This chapter produces the Threat Register for Jamiyah Home for the Aged (JHA): a structured list of the realistic events and conditions that could stop the Home from sheltering, feeding, caring for and protecting its residents.
It is Part 1 of the Risk Assessment Report (RAR), and every later step in the BCM programme draws on it.
ISO 22301 (clause 8.2.3) requires an organisation to identify, analyse and evaluate the risks of disruption to its prioritised activities. Identification comes first because you can't analyse what you haven't named.
A threat missing from the register will not be rated, will not inform the Business Impact Analysis (BIA), and will have no plan when it arrives.
For JHA, the stakes are concrete. The Home operates 24 hours a day, every day of the year, for residents who are elderly, frail and largely without family support.
Unlike an office, it cannot close and ask its clients to stay at home. Any disruption — to the building, the staff, the kitchen, the medication supply or the records system — falls directly on people who have nowhere else to go.
Separating identification from evaluation guards against two common errors. The first is premature dismissal: teams that rate as they list tend to discard unfamiliar threats ("that has never happened here") before describing them properly. The second is recency bias: if COVID-19 dominates memory, cyber and supply chain threats get crowded out.
Listing threats first, broadly and without judgement, produces a complete starting set. Evaluation then happens once, consistently, against criteria the Board has agreed.
These terms are often blurred. This guide uses them as follows:
Haze on its own is a threat. Haze reaching a Home whose residents have weakened lungs and whose wards may depend partly on natural ventilation becomes a risk to resident health and continuity of care. The register records the threat; later chapters examine vulnerabilities and rate the risk.
Some threats originate outside the Home and cannot be prevented by it: a transboundary haze episode, an MRT breakdown, a supplier's insolvency. Others originate inside: an electrical fault, misuse of access to resident records, a key manager leaving without a successor.
Both matter. External threats often hit many organisations at once, so shared resources such as agency nurses or transport become scarce. Internal threats tend to be more frequent and feel ordinary, which makes them easy to overlook.
Each threat is described from two angles. Country-level relevance describes how the threat presents across Singapore — climate, infrastructure, regulation and incident history. Organisation-level relevance describes how it would land at JHA specifically: at 1 Tampines Avenue 3, with this resident population, these suppliers and these obligations to MSF and the Commissioner of Charities.
A threat can be rare nationally yet serious locally, or common nationally yet of limited consequence to the Home. Holding both views prevents over-reaction to headlines and under-reaction to local exposure.
The register also supports governance. The Code of Governance for Charities and IPCs expects the Board to oversee risk, and the Social Residential Homes Act 2025 (SRHA), in operation since 1 July 2026, strengthens safeguards for residents' safety and wellbeing and replaces relevant provisions of the Destitute Persons Act (MSF). A documented, regularly reviewed register is tangible evidence that the Board and the Superintendent are discharging that duty.
This chapter identifies potential sources of disruption only. It does not assess likelihood, estimate impact, assign risk ratings or propose controls. Those steps follow in RAR Part 2 onwards, where each threat listed here will be analysed, evaluated and, where necessary, treated.
Table RAR-1 lists 70 threats across five categories, presented below one category at a time under the same five columns. Closely related threats (for example, riot and public disorder) are grouped in a single row where they disrupt JHA in the same way.
| Column | What it records |
|---|---|
| Category of Threats | The type of resource the threat primarily takes away: access to premises, people, supply chain, or equipment and IT |
| Types of Threats | The specific threat, named so it can be referenced in later RAR, BIA and plan documents |
| Description of Threat | How the threat arises and how it disrupts operations |
| Country-Level Relevance | How the threat presents across Singapore, using descriptive terms such as commonly encountered, occasional, emerging, increasing concern, credible but infrequent or low historical occurrence. These are context statements, not likelihood ratings |
| Organisation-Level Relevance | How the threat could affect JHA's residents, staff, premises, ICT, suppliers, regulatory standing and public confidence |
Where JHA-specific information was not available, the register assumes the following. The Superintendent should confirm or correct each point before RAR Part 2 begins.
