[BCM] [KKH] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment

[BCM] [KKH] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment

[BCM] [KKH] [E3] [RAR] [P3] Risk Impact and Likelihood Assessment

More Posts

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, 'ebe9ac30-955e-4fbd-bf62-318c559361dd', {"useNewLoader":"true","region":"na1"});

More Posts

Introduction

More Information About Business Continuity Management Courses

Introduction

More Information About Business Continuity Management Courses

Comments:

Introduction

More Information About Business Continuity Management Courses

Comments:

Implementing Business Continuity Management for KK Women's and Children's Hospital: An Enterprise Implementation Guide

Implementing Business Continuity Management for KK Women's and Children's Hospital: An Enterprise Implementation Guide

Achieving

Business Continuity Management Certified Planner-Specialist-Expert

Achieving

Business Continuity Management Certified Planner-Specialist-Expert

Achieving

Part 3: RAR - Risk Impact and Likelihood Assessment

Following the identification of credible threats (RAR Part 1) and the evaluation of existing treatment and control measures (RAR Part 2), the next step in the Business Continuity Management (BCM) lifecycle is to assess the likelihood and potential impact of each threat.

This assessment provides a structured and consistent method for understanding the risks that could affect the delivery of KK Women's and Children's Hospital (KKH)'s Critical Business Functions and supporting services.

Consistent with the principles of ISO 22301, ISO 22313, ISO 31000 and recognised Business Impact Analysis (BIA) practices, this assessment evaluates each identified threat across seven impact areas: Finance, Operations, Legal and Regulatory, Reputation and Image, Social Responsibility, People, Assets, IT Systems and Information.

The highest impact score among these areas is used together with the assessed likelihood of occurrence to determine the overall risk rating and corresponding risk level.

The assessments presented in this chapter are indicative and assume the existence of reasonable operational controls identified in RAR Part 2.

They represent the residual risk remaining after existing controls have been considered, but before additional recommended improvements are implemented.

Final impact scores, likelihood ratings, and risk levels should be validated by the relevant business owners, the enterprise risk management function, ICT specialists, facilities management, clinical leaders, and senior management before formal adoption.

In addition to calculating the risk rating, the chapter estimates the likely duration of operational disruption for each threat.

This assists management in prioritising recovery strategies, allocating recovery resources, determining Business Continuity Strategies, developing Crisis Management scenarios, and strengthening Operational Resilience across KKH.

