---
title: [BCM] [JS] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment
description: [BCM] [JS] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment
image: https://blog.bcm-institute.org/hubfs/Jamiyah%20Singapore%20Graphic%20Folder/JS%20BCM%20E3%20Morepost/BCM%5D%20%5BJS%5D%20%5BE3%5D%20%5BRAR%5D%20%5BT3%5D%20Risk%20Impact%20and%20Likelihood%20Assessment.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Resilient Communities: Implementing Business Continuity Management at Jamiyah Singapore
# \[BCM\] \[JS\] \[E3\] \[RAR\] \[P3\] Risk Impact and Likelihood Assessment
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b764264e-ccf8-489f-9125-6bdfc8db17b3)
Risk Impact and Likelihood Assessment is the third component of the Risk Analysis and Review (RAR) methodology.
It builds upon the threats identified in RAR Part 1 — List of Threats and the treatment and control assessment developed in RAR Part 2 — Treatment and Control.
This assessment determines the potential consequences of each identified threat, estimates its likelihood of occurrence, and establishes a risk rating to support management decision-making.
For Jamiyah Singapore (JS), the assessment must consider more than financial loss or administrative disruption.
As a charitable and community service organisation, JS may provide services to residents, children, students, vulnerable individuals and families who depend on timely care and assistance.
Disruption to these services could affect beneficiary safety, safeguarding, continuity of care, essential welfare support, regulatory obligations and public confidence.
[![Banner \[BCM\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng) Oct 15, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
### [![\[BCM\] \[JS\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/7a1ba6dc-8352-46e7-b150-d25945acf3d9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7a1ba6dc-8352-46e7-b150-d25945acf3d9)
#### ****Risk Impact and Likelihood Assessment**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/972f1733-4274-42e5-9fc6-fe3acf70f929)[![Banner \[BCM\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1626b4db-b5dd-4c9d-8d1d-c84aa9a691f1)**
### **RAR Part 3: Risk Impact and Likelihood Assessment for Jamiyah Singapore**
#### Introduction
[![\[BCM\] \[JS\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/f4035e58-2c2f-4b9b-aa1d-4e24ef7507fe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4035e58-2c2f-4b9b-aa1d-4e24ef7507fe)Risk Impact and Likelihood Assessment is the third component of the Risk Analysis and Review (RAR) methodology. It builds upon the threats identified in RAR Part 1 — List of Threats and the treatment and control assessment developed in RAR Part 2 — Treatment and Control.
The purpose of this assessment is to determine the potential consequences of each identified threat, estimate its likelihood of occurrence and establish a risk rating that supports management decision-making.
For Jamiyah Singapore (JS), the assessment must consider more than financial loss or administrative disruption. As a charitable and community service organisation, JS may provide services to residents, children, students, vulnerable individuals and families who depend on timely care and assistance.
Disruption to these services could affect beneficiary safety, safeguarding, continuity of care, essential welfare support, regulatory obligations and public confidence.
Consequently, the assessment evaluates threats across seven impact areas:
1. Finance.
2. Operations.
3. Legal and Regulatory.
4. Reputation and Image.
5. Social Responsibility.
6. People.
7. Assets, IT Systems and Information.
The assessment uses the highest impact score across these seven areas, together with the estimated likelihood, to calculate the overall risk rating.
##### **Relationship Between RAR Parts 1, 2 and 3**
**\**
**Risk Analysis and Review Methodology**
RAR Part 1 — List of Threats
Identify credible sources of disruption
RAR Part 2 — Treatment and Control
Identify and validate existing controls and planned improvements
RAR Part 3 — Risk Impact and Likelihood Assessment
Score consequences, likelihood and overall risk
Risk Treatment and BCM Improvement
Prioritise additional controls, recovery capabilities and assurance activities
##### **Assessment Assumptions**
The scores in this chapter are illustrative planning estimates, not verified JS risk ratings.
They assume a Singapore-based, multi-service charitable organisation with residential care, education, welfare assistance, ICT and external supplier dependencies.
The assessment takes a conservative view of consequences for beneficiary safety and continuity of essential care.
Because the controls described in RAR Part 2 have not been independently validated, these scores should be treated as provisional scenario-based assessments, rather than confirmed residual risk ratings.
The expected disruption periods are illustrative planning windows for material interruption of an affected service. They are not approved Recovery Time Objectives (RTOs), Maximum Tolerable Periods of Disruption (MTPDs), or predictions of incident duration.
#### **Risk Assessment Methodology**
##### **Impact Scoring Scale**
| Score | Impact Classification | General Interpretation |
| --- | --- | --- |
| 1 | Insignificant | Negligible service interruption, limited inconvenience and no material beneficiary harm. |
| 2 | Minor | Localised disruption manageable through routine operational arrangements. |
| 3 | Moderate | Noticeable service degradation, additional resources or management intervention required. |
| 4 | Major | Serious disruption to critical services, significant beneficiary consequences or substantial recovery requirements. |
| 5 | Severe / Critical | Potential loss of life, serious safeguarding consequences, prolonged essential service failure or severe organisational consequences. |
The seven impact areas should be assessed individually.