Natural threats deny or degrade access to the Home, or make parts of it unusable. Singapore escapes most large-scale geophysical hazards, so the credible threats are weather, heat and air quality.
| Category of Threats | Types of Threats | Description of Threat | Country-Level Relevance | Organisation-Level Relevance |
|---|---|---|---|---|
| Denial of Access – Natural Disaster | Flood and flash flood | Intense rain overwhelms drains within an hour, ponding roads, car parks and ground floors. Access is blocked until water recedes; ground-level switch rooms and stores may be damaged. | Commonly encountered. Flash floods recur in monsoon periods; they are short-lived but arrive with little warning. | Staff and deliveries delayed; water entering ground-floor wards, the kitchen or switch rooms could force residents to be moved within the building. |
| Denial of Access – Natural Disaster | Severe storm and Sumatra squall | Thunderstorms and squall lines bring strong gusts that topple trees, damage roofs and windows, and bring down overhead cables. | Commonly encountered, especially in inter-monsoon periods; damage is usually localised. | Roof or window damage could close rooms; fallen trees along the frontage could block ambulance and delivery access. |
| Denial of Access – Natural Disaster | Lightning | Strikes cause power surges that damage electrical and electronic systems, and halt outdoor activity during alerts. | Commonly encountered; Singapore has one of the highest lightning rates in the world. | Surges may disable fire alarm panels, nurse-call, CCTV and ICT; outdoor activities and deliveries pause during alerts. |
| Denial of Access – Natural Disaster | Earthquake tremors | Large earthquakes off Sumatra send tremors through buildings, prompting precautionary evacuation and structural checks. | Low historical occurrence of damage; distant tremors are felt occasionally, as Singapore lies away from active fault zones. | Even mild tremors may distress residents and lead to precautionary evacuation of frail residents, with checks needed before re-entry. |
| Denial of Access – Natural Disaster | Tsunami | Seismic sea waves inundate coastal land. | Low historical occurrence; Sumatra and the Malay Peninsula shelter Singapore, and the 2004 Indian Ocean tsunami did not reach it. | Negligible direct exposure for an inland Tampines site; retained for completeness and periodic review. |
| Denial of Access – Natural Disaster | Landslide and slope failure | Prolonged rain destabilises slopes, retaining walls or excavations, blocking roads or undermining structures. | Occasional and localised, mainly on hilly terrain or construction sites. | Limited exposure on largely flat ground; collapse of nearby excavations could still close access roads. |
| Denial of Access – Natural Disaster | Vegetation fire (wildfire) | Grass and scrub fires in dry spells produce smoke and can approach fences or close roads. | Occasional; vegetation fires rise sharply in dry months such as February and March. | Smoke from nearby green spaces could enter wards and aggravate residents' respiratory conditions. |
| Denial of Access – Natural Disaster | Extreme heat | Sustained heat and humidity raise heat stress, strain air-conditioning and drive up power demand. | Increasing concern; a long-term warming trend has led to national heat stress advisories. | Elderly residents are highly susceptible to heat illness; cooling failure could make wards or the kitchen unusable, and staff doing physical care face heat strain. |
| Denial of Access – Natural Disaster | Transboundary haze | Smoke from regional land and forest fires degrades air quality for days or weeks. | Occasional but recurring; severe episodes occurred in 2013, 2015 and 2019. | Residents with heart and lung conditions are at risk; outings, outdoor programmes and visits may be curtailed, and ventilation of wards becomes constrained. |
| Denial of Access – Natural Disaster | Pandemic-related movement restrictions | Public health orders restrict movement, visiting and gatherings, limiting who may enter the premises. | Credible but infrequent; SARS (2003) and the 2020 circuit breaker showed how restrictions fall on care homes. | Visitors, volunteers, visiting doctors and vendors may be barred, and staff movement between sites or lodgings restricted. |
| Denial of Access – Natural Disaster | Sinkhole and ground subsidence | Underground voids, often linked to tunnelling, utility works or leaking pipes, cause sudden ground collapse. | Low historical occurrence; isolated incidents have been linked to underground works. | A collapse on an access road or in the compound could cut vehicle access, utilities or the main entrance. |
| Denial of Access – Natural Disaster | Volcanic ash | Eruptions in Indonesia or the Philippines spread ash that disrupts air travel and, rarely, air quality. | Low historical occurrence; impacts are mainly flight cancellations. | Mainly affects foreign staff returning from home leave and any supplies flown in. |
Man-made threats arise from human activity, accident or intent. For a home whose residents cannot evacuate themselves, fire and anything that forces evacuation dominate this category.