Table T3: Risk Impact and Likelihood Assessment

Threat	Impact Area - Finance	Impact Area - Operations	Impact Area - Legal & Regulatory	Impact Area - Reputation & Image	Impact Area - Social Responsibility	Impact Area - People	Impact Area - Assets / IT Systems / Information	Risk Impact Area (Highest Numeric Score)	Risk Likelihood	Risk Rating	Risk Level	Expected Period of Disruption
Flash Flood	3	4	3	3	4	3	3	4 – Operations; Social Responsibility	3 – Possible	12	High	8–24 hours
Severe Storm	2	3	2	2	3	2	3	3 – Operations; Assets	4 – Likely	12	High	4–24 hours
Lightning Strike	2	3	2	2	2	2	4	4 – Assets/IT	3 – Possible	12	High	4–8 hours
Extreme Heat	2	3	2	2	3	3	3	3 – Operations; People; Assets	4 – Likely	12	High	1–3 days
Haze	2	3	2	2	4	4	2	4 – Social Responsibility; People	3 – Possible	12	High	3–7 days
Pandemic Movement Restrictions	4	5	4	4	5	5	3	5 – Operations; Social Responsibility; People	3 – Possible	15	High	2–4 weeks
Regional Earthquake Effects	3	4	3	3	4	4	4	4 – Operations; Social Responsibility; People; Assets	2 – Unlikely	8	Moderate	1–7 days
Fire	5	5	4	5	5	5	5	5 – Finance; Operations; Reputation; Social Responsibility; People; Assets	3 – Possible	15	High	1–2 weeks
Explosion	5	5	5	5	5	5	5	5 – All Major Areas	2 – Unlikely	10	High	1–2 weeks
Chemical Spill	3	4	4	3	4	4	3	4 – Operations; Legal; Social Responsibility; People	3 – Possible	12	High	1–3 days
Medical Gas Leak	5	5	5	5	5	5	4	5 – Finance; Operations; Legal; Reputation; Social Responsibility; People	2 – Unlikely	10	High	4–24 hours
Structural Failure	4	5	4	4	5	5	5	5 – Operations; Social Responsibility; People; Assets	2 – Unlikely	10	High	1–2 weeks
Bomb Threat	3	4	3	4	4	4	3	4 – Operations; Reputation; Social Responsibility; People	2 – Unlikely	8	Moderate	4–24 hours
Terrorism	5	5	5	5	5	5	5	5 – All Major Areas	2 – Unlikely	10	High	2–4 weeks
Active Assailant	4	5	5	5	5	5	3	5 – Operations; Legal; Reputation; Social Responsibility; People	2 – Unlikely	10	High	1–3 days
Public Transport Disruption	2	3	1	2	2	3	1	3 – Operations; People	4 – Likely	12	High	4–24 hours
Major Traffic Incident	2	4	2	2	3	2	1	4 – Operations	3 – Possible	12	High	4–24 hours
Pandemic	5	5	4	5	5	5	3	5 – Finance; Operations; Reputation; Social Responsibility; People	3 – Possible	15	High	More than 1 month
Infectious Disease Outbreak	4	5	4	4	5	5	2	5 – Operations; Social Responsibility; People	4 – Likely	20	Very High	2–4 weeks
Mass Illness	3	4	3	3	4	5	2	5 – People	3 – Possible	15	High	1–2 weeks
Loss of Key Personnel	3	4	3	3	3	5	2	5 – People	3 – Possible	15	High	1–3 weeks
Skills Shortage	3	4	3	3	4	5	2	5 – People	4 – Likely	20	Very High	More than 1 month
Staff Fatigue	2	4	3	3	4	5	1	5 – People	4 – Likely	20	Very High	1–2 weeks
Psychological Stress	2	3	2	2	3	4	1	4 – People	4 – Likely	16	High	1–2 weeks
Mandatory Quarantine	3	5	3	3	4	5	2	5 – Operations; People	3 – Possible	15	High	2–4 weeks
Family Emergencies	2	3	1	1	2	3	1	3 – Operations; People	3 – Possible	9	Moderate	1–3 days
Supplier Failure	4	5	4	4	5	3	3	5 – Operations; Social Responsibility	3 – Possible	15	High	1–2 weeks
Cloud Service Provider Failure	3	4	4	3	3	2	5	5 – Assets/IT	3 – Possible	15	High	1–3 days
Telecommunications Failure	3	5	3	3	4	3	5	5 – Operations; Assets	3 – Possible	15	High	8–24 hours
Utility Failure	4	5	4	4	5	4	5	5 – Operations; Social Responsibility; Assets	3 – Possible	15	High	1–3 days
Logistics Disruption	3	4	3	3	4	2	2	4 – Operations; Social Responsibility	3 – Possible	12	High	3–7 days
Fuel Supply Disruption	3	4	3	3	4	2	2	4 – Operations; Social Responsibility	2 – Unlikely	8	Moderate	3–7 days
Vendor Insolvency	3	4	3	3	3	2	2	4 – Operations	2 – Unlikely	8	Moderate	1–2 weeks
Third-Party Cyber Incident	4	5	5	4	4	2	5	5 – Operations; Legal; Assets	3 – Possible	15	High	3–7 days
Single Source Dependency	3	5	3	3	4	2	2	5 – Operations	3 – Possible	15	High	1–2 weeks
Regulatory Import Restrictions	4	5	5	4	5	3	2	5 – Operations; Legal; Social Responsibility	2 – Unlikely	10	High	2–4 weeks
Cyber Attack	5	5	5	5	4	3	5	5 – Finance; Operations; Legal; Reputation; Assets	4 – Likely	20	Very High	1–2 weeks
Ransomware	5	5	5	5	5	3	5	5 – Finance; Operations; Legal; Reputation; Social Responsibility; Assets	4 – Likely	20	Very High	1–2 weeks
Malware Infection	3	4	3	3	2	2	5	5 – Assets/IT	4 – Likely	20	Very High	1–3 days
Distributed Denial of Service (DDoS)	3	4	3	3	2	1	5	5 – Assets/IT	3 – Possible	15	High	4–24 hours
Insider Threat	4	4	5	5	3	2	5	5 – Legal; Reputation; Assets	3 – Possible	15	High	1–2 weeks
Data Breach	4	4	5	5	4	2	5	5 – Legal; Reputation; Assets	3 – Possible	15	High	1–2 weeks
Network Failure	3	5	3	3	3	2	5	5 – Operations; Assets	4 – Likely	20	Very High	8–24 hours
Server Failure	3	5	3	3	3	2	5	5 – Operations; Assets	3 – Possible	15	High	8–24 hours
Database Corruption	4	5	5	4	3	2	5	5 – Operations; Legal; Assets	3 – Possible	15	High	1–3 days
Cloud Service Outage	3	4	3	3	2	2	5	5 – Assets	3 – Possible	15	High	8–24 hours
Power Failure	4	5	4	4	5	4	5	5 – Operations; Social Responsibility; Assets	3 – Possible	15	High	4–24 hours
Hardware Failure	3	4	3	2	2	2	5	5 – Assets	3 – Possible	15	High	4–24 hours
Software Failure	3	5	3	3	2	2	5	5 – Operations; Assets	3 – Possible	15	High	8–24 hours
Backup Failure	4	5	4	4	3	2	5	5 – Operations; Assets	2 – Unlikely	10	High	1–3 days
Data Centre Failure	5	5	4	5	4	3	5	5 – Finance; Operations; Reputation; Assets	2 – Unlikely	10	High	3–7 days
Identity & Access Management Failure	3	5	4	3	3	2	5	5 – Operations; Assets	3 – Possible	15	High	4–24 hours
Artificial Intelligence System Failure	3	4	4	3	4	2	4	4 – Operations; Legal; Social Responsibility; Assets	2 – Unlikely	8	Moderate	1–3 days

