---
title: [BCM] [JHA] [E3] [RAR] [P2] Treatment and Control
description: How Jamiyah Home for the Aged assesses avoidance, reduction, transference and acceptance for its 70 threats, with existing and planned controls.
image: https://blog.bcm-institute.org/hubfs/JHA%20Graphic%20Folder/JHA%20BCM%20E3%20Morepost/BCM%5D%20%5BJHA%5D%20%5BE3%5D%20%5BRAR%5D%20%5BT2%5D%20Treatment%20and%20Control.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Sustaining Community Services: Implementing BCM at Jamiyah Home for the Aged
# \[BCM\] \[JHA\] \[E3\] \[RAR\] \[P2\] Treatment and Control
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ce18ee1-97ef-4ed4-b16b-5d6ab24cec19)RAR Part 1 identified 70 threats that could disrupt Jamiyah Home for the Aged (JHA). Part 2 asks the next question: what is already in place to address each threat, and is it sufficient?
For most organisations, a disruption means lost output.
For JHA, it can mean a frail resident left without supervision, medication, food, water or safe shelter. The Home (Darul Takrim) has cared for elderly destitute persons around the clock at 1 Tampines Avenue 3 since 1997, with Jamiyah Singapore as managing agent.
Residents cannot be sent home while a problem is being fixed.
The Board and the Superintendent therefore need a clear, evidence-based view of how each threat is treated and controlled before they rate risks or approve continuity strategies.
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng) Oct 21, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/5cd5edea-eed4-45ec-99b3-824e5267fb21)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/121caffe-2e46-49cd-9bc5-976ed1c4cca9)
[![\[BCM\] \[E3\] \[RAR\] \[T1\] \[T2\] \[T3\] Template ](https://no-cache.hubspot.com/cta/default/3893111/a7ace75d-4eac-4e29-9c8c-e7515c73c4bc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a7ace75d-4eac-4e29-9c8c-e7515c73c4bc)
### Risk Assessment Report (RAR) Part 2: Treatment and Control for Jamiyah Home for the Aged
#### Introduction
RAR Part 1 identified 70 threats that could disrupt Jamiyah Home for the Aged (JHA). Part 2 asks the next question: what is already in place to address each threat, and is it sufficient?
For most organisations, a disruption means lost output.
For JHA, it can mean a frail resident left without supervision, medication, food, water or safe shelter. The Home (Darul Takrim) has cared for elderly destitute persons around the clock at 1 Tampines Avenue 3 since 1997, with Jamiyah Singapore as managing agent.
Residents cannot be sent home while a problem is being fixed.
The Board and the Superintendent therefore need a clear, evidence-based view of how each threat is treated and controlled before they rate risks or approve continuity strategies.
##### Threats, treatments and controls
Three terms are used throughout this chapter and must not be confused.
- **A threat** is a potential source of disruption, such as a fire, an infectious disease outbreak or a ransomware attack. The threats here are those approved in RAR Part 1.
- **A risk treatment** is JHA's overall approach to that threat: avoid it, reduce it, transfer part of it, or accept what remains.
- **A control** is a specific measure that puts the treatment into effect, such as a fire alarm, a seven-day medication reserve or a tested backup.
Most threats need more than one treatment. Detection, compartmentation, and evacuation drills reduce fire risk at the Home, and insurance transfers part of its financial consequences. Insurance pays for repairs; it does not move residents to safety. Transference never removes JHA's accountability for the people in its care.
##### Why controls must be tested, not just listed
A control's presence does not mean the risk is managed. A generator that has never run under load, a pandemic plan written for the last outbreak or a backup that has never been restored can give false comfort.
Judge each control on five questions: Is it adequate for the threat? Is it reliable? Does it have a named owner? Has it been tested? Did it work?
Where the answer is no, the weakness is a control gap.
A gap that is merely noted achieves nothing, so each gap in this chapter becomes a planned control with an owner, a priority, a timeframe, and the evidence that it is done.
##### How this chapter supports the rest of the BCM programme
RAR Part 3 will rate likelihood and impact against the controls that actually exist. The Business Continuity Strategy will use the gaps to decide what to fund: reserve stocks, an alternate site, standby suppliers, cross-trained staff. Crisis Management will use the threats and weak points to design realistic exercises.
Operational Resilience will use shared dependencies, such as one caterer or Jamiyah Singapore's shared ICT serving several critical functions, to identify single points of failure.
##### Risk acceptance is a decision, not a default
Some residual risk will always remain. Accepting it is legitimate only when it is informed, documented, approved by the right authority, monitored and reviewed.
An unexamined gap is not an accepted risk, and you should not accept any risk to resident safety simply because fixing it is costly or inconvenient.
#### The Four Risk Treatment Approaches
| Treatment | Meaning at JHA |
| --- | --- |
| **Risk Avoidance** | Remove the source of the risk by stopping, redesigning or never starting the activity. Examples: closing an unsafe ward, retiring unsupported software, prohibiting indoor smoking, not relying on a single halal caterer. |
| **Risk Reduction** | Lower the likelihood or the consequences through detection, redundancy, reserves, cross-training, backups, procedures, drills and exercises. |
| **Risk Transference** | Share part of the financial, contractual or service consequence through insurance, service agreements, warranties or mutual aid. Accountability for residents stays with JHA. |
| **Risk Acceptance** | Formally retain residual risk within appetite, or where further treatment is impracticable or disproportionate, with a named approver, monitoring, and review. |
#### Assessment Basis and Assumptions
The assessment covers all 70 threats in Table RAR-1, in the same order and under the same names. No threats have been added, removed or combined. E
ach table below covers one of the five categories, so the table heading shows the category rather than repeating it in every row.