| Category of Threats | Types of Threats | Description of Threat | Country-Level Relevance | Organisation-Level Relevance |
|---|---|---|---|---|
| Denial of Access – Man-made Disaster | Fire | Electrical faults, cooking, smoking materials or oxygen-enriched areas ignite fire and smoke that force evacuation. | Commonly encountered; residential premises account for a large share of fires attended by SCDF. | Evacuating bedbound and wheelchair-using residents is slow and staff-intensive; smoke or water damage could close wards for weeks. |
| Denial of Access – Man-made Disaster | Explosion | Gas, pressurised cylinders, lithium-ion batteries or electrical equipment ignite violently. | Credible but infrequent; battery fires from personal mobility devices are a recognised cause. | Medical oxygen cylinders and mobility-aid batteries add ignition sources; structural damage would deny access to affected blocks. |
| Denial of Access – Man-made Disaster | Chemical spill | Cleaning chemicals, disinfectants or road-tanker loads are released, producing fumes and contamination. | Occasional; incidents are usually minor and contained. | A spill in laundry or cleaning stores could force local evacuation; fumes affect residents with respiratory illness. |
| Denial of Access – Man-made Disaster | Gas leak | Town gas or LPG leaks in kitchen areas create fire and asphyxiation hazards. | Occasional and usually localised. | Kitchen shutdown halts in-house meal preparation; affected areas may need evacuating. |
| Denial of Access – Man-made Disaster | Structural failure and building collapse | Deterioration, defects, water ingress or overloading cause ceiling, wall, floor or walkway failure. | Low historical occurrence; building controls and periodic structural inspections are strong. | The Home has occupied its site since 1997; ageing ceilings, walkways or fittings could fail, closing wards or circulation routes. |
| Denial of Access – Man-made Disaster | Civil disturbance, riot and public disorder | Unrest or crowd incidents disrupt movement and threaten nearby premises. | Low historical occurrence; the 2013 Little India riot is a rare example. | Low direct exposure; disorder near transport routes could delay staff and deliveries. |
| Denial of Access – Man-made Disaster | Terrorism | Attacks on people or infrastructure, including vehicle and lone-actor attacks, cause casualties, cordons and lockdowns. | Credible but infrequent; national assessments continue to treat the threat as serious, with self-radicalised individuals a key concern. | Attacks nearby or on the transport network could trigger cordons and staff absence, and would heighten anxiety among residents and staff. |
| Denial of Access – Man-made Disaster | Bomb threat and suspicious item | Threats arrive by phone, email or post, or suspicious items are found, requiring search or evacuation. | Occasional; email hoaxes aimed at schools and institutions have increased. | Any evacuation of frail residents is disruptive; repeated hoaxes wear down staff. |
| Denial of Access – Man-made Disaster | Sabotage and vandalism | Insiders or outsiders deliberately damage equipment, utilities, vehicles or property. | Occasional. | Damage to building services or kitchen equipment would interrupt care routines. |
| Denial of Access – Man-made Disaster | Active assailant or intruder | An aggressive or armed person enters intending harm, or an unauthorised person gains access. | Credible but infrequent; strict weapons controls limit firearm incidents, but knife attacks occur. | Residents with limited mobility cannot readily move away from danger, so any intrusion would affect a highly vulnerable group. |
| Denial of Access – Man-made Disaster | Utility failure affecting access | Power loss disables lifts, electronic locks, gates and lighting. | Low historical occurrence of prolonged outages; local faults occur. | Residents on upper floors may be unable to move between floors without lifts, and access systems may not work as intended. |
| Denial of Access – Man-made Disaster | Road closure and major traffic incident | Accidents, roadworks or events close roads around Tampines. | Commonly encountered; usually brief. | Ambulances, deliveries and staff arrivals delayed; residents' medical appointments missed. |
| Denial of Access – Man-made Disaster | Public transport disruption | MRT or bus failures disrupt commuting. | Occasional; the six-day East-West Line disruption in September 2024 showed the potential scale. | Shift staff commuting on eastern rail lines may arrive late, leaving the outgoing shift to cover. |
| Denial of Access – Man-made Disaster | Aircraft accident | An aircraft crash or falling debris affects areas under approach and departure paths. | Low historical occurrence; Changi Airport and Paya Lebar Air Base operate in the east. | Location under eastern flight paths means an accident could trigger cordons or damage nearby. |
| Denial of Access – Man-made Disaster | Nearby industrial accident | Fire, explosion or toxic release at nearby industrial premises. | Occasional. | Industrial estates in the eastern region are close enough that smoke or plumes could require residents to shelter in place. |
People are JHA's most critical resource: residential care cannot be automated or deferred. These threats reduce the number, skills or wellbeing of the staff, volunteers and partners who deliver it.
