Following the identification of credible threats (RAR Part 1) and the evaluation of existing treatment and control measures (RAR Part 2), the next step in the Business Continuity Management (BCM) lifecycle is to assess the likelihood and potential impact of each threat.
This assessment provides a structured and consistent method for understanding the risks that could affect the delivery of KK Women's and Children's Hospital (KKH)'s Critical Business Functions and supporting services.
Consistent with the principles of ISO 22301, ISO 22313, ISO 31000 and recognised Business Impact Analysis (BIA) practices, this assessment evaluates each identified threat across seven impact areas: Finance, Operations, Legal and Regulatory, Reputation and Image, Social Responsibility, People, Assets, IT Systems and Information.
The highest impact score among these areas is used together with the assessed likelihood of occurrence to determine the overall risk rating and corresponding risk level.
The assessments presented in this chapter are indicative and assume the existence of reasonable operational controls identified in RAR Part 2.
They represent the residual risk remaining after existing controls have been considered, but before additional recommended improvements are implemented.
Final impact scores, likelihood ratings, and risk levels should be validated by the relevant business owners, the enterprise risk management function, ICT specialists, facilities management, clinical leaders, and senior management before formal adoption.
In addition to calculating the risk rating, the chapter estimates the likely duration of operational disruption for each threat.
This assists management in prioritising recovery strategies, allocating recovery resources, determining Business Continuity Strategies, developing Crisis Management scenarios, and strengthening Operational Resilience across KKH.
Table T3: Risk Impact and Likelihood Assessment
|
Threat |
Impact Area - Finance |
Impact Area - Operations |
Impact Area - Legal & Regulatory |
Impact Area - Reputation & Image |
Impact Area - Social Responsibility |
Impact Area - People |
Impact Area - Assets / IT Systems / Information |
Risk Impact Area (Highest Numeric Score) |
Risk Likelihood |
Risk Rating |
Risk Level |
Expected Period of Disruption |
|
Flash Flood |
3 |
4 |
3 |
3 |
4 |
3 |
3 |
4 – Operations; Social Responsibility |
3 – Possible |
12 |
High |
8–24 hours |
|
Severe Storm |
2 |
3 |
2 |
2 |
3 |
2 |
3 |
3 – Operations; Assets |
4 – Likely |
12 |
High |
4–24 hours |
|
Lightning Strike |
2 |
3 |
2 |
2 |
2 |
2 |
4 |
4 – Assets/IT |
3 – Possible |
12 |
High |
4–8 hours |
|
Extreme Heat |
2 |
3 |
2 |
2 |
3 |
3 |
3 |
3 – Operations; People; Assets |
4 – Likely |
12 |
High |
1–3 days |
|
Haze |
2 |
3 |
2 |
2 |
4 |
4 |
2 |
4 – Social Responsibility; People |
3 – Possible |
12 |
High |
3–7 days |
|
Pandemic Movement Restrictions |
4 |
5 |
4 |
4 |
5 |
5 |
3 |
5 – Operations; Social Responsibility; People |
3 – Possible |
15 |
High |
2–4 weeks |
|
Regional Earthquake Effects |
3 |
4 |
3 |
3 |
4 |
4 |
4 |
4 – Operations; Social Responsibility; People; Assets |
2 – Unlikely |
8 |
Moderate |
1–7 days |
|
Fire |
5 |
5 |
4 |
5 |
5 |
5 |
5 |
5 – Finance; Operations; Reputation; Social Responsibility; People; Assets |
3 – Possible |
15 |
High |
1–2 weeks |
|
Explosion |
5 |
5 |
5 |
5 |
5 |
5 |
5 |
5 – All Major Areas |
2 – Unlikely |
10 |
High |
1–2 weeks |
|
Chemical Spill |
3 |
4 |
4 |
3 |
4 |
4 |
3 |
4 – Operations; Legal; Social Responsibility; People |
3 – Possible |
12 |
High |
1–3 days |
|
Medical Gas Leak |
5 |
5 |
5 |
5 |
5 |
5 |
4 |
5 – Finance; Operations; Legal; Reputation; Social Responsibility; People |
2 – Unlikely |
10 |
High |
4–24 hours |
|
Structural Failure |
4 |
5 |
4 |
4 |
5 |
5 |
5 |
5 – Operations; Social Responsibility; People; Assets |
2 – Unlikely |
10 |
High |