It relies on the planning assumptions set out in RAR Part 1: a single-site, 24-hour home for frail and often immobile residents; local and foreign care staff on shifts; finance, HR, procurement and some ICT shared with Jamiyah Singapore; halal meals and several support services from external vendors; and income from MSF funding and donations. The Superintendent should confirm these before approving the chapter.
**Evidence limitation.** No JHA documents confirming implemented controls were available. The only control confirmed from a published source is the Home's request that visitors write in to the Superintendent before visiting. All other existing controls are assumed and require validation. Planned controls are recommendations; owners, priorities and timeframes are planning assumptions. Reserve levels and recovery times are taken from the Corporate and Business Unit MBCO chapter of this series.
**Conventions used in the tables**
- **NA\*** — Not Applicable – the threat cannot be fully avoided; reduction and preparedness measures are required.
- **NE** — Not evidenced. **NA** — Not applicable.
- **AV** — Assumed existing control requiring validation.
- Reduction status: **\[Partial\]** partially implemented; **\[Validate\]** dependent on validation; **\[Gap\]** limited by a known control gap.
- Control types: (P) Preventive, (D) Detective, (C) Corrective, (Dir) Directive, (Dt) Deterrent, (Cm) Compensating, (R) Recovery.
- Risk acceptance marked “Not appropriate” means not appropriate for acceptance at the current exposure. “Proposed” acceptance still requires formal approval.
- Planned controls read: owner | priority | timeframe — action. Evidence of completion.
#### Part 1: Treatment and Control Assessment
**Table RAR-2: Treatment and Control for Jamiyah Home for the Aged** is presented in five parts, one per threat category. Numbers match Table RAR-1.
##### Category 1 — Denial of Access: Natural Disaster
Natural hazards in Singapore are rarely catastrophic, but frail residents feel heat, haze and flooding long before a healthy workforce does.
**Table RAR-2-C1: Treatment and Control for Jamiyah Home for the Aged**
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
| --- | --- | --- | --- | --- | --- | --- |
| 1. Flood and flash flood | NA\* | \[Validate\] Drain upkeep, weather monitoring, move residents to upper floors. | NE — water-damage cover unverified. | Not appropriate until flood exposure is mapped. | AV: PUB flood alerts (D); drain and scupper inspections (P); evacuation plan (Dir). | Facilities Officer \| High \| 3 months — map ground-floor wards, kitchen and switch room; raise critical stock; deploy flood barriers on alert. Evidence: exposure map, drill record. |
| 2. Severe storm and Sumatra squall | NA\* | \[Partial\] Roof, window and tree upkeep; outdoor activities stop. | NE — property cover unverified. | NE | AV: MSS warnings (D); roof and window inspections (P). | Facilities Officer \| Medium \| 6 months — pre-squall checklist; arborist check of compound trees; second ambulance access route. Evidence: checklist, arborist report. |
| 3. Lightning | NA\* | \[Partial\] Lightning protection; surge protection unknown. | NE — equipment damage cover unverified. | Brief outdoor pauses accepted by the Superintendent; annual review. | AV: lightning protection to SS 555 (P); MSS lightning alerts (D). | Facilities Officer \| Medium \| 6 months — verify certificate; surge protection on fire alarm, nurse-call, CCTV and ICT circuits. Evidence: certificate, installation record. |
| 4. Earthquake tremors | NA\* | \[Validate\] Evacuation applies; no post-tremor check criteria. | NE — policy terms unverified. | Accepted within appetite (proposed): low likelihood, limited consequence. Approver: Board-delegated committee. Annual review; monitor MSS tremor reports; reconsider if tremors are felt or cracks appear. | AV: evacuation plan (Dir); defect reporting (D). | Facilities Officer \| Low \| 12 months — post-tremor inspection checklist; on-call structural engineer; reassurance script for residents. Evidence: approved checklist. |
| 5. Tsunami | NA\* | NA — negligible exposure at an inland site. | NA | Accepted within appetite (proposed): negligible direct exposure. Approver: Board-delegated committee. Review with the register; trigger: change in national advisories. | AV: general evacuation plan (Dir). | BCM Coordinator \| Low \| annual — no new control; keep under review. Evidence: register review minute. |
| 6. Landslide and slope failure | NA\* | \[Validate\] Flat site; nearby excavation not monitored. | NA | Accepted within appetite (proposed) once alternate access is confirmed. Approver: Superintendent; annual review. | AV: defect reporting (D). | Facilities Officer \| Low \| 12 months — log nearby excavation works; confirm alternate access route. Evidence: site note. |
