workforce-related threats, such as pandemics and the loss of key personnel, continue to pose significant operational challenges.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/5b9296da-5ad2-4d32-9649-814eba589ec0)
Risk Impact and Likelihood Assessment provides a structured approach for evaluating threats affecting the Gambling Regulatory Authority (GRA) and prioritising risk treatment activities.
By assessing the impact of each threat across financial, operational, legal, reputational, social responsibility, people, and information asset dimensions, GRA can identify those risks that pose the greatest threat to its ability to fulfil its regulatory mandate.
The results of this assessment highlight the increasing importance of cybersecurity, technology resilience, data protection, third-party risk management, and workforce preparedness.
These findings provide valuable input into the subsequent Business Continuity Management phases, particularly Business Impact Analysis, Business Continuity Strategy development, and recovery planning.
Through regular review and reassessment of risks, GRA can maintain an up-to-date understanding of its threat landscape and strengthen its overall organisational resilience in alignment with ISO 22301 and regulatory best practices.
[![\[Thin Banner\] Gambling Regulatory Authority](https://no-cache.hubspot.com/cta/default/3893111/4f23072f-0544-42d8-b1c9-4b74082dae90.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4f23072f-0544-42d8-b1c9-4b74082dae90)
| **eBook 3: Starting Your BCM Implementation** | | | | | | |
| --- | --- | --- | --- | --- | --- | --- |
| **MBCO** | **P&S** | **RAR T1** | **RAR T2** | **RAR T3** | **BCS T1** | ** CBF** |
| [![BCM\] \[GRA\] \[E3\] \[BIA\] MBCO Corporate MBCO](https://no-cache.hubspot.com/cta/default/3893111/0928875b-21b0-4069-a7d1-cf71945665fd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0928875b-21b0-4069-a7d1-cf71945665fd) | [![BCM\] \[GRA\] \[E3\] \[BIA\] \[PS\] Key Product and Services](https://no-cache.hubspot.com/cta/default/3893111/e5ef9b95-2b3a-4aef-b926-9216ad45c3df.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5ef9b95-2b3a-4aef-b926-9216ad45c3df) | [![BCM\] \[GRA\] \[E3\] \[RAR\] \[T1\] List of Threats](https://no-cache.hubspot.com/cta/default/3893111/b6d1802e-aac8-4351-a34d-f9deebccc3c9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b6d1802e-aac8-4351-a34d-f9deebccc3c9) | [![\[BCM\] \[GRA\] \[E3\] \[RAR\] \[T2\] Treatment and Control](https://no-cache.hubspot.com/cta/default/3893111/2425431c-533d-4f91-8091-1961d97b12dd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2425431c-533d-4f91-8091-1961d97b12dd) | [![\[BCM\] \[GRA\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/e5ca5611-3aac-456e-9409-537c3d48ec6f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5ca5611-3aac-456e-9409-537c3d48ec6f) | [![BCM\] \[GRA\] \[E3\] \[BCS\] \[T1\] Mitigation Strategies and Justification](https://no-cache.hubspot.com/cta/default/3893111/07efb463-2472-44c1-8e9b-b2f585615754.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/07efb463-2472-44c1-8e9b-b2f585615754) | [![\[BCM\] \[GRA\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/a38bb175-c38a-41d4-9121-eca90cf91bb8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a38bb175-c38a-41d4-9121-eca90cf91bb8) |
| | | | | | | |
---
#### More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer \[BCM-3\] and the BCM-5000 Business Continuity Management Expert Implementer \[BCM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f3922b80-e96a-46d6-8993-dc150a5de2d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9ff8a3dc-e39a-465b-929f-72e232cdd5fb) | [![Register \[BL-B-3\]*](https://no-cache.hubspot.com/cta/default/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21525c10-4003-4934-95fc-fe218174bc5b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/46460171-c91a-4936-9bb2-8dc5928a0e02) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1cb17ac7-50b2-4f88-bc4b-c7444e4b57b5) |
| [![FAQ \[BL-B-3\]](https://no-cache.hubspot.com/cta/default/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c199ae8-c470-4bb7-9612-73c7a084e94c) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/8999211a-2c51-4be7-bf49-c393f6c67974) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5c1aa95d-f6dd-4067-a95c-5cc0c32d7ed8) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/086ab3b9-4d66-4a95-b2f7-1148e9803a9c) |
### Your Comments Here :
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook/author/moh-heng-goh"
},
"dateModified" : "2026-06-28T10:42:39.157Z",
"datePublished" : "2026-06-18T08:53:05.000Z",
"headline" : "[BCM] [GRA] [E3] [RAR] [T3] Risk Impact and Likelihood Assessment",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-gra-e3-rar-t3-risk-impact-and-likelihood-assessment",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```