A high score in People or Social Responsibility should not be averaged down by lower financial consequences.
##### **Likelihood Scoring Scale**
| Score | Likelihood Classification | Assessment Interpretation |
| --- | --- | --- |
| 1 | Rare | Exceptional circumstances; limited relevant occurrence or exposure. |
| 2 | Unlikely | Credible but infrequent under the assessed operating conditions. |
| 3 | Possible | Plausible during the assessment horizon. |
| 4 | Likely | Recurring exposure or conditions make occurrence relatively frequent. |
| 5 | Almost Certain | Expected repeatedly or persistently under the assessed operating conditions. |
For this illustrative assessment, the likelihood horizon is assumed to be three years. JS should approve its own assessment horizon and scoring definitions before adopting the register.
##### **Risk Rating Calculation**
Risk Impact =\\max(F,O,L,R,S,P,A) \\\]
Where the seven variables represent Finance, Operations, Legal and Regulatory, Reputation, Social Responsibility, People, and Assets/IT/Information.
Risk Rating = Highest Impact Score times Likelihood Score
##### **Risk Level Classification**
| Risk Rating | Risk Level | Management Interpretation |
| --- | --- | --- |
| 1–4 | Low | Manage through routine controls and monitoring. |
| 5–9 | Moderate | Review controls and address identified weaknesses. |
| 10–14 | High | Prioritise management attention and targeted improvements. |
| 15–19 | Very High | Escalate for senior management review and timely treatment. |
| 20–25 | Critical | Require urgent executive attention and assessment of immediate safeguards. |
These bands are proposed for the eBook and are not presented as an ISO-mandated matrix.
#### **Risk Rating Matrix**
Illustrative 5 × 5 matrix. Select a cell to view its classification.
**\**
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cc5424e8-db70-448e-a9f9-67596ef970f6)
#### **Risk Impact and Likelihood Assessment Register**
Table RAR Part 3: Risk Impact and Likelihood Assessment for Jamiyah Singapore
The following tables reproduce the 108 specific threats from the preceding RAR Part 1 register, grouped into five categories. Threat names are retained, including threats with similar names that represent different disruption mechanisms.
To keep the tables readable, the seven impact columns use abbreviated headings:
- F: Finance; O: Operations; L&R: Legal & Regulatory; R&I: Reputation & Image; SR: Social Responsibility; P: People; A/IT/I: Assets/IT Systems/Information.
- Highest: Risk Impact Area (Highest Numeric Score); Likelihood: Risk Likelihood; Rating: Risk Rating; Level: Risk Level; Disruption: Expected Period of Disruption.
All seven impact values and likelihood values use the five-point scale above. Disruption periods represent planning estimates, not acceptable interruption thresholds.
##### **Category 1: Denial of Access – Natural Disaster**
| Threat | F | O | L&R | R&I | SR | P | A/IT/I | Highest | Likelihood | Rating | Level | Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Flood | 3 | 4 | 3 | 3 | 4 | 4 | 3 | 4 | 3 | 12 | High | 4–48 hours |
| Flash Flood | 2 | 4 | 2 | 3 | 4 | 4 | 2 | 4 | 4 | 16 | Very High | 2–24 hours |
| Severe Thunderstorm | 2 | 3 | 2 | 2 | 3 | 3 | 3 | 3 | 4 | 12 | High | 1–12 hours |
| Lightning Strike | 3 | 3 | 2 | 2 | 3 | 4 | 4 | 4 | 3 | 12 | High | 2–24 hours |
| Earthquake and Regional Tremors | 3 | 4 | 3 | 3 | 4 | 4 | 4 | 4 | 2 | 8 | Moderate | 4–72 hours |
| Tsunami or Coastal Inundation | 4 | 5 | 4 | 4 | 5 | 5 | 4 | 5 | 1 | 5 | Moderate | 1–7 days |
| Landslide or Slope Failure | 3 | 4 | 3 | 3 | 4 | 4 | 4 | 4 | 2 | 8 | Moderate | 1–7 days |
| Vegetation or Wildfire | 3 | 4 | 3 | 3 | 4 | 4 | 3 | 4 | 2 | 8 | Moderate | 4–48 hours |
| Extreme Heat | 2 | 4 | 3 | 3 | 4 | 5 | 3 | 5 | 4 | 20 | Critical | 4–72 hours |
| Transboundary Haze | 2 | 3 | 3 | 3 | 4 | 4 | 2 | 4 | 3 | 12 | High | 1–14 days |
| Pandemic-Related Movement Restrictions | 3 | 5 | 4 | 4 | 5 | 4 | 2 | 5 | 2 | 10 | High | 1–8 weeks |
| Prolonged Severe Weather | 3 | 4 | 3 | 3 | 4 | 4 | 3 | 4 | 3 | 12 | High | 1–7 days |
| Sinkhole or Ground Subsidence | 3 | 4 | 3 | 3 | 4 | 4 | 4 | 4 | 2 | 8 | Moderate | 1–14 days |
| Regional Volcanic Ash | 2 | 3 | 2 | 2 | 3 | 2 | 2 | 3 | 1 | 3 | Low | 1–7 days |
| Coastal Storm Surge and Sea-Level Extremes | 4 | 5 | 4 | 4 | 5 | 5 | 4 | 5 | 2 | 10 | High | 1–14 days |
Assessment interpretation: Flooding, severe weather, heat stress and haze warrant attention because of Singapore's climatic conditions. However, the most severe consequences arise where an event threatens the safety or habitability of premises occupied by vulnerable residents.