| 7. Vegetation fire (wildfire) | NA\* | \[Partial\] Windows closed when smoke is noticed. | NA | NE | AV: fire alarm (D); window closure (Dir). | Facilities Officer \| Low \| 9 months — smoke-ingress steps added to the haze action card; clear vegetation next to the building. Evidence: action card. |
| 8. Extreme heat | NA\* | \[Gap\] Relies on air-conditioning and hydration rounds; no ward thresholds. | NA | Not appropriate: residents are highly heat-susceptible. | AV: NEA heat stress advisories (D); hydration rounds (P); fans (Cm). | Nursing Lead and Facilities Officer \| High \| 3 months — ward and kitchen temperature thresholds with actions; high-risk resident list; cool refuge room; daily log. Evidence: protocol, log audit. |
| 9. Transboundary haze | NA\* | \[Partial\] Outings curtailed; indoor filtration unknown. | NA | Short episodes may be accepted by the Superintendent after controls; review each season; trigger: PSI in the unhealthy range. | AV: NEA air-quality monitoring (D); mask stock (P). | Facilities Officer \| Medium \| before the next south-west monsoon — clean-air room with purifiers; PSI-band action card; masks for residents with heart or lung conditions. Evidence: inventory, card. |
| 10. Pandemic-related movement restrictions | NA\* | \[Partial\] COVID-19 experience with video visits and teleconsultation. | NA | NE | AV: video-call visits (Cm); teleconsultation with visiting doctors (Cm). | Superintendent \| Medium \| 6 months — pre-agreed essential-entry list (doctors, vendors); staff travel letters; tele-visit kit. Evidence: list, kit. |
| 11. Sinkhole and ground subsidence | NA\* | \[Validate\] No alternate entrance plan. | NE | Acceptance may be appropriate only after alternate access is confirmed. | AV: defect reporting (D). | Facilities Officer \| Low \| 12 months — alternate vehicle and pedestrian entrance; mark utility shut-offs. Evidence: site plan. |
| 12. Volcanic ash | NA\* | \[Partial\] Staggered home leave limits stranded staff. | NA | Accepted within appetite (proposed): indirect effect only. Approver: Superintendent; annual review; trigger: major regional eruption. | AV: staggered home leave (P). | HR \| Low \| 12 months — covered by travel-restriction controls (No. 37). Evidence: as No. 37. |
*Implementation focus:* Extreme heat and flooding are the natural threats most likely to harm residents. Both need site-specific thresholds and triggers, not general awareness. Several low-exposure threats are proposed for formal acceptance rather than further spending.
##### Category 2 — Denial of Access: Man-made Disaster
Man-made threats range from fire inside the Home to incidents on the roads and estates around Tampines.
The main difficulty is that many residents cannot evacuate a building quickly.
**Table RAR-2-C2: Treatment and Control for Jamiyah Home for the Aged**
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
| --- | --- | --- | --- | --- | --- | --- |
| 13. Fire | Partially Applicable — prohibit indoor smoking, unapproved heaters and unattended charging of mobility aids; enforcement NE. | \[Validate\] Detection, sprinklers, compartmentation and drills. | Partially Applicable — fire insurance via Jamiyah Singapore assumed. Resident safety stays with JHA. | Not appropriate. | AV: fire alarm and sprinklers maintained (P/D); Fire Safety Manager where required (Dir); drills (Dir). | Superintendent and Fire Safety Manager \| High \| 3 months — night-shift drill including bedbound residents; evacuation aid for each non-ambulant resident; grab-and-go list; alternate shelter agreement. Evidence: drill timing, after-action report. |
| 14. Explosion | Partially Applicable — oxygen cylinders and batteries stored away from heat and exits; status NE. | \[Validate\] Storage and charging rules. | NE | Not appropriate. | AV: cylinder storage rules (P); battery charging rules (P). | Nursing Lead and Facilities Officer \| High \| 6 months — oxygen storage audit; signage; fixed charging station away from exits. Evidence: audit. |
| 15. Chemical spill | Partially Applicable — substitute hazardous cleaning products where safer ones exist. | \[Partial\] Storage and safety data sheets. | NE — cleaning vendor liability unverified. | NE | AV: safety data sheets and storage (Dir); spill kit (C). | Facilities Officer and cleaning vendor \| Medium \| 6 months — chemical inventory; spill kits at laundry and stores; vendor training check. Evidence: inventory. |
| 16. Gas leak | Partially Applicable — convert to electric cooking where feasible. | \[Validate\] Installation inspection and isolation. | NE | Not appropriate. | AV: licensed gas worker inspections (P); emergency shut-off (C); detector if fitted (D). | Facilities Officer and Kitchen Supervisor \| High \| 6 months — confirm detector and shut-off; train every kitchen shift; activate standby caterer when the kitchen is closed. Evidence: inspection report. |
