[BCM] [SHINE] [E3] [RAR] [T2] Treatment and Control

Introduction

More Information About Business Continuity Management Courses

Table R2: Threats and Risk Treatment

RAR 2 – Treatment and Control for SHINE

In the second phase of the Business Continuity Management (BCM) Planning Methodology for SHINE Children and Youth Services, the focus shifts to Risk Analysis and Review (RAR).

This phase involves identifying threats and assessing their potential impact on the organisation.

Once threats are identified, risk treatment and controls must be implemented to manage these risks effectively.

In this chapter, we will examine the threats SHINE faces, how they are currently addressed, and what additional controls could further mitigate these risks.

The treatment of identified risks can be categorised into four broad strategies: Risk Avoidance, Risk Reduction, Risk Transference, and Risk Acceptance.

Each threat must be analysed to determine which treatment is most suitable for mitigating its potential impact on SHINE’s operations. This chapter will outline the current treatment strategies, existing controls, and planned additional controls for each identified threat.

Threat	Existing Risk Treatment - Risk Avoidance	Existing Risk Treatment - Risk Reduction	Existing Risk Treatment - Risk Transference	Existing Risk Treatment - Risk Acceptance	Existing Controls	Additional (Planned) Controls
Denial of Access – Natural Disaster	Relocation of operations to unaffected areas	Emergency evacuation plans, backup sites	Insurance coverage for damages and disruptions	Minimal staff presence during disasters	Emergency response protocols, disaster recovery sites	Investment in off-site cloud storage, staff relocation exercises
Denial of Access – Man-made Disaster	Diversification of key suppliers and partners	Increased security measures, site fencing	Legal contracts with third-party providers to share risks	Accept limited access to certain facilities in case of an attack	Security guards, video surveillance, and building reinforcement	Regular security drills, review of third-party risk management
Unavailability of People	Cross-training employees for key roles	Remote working arrangements, flexible hours	Outsourcing roles or hiring temporary staff	Accept some level of absenteeism during crises	Staff contingency plans, part-time and freelance staff	Establish partnerships with staffing agencies, further remote work capabilities
Disruption to the Supply Chain	Diversified supply chain sources	Stockpiling essential materials, local suppliers	Contracts with suppliers to ensure business continuity	Accept minor delays in non-critical supplies	Supplier agreements, vendor relationships, and alternate suppliers	Long-term supplier agreements, additional local suppliers
Equipment and IT-Related Disruption	Cloud migration, automation for critical systems	Regular system maintenance, backup power supplies	IT support and service level agreements (SLAs) with third parties	Accept some system downtime for non-essential systems	Backup servers, UPS (uninterruptible power supply), firewalls	Implement AI-based monitoring, disaster recovery systems

In conclusion, the treatment and control of risks at SHINE Children and Youth Services are ongoing processes that require proactive management and regular updates.

The threats SHINE faces, including natural and man-made disasters, supply chain disruptions, and IT-related issues, pose significant risks to the organisation’s ability to provide uninterrupted services.

By employing a comprehensive risk treatment strategy that incorporates risk avoidance, reduction, transference, and acceptance, SHINE ensures that it can continue its mission effectively.

The current controls in place, such as backup systems, security measures, and supplier contracts, provide a solid foundation for managing threats.

However, as the environment evolves, it is crucial to continue improving these controls. The additional planned controls, such as further cloud migrations, enhanced security measures, and new supplier agreements, will bolster SHINE’s resilience and ability to maintain its critical services even in the face of crises.

Ultimately, this chapter has outlined a dynamic approach to managing risks, ensuring SHINE’s operational continuity while also fostering a culture of preparedness and resilience within the organisation.

Continuity of Care: Ensuring SHINE’s Mission Through Effective BCM

eBook 3: Starting Your BCM Implementation

RAR T1

RAR T2

RAR T3

BCS T1

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].