For example, the proposed Critical rating for extreme heat assumes a prolonged cooling failure affecting highly vulnerable residents, not merely hot outdoor weather. The rating should be reduced if the scenario does not apply to JS's actual facilities.
##### **Category 2: Denial of Access – Man-made Disaster**
| Threat | F | O | L&R | R&I | SR | P | A/IT/I | Highest | Likelihood | Rating | Level | Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Building Fire | 4 | 5 | 4 | 4 | 5 | 5 | 5 | 5 | 3 | 15 | Very High | 1–30 days |
| Explosion | 4 | 5 | 4 | 4 | 5 | 5 | 5 | 5 | 2 | 10 | High | 1–30 days |
| Chemical Spill | 3 | 4 | 4 | 4 | 5 | 5 | 3 | 5 | 2 | 10 | High | 4–72 hours |
| Gas Leak | 3 | 4 | 4 | 4 | 5 | 5 | 4 | 5 | 3 | 15 | Very High | 4–72 hours |
| Structural Failure | 4 | 5 | 4 | 4 | 5 | 5 | 5 | 5 | 2 | 10 | High | 1–30 days |
| Building Collapse | 5 | 5 | 5 | 5 | 5 | 5 | 5 | 5 | 1 | 5 | Moderate | 7–90 days |
| Civil Disturbance | 2 | 4 | 3 | 3 | 4 | 4 | 2 | 4 | 2 | 8 | Moderate | 4–48 hours |
| Riot | 3 | 4 | 3 | 4 | 4 | 5 | 3 | 5 | 1 | 5 | Moderate | 1–7 days |
| Terrorist Attack | 5 | 5 | 5 | 5 | 5 | 5 | 5 | 5 | 2 | 10 | High | 1–90 days |
| Bomb Threat or Suspicious Object | 2 | 4 | 3 | 3 | 4 | 4 | 2 | 4 | 2 | 8 | Moderate | 2–24 hours |
| Sabotage or Deliberate Property Damage | 3 | 4 | 4 | 4 | 4 | 4 | 4 | 4 | 3 | 12 | High | 4–72 hours |
| Active Assailant | 4 | 5 | 5 | 5 | 5 | 5 | 3 | 5 | 2 | 10 | High | 1–30 days |
| Public Disorder Near Facilities | 2 | 3 | 2 | 3 | 3 | 4 | 2 | 4 | 3 | 12 | High | 2–24 hours |
| Utility Infrastructure Incident | 3 | 4 | 3 | 3 | 4 | 4 | 4 | 4 | 3 | 12 | High | 4–72 hours |
| Road Closure | 2 | 3 | 2 | 2 | 3 | 3 | 1 | 3 | 4 | 12 | High | 2–24 hours |
| Public Transport Disruption | 2 | 4 | 2 | 3 | 4 | 3 | 1 | 4 | 4 | 16 | Very High | 2–24 hours |
| Major Traffic Incident | 2 | 3 | 2 | 3 | 4 | 4 | 2 | 4 | 4 | 16 | Very High | 2–12 hours |
| Aircraft Accident | 3 | 4 | 3 | 3 | 4 | 5 | 4 | 5 | 1 | 5 | Moderate | 1–14 days |
| Nearby Industrial Accident | 3 | 5 | 4 | 4 | 5 | 5 | 4 | 5 | 2 | 10 | High | 1–14 days |
| Construction Accident or Excavation Damage | 3 | 4 | 3 | 3 | 4 | 4 | 4 | 4 | 3 | 12 | High | 4–72 hours |
| Security Lockdown or Police Cordoning | 2 | 4 | 3 | 3 | 4 | 4 | 2 | 4 | 3 | 12 | High | 4–72 hours |
Assessment interpretation: Building fire, gas leak and major security incidents may have severe consequences even when their occurrence is infrequent.
For JS, the operational implications include evacuation, loss of residential accommodation, interrupted care and the need to account for vulnerable beneficiaries.
The illustrative risk matrix should not be used to defer mandatory life-safety controls simply because a rare catastrophic event receives a Moderate numerical rating.