| 17. Structural failure and building collapse | Partially Applicable — close unsafe areas pending inspection. | \[Validate\] Periodic inspection of a building in use since 1997. | NE | Not appropriate. | AV: periodic structural inspection under the Building Control Act (D); defect reporting (D). | Facilities Officer \| High \| 6 months — defect register with severity triggers; ward decant plan; on-call engineer. Evidence: register, plan. |
| 18. Civil disturbance, riot and public disorder | NA\* | \[Partial\] Staff alerted through public channels. | NA | Accepted within appetite (proposed): low direct exposure. Approver: Superintendent; annual review; trigger: incident near the Home. | AV: SGSecure alerts (D). | Superintendent \| Low \| 12 months — covered by shift holdover rule (No. 25). Evidence: as No. 25. |
| 19. Terrorism | NA\* | \[Partial\] Security awareness. | NE | Not appropriate. | AV: SGSecure@Workplaces awareness (Dir); visitor registration (Dt). | Superintendent \| Medium \| 6 months — adapt Run, Hide, Tell for immobile residents; include in annual tabletop. Evidence: exercise report. |
| 20. Bomb threat and suspicious item | NA\* | \[Partial\] Police reporting. | NE | Not appropriate. | AV: police reporting procedure (Dir). | Superintendent \| Medium \| 6 months — call checklist at reception; evacuate-or-shelter criteria; search plan. Evidence: checklist. |
| 21. Sabotage and vandalism | Partially Applicable — restrict access to plant rooms. | \[Partial\] Locked plant rooms and CCTV. | NE — property cover unverified. | NE | AV: locked plant rooms (P); CCTV (Dt/D). | Facilities Officer \| Medium \| 6 months — plant-room access list; key register. Evidence: register. |
| 22. Active assailant or intruder | Partially Applicable — visits arranged in advance through the Superintendent. | \[Partial\] Access control and CCTV; guard cover unverified. | NE — security vendor liability unverified. | Not appropriate. | Confirmed (published): visitors asked to write in to the Superintendent before visiting (Dir/Dt). AV: CCTV (D); guard (P). | Superintendent and security vendor \| High \| 6 months — lockdown procedure; panic alarms at reception and night station; de-escalation training. Evidence: procedure, training record. |
| 23. Utility failure affecting access | NA\* | \[Gap\] No plan for upper-floor residents without lifts. | NA | Not appropriate. | AV: lift rescue (C); door manual override (Cm). | Facilities Officer \| High \| 3 months — fail-safe release on electronic doors; evacuation chairs; stay-in-place supplies on upper floors. Evidence: test record. |
| 24. Road closure and major traffic incident | NA\* | \[Partial\] Informal knowledge of alternate routes. | NA | Delays to routine appointments may be accepted by the Nursing Lead; not emergencies. | AV: alternate routes known informally (Cm). | Administration Officer \| Low \| 9 months — documented alternate routes; ambulance access briefing. Evidence: route sheet. |
| 25. Public transport disruption | NA\* | \[Partial\] Outgoing shift holds over. | NA | NE | AV: shift holdover (Cm). | HR and Nursing Lead \| Medium \| 6 months — holdover rule with maximum hours; map staff rail dependency; taxi reimbursement. Evidence: rule, map. |
| 26. Aircraft accident | NA\* | NA — no proportionate site measure. | NE — property cover unverified. | Accepted within appetite (proposed): rare event. Approver: Board-delegated committee; annual review; trigger: change in flight paths. | AV: general evacuation plan (Dir). | BCM Coordinator \| Low \| annual — no new control; relies on fire and cordon controls. Evidence: register review. |
| 27. Nearby industrial accident | NA\* | \[Gap\] No shelter-in-place procedure. | NA | Not appropriate until shelter-in-place exists. | AV: SCDF public alerts (D). | Superintendent \| Medium \| 6 months — shelter-in-place procedure (close windows, stop fresh-air intake, headcount); annual exercise. Evidence: procedure, exercise report. |
*Implementation focus:* The decisive gap is the absence of a tested way to move or shelter immobile residents. Fire, structural failure, nearby industrial plumes, and utility failure all point to that need.
##### Category 3 — Unavailability of People
Continuity at JHA is first a staffing problem. Residents need hands-on care every hour, and only competent staff can perform some tasks, such as medication.
**Table RAR-2-C3: Treatment and Control for Jamiyah Home for the Aged**
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
| --- | --- | --- | --- | --- | --- | --- |
| 28. Pandemic and epidemic | NA\* | \[Partial\] COVID-19 experience; plan currency unverified. | NA — duty of care cannot be transferred. | Not appropriate. | AV: MOH guidance adopted (Dir); PPE stock (P); split teams (Cm); vaccination records (P). | Nursing Lead and HR \| High \| 6 months — staffing actions at 20%, 30% and 40% absence; 14-day PPE reserve; live-in contingency; tabletop. Evidence: plan, stock count, exercise. |