| Category of Threats | Types of Threats | Description of Threat | Country-Level Relevance | Organisation-Level Relevance |
|---|---|---|---|---|
| Unavailability of People | Pandemic and epidemic | A novel or re-emerging pathogen spreads widely, causing illness, absence and public health controls. | Credible but infrequent, with growing concern; SARS (2003) and COVID-19 (2020–2022) caused prolonged disruption. | Elderly residents face severe outcomes; staff illness and isolation could push shifts below safe levels just as care needs rise. |
| Unavailability of People | Infectious disease outbreak within the Home | Influenza, COVID-19, norovirus, scabies or food poisoning spreads through shared living and dining areas. | Commonly encountered in residential care settings. | Residents and staff fall ill together; notification, cohorting and admission pauses add workload and regulatory contact. |
| Unavailability of People | Labour strike and industrial action | Staff or vendors' workers collectively withdraw labour. | Low historical occurrence; tripartite labour relations make strikes very rare. | Low direct exposure; disputes at outsourced vendors could still interrupt cleaning, catering or security. |
| Unavailability of People | High staff turnover and mass resignation | Care workers leave, sometimes in groups, for better-paid roles in healthcare or overseas. | Increasing concern; eldercare competes for a limited pool of care staff. | Shift gaps, loss of knowledge of individual residents' needs, and heavier reliance on overtime or agency staff. |
| Unavailability of People | Loss of key personnel | Sudden illness, death or departure of the Superintendent, senior nurse, finance lead or IT contact. | Commonly encountered in small social service organisations. | Decisions, approvals and regulatory reporting to MSF stall where named individuals have no trained deputy. |
| Unavailability of People | Skills shortage | Shortage of nurses, dementia-trained carers or staff with residents' languages; foreign manpower policy changes tighten supply. | Increasing concern; an ageing population is raising demand faster than supply. | Specialised roles may stay vacant, limiting the level of care JHA can safely provide. |
| Unavailability of People | Workplace injury | Back injuries from lifting and transfers, slips, falls and needlestick injuries. | Commonly encountered in care and healthcare settings. | Injured staff on medical leave reduce shift capacity; injuries trigger workplace safety reporting. |
| Unavailability of People | Workplace violence | Aggression by residents with cognitive or mental health conditions, by visitors, or between residents. | Increasing concern across healthcare and care settings. | Staff injury and trauma, harm to residents, and incidents reportable to MSF. |
| Unavailability of People | Staff fatigue and psychological stress | Long shifts, overtime, emotional demands and grief after resident deaths wear staff down. | Increasing concern; care workers' mental wellbeing is a recognised sector priority. | Higher risk of medication and supervision errors, sick leave and resignations. |
| Unavailability of People | Travel restrictions | Border closures or flight disruptions strand staff abroad or halt recruitment. | Credible but infrequent; seen widely during COVID-19. | Foreign staff on home leave may be unable to return; overseas recruitment stalls. |
| Unavailability of People | Mandatory quarantine and isolation | Health orders require exposed staff or residents to isolate. | Occasional, linked to outbreaks. | A whole shift team may be isolated at once, while quarantined residents need more intensive care. |
| Unavailability of People | Family emergencies | Staff absent for bereavement, caregiving duties or children's school closures. | Commonly encountered. | Absences cluster around festive periods, school closures or crises in staff members' home countries. |
| Unavailability of People | Loss of volunteers and visiting partners | Volunteers, visiting doctors, therapists and religious teachers withdraw or cannot attend. | Occasional; volunteering fell sharply during COVID-19. | Activity programmes, befriending and some clinical reviews depend on partners; their absence affects residents' wellbeing and care quality. |
JHA depends on a chain of external providers for food, medicine, utilities, money and systems. Because residents need meals and medication every day, many of these dependencies are felt within hours, not weeks.