##### **Category 3: Unavailability of People**
| Threat | F | O | L&R | R&I | SR | P | A/IT/I | Highest | Likelihood | Rating | Level | Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Pandemic | 4 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 2 | 10 | High | 2–12 weeks |
| Epidemic | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 3 | 15 | Very High | 1–6 weeks |
| Infectious Disease Outbreak Within a Facility | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 4 | 20 | Critical | 1–4 weeks |
| Mass Illness or Foodborne Illness | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 3 | 15 | Very High | 2–14 days |
| Labour Strike | 3 | 4 | 3 | 4 | 4 | 3 | 1 | 4 | 2 | 8 | Moderate | 1–14 days |
| Industrial Action or Work Stoppage | 3 | 4 | 3 | 4 | 4 | 3 | 1 | 4 | 2 | 8 | Moderate | 1–14 days |
| High Staff Turnover | 3 | 4 | 3 | 4 | 4 | 4 | 1 | 4 | 4 | 16 | Very High | 1–12 weeks |
| Loss of Key Personnel | 3 | 5 | 3 | 4 | 5 | 4 | 2 | 5 | 3 | 15 | Very High | 1–8 weeks |
| Specialist Skills Shortage | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 4 | 20 | Critical | 2–12 weeks |
| Workplace Accident | 3 | 4 | 4 | 4 | 4 | 5 | 3 | 5 | 3 | 15 | Very High | 1–30 days |
| Workplace Violence | 3 | 4 | 4 | 4 | 4 | 5 | 2 | 5 | 3 | 15 | Very High | 1–30 days |
| Staff Fatigue | 3 | 5 | 4 | 4 | 5 | 5 | 2 | 5 | 4 | 20 | Critical | 2–21 days |
| Psychological Stress and Burnout | 3 | 4 | 3 | 4 | 4 | 5 | 1 | 5 | 4 | 20 | Critical | 2–12 weeks |
| Travel Restrictions | 3 | 4 | 3 | 3 | 4 | 3 | 1 | 4 | 3 | 12 | High | 1–8 weeks |
| Mandatory Quarantine or Isolation | 3 | 5 | 4 | 4 | 5 | 4 | 1 | 5 | 3 | 15 | Very High | 3–14 days |
| Family or Caregiving Emergencies | 2 | 4 | 2 | 3 | 4 | 3 | 1 | 4 | 4 | 16 | Very High | 1–14 days |
| Mass Resignation | 4 | 5 | 4 | 4 | 5 | 4 | 2 | 5 | 3 | 15 | Very High | 4–12 weeks |
| Volunteer Unavailability | 2 | 4 | 2 | 3 | 4 | 3 | 1 | 4 | 4 | 16 | Very High | 2–21 days |
| Concurrent Leave or Scheduling Failure | 2 | 5 | 4 | 4 | 5 | 4 | 1 | 5 | 4 | 20 | Critical | 1–7 days |
| Loss of Leadership or Decision-Making Capacity | 3 | 5 | 4 | 5 | 5 | 4 | 2 | 5 | 3 | 15 | Very High | 2–30 days |
| Contractor Workforce Shortage | 3 | 4 | 3 | 3 | 4 | 3 | 1 | 4 | 4 | 16 | Very High | 2–30 days |
Assessment interpretation: Workforce availability is a particularly important risk area for JS because some services require continuous supervision and personnel with specific qualifications or competencies.
Infectious disease outbreaks, specialist skills shortages, fatigue and scheduling failures may affect several CBFs simultaneously. The severity of a shortage depends on which roles are unavailable, not simply the number of absent employees.
The proposed Critical ratings assume that essential care or safeguarding staffing could fall below safe operating requirements. They must be validated against actual staffing establishments, service requirements and contingency capacity.
##### **Category 4: Disruption to the Supply Chain**
Table RAR Part 3: Risk Impact and Likelihood Assessment for Jamiyah Singapore — Category 4
The following table uses the same five-point impact and likelihood scales established in RAR Part 3. The risk ratings and expected disruption periods are illustrative and require validation by Jamiyah Singapore.