| 29. Infectious disease outbreak within the Home | Partially Applicable — pause admissions and group activities during an outbreak. | \[Validate\] Infection prevention and control. | NE — specialist cleaning contract unverified. | Not appropriate. | AV: IPC procedures (P); symptom surveillance (D); MOH notification (Dir); isolation room (C). | Nursing Lead \| High \| 3 months — line-list template; floor-by-floor cohorting plan; IPC link nurse; outbreak drill. Evidence: drill report. |
| 30. Labour strike and industrial action | NA\* | \[Partial\] Stable industrial relations; vendor dependence remains. | Partially Applicable — vendor contracts. | Accepted within appetite (proposed) for direct strike risk. Approver: Superintendent; annual review; trigger: vendor labour dispute. | AV: vendor contracts (Dir). | Procurement \| Low \| 9 months — covered by vendor continuity clauses (No. 52). Evidence: as No. 52. |
| 31. High staff turnover and mass resignation | NA\* | \[Partial\] Recruitment and handover notes. | Partially Applicable — agency staffing, arrangement NE. | NE | AV: recruitment (P); handover notes (Cm). | HR \| High \| 6 months — one-page profile of each resident's needs and preferences; retention review; agency agreement. Evidence: profiles, agreement. |
| 32. Loss of key personnel | Partially Applicable — remove sole-person dependency for critical roles. | \[Gap\] No named deputies or written delegation. | NE — secondment from Jamiyah Singapore not formalised. | Not appropriate. | AV: job descriptions (Dir); leave handovers (Cm). | Superintendent and Jamiyah HR \| High \| 3 months — named alternate per critical role; written delegation for emergency spending and MSF reporting; exercise. Evidence: delegation schedule. |
| 33. Skills shortage | Partially Applicable — redesign tasks so qualified staff focus on qualified duties. | \[Partial\] Training and recruitment. | NE | Not appropriate if medication-competent cover lapses. | AV: competency records (D). | Nursing Lead \| High \| 6 months — skills matrix by shift; cross-training for permitted medication tasks; dementia-care training. Evidence: matrix. |
| 34. Workplace injury | Partially Applicable — prohibit manual lifts where a hoist is required. | \[Partial\] Safe handling training. | Partially Applicable — work injury compensation insurance assumed. | NE | AV: work injury insurance (Cm); safe handling training (P); incident reporting (D). | HR and Nursing Lead \| Medium \| 6 months — hoist use audit; injury trend review. Evidence: audit. |
| 35. Workplace violence | Partially Applicable — restrict lone working with residents at known risk. | \[Partial\] Incident reporting. | NE | Not appropriate. | AV: incident reporting (D); MSF reporting (Dir). | Nursing Lead \| High \| 6 months — de-escalation training; behaviour care plans; post-incident debrief. Evidence: training record. |
| 36. Staff fatigue and psychological stress | Partially Applicable — cap consecutive shifts. | \[Partial\] Shift patterns and supervision. | NE — Employee Assistance Programme unverified. | NE | AV: shift patterns (P); supervisor check-ins (D). | HR \| Medium \| 6 months — maximum-hours rule during incidents; counselling access; post-incident welfare check. Evidence: policy. |
| 37. Travel restrictions | NA\* | \[Partial\] Staggered home leave. | NA | NE | AV: staggered leave (P); pass tracking (D). | HR \| Medium \| 6 months — cap concurrent home leave per shift; map nationality concentration; local relief pool. Evidence: leave policy. |
| 38. Mandatory quarantine and isolation | NA\* | \[Partial\] Contingency rosters. | NA | Not appropriate below the safe minimum roster. | AV: contingency rosters (Cm). | HR and Nursing Lead \| High \| 3 months — test loss of a full shift team; standby pool with Jamiyah Nursing Home. Evidence: exercise record. |
| 39. Family emergencies | NA\* | \[Partial\] Emergency leave. | NA | NE | AV: emergency leave procedure (Dir). | HR \| Medium \| 6 months — festive-period leave planning; relief pool. Evidence: leave plan. |
| 40. Loss of volunteers and visiting partners | Partially Applicable — essential care never relies on volunteers. | \[Partial\] Volunteer rosters. | Partially Applicable — partner agreements NE. | Pause of group activities accepted by the Superintendent within the CBF-12 MTPD of 30 days. | AV: volunteer rosters (Dir). | Programme Coordinator \| Low \| 9 months — staff-led minimum activity plan; teleconsultation fallback for visiting doctors. Evidence: plan. |
*Implementation focus:* An available person is not always a suitable replacement. Controls must protect competence on every shift, especially for medication and night supervision.
##### Category 4 — Disruption to the Supply Chain
JHA depends on caterers, pharmacies, utilities, vendors, and Jamiyah Singapore's shared services. Contracts can share some consequences, but the Home still has to feed and medicate residents today.