| Category of Threats | Types of Threats | Description of Threat | Country-Level Relevance | Organisation-Level Relevance |
|---|---|---|---|---|
| Disruption to the Supply Chain | Catering and food supplier failure | A caterer or food supplier fails to deliver, through breakdown, staffing or food safety suspension. | Occasional; food safety suspensions of caterers occur periodically. | Residents need three meals daily, including halal and therapeutic diets; failure is felt within hours. |
| Disruption to the Supply Chain | Outsourcing and shared services failure | Shared services from Jamiyah Singapore, or outsourced cleaning, laundry, security or maintenance, stop. | Occasional. | Payroll, HR, procurement or finance problems at the managing agent pass directly to JHA. |
| Disruption to the Supply Chain | Medication and medical supply disruption | Pharmacy services, consumables or oxygen are interrupted by shortages, recalls or provider failure. | Occasional; global shortages of specific medicines have affected Singapore. | Missed chronic medications, wound care or continence supplies harm residents within days. |
| Disruption to the Supply Chain | Utility failure | Electricity, water or town gas is lost through grid, network or building faults. | Low historical occurrence of prolonged national outages; local faults are occasional. | Without power or water there is no cooking, laundry, bathing, cooling or powered care equipment. |
| Disruption to the Supply Chain | Telecommunications provider failure | A carrier outage disrupts fixed lines, mobile service and broadband. | Occasional; several high-profile carrier outages have occurred in recent years. | Contact with families, MSF, hospitals and on-call managers is lost where lines share one carrier. |
| Disruption to the Supply Chain | Cloud service provider failure | A provider of email, finance, rostering or care-record software suffers prolonged failure, withdraws service or changes terms. | Increasing concern; small organisations rely heavily on global providers. | Records, rosters and finance data become inaccessible or must be migrated at short notice. |
| Disruption to the Supply Chain | Fuel supply disruption | Diesel for standby generators or LPG deliveries are interrupted. | Low historical occurrence; national fuel supply is resilient. | Generator runtime is limited to on-site fuel during a long power outage. |
| Disruption to the Supply Chain | Logistics and transportation failure | Vehicles, drivers or transport contractors are unavailable. | Occasional. | Residents miss hospital and specialist appointments; deliveries arrive late. |
| Disruption to the Supply Chain | Banking and payment system failure | Bank, PayNow, GIRO or card networks fail. | Occasional; major bank digital outages in 2023 drew regulatory action. | Payroll, vendor payments and donation collection are delayed. |
| Disruption to the Supply Chain | Regulatory and funding change | Changes in licensing conditions, funding, charity regulation or foreign manpower rules alter what JHA must do or can afford. | Increasing concern during the transition to the SRHA licensing regime. | New conditions or delayed funding could constrain staffing, admissions or capital works. |
| Disruption to the Supply Chain | Import restrictions and food supply shocks | Export bans, animal disease or shipping disruption cut supplies of food and goods. | Occasional; Singapore imports most of its food, and Malaysia's 2022 chicken export ban is a recent example. | Menu changes and cost increases; halal-certified alternatives may be harder to source. |
| Disruption to the Supply Chain | Vendor insolvency and contract termination | A supplier closes, exits the market or ends its contract at short notice. | Occasional; small-business failures rise in downturns. | Sudden loss of catering, laundry, maintenance or software; replacement takes time under charity procurement rules. |
| Disruption to the Supply Chain | Third-party cyber incident | A supplier's systems are compromised, exposing JHA data or halting service. | Increasing concern. | Resident and donor data held by vendors may be exposed, while data protection obligations stay with JHA. |
| Disruption to the Supply Chain | Single source dependency | Only one supplier, or one person, can provide a critical good or service. | Commonly encountered among small organisations. | Halal catering, pharmacy, lift maintenance or system administration may each rest on one provider. |
Technology at JHA covers two kinds of equipment: ICT that holds records, rosters and finances, and care and safety equipment that keeps residents safe. Both are covered here.