| Threat | Impact Area - Finance | Impact Area - Operations | Impact Area - Legal & Regulatory | Impact Area - Reputation & Image | Impact Area - Social Responsibility | Impact Area - People | Impact Area - Assets/IT Systems/Information | Risk Impact Area (Highest Numeric Score) | Risk Likelihood | Risk Rating | Risk Level | Expected Period of Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Supplier Operational Failure | 3 | 5 | 3 | 4 | 5 | 3 | 2 | 5 | 3 | 15 | Very High | 1–14 days |
| Outsourcing Service Failure | 3 | 5 | 4 | 4 | 5 | 4 | 2 | 5 | 3 | 15 | Very High | 1–14 days |
| Cloud Service Provider Failure | 3 | 5 | 4 | 4 | 4 | 2 | 5 | 5 | 3 | 15 | Very High | 4–72 hours |
| Telecommunications Provider Failure | 2 | 5 | 3 | 4 | 5 | 3 | 4 | 5 | 3 | 15 | Very High | 2–48 hours |
| Electricity Supply Failure | 3 | 5 | 4 | 4 | 5 | 5 | 5 | 5 | 3 | 15 | Very High | 1–48 hours |
| Water Supply Interruption | 3 | 5 | 4 | 4 | 5 | 5 | 3 | 5 | 3 | 15 | Very High | 4–72 hours |
| Fuel Supply Disruption | 3 | 4 | 2 | 3 | 4 | 3 | 2 | 4 | 2 | 8 | Moderate | 1–14 days |
| Logistics and Freight Disruption | 3 | 4 | 3 | 3 | 4 | 3 | 2 | 4 | 3 | 12 | High | 2–21 days |
| Transportation Provider Failure | 3 | 5 | 4 | 4 | 5 | 4 | 2 | 5 | 3 | 15 | Very High | 4–72 hours |
| Banking Service Disruption | 4 | 4 | 3 | 4 | 4 | 2 | 4 | 4 | 3 | 12 | High | 4–72 hours |
| Payment System Failure | 4 | 4 | 3 | 4 | 4 | 2 | 4 | 4 | 4 | 16 | Very High | 2–48 hours |
| Regulatory or Administrative Restrictions | 3 | 4 | 5 | 4 | 4 | 3 | 2 | 5 | 3 | 15 | Very High | 1–30 days |
| Import Restrictions | 3 | 4 | 3 | 3 | 4 | 3 | 2 | 4 | 3 | 12 | High | 1–30 days |
| Vendor Insolvency | 4 | 5 | 3 | 4 | 5 | 3 | 3 | 5 | 3 | 15 | Very High | 1–12 weeks |
| Third-Party Cyber Incident | 4 | 5 | 5 | 5 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 1–14 days |
| Contract Termination or Dispute | 4 | 4 | 4 | 4 | 4 | 2 | 2 | 4 | 3 | 12 | High | 1–12 weeks |
| Single-Source Supplier Dependency | 4 | 5 | 4 | 4 | 5 | 4 | 3 | 5 | 4 | 20 | Critical | 1–30 days |
| Supplier's Subcontractor Failure | 3 | 4 | 3 | 3 | 4 | 3 | 2 | 4 | 3 | 12 | High | 1–21 days |
| Food Supply Contamination or Recall | 3 | 5 | 5 | 5 | 5 | 5 | 3 | 5 | 3 | 15 | Very High | 1–14 days |
| Healthcare Product Shortage | 3 | 5 | 4 | 4 | 5 | 5 | 3 | 5 | 3 | 15 | Very High | 2–30 days |
| Geopolitical Trade Disruption | 4 | 4 | 3 | 3 | 4 | 3 | 2 | 4 | 3 | 12 | High | 2–12 weeks |
| Port or Airport Disruption | 3 | 4 | 3 | 3 | 4 | 3 | 2 | 4 | 3 | 12 | High | 2–21 days |
| Supplier Concentration Across Multiple Services | 4 | 5 | 4 | 5 | 5 | 4 | 4 | 5 | 4 | 20 | Critical | 1–30 days |
| Donor or Funding Channel Interruption | 5 | 5 | 3 | 5 | 5 | 3 | 3 | 5 | 3 | 15 | Very High | 2–12 weeks |
Category 4 assessment summary: The most significant illustrative exposures concern third-party cyber incidents, single-source supplier dependencies and supplier concentration across multiple critical services. These scenarios could simultaneously affect residential care, healthcare support, food assistance, welfare payments and administrative operations.
