[BCM] [BT] [E3] [BIA] [T2] [CBF] [5] Compliance, Governance & Reporting

BIA Questionnaires 

Part 3: Impact Over Time of Business Functions

Notes for BCM Institute's Course Participants: This is the template for completing the "Part 3: Impact Over Time of Business Functions."

CBF 5: Compliance, Governance & Reporting

In the realm of corporate governance and statutory compliance, time sensitivity plays a crucial role in sustaining the operational integrity and legal standing of an organisation.

For Bandtree, as a government-linked company (GLC) operating under Darussalam Assets, maintaining robust compliance and reporting functions is not only a regulatory necessity but also a pillar of public trust and organisational resilience.

Purpose of Chapter

This chapter presents a detailed assessment of how disruptions to the key sub-functions under CBF-5 —Compliance, Governance, and Reporting — impact the organisation over various time intervals.

The analysis is conducted using a structured Business Impact Analysis (BIA) approach, with impact levels scored on a scale from 1 (lowest) to 5 (highest).

The objective is to determine the criticality of each sub-process over specific periods of disruption, enabling the prioritisation of recovery actions and continuity planning.

Each sub-function—ranging from regulatory compliance to ESG reporting and business continuity governance—is evaluated against its time-sensitive dependencies, legal obligations, and stakeholder expectations.

The analysis considers the Recovery Time Objective (RTO), Maximum Tolerable Period of Disruption (MTPD), and periods of heightened vulnerability for each sub-process.

This structured approach enables Bandtree to prioritise response efforts, allocate resources effectively, and enhance overall resilience in the face of unexpected disruptions.

This table outlines the CBF-5: Compliance, Governance & Reporting and its sub-processes (Sub-CBFs) for Bandtree, following the impact over time methodology from BCM Institute's guidance Notes and using a 1–5 severity scale.

Table 3-1: [BIA] [P3] Impact Over Time of Business Functions (Sub-CBF) for CBF-5 Compliance, Governance & Reporting

Table 3-2: [BIA] [P3] Impact Over Time of Business Functions (Sub-CBF) for CBF-5 Compliance, Governance & Reporting

Legend – Impact Scores

• 1 = Negligible Impact (Very Low)
• 2 = Minor Impact (Low)
• 3 = Moderate Impact (Medium)
• 4 = Major Impact (High)
• 5 = Critical/Catastrophic Impact (Very High)

Key Notes

• RTO (Recovery Time Objective): Indicates the acceptable downtime before severe impact begins.
• MTPD (Maximum Tolerable Period of Disruption): Maximum allowable time the sub-function can be disrupted before irrecoverable consequences occur.
• Vulnerable Period: Timeframes in which disruption has amplified effects (e.g., audits, contract renewals, public reporting).

Summing Up... Part 3

The findings of this impact assessment underscore the high sensitivity and criticality of Bandtree compliance, governance, and reporting functions across both short-term and extended disruption periods.

Sub-CBFs, such as Regulatory & Legal Compliance and Strategic & Statutory Reporting, exhibit elevated impact ratings within the first 24 to 48 hours of interruption, emphasising their time-critical nature during legal filing periods and reporting cycles.

By identifying the Recovery Time Objectives (RTOs) and the Maximum Tolerable Periods of Disruption (MTPDs) for each sub-CBF, the organisation is better equipped to allocate resources, implement risk mitigation strategies, and align recovery priorities with regulatory mandates and corporate governance standards.

This impact analysis not only reinforces the need for timely and uninterrupted execution of compliance functions but also contributes directly to the development of effective Business Continuity Plans (BCPs) and risk oversight frameworks.

Through this structured understanding, Bandtree strengthens its resilience, safeguards stakeholder confidence, and ensures uninterrupted compliance with Brunei’s legal and governance requirements.

 BIA Questionnaires 

Part 4: Supporting IT Systems and Applications

Notes for BCM Institute's Course Participants: This is the template for completing the "Part 4: Supporting IT Systems and Applications."

CBF 5: Compliance, Governance & Reporting

In today's data-driven and compliance-centric environment, the integrity and continuity of supporting IT systems play a pivotal role in sustaining the effectiveness of Bandtree Sdn Bhd’s compliance, governance, and reporting functions.

CBF-5 encompasses critical sub-processes, including Regulatory and Legal Compliance, Internal Audit, Corporate Governance Monitoring, ESG Reporting, Business Continuity Governance, and Strategic and Statutory Reporting.

Each of these areas relies on a suite of IT systems and applications to manage information flow, ensure regulatory alignment, generate reports, and support strategic decision-making.

Purpose of Chapter

This chapter identifies the key IT systems and applications supporting each sub-function under CBF-5. It outlines their associated Recovery Point Objectives (RPOs), Recovery Time Objectives (RTOs), and any special equipment or infrastructure dependencies.

The objective is to establish a comprehensive understanding of the technological backbone that enables continuity, accountability, and resilience in Bandtree’s governance and compliance ecosystem.

Here is a detailed table for CBF-5: Compliance, Governance & Reporting and its Sub-CBFs, designed for Bandtree with the specified headers:

Table 4-1: [BIA] [P4] Supporting IT Systems and Applications for CBF-5 Compliance, Governance & Reporting

Table 4-2: [BIA] [P4] Supporting IT Systems and Applications for CBF-5 Compliance, Governance & Reporting

Summing Up ... for Part 4

The effectiveness of CBF-5 Compliance, Governance & Reporting is inextricably linked to the availability and resilience of its supporting IT systems.

As demonstrated, each sub-function depends on purpose-built applications, from audit software and compliance databases to governance dashboards and ESG analytics platforms.

Ensuring that these systems meet the defined RPOs and RTOs is not merely an operational requirement—it is essential for maintaining Bandtree Sdn Bhd’s regulatory standing, internal control framework, and stakeholder trust.

As we advance, the organisation must continuously assess, update, and test the performance and recovery capability of these systems to align with evolving regulatory requirements and business priorities.

This proactive approach reinforces Bandtree’s commitment to robust governance and operational continuity.