The Risk Impact and Likelihood Assessment translates the Threat Register developed in earlier chapters into a structured assessment that enables KKH to prioritise risks based on their potential consequences and probability of occurrence.

By evaluating each threat across seven impact dimensions and combining the highest credible impact score with an independently assessed likelihood, the hospital gains a consistent and transparent basis for determining risk ratings and prioritising management attention.

The assessment demonstrates that healthcare organisations such as KKH face significant exposure to clinical, technological, workforce, infrastructure and supply chain risks.

Threats, including infectious disease outbreaks, cyberattacks, ransomware, network failures, workforce shortages, and critical supplier disruptions, have the potential to affect multiple impact areas simultaneously and therefore warrant enhanced preparedness, resilience measures, and executive oversight.

Equally important are low-likelihood but high-consequence events such as fire, terrorism, structural failure and medical gas incidents, which require robust contingency planning despite their relatively infrequent occurrence.

It should be recognised that the scores presented in this chapter are intended as decision-support tools rather than definitive measurements of organisational risk.

They should be validated through KKH's risk governance process, taking into consideration actual control effectiveness, operational experience, emerging threat intelligence, regulatory requirements and the organisation's approved risk appetite.

A well-developed Risk Impact and Likelihood Assessment enables management to make informed decisions regarding Business Continuity Strategy, Crisis Management, IT Disaster Recovery, resource allocation and Operational Resilience investment.

Regular review and reassessment ensure that the Risk Assessment Report remains aligned with changes in the operating environment, emerging threats, technological developments and evolving healthcare service requirements.

Ultimately, an effective Risk Assessment not only identifies which threats may occur but also provides a clear understanding of their potential consequences, likelihood and expected duration of disruption, thereby strengthening KKH's ability to sustain essential healthcare services during incidents, emergencies and disasters.

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].



	Please feel free to send us a note if you have any questions.

eBook 3: Starting Your BCM Implementation

RAR T1

RAR T2

RAR T3

BCS T1

eBook 1