##### **Category 5: Equipment and IT-Related Disruption**
Table RAR Part 3: Risk Impact and Likelihood Assessment for Jamiyah Singapore — Category 5
| Threat | Impact Area - Finance | Impact Area - Operations | Impact Area - Legal & Regulatory | Impact Area - Reputation & Image | Impact Area - Social Responsibility | Impact Area - People | Impact Area - Assets/IT Systems/Information | Risk Impact Area (Highest Numeric Score) | Risk Likelihood | Risk Rating | Risk Level | Expected Period of Disruption |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Cyberattack | 4 | 5 | 5 | 5 | 4 | 3 | 5 | 5 | 4 | 20 | Critical | 1–14 days |
| Ransomware | 5 | 5 | 5 | 5 | 5 | 3 | 5 | 5 | 4 | 20 | Critical | 2–21 days |
| Malware Infection | 3 | 4 | 3 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Distributed Denial of Service (DDoS) | 3 | 4 | 3 | 4 | 3 | 1 | 4 | 4 | 4 | 16 | Very High | 2–48 hours |
| Insider Threat | 4 | 5 | 5 | 5 | 4 | 3 | 5 | 5 | 3 | 15 | Very High | 1–30 days |
| Personal Data Breach | 5 | 4 | 5 | 5 | 5 | 3 | 5 | 5 | 4 | 20 | Critical | 1–30 days |
| Network Failure | 3 | 5 | 3 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 2–72 hours |
| Server Failure | 3 | 5 | 3 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Database Corruption | 4 | 5 | 5 | 5 | 5 | 3 | 5 | 5 | 3 | 15 | Very High | 1–14 days |
| Cloud Service Outage | 3 | 5 | 4 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Power Failure Affecting ICT | 3 | 5 | 3 | 4 | 4 | 3 | 5 | 5 | 4 | 20 | Critical | 1–48 hours |
| Hardware Failure | 3 | 4 | 3 | 3 | 4 | 2 | 4 | 4 | 4 | 16 | Very High | 4–72 hours |
| Software Failure | 3 | 5 | 4 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Telecommunications System Failure | 3 | 5 | 3 | 4 | 5 | 3 | 4 | 5 | 4 | 20 | Critical | 2–48 hours |
| Internet Connectivity Failure | 3 | 5 | 3 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 2–48 hours |
| Mobile Communications Outage | 2 | 5 | 3 | 4 | 5 | 3 | 4 | 5 | 3 | 15 | Very High | 2–48 hours |
| Backup Failure | 5 | 5 | 5 | 5 | 5 | 3 | 5 | 5 | 3 | 15 | Very High | 2–30 days |
| Data Centre Failure | 4 | 5 | 4 | 5 | 4 | 2 | 5 | 5 | 3 | 15 | Very High | 1–14 days |
| Authentication System Failure | 3 | 5 | 3 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 2–72 hours |
| Identity and Access Management Failure | 4 | 5 | 5 | 4 | 4 | 2 | 5 | 5 | 3 | 15 | Very High | 4–72 hours |
| Artificial Intelligence System Failure | 3 | 4 | 4 | 4 | 4 | 2 | 4 | 4 | 3 | 12 | High | 4–72 hours |
| AI-Enabled Phishing or Impersonation | 5 | 4 | 5 | 5 | 4 | 3 | 5 | 5 | 4 | 20 | Critical | 1–14 days |
| Software Supply Chain Compromise | 4 | 5 | 5 | 5 | 4 | 2 | 5 | 5 | 3 | 15 | Very High | 1–21 days |
| Misconfiguration or Failed System Change | 3 | 5 | 4 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Loss or Theft of ICT Devices | 3 | 3 | 5 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 1–14 days |
| Cyber-Physical Equipment Failure | 4 | 5 | 4 | 4 | 5 | 5 | 5 | 5 | 3 | 15 | Very High | 4–72 hours |
| Cooling or Environmental Control Failure | 3 | 5 | 4 | 4 | 5 | 5 | 4 | 5 | 4 | 20 | Critical | 2–72 hours |
| Data Synchronisation Failure | 3 | 4 | 4 | 4 | 4 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Electronic Records or Document Management Failure | 3 | 5 | 4 | 4 | 5 | 3 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Payment Application or Finance System Failure | 5 | 5 | 4 | 5 | 5 | 2 | 5 | 5 | 4 | 20 | Critical | 4–72 hours |
| Communication Platform Failure | 3 | 5 | 3 | 4 | 5 | 3 | 4 | 5 | 4 | 20 | Critical | 2–48 hours |
| Digital Service Provider Concentration | 4 | 5 | 5 | 5 | 5 | 3 | 5 | 5 | 3 | 15 | Very High | 1–14 days |
Category 5 assessment summary: The principal illustrative exposures include cyberattacks, ransomware, personal data breaches, essential application outages, authentication failures and loss of communications.
The ratings assume disruption to systems supporting critical JS services. The actual scores should be reassessed against verified system criticality, cybersecurity controls, backup arrangements, recovery testing and the availability of manual workarounds.
**Risk Rating Reference**
| Risk Rating | Risk Level |
| --- | --- |
| 1–4 | Low |
| 5–9 | Moderate |
| 10–14 | High |
| 15–19 | Very High |
| 20–25 | Critical |
Calculation: Risk Rating = Highest Impact Score × Risk Likelihood.
Both regenerated tables preserve the numerical scores and risk levels from the preceding RAR Part 3 assessment, with the full requested column headings restored. All ratings and expected disruption periods remain illustrative until validated and approved by Jamiyah Singapore.
#### **Consolidated Risk Assessment Results**
The illustrative register identifies several areas requiring particular attention during JS's subsequent BCM planning activities.
