Risk Details Form Primary and Secondary Risk Types Examples – Primary Risk Secondary Risk Additional description Potential consequences / contributing factors Existing controls Category Category if required Disruption to essential Business Disruption to Harm to clients. Natural disaster. Procedures to be followed in the hours preceding services includes those Continuity essential services a storm to protect computers, paper records etc. Disruption to clinical Inadequate back-up systems, or failure services which would are specified (Documents Register) services. of back-up systems to provide adequate impact on the Recovery processes, including procedures for Loss of clinical information. continuity of impact assessment, repair/restoration, alternate Non-compliance with procedure for operations, Breach of regulatory waste solutions, post-incident analysis, and the updating managing back-up systems. management management of the of the emergency management plan are specified security and operability requirements. (Documents Register) of communications Communication response team, defining systems. Disruption to employee roles and responsibilities and essential services may establishing a chain of command for operational result from power functions and maintenance of communications outages including infrastructure and IT services, are specified emergencies power (Documents Register) outage and interruption to water Staff Mandatory training, includes training for all phases of an emergency are scheduled (Training and waste management supply. Register). Communications leader training for those responsible for coordinating communications operations during major emergency events, is scheduled (Training Register). Employee contact lists maintained with details of employee’s office, mobile and personal numbers, office and personal email addresses. Requirements for databases to be backed up at the last possible moment, are specified. Emergency plan documented and available to all staff (Documents Register). Service provider contact detailing contact information for IT, Internet, and
Risk Details Form Primary and Secondary Risk Types – Examples Primary Risk Category Secondary Risk Category Additional description if required Potential consequences / contributing factors Existing controls Business Continuity Disruption to essential services Disruption to essential services includes those services which would impact on the continuity of operations, management of the security and operability of communications systems. Disruption to essential services may result from power outages including emergencies power outage and interruption to water and waste management supply. Harm to clients. Disruption to clinical services. Loss of clinical information. Breach of regulatory waste management requirements. Natural disaster. Inadequate back-up systems, or failure of back-up systems to provide adequate Non-compliance with procedure for managing back-up systems. Procedures to be followed in the hours preceding a storm to protect computers, paper records etc. are specified (Documents Register) Recovery processes, including procedures for impact assessment, repair/restoration, alternate solutions, post-incident analysis, and the updating of the emergency management plan are specified (Documents Register) Communication response team, defining employee roles and responsibilities and establishing a chain of command for operational functions and maintenance of communications infrastructure and IT services, are specified (Documents Register) Staff Mandatory training, includes training for all phases of an emergency are scheduled (Training Register). Communications leader training for those responsible for coordinating communications operations during major emergency events, is scheduled (Training Register). Employee contact lists maintained with details of employee’s office, mobile and personal numbers, office and personal email addresses. Requirements for databases to be backed up at the last possible moment, are specified. Emergency plan documented and available to all staff (Documents Register). Service provider contact detailing contact information for IT, Internet, and
doc_256_LOGIQC_QMS_Risk_Module_Set-up_Guide_v2.docx