**Table RAR-2-C4: Treatment and Control for Jamiyah Home for the Aged**
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
| --- | --- | --- | --- | --- | --- | --- |
| 41. Catering and food supplier failure | Partially Applicable — avoid a single halal caterer. | \[Gap\] Three-day reserve set in the MBCO not evidenced. | Partially Applicable — service levels unverified. | Not appropriate (MTPD 12 hours). | AV: catering contract (Dir); dry stock (Cm). | Kitchen Supervisor and Procurement \| High \| 3 months — standby halal caterer for texture-modified diets; three-day reserve with rotation; printed diet list. Evidence: agreement, stock audit. |
| 42. Outsourcing and shared services failure | Partially Applicable — keep minimum emergency authority at the Home. | \[Validate\] Payroll, HR, finance and ICT rely on Jamiyah Singapore. | Partially Applicable — internal service arrangement; accountability stays with JHA. | Not appropriate for payroll. | AV: shared services from Jamiyah Singapore (Dir). | Superintendent and Jamiyah Finance \| High \| 6 months — service schedule with continuity commitments; local emergency purchasing authority; offline payroll fallback. Evidence: signed schedule. |
| 43. Medication and medical supply disruption | Partially Applicable — avoid dependence on one pharmacy. | \[Gap\] Seven-day reserve set in the MBCO not evidenced. | Partially Applicable — pharmacy agreement unverified. | Not appropriate. | AV: supply via polyclinic, hospital or pharmacy (Dir); stock checks (D). | Nursing Lead \| High \| 3 months — seven-day reserve of time-critical medicines; alternate pharmacy; minimum continence and wound stock; emergency prescribing route. Evidence: stock check. |
| 44. Utility failure | NA\* | \[Validate\] Standby power and roof tank. | NA | Not appropriate (CBF-4 RTO 4 hours). | AV: emergency lighting (Cm); roof tank (Cm); fault reporting (D). | Facilities Officer \| High \| 3 months — critical-load list; generator or mobile generator hire; bottled water reserve (illustratively 3 litres per resident per day for 3 days); water bowser arrangement. Evidence: load list, stock count. |
| 45. Telecommunications provider failure | Partially Applicable — avoid a single carrier. | \[Partial\] Fixed line and staff mobiles. | Partially Applicable — carrier terms unverified. | NE | AV: fixed line and mobiles (Cm). | Jamiyah ICT \| High \| 6 months — second-carrier mobile router; printed contacts for MSF, hospitals and next of kin; monthly test. Evidence: test log. |
| 46. Cloud service provider failure | Partially Applicable — avoid providers without data export. | \[Validate\] Vendor support. | Partially Applicable — provider terms unverified. | NE | AV: vendor support (C). | Jamiyah ICT \| Medium \| 6 months — data export test; exit plan for critical services. Evidence: test record. |
| 47. Fuel supply disruption | NA\* | \[Validate\] On-site fuel only. | NE | Not appropriate. | AV: on-site diesel (Cm). | Facilities Officer \| High \| 3 months — minimum 24-hour fuel; priority refuelling contract. Evidence: contract, dip reading. |
| 48. Logistics and transportation failure | Partially Applicable — avoid one transport provider. | \[Partial\] Bookings with providers. | Partially Applicable — provider terms unverified. | Routine appointment delays may be accepted with the doctor's agreement. | AV: transport bookings (Dir). | Case Management and Nursing Lead \| Medium \| 6 months — second provider; list of time-critical appointments. Evidence: agreement. |
| 49. Banking and payment system failure | Partially Applicable — avoid one payment channel. | \[Partial\] Dual authorisation. | NA | Short delays to non-critical payments accepted by Finance; never payroll. | AV: dual authorisation (P); petty cash (Cm). | Jamiyah Finance \| Medium \| 6 months — petty cash float; second bank channel; emergency spending authority. Evidence: delegation. |
| 50. Regulatory and funding change | NA\* | \[Partial\] Regulatory monitoring. | NA | NE | AV: MSF liaison (D); budgeting (P). | Superintendent \| Medium \| 6 months — gap review against Social Residential Homes Act 2025 licensing conditions; three-month funding-delay scenario. Evidence: gap review. |
| 51. Import restrictions and food supply shocks | Partially Applicable — diversify halal sources. | \[Partial\] Menu flexibility. | NA | Menu substitutions accepted by the Kitchen Supervisor within dietary guidance. | AV: menu flexibility (Cm). | Kitchen Supervisor \| Low \| 9 months — approved substitute list per staple item. Evidence: list. |
| 52. Vendor insolvency and contract termination | Partially Applicable — financial checks before award. | \[Partial\] Vendor registration. | Partially Applicable — exit clauses unverified. | NE | AV: vendor registration (P). | Procurement \| Medium \| 6 months — continuity, notice and exit-assistance clauses at renewal; standby vendors. Evidence: revised contracts. |
| 53. Third-party cyber incident | Partially Applicable — avoid vendors without minimum security. | \[Validate\] Contract terms. | NE — vendor indemnity unverified. | Not appropriate: JHA keeps its PDPA obligations. | AV: vendor contracts (Dir). | Data Protection Officer and Procurement \| High \| 6 months — data protection and breach-notification clauses; vendor security questionnaire. Evidence: clauses. |
| 54. Single source dependency | Partially Applicable — diversify where a market exists. | \[Gap\] No single-source register. | NE | NE | AV: supplier list (D). | Procurement \| High \| 6 months — single-source register; qualify alternatives for halal catering, pharmacy, lift maintenance and system administration. Evidence: register. |
*Implementation focus:* The MBCO already sets reserve levels for food, medication, water and PPE. The task now is to prove those reserves exist, rotate and can be replenished from a second source.
##### Category 5 — Equipment and IT-Related Disruption
Technology at JHA supports care rather than delivers it, but care records, medication charts, nurse-call and powered care equipment now sit close to the resident.