| Category of Threats | Types of Threats | Description of Threat | Country-Level Relevance | Organisation-Level Relevance |
|---|---|---|---|---|
| Equipment and IT-Related Disruption | Ransomware | Malicious software encrypts files and systems, often with data theft and extortion. | Increasing concern; ransomware is among the cyber incidents most frequently reported nationally. | Care records, medication charts, rosters and finance become unavailable; staff revert to paper. |
| Equipment and IT-Related Disruption | Malware, phishing and business email compromise | Malicious emails steal credentials, install malware or trick staff into fraudulent payments. | Commonly encountered; phishing is a leading route for scams and intrusions. | Fraudulent changes to vendor bank details, or fake appeals using JHA's name, cause financial loss and damage donor trust. |
| Equipment and IT-Related Disruption | Distributed Denial of Service (DDoS) | A flood of traffic overwhelms a website, donation page or internet link. | Occasional; hacktivist campaigns have targeted Singapore websites. | Little effect on care; public information and online giving become unavailable. |
| Equipment and IT-Related Disruption | Insider threat | Staff, contractors or volunteers misuse access to systems, records, medication or funds. | Occasional. | Theft of residents' money or medicines, or misuse of data, would cause serious harm and reputational damage. |
| Equipment and IT-Related Disruption | Data breach | Personal data of residents, staff or donors is disclosed through loss, error or attack. | Commonly encountered; the data protection regulator regularly takes action against charities and SMEs. | Health and financial details are sensitive; breach notification duties and loss of donor confidence follow. |
| Equipment and IT-Related Disruption | Network and internet failure | The local network, Wi-Fi, router or internet link fails. | Commonly encountered at local level. | Cloud systems become unreachable; tablets used for care documentation stop working. |
| Equipment and IT-Related Disruption | Server and hardware failure | PCs, laptops, tablets, printers or servers break down. | Commonly encountered. | With few devices per shift, one failure can halt documentation or medication rounds. |
| Equipment and IT-Related Disruption | Software failure and database corruption | Bugs, failed updates or corrupted databases make applications unusable or data unreliable. | Occasional; the July 2024 global CrowdStrike update failure showed the reach of a single faulty update. | Missing or incorrect care, medication or payroll data. |
| Equipment and IT-Related Disruption | Cloud service outage | Hosted email, collaboration or business applications are temporarily unavailable. | Occasional; outages at global providers reach Singapore users. | Staff lose email, shared files and online records for hours. |
| Equipment and IT-Related Disruption | Power failure | Power loss or surge affects ICT and electrically powered care equipment. | Low historical occurrence of prolonged outages. | Pressure-relief mattresses, oxygen concentrators, suction, nurse-call, CCTV and medicine fridges stop. |
| Equipment and IT-Related Disruption | Loss of telecommunications and mobile communications | Fixed lines, mobile networks or internal handsets fail. | Occasional. | Staff cannot call emergency services, families or on-call managers, or coordinate between floors. |
| Equipment and IT-Related Disruption | Backup failure | Backups are missing, untested, corrupted or encrypted along with the originals. | Commonly encountered weakness in small organisations. | Records cannot be restored after another incident, turning a short outage into permanent loss. |
| Equipment and IT-Related Disruption | Data centre and server room failure | Cooling, power or fire problems hit the on-site server room or the managing agent's hosting. | Low historical occurrence at commercial data centres; small server rooms are more exposed. | Systems shared with Jamiyah Singapore may fail for all its services at once. |
| Equipment and IT-Related Disruption | Authentication and identity management failure | Multi-factor authentication, password resets or single sign-on fail, or the only administrator is unavailable. | Emerging, as reliance on single sign-on grows. | Staff may be locked out of systems outside office hours. |
| Equipment and IT-Related Disruption | Care and safety equipment failure | Nurse-call, fire alarm, lifts, hoists, electric beds, kitchen or laundry machines break down. | Commonly encountered. | Directly affects resident safety, mobility and daily routines. |
| Equipment and IT-Related Disruption | Artificial intelligence system failure | AI-enabled tools such as fall detection, rostering aids or transcription give wrong outputs or stop. | Emerging; national AI governance frameworks promote responsible adoption. | Where adopted, over-reliance could lead to missed alerts or inaccurate records; current use is assumed to be limited. |
Every required coverage area is addressed by at least two threats in Table RAR-1. Where a threat touches several areas, it is mapped to its primary consequence.
