[BCM] [SAESL] [E1] [C8] Chapter 8: Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

Introduction

Singapore Aero Engine Services Private Limited (SAESL) now has goals, objectives, assumptions, a BCM team and an understanding of its operating environment. What it needs next is a method: a repeatable sequence of work that takes the programme from a decision to proceed through to tested plans and continual improvement.

This chapter sets out a seven-phase BCM planning methodology and applies it to SAESL. The phases are Project Management (PM), Risk Analysis and Review (RAR), Business Impact Analysis (BIA), Business Continuity Strategy (BCS), Plan Development (PD), Testing and Exercising (TE) and Program Management (PgM). Each phase maps to specific clauses of ISO 22301, so following the method also builds the evidence SAESL needs for a conforming business continuity management system (BCMS).

Why a Structured Methodology

A methodology brings three benefits. It makes sure no essential step is skipped. It makes the programme predictable, so leadership knows what will be delivered and when. It also makes the programme repeatable, so that when SAESL reviews its BCMS each year, it follows the same disciplined path.

The seven phases broadly follow the Plan-Do-Check-Act cycle introduced in Chapter 1. Project Management is mostly "Plan". Analysis, strategy and plan development are "Do". Testing and exercising are "Check". Program Management carries the cycle into "Act" and back around again.

Phase 1: Project Management (PM)

Purpose: establish the programme on a sound footing.

This phase confirms leadership commitment, appoints the BCM team described in Chapter 6, agrees the scope of the BCMS and approves the BC policy. It also produces a project plan with milestones, resources and a budget. In ISO 22301 terms, it addresses clauses 4.3 (scope), 5 (leadership), 6 (planning) and 7 (support).

SAESL example: the steering committee might approve a phased scope that starts with engine overhaul and the engine test facility, then extends to component repair and support services. The project plan would schedule BIA workshops around peak shop workload so that key engineers can attend.

Phase 2: Risk Analysis and Review (RAR)

Purpose: identify and evaluate the risks of disruption to SAESL's activities and resources.

This phase identifies threats and vulnerabilities, rates their likelihood and impact, and decides which require treatment. It corresponds to clause 8.2.3. Chapter 9 describes the method in detail.

SAESL example: the risk review might find that the engine test facility is a single point of failure, and that a fire or major equipment failure there would halt deliveries of overhauled engines.

Phase 3: Business Impact Analysis (BIA)

Purpose: determine which activities matter most and how quickly they must be restored.

The BIA assesses the impact of disruption over time on each activity, and sets the maximum tolerable period of disruption (MTPD), recovery time objective (