**Table RAR-2-C5: Treatment and Control for Jamiyah Home for the Aged**
| Threat | Existing Risk Treatment – Risk Avoidance | Existing Risk Treatment – Risk Reduction | Existing Risk Treatment – Risk Transference | Existing Risk Treatment – Risk Acceptance | Existing Controls | Additional Planned Controls |
| --- | --- | --- | --- | --- | --- | --- |
| 55. Ransomware | Partially Applicable — prohibit unsupported operating systems. | \[Validate\] Endpoint protection, patching and backups. | NE — cyber insurance unverified. | Not appropriate. | AV: endpoint protection (P/D); patching (P); multi-factor authentication (P); backups (R). | Jamiyah ICT \| High \| 6 months — attain CSA Cyber Essentials; offline or immutable backups; ransomware tabletop with JHA. Evidence: certification, exercise. |
| 56. Malware, phishing and business email compromise | Partially Applicable — no bank-detail change on email alone. | \[Partial\] Filtering and dual approval. | NE | NE | AV: email filtering (P); dual authorisation (P). | Jamiyah Finance and ICT \| High \| 3 months — call-back verification for payment changes; phishing simulation. Evidence: results. |
| 57. Distributed Denial of Service (DDoS) | NA\* | \[Partial\] Hosting provider protection. | Partially Applicable — hosting terms. | Accepted within appetite (proposed): no care impact. Approver: Superintendent; annual review; trigger: greater reliance on online giving. | AV: hosting protection (P). | Jamiyah ICT \| Low \| 12 months — alternative donation channel published. Evidence: channel live. |
| 58. Insider threat | Partially Applicable — least-privilege access. | \[Partial\] Two-person handling of residents' money. | NE — fidelity cover unverified. | Not appropriate. | AV: two-signature resident money handling (P); controlled drug register (D). | Superintendent \| High \| 6 months — surprise audits of residents' money and medicines; access recertification. Evidence: audit reports. |
| 59. Data breach | Partially Applicable — minimise data; no resident data on personal messaging apps. | \[Partial\] Access controls. | NE — cyber liability cover unverified. | Not appropriate. | AV: Data Protection Officer under the PDPA (Dir); access controls (P). | Data Protection Officer \| High \| 6 months — breach playbook covering PDPC and MSF notification; messaging-app audit; tabletop. Evidence: playbook. |
| 60. Network and internet failure | Partially Applicable — avoid a single link. | \[Partial\] ISP support. | Partially Applicable — ISP terms unverified. | NE | AV: ISP support (C). | Jamiyah ICT \| High \| 6 months — secondary link; offline documentation mode on care tablets. Evidence: failover test. |
| 61. Server and hardware failure | Partially Applicable — retire end-of-life devices. | \[Partial\] Asset register. | Partially Applicable — warranties. | NE | AV: asset register (D). | Jamiyah ICT \| Medium \| 6 months — spare tablet per floor; next-day replacement. Evidence: spares count. |
| 62. Software failure and database corruption | Partially Applicable — retire unsupported applications. | \[Validate\] Change approval and backups. | Partially Applicable — vendor service level. | Not appropriate for care data. | AV: change approval (P); backups (R). | Jamiyah ICT and Nursing Lead \| High \| 3 months — rollback test; medication record reconciliation after any restore. Evidence: test record. |
| 63. Cloud service outage | NA\* | \[Gap\] No downtime procedure. | Partially Applicable — provider terms. | NE | AV: vendor status monitoring (D). | Nursing Lead and Jamiyah ICT \| High \| 3 months — weekly offline care pack (care plans, medication charts, allergies, next of kin); downtime forms. Evidence: pack audit. |
| 64. Power failure | NA\* | \[Validate\] UPS and generator. | NA | Not appropriate. | AV: UPS (R); generator if installed (R). | Facilities Officer and Nursing Lead \| High \| 3 months — quarterly on-load generator test; list of power-dependent residents; manual repositioning schedule. Evidence: test record. |
| 65. Loss of telecommunications and mobile communications | NA\* | \[Partial\] Fixed and mobile lines. | NA | Not appropriate. | AV: fixed line and mobiles (Cm). | Superintendent and Jamiyah ICT \| High \| 3 months — two-way radios between floors; printed contacts; runner procedure to reach 995. Evidence: radio test. |
| 66. Backup failure | Partially Applicable — discontinue unreliable methods. | \[Validate\] Restores untested. | Partially Applicable — managed backup terms. | Not appropriate. | AV: scheduled backups (R); failure alerts (D). | Jamiyah ICT \| High \| 3 months — quarterly restore test against the four-hour RTO. Evidence: restore report. |
| 67. Data centre and server room failure | Partially Applicable — avoid single-site hosting. | \[Validate\] Shared with Jamiyah Singapore. | Partially Applicable — hosting terms. | Not appropriate. | AV: server room cooling (P). | Jamiyah ICT \| Medium \| 6 months — recovery test of shared systems; JHA care systems placed first in Jamiyah's recovery order. Evidence: recovery plan. |
| 68. Authentication and identity management failure | Partially Applicable — avoid a single sign-in route. | \[Gap\] Out-of-hours lockout risk. | NE | NE | AV: helpdesk reset (C). | Jamiyah ICT \| Medium \| 6 months — sealed break-glass account for the night nurse-in-charge; out-of-hours support. Evidence: test log. |
| 69. Care and safety equipment failure | Partially Applicable — withdraw unserviceable equipment. | \[Partial\] Servicing and spare oxygen. | Partially Applicable — warranties and rental. | Not appropriate. | AV: servicing (P); spare oxygen (Cm); nurse-call maintenance (P). | Nursing Lead and Facilities Officer \| High \| 3 months — register with a backup for each item (oxygen, suction, hoists, mattresses, nurse-call, medicine fridges); fridge alarms; rental agreements. Evidence: register. |
| 70. Artificial intelligence system failure | Applicable (proposed) — prohibit AI-only clinical decisions. | \[Partial\] Use assumed limited. | NE | Accepted within appetite (proposed) while use is limited. Approver: Superintendent; annual review; trigger: new AI tool adopted. | AV: limited use (Dir). | Superintendent and Jamiyah ICT \| Low \| 12 months — AI use register; human-review rule. Evidence: register. |
*Implementation focus:* For JHA, the most important question is whether staff can still give the right care to the right resident when every screen is dark and the power is off.