**Table RAR Part 3-A: Principal Risk Themes**
| Risk Theme | Representative Threats | Principal BCM Concern |
| --- | --- | --- |
| Beneficiary and Resident Safety | Building fire, extreme heat, infectious disease outbreak, gas leak | Safe care, supervision, safeguarding and alternative accommodation |
| Workforce Resilience | Specialist skills shortage, fatigue, scheduling failure, loss of key personnel | Ability to sustain competent personnel across essential shifts |
| Essential Supply Continuity | Water interruption, food contamination, supplier concentration | Availability of essential goods and contracted services |
| Cybersecurity and Information Protection | Ransomware, cyberattack, personal data breach, third-party cyber incident | Protection and recovery of confidential and operationally essential information |
| ICT Service Availability | Cloud outage, network failure, authentication failure, backup failure | Recovery of applications and information supporting critical functions |
| Financial and Welfare Service Continuity | Payment system failure, finance application failure, funding interruption | Continued emergency assistance and essential expenditure |
| Premises and Transportation | Flooding, fire, public transport disruption, road closure | Safe access, staff mobilisation and beneficiary transport |
##### **Interpreting High and Critical Ratings**
A High or Critical rating does not automatically establish that existing controls are ineffective.
Likewise, a Moderate rating does not mean a threat can be ignored.
The risk rating reflects the combination of the assessed scenario consequences and likelihood. It must be interpreted alongside legal obligations, safeguarding responsibilities, existing controls and the organisation's approved risk appetite.
In particular, threats with catastrophic safety consequences may require mandatory protection even when their numerical risk rating is relatively low.
##### **Relationship Between Risk Assessment and Business Impact Analysis**
RAR and BIA address related but different questions.
RAR examines what could cause disruption, the possible consequences and the likelihood of the assessed scenario.
BIA examines how interruption affects specific business functions over time and establishes the recovery requirements necessary to maintain acceptable service outcomes.
For example, ransomware may receive a Critical risk rating. However, the BIA must still establish which beneficiary services depend on the affected systems, how quickly those services need to be restored and whether secure manual alternatives are available.
The RAR assessment therefore informs recovery planning but does not replace the BIA.
##### **Expected Period of Disruption Versus Recovery Time Objective**
The Expected Period of Disruption is an estimate of how long a particular threat scenario could affect normal operations.
The Recovery Time Objective is the approved target for restoring the required capability following a disruption.
These values should not be confused.
A ransomware incident could disrupt the normal ICT environment for several days, while a critical residential care function might require continuity without interruption.
In that situation, the recovery strategy must provide a means of sustaining essential care independently of the unavailable ICT system.
#### **Validation and Approval**
Before the assessment becomes JS's formal Risk Assessment Report, the BCM Coordinator should coordinate validation with the relevant CBF owners and supporting departments.
**Table RAR Part 3-B: Assessment Validation Responsibilities**
| Activity | Responsible Contributor | Required Review |
| --- | --- | --- |
| Validate threat scenarios | CBF Owners / BCM Coordinator | Relevant Department Heads |
| Validate financial consequences | Finance | Finance Management |
| Validate operational consequences | CBF Owners | BCM Coordinator |
| Validate legal and regulatory consequences | Governance / Compliance | Senior Management |
| Validate reputation consequences | Communications / Management | Senior Management |
| Validate social responsibility consequences | Relevant Service Owners | BCM Steering Committee |
| Validate people and safeguarding consequences | HR / Care and Service Management | Relevant Department Heads |
| Validate technology and information consequences | ICT / Information Security / Data Protection Officer | ICT Management |
| Validate likelihood assumptions | Risk Management / CBF Owners | BCM Steering Committee |
| Confirm expected disruption periods | CBF Owners / Facilities / ICT / Suppliers | BCM Coordinator |
| Consolidate the Risk Assessment Report | BCM Coordinator | BCM Steering Committee |
| Approve final ratings and risk priorities | Designated Senior Management | Authorised Governance Body |
Evidence should include relevant incident histories, facility information, workforce records, supplier performance data, ICT recovery results, control testing, service dependencies and management-approved risk criteria.
##### **Reassessment Following Control Validation**
The assessment should distinguish between inherent risk and residual risk.
Inherent risk represents exposure before considering the effectiveness of relevant controls.
Residual risk represents the exposure remaining after considering controls that have been verified as operating effectively.
The numerical scores presented in this chapter are provisional scenario-based ratings. They should not be represented as confirmed residual risk because the assumed controls from RAR Part 2 have not yet been validated.
JS should reassess the ratings after verifying control design, operating effectiveness and recovery capability.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/5b9296da-5ad2-4d32-9649-814eba589ec0)
RAR Part 3 establishes a structured methodology for evaluating the consequences and likelihood of threats that could disrupt Jamiyah Singapore's Critical Business Functions.
By assessing Finance, Operations, Legal and Regulatory, Reputation and Image, Social Responsibility, People, and Assets/IT Systems/Information, JS can develop a broader understanding of risk than would be possible through financial or operational considerations alone.
This is particularly important for a charitable and community service organisation where interruption may affect vulnerable beneficiaries and essential care responsibilities.
The assessment highlights the need to consider both traditional threats, such as fire, flooding, infectious disease and workforce shortages, and emerging threats involving cyberattacks, cloud dependencies, AI-enabled impersonation and supply chain concentration.
The resulting risk ratings provide a starting point for prioritising management attention, evaluating control adequacy and identifying areas requiring further resilience investment.
