[BCM] [MINDS] [E3] [RAR] [T2] Treatment and Control

Threat

Existing Risk Treatment - Risk Avoidance

Existing Risk Treatment - Risk Reduction

Existing Risk Treatment - Risk Transference

Existing Risk Treatment - Risk Acceptance

Existing Controls

Additional (Planned) Controls

Denial of Access – Natural Disaster (e.g. flood, fire, haze, pandemic-related lockdowns)

Avoid locating new centres in high-risk flood or fire-prone areas where possible

Emergency evacuation plans, alternative care locations, remote service arrangements for suitable programmes

Insurance coverage for property damage and business interruption

Acceptance of short-term service disruption during severe events where safety is prioritised

• Fire safety systems and drills

• Safe distancing and health protocols

• MOH / MSF emergency guidelines compliance

• Pre-arranged mutual aid agreements with partner VWOs

• Enhanced remote engagement plans for clients and caregivers

Denial of Access – Man-made Disaster (e.g. building damage, security incident, transport disruption)

Restrict access to high-risk zones; controlled entry to premises

Security measures, access controls, alternative transport arrangements

Insurance for vandalism or malicious damage

Acceptance of temporary access limitations during investigations or repairs

• Visitor management systems

• CCTV and security patrols

• Incident response procedures

• Periodic security risk assessments

• Business continuity site relocation playbooks

Unavailability of People (e.g. staff illness, attrition, industrial action)

Avoid over-reliance on single individuals for critical roles

Cross-training, staff rotation, relief staffing arrangements

Outsourced temporary staffing or professional services

Acceptance of reduced service levels during prolonged manpower shortages

• Succession planning

• Leave and sick coverage policies

• Volunteer engagement

• Formalised skills matrix

• Expanded pool of trained relief staff and volunteers

Disruption to the Supply Chain (e.g. food, medical supplies, assistive devices)

Avoid sole-source suppliers for critical items

Buffer stock, approved vendor lists, supplier performance monitoring

Contracts with suppliers including service-level agreements

Acceptance of limited substitutions for non-critical items

• Inventory tracking

• Framework agreements with vendors

• Secondary suppliers for critical consumables

• Periodic supplier resilience reviews

Equipment and IT-Related Disruption (e.g. system outage, device failure, cyber incident)

Avoid unsupported or obsolete systems

Preventive maintenance, data backups, cybersecurity controls

IT support contracts and cyber insurance

Acceptance of brief system downtime for maintenance or recovery

• Regular system backups

• Antivirus and firewall protection

• Helpdesk support

• Disaster recovery testing

• Cloud-based systems for critical applications