#### Part 2: Priority Control Gaps
Six gaps recur across many threats. Closing them lowers exposure in several categories at once, so they should lead the improvement plan.
**Table RAR-2A: Cross-Cutting Control Gaps**
| Gap | Threats affected (RAR-1 numbers) | Owner |
| --- | --- | --- |
| No tested way to evacuate, shelter or relocate immobile residents, and no alternate site agreement | 1, 13, 17, 19, 22, 23, 27 | Superintendent / Jamiyah Singapore |
| Reserves set in the MBCO (food, water, medication, PPE, fuel) not evidenced | 28, 41, 43, 44, 47, 54 | Kitchen Supervisor / Nursing Lead / Facilities Officer |
| No named alternates or written delegation for critical roles | 32, 38, 42 and every major incident | Superintendent / Jamiyah HR |
| No paper fallback for care-critical information | 55, 60, 62, 63, 64, 67 | Nursing Lead / Jamiyah ICT |
| Standby power and power-dependent care equipment untested | 3, 44, 47, 64, 69 | Facilities Officer / Nursing Lead |
| Recovery arrangements never exercised | All categories | BCM Coordinator |
Before relying on any assumed control, its owner should confirm that it exists, who owns it, that its design matches the threat, that it works in normal conditions, and that it works under disruption within the RTO. Policies alone are not evidence; inspection records, test results and exercise reports are. Where an unverified control could expose residents to immediate harm, the owner should take interim action now rather than wait for the indicated timeframe.
#### Part 3: Formal Risk Acceptance
No formally approved risk acceptance at JHA has been evidenced. The tables propose acceptance for a small number of threats where exposure is low or the effect is indirect. These proposals are summarised below for decision.
**Table RAR-2B: Proposed Risk Acceptances**
| Threats | Rationale | Approver |
| --- | --- | --- |
| 4. Earthquake tremors; 5. Tsunami; 26. Aircraft accident | Low likelihood or negligible direct exposure; general emergency procedures apply | Board-delegated committee for JHA |
| 6. Landslide; 11. Sinkhole (once alternate access is confirmed); 12. Volcanic ash; 18. Civil disturbance; 30. Labour strike | Limited or indirect effect, covered by other controls | Superintendent |
| 57. DDoS; 70. Artificial intelligence system failure | No direct effect on resident care at current levels of use | Superintendent |
**Table RAR-2C: Risk Acceptance Requirements**
| Requirement | Application at JHA |
| --- | --- |
| Rationale | State why further treatment is unnecessary, impracticable or disproportionate, with evidence. |
| Approving authority | Superintendent for minor operational residual risks; the Board of Jamiyah Singapore, or its delegated committee for JHA, for anything affecting resident welfare, regulatory standing or significant cost. |
| Monitoring | Name the indicator watched, such as PSI readings, tremor reports or incident trends. |
| Review | At least annually with the Threat Register, and after any incident, exercise finding or material change. |
| Reconsideration triggers | Control failure, change in resident profile or capacity, new licensing conditions under the Social Residential Homes Act 2025, or a new MSF or MOH directive. |
| Limit | Never accept a risk that would breach a statutory duty, a licensing condition or the Corporate MBCO. |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/6755d2e8-5050-4a5e-be0a-a1568a65e0ed)
This chapter has examined all 70 threats in JHA's Threat Register through the four treatment approaches. The pattern is clear. Few threats can be avoided outright; most must be reduced through preparedness. Insurance and contracts can share some consequences, but they cannot care for a resident. Formal acceptance is proposed for only ten low-exposure threats, with limited operational acceptance for a few others, such as short haze episodes. Each acceptance still needs an approver, a review date and a trigger.
The assessment also shows that JHA's existing controls are, for now, assumptions. Many probably exist, given the Home's long operation, its regulatory obligations and its experience of COVID-19. Until they are inspected, owned and tested, the Board cannot rely on them. Six cross-cutting gaps stand out: moving or sheltering immobile residents, verified reserves, named alternates, a paper fallback for care records, tested standby power and a programme of exercises.
The next stage, RAR Part 3: Risk Impact and Likelihood Assessment, will rate each threat against the controls that are actually confirmed. Those ratings, with the gaps identified here, will shape the Business Continuity Strategy and the Board's decisions on what to fund to keep every resident safe, supervised and cared for during a disruption.
*Assessment note from the author: all existing controls are assumed and require validation; planned controls, owners and timeframes are recommendations. ISO 22301, ISO 22313, ISO 31000 and ISO 31010 provide requirements and guidance; they are not Singapore regulatory authorities.*
**Comments**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng"
},
"dateModified" : "2026-10-21T10:33:55.792Z",
"datePublished" : "2026-10-21T10:33:55.000Z",
"headline" : "[BCM] [JHA] [E3] [RAR] [P2] Treatment and Control",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-jha-e3-rar-p2-treatment-and-control",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```