However, numerical scores must be supported by evidence, consistent assessment criteria and informed management judgement.
The assessment should also remain aligned with the Business Impact Analysis, which establishes the time-critical requirements for maintaining and restoring essential services.
Following validation, the Risk Assessment Report will provide important inputs to Business Continuity Strategy development, Crisis Management planning, operational recovery procedures, testing and exercising.
Ultimately, effective risk assessment enables Jamiyah Singapore to move from identifying potential disruptions to understanding their consequences, establishing appropriate priorities and strengthening its ability to protect beneficiaries and sustain essential services.
Assessment and quality-control note: The preceding RAR Part 1 and RAR Part 2 chapters contain a discrepancy in their stated threat counts. The tables presented here contain 113 distinct threat entries across the five categories: 15 natural disaster, 21 man-made disaster, 21 people-related, 24 supply chain and 32 equipment/IT-related threats. The approved master Threat Register should be reconciled against these entries before formal adoption. All numerical ratings and disruption periods are illustrative, not verified JS findings, and must be reviewed against actual facilities, service dependencies, control effectiveness and historical evidence.
[![x \[BCM\] \[JS\] \[3/4 Banner\] Resilient Communities: Implementing Business Continuity Management at JS](https://no-cache.hubspot.com/cta/default/3893111/320f01c4-c800-4496-aa02-c30e72e7481d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/320f01c4-c800-4496-aa02-c30e72e7481d)
| **eBook 3: Starting Your BCM Implementation** | | | | | | |
| --- | --- | --- | --- | --- | --- | --- |
| **MBCO** | **P&S** | **RAR T1** | **RAR T2** | **RAR T3** | **BCS T1** | **CBF** |
| [![\[BCM\] \[JS\] \[E3\] \[BIA\] MBCO Corporate MBCO](https://no-cache.hubspot.com/cta/default/3893111/723f3c3d-5ee0-4bf8-8e22-3244b607978a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/723f3c3d-5ee0-4bf8-8e22-3244b607978a) | [![\[BCM\] \[JS\] \[E3\] \[BIA\] \[PS\] Key Product and Services](https://no-cache.hubspot.com/cta/default/3893111/db4572cb-afab-45f2-902b-8a8b33b88b58.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/db4572cb-afab-45f2-902b-8a8b33b88b58) | [![\[BCM\] \[JS\] \[E3\] \[RAR\] \[T1\] List of Threats](https://no-cache.hubspot.com/cta/default/3893111/87b522e2-f0d8-4959-9c59-40a3be1b6f71.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/87b522e2-f0d8-4959-9c59-40a3be1b6f71) | [![\[BCM\] \[JS\] \[E3\] \[RAR\] \[T2\] Treatment and Control](https://no-cache.hubspot.com/cta/default/3893111/bbf2124f-6183-4c2f-85f0-727313f44adf.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bbf2124f-6183-4c2f-85f0-727313f44adf) | [![\[BCM\] \[JS\] \[E3\] \[RAR\] \[T3\] Risk Impact and Likelihood Assessment](https://no-cache.hubspot.com/cta/default/3893111/f4035e58-2c2f-4b9b-aa1d-4e24ef7507fe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4035e58-2c2f-4b9b-aa1d-4e24ef7507fe) | [![\[BCM\] \[JS\] \[E3\] \[BCS\] \[T1\] Mitigation Strategies and Justification](https://no-cache.hubspot.com/cta/default/3893111/4691ede5-015e-4d02-890f-1dc8a37980a6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4691ede5-015e-4d02-890f-1dc8a37980a6) | [![\[BCM\] \[JS\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/0e87ad0d-3fdf-495a-a60f-384b0e67a940.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0e87ad0d-3fdf-495a-a60f-384b0e67a940) |
#### More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer \[BCM-3\] and the BCM-5000 Business Continuity Management Expert Implementer \[BCM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f3922b80-e96a-46d6-8993-dc150a5de2d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9ff8a3dc-e39a-465b-929f-72e232cdd5fb) | [![Register \[BL-B-3\]\*](https://no-cache.hubspot.com/cta/default/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21525c10-4003-4934-95fc-fe218174bc5b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/46460171-c91a-4936-9bb2-8dc5928a0e02) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1cb17ac7-50b2-4f88-bc4b-c7444e4b57b5) |
| [![FAQ \[BL-B-3\]](https://no-cache.hubspot.com/cta/default/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c199ae8-c470-4bb7-9612-73c7a084e94c) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/8999211a-2c51-4be7-bf49-c393f6c67974) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5c1aa95d-f6dd-4067-a95c-5cc0c32d7ed8) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/086ab3b9-4d66-4a95-b2f7-1148e9803a9c) |
#### **Comments:**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng"
},
"dateModified" : "2026-10-15T10:29:23.523Z",
"datePublished" : "2026-10-15T09:08:42.000Z",
"headline" : "[BCM] [JS] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-js-e3-rar-p3-risk-impact-and-likelihood-assessment",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```