1–2 weeks |
|
Bomb Threat |
3 |
4 |
3 |
4 |
4 |
4 |
3 |
4 – Operations; Reputation; Social Responsibility; People |
2 – Unlikely |
8 |
Moderate |
4–24 hours |
|
Terrorism |
5 |
5 |
5 |
5 |
5 |
5 |
5 |
5 – All Major Areas |
2 – Unlikely |
10 |
High |
2–4 weeks |
|
Active Assailant |
4 |
5 |
5 |
5 |
5 |
5 |
3 |
5 – Operations; Legal; Reputation; Social Responsibility; People |
2 – Unlikely |
10 |
High |
1–3 days |
|
Public Transport Disruption |
2 |
3 |
1 |
2 |
2 |
3 |
1 |
3 – Operations; People |
4 – Likely |
12 |
High |
4–24 hours |
|
Major Traffic Incident |
2 |
4 |
2 |
2 |
3 |
2 |
1 |
4 – Operations |
3 – Possible |
12 |
High |
4–24 hours |
|
Pandemic |
5 |
5 |
4 |
5 |
5 |
5 |
3 |
5 – Finance; Operations; Reputation; Social Responsibility; People |
3 – Possible |
15 |
High |
More than 1 month |
|
Infectious Disease Outbreak |
4 |
5 |
4 |
4 |
5 |
5 |
2 |
5 – Operations; Social Responsibility; People |
4 – Likely |
20 |
Very High |
2–4 weeks |
|
Mass Illness |
3 |
4 |
3 |
3 |
4 |
5 |
2 |
5 – People |
3 – Possible |
15 |
High |
1–2 weeks |
|
Loss of Key Personnel |
3 |
4 |
3 |
3 |
3 |
5 |
2 |
5 – People |
3 – Possible |
15 |
High |
1–3 weeks |
|
Skills Shortage |
3 |
4 |
3 |
3 |
4 |
5 |
2 |
5 – People |
4 – Likely |
20 |
Very High |
More than 1 month |
|
Staff Fatigue |
2 |
4 |
3 |
3 |
4 |
5 |
1 |
5 – People |
4 – Likely |
20 |
Very High |
1–2 weeks |
|
Psychological Stress |
2 |
3 |
2 |
2 |
3 |
4 |
1 |
4 – People |
4 – Likely |
16 |
High |
1–2 weeks |
|
Mandatory Quarantine |
3 |
5 |
3 |
3 |
4 |
5 |
2 |
5 – Operations; People |
3 – Possible |
15 |
High |
2–4 weeks |
|
Family Emergencies |
2 |
3 |
1 |
1 |
2 |
3 |
1 |
3 – Operations; People |
3 – Possible |
9 |
Moderate |
1–3 days |
|
Supplier Failure |
4 |
5 |
4 |
4 |
5 |
3 |
3 |
5 – Operations; Social Responsibility |
3 – Possible |
15 |
High |
1–2 weeks |
|
Cloud Service Provider Failure |
3 |
4 |
4 |
3 |
3 |
2 |
5 |
5 – Assets/IT |
3 – Possible |
15 |
High |
1–3 days |
|
Telecommunications Failure |
3 |
5 |
3 |
3 |
4 |
3 |
5 |
5 – Operations; Assets |
3 – Possible |
15 |
High |
8–24 hours |
|
Utility Failure |
4 |
5 |
4 |
4 |
5 |
4 |
5 |
5 – Operations; Social Responsibility; Assets |
3 – Possible |
15 |
High |
1–3 days |
|
Logistics Disruption |
3 |
4 |
3 |
3 |
4 |
2 |
2 |
4 – Operations; Social Responsibility |
3 – Possible |
12 |
High |
3–7 days |
|
Fuel Supply Disruption |
3 |
4 |
3 |
3 |
4 |
2 |
2 |
4 – Operations; Social Responsibility |
2 – Unlikely |
8 |
Moderate |
3–7 days |
|
Vendor Insolvency |
3 |
4 |
3 |
3 |
3 |
2 |
2 |
4 – Operations |
2 – Unlikely |
8 |
Moderate |
1–2 weeks |
|
Third-Party Cyber Incident |
4 |
5 |
5 |
4 |
4 |
2 |
5 |
5 – Operations; Legal; Assets |
3 – Possible |
15 |
High |
3–7 days |
|
Single Source Dependency |
3 |
5 |
3 |
3 |
4 |
2 |
2 |
5 – Operations |
3 – Possible |
15 |
High |
1–2 weeks |
|
Regulatory Import Restrictions |
4 |
5 |
5 |
4 |
5 |
3 |
2 |
5 – Operations; Legal; Social Responsibility |
2 – Unlikely |
10 |
High |
2–4 weeks |
|
Cyber Attack |
5 |
5 |
5 |
5 |
4 |
3 |
5 |
5 – Finance; Operations; Legal; Reputation; Assets |
4 – Likely |
20 |
Very High |
1–2 weeks |
|
Ransomware |
5 |
5 |
5 |
5 |
5 |
3 |
5 |
5 – Finance; Operations; Legal; Reputation; Social Responsibility; Assets |
4 – Likely |
20 |
Very High |
1–2 weeks |
|
Malware Infection |
3 |
4 |
3 |
3 |
2 |
2 |
5 |
5 – Assets/IT |
4 – Likely |
20 |
Very High |
1–3 days |
|
Distributed Denial of Service (DDoS) |
3 |
4 |
3 |
3 |
2 |
1 |
5 |
5 – Assets/IT |
3 – Possible |
15 |
High |
4–24 hours |
|
Insider Threat |
4 |
4 |
5 |
5 |
3 |
2 |
5 |
5 – Legal; Reputation; Assets |
3 – Possible |
15 |
High |
1–2 weeks |
|
Data Breach |
4 |
4 |
5 |
5 |
4 |
2 |
5 |
5 – Legal; Reputation; Assets |
3 – Possible |
15 |
High |
1–2 weeks |
|
Network Failure |
3 |
5 |
3 |
3 |
3 |
2 |
5 |
5 – Operations; Assets |
4 – Likely |
20 |
Very High |
8–24 hours |
|
