
Part 3: RAR – Risk Impact and Likelihood Assessment
Surbana Jurong Group
This chapter presents the Risk Impact and Likelihood Assessment for Surbana Jurong (SJ) as part of the organisation’s overall Risk Assessment and Review (RAR) process.
Building on the identified threats outlined in Part 1: RAR – List of Threats, this section evaluates each risk based on its potential impact across several critical domains, namely: Finance, Operations, Legal and Regulatory, Reputation and Image, Social Responsibility, People, and Assets/IT Systems/Information.
The purpose of this assessment is to determine the severity of each threat if it materialises, combined with the likelihood of its occurrence.
This structured evaluation helps prioritise risks that require immediate mitigation and informs strategic decisions related to business continuity planning, disaster recovery, and operational resilience.
The analysis supports compliance with ISO 22301 Business Continuity Management System (BCMS) standards. It is essential in ensuring SJ's ability to maintain service delivery, safeguard stakeholders, and protect its corporate reputation in the face of various disruptions.
Each threat is scored using a 5-point scale for both impact and likelihood. The resulting risk ratings guide the determination of risk levels—Low, Medium, High, or Critical—and assist in estimating the expected period of disruption.
Here is the "Part 3: RAR - Risk Impact and Likelihood Assessment" table for Surbana Jurong (SJ) based on a standard risk assessment framework.
The threats are assumed based on typical risks for an engineering and infrastructure consultancy firm like SJ (referencing from your Part 1: RAR - List of Threats):
Risk Impact and Likelihood Assessment Table
Threat |
Finance |
Operations |
Legal & Regulatory |
Reputation & Image |
Social Responsibility |
People |
Assets / IT Systems / Information |
Risk Impact Area (Highest Score) |
Risk Likelihood |
Risk Rating (Impact × Likelihood) |
Risk Level |
Expected Period of Disruption |
Cyberattack on design platforms |
4 |
4 |
3 |
4 |
2 |
3 |
5 |
5 (Assets/IT) |
4 (Likely) |
20 |
High |
3 – 7 days |
Pandemics affecting on-site operations |
4 |
5 |
4 |
4 |
5 |
5 |
3 |
5 (Operations/People) |
3 (Possible) |
15 |
Medium |
1 – 2 weeks |
Data breach or IP theft |
4 |
3 |
5 |
4 |
2 |
3 |
5 |
5 (Legal & IT) |
3 (Possible) |
15 |
Medium |
1 week |
Fire or flood in the data centre |
5 |
4 |
3 |
3 |
2 |
2 |
5 |
5 (IT Systems) |
2 (Unlikely) |
10 |
Low-Med |
3 – 5 days |
Regulatory non-compliance (e.g. PDPA, BIM, safety) |
4 |
3 |
5 |
4 |
3 |
2 |
4 |
5 (Legal & Regulatory) |
2 (Unlikely) |
10 |
Low-Med |
1 – 2 days |
Project site accident/fatality |
3 |
4 |
4 |
5 |
5 |
5 |
2 |
5 (People) |
3 (Possible) |
15 |
Medium |
1 – 2 weeks |
Political instability in overseas projects |
4 |
4 |
4 |
4 |
3 |
3 |
3 |
4 (Finance/Operations) |
2 (Unlikely) |
8 |
Low |
>2 weeks |
Contractor/vendor failure |
4 |
5 |
3 |
3 |
3 |
3 |
2 |
5 (Operations) |
3 (Possible) |
15 |
Medium |
3 – 7 days |
Industrial espionage |
4 |
2 |
5 |
4 |
2 |
3 |
4 |
5 (Legal & Regulatory) |
2 (Unlikely) |
10 |
Low-Med |
1 week |
Environmental/climate disaster (e.g. flooding at the site) |
5 |
5 |
4 |
4 |
5 |
4 |
4 |
5 (Operations & Social Responsibility) |
3 (Possible) |
15 |
Medium |
1 – 2 weeks |
Notes
- Scoring system (1-5) is assumed:
- 1 = Negligible/Remote, 5 = Severe/Certain.
- Risk Rating = Impact × Likelihood.
- Risk Level:
- 1–6 = Low,
- 7–14 = Medium,
- 15–19 = High,
- 20–25 = Critical.
Summing Up ...
The Risk Impact and Likelihood Assessment highlights the varied nature and severity of threats that may affect Surbana Jurong’s operations, both locally and in its overseas projects.
Through this structured evaluation, SJ gains visibility into which risk scenarios pose the most significant threat to its critical business functions and stakeholders.
High-risk areas such as cyberattacks, project site accidents, and vendor failures indicate the need for strengthened controls, improved resilience strategies, and contingency planning.
This chapter serves as a foundation for the next step in the risk management lifecycle—developing and refining targeted risk treatment and mitigation strategies, as documented in Part 4: RAR – Risk Treatment Plan.
By prioritising and addressing these risks proactively, Surbana Jurong enhances its ability to continue delivering engineering and infrastructure services reliably and responsibly, even in times of crisis.
More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].