| Coverage area | Threats in Table RAR-1 with a primary effect on it |
|---|---|
| People | Pandemic and epidemic; staff turnover; loss of key personnel; skills shortage; fatigue and stress |
| Premises | Flood; fire; structural failure; severe storm; sinkhole |
| Technology | Server and hardware failure; software failure; care and safety equipment failure; AI system failure |
| Information | Data breach; backup failure; database corruption; insider threat |
| Communications | Telecommunications provider failure; loss of mobile communications |
| Suppliers | Catering failure; medication supply disruption; vendor insolvency; single source dependency |
| Utilities | Utility failure; power failure; fuel supply disruption; gas leak |
| Transportation | Public transport disruption; road closure; logistics failure |
| Third parties | Outsourcing and shared services failure; third-party cyber incident; loss of volunteers and partners |
| Regulators | Regulatory and funding change; infectious disease outbreak within the Home (notification duties) |
| Customers and stakeholders | Pandemic movement restrictions (families, visitors); workplace violence (residents) |
| Reputation | Insider threat; data breach; business email compromise |
| Governance | Loss of key personnel; regulatory and funding change |
| Financial operations | Banking and payment failure; business email compromise; import restrictions |
| Cybersecurity | Ransomware; malware and phishing; DDoS; authentication failure |
| Physical security | Active assailant or intruder; terrorism; bomb threat; sabotage |
Traditional threats (fire, flood, utility failure), technological threats (ransomware, cloud outage) and emerging threats (extreme heat, AI system failure, identity management failure) are all represented.
Table RAR-1 gives JHA a single, agreed list of 70 credible threats to its residents, staff, premises, systems and partners. That list is the foundation on which every later BCM decision will rest.
A BCM programme can only prepare for what it has recognised. Without a comprehensive register, attention drifts to the most recent or most dramatic incident, and quieter threats — a single pharmacy supplier, an untested backup, a manager with no deputy — go unexamined until they fail. The register makes the Home's exposure visible to the Board and the Superintendent in one place.
The register now becomes the input to the steps that follow:
A threat register is a living document. JHA's operating environment is changing: the SRHA licensing regime is new, the workforce market for care staff is tightening, more records are moving to cloud services, and the climate is bringing more extreme heat and intense rainfall. The register should be reviewed at least annually, and also after any significant incident, any change in premises, suppliers or systems, and any new regulatory requirement.
Emerging threats need particular attention between reviews. Cyber threats evolve monthly; climate-related threats are intensifying; supply chains remain exposed to regional and global shocks. Assigning someone to monitor these areas — through national advisories, sector networks and supplier updates — keeps the register a true picture rather than a historical record.
A well-maintained register strengthens resilience in practical ways. It gives the Board evidence for governance and assurance, it gives managers a shared language for discussing disruption, and it gives auditors and regulators a clear trail from threat to plan. Most importantly, it keeps the focus where it belongs: on the frail and destitute residents who depend on JHA every hour of every day.
Identifying threats is the first step in protecting JHA's critical services. The Risk Assessment that follows will evaluate the likelihood and impact of each threat in Table RAR-1 and determine how each should be treated.
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S | RAR T1 | RAR T2 | RAR T3 | BCS T1 | CBF |