Server Failure |
3 |
5 |
3 |
3 |
3 |
2 |
5 |
5 – Operations; Assets |
3 – Possible |
15 |
High |
8–24 hours |
|
Database Corruption |
4 |
5 |
5 |
4 |
3 |
2 |
5 |
5 – Operations; Legal; Assets |
3 – Possible |
15 |
High |
1–3 days |
|
Cloud Service Outage |
3 |
4 |
3 |
3 |
2 |
2 |
5 |
5 – Assets |
3 – Possible |
15 |
High |
8–24 hours |
|
Power Failure |
4 |
5 |
4 |
4 |
5 |
4 |
5 |
5 – Operations; Social Responsibility; Assets |
3 – Possible |
15 |
High |
4–24 hours |
|
Hardware Failure |
3 |
4 |
3 |
2 |
2 |
2 |
5 |
5 – Assets |
3 – Possible |
15 |
High |
4–24 hours |
|
Software Failure |
3 |
5 |
3 |
3 |
2 |
2 |
5 |
5 – Operations; Assets |
3 – Possible |
15 |
High |
8–24 hours |
|
Backup Failure |
4 |
5 |
4 |
4 |
3 |
2 |
5 |
5 – Operations; Assets |
2 – Unlikely |
10 |
High |
1–3 days |
|
Data Centre Failure |
5 |
5 |
4 |
5 |
4 |
3 |
5 |
5 – Finance; Operations; Reputation; Assets |
2 – Unlikely |
10 |
High |
3–7 days |
|
Identity & Access Management Failure |
3 |
5 |
4 |
3 |
3 |
2 |
5 |
5 – Operations; Assets |
3 – Possible |
15 |
High |
4–24 hours |
|
Artificial Intelligence System Failure |
3 |
4 |
4 |
3 |
4 |
2 |
4 |
4 – Operations; Legal; Social Responsibility; Assets |
2 – Unlikely |
8 |
Moderate |
1–3 days |
The Risk Impact and Likelihood Assessment translates the Threat Register developed in earlier chapters into a structured assessment that enables KKH to prioritise risks based on their potential consequences and probability of occurrence.
By evaluating each threat across seven impact dimensions and combining the highest credible impact score with an independently assessed likelihood, the hospital gains a consistent and transparent basis for determining risk ratings and prioritising management attention.
The assessment demonstrates that healthcare organisations such as KKH face significant exposure to clinical, technological, workforce, infrastructure and supply chain risks.
Threats, including infectious disease outbreaks, cyberattacks, ransomware, network failures, workforce shortages, and critical supplier disruptions, have the potential to affect multiple impact areas simultaneously and therefore warrant enhanced preparedness, resilience measures, and executive oversight.
Equally important are low-likelihood but high-consequence events such as fire, terrorism, structural failure and medical gas incidents, which require robust contingency planning despite their relatively infrequent occurrence.
It should be recognised that the scores presented in this chapter are intended as decision-support tools rather than definitive measurements of organisational risk.
They should be validated through KKH's risk governance process, taking into consideration actual control effectiveness, operational experience, emerging threat intelligence, regulatory requirements and the organisation's approved risk appetite.
A well-developed Risk Impact and Likelihood Assessment enables management to make informed decisions regarding Business Continuity Strategy, Crisis Management, IT Disaster Recovery, resource allocation and Operational Resilience investment.
Regular review and reassessment ensure that the Risk Assessment Report remains aligned with changes in the operating environment, emerging threats, technological developments and evolving healthcare service requirements.
Ultimately, an effective Risk Assessment not only identifies which threats may occur but also provides a clear understanding of their potential consequences, likelihood and expected duration of disruption, thereby strengthening KKH's ability to sustain essential healthcare services during incidents, emergencies and disasters.
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S | RAR T1 | RAR T2 | RAR T3 | BCS T1 | eBook 1 |
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].
|
Please feel free to send us a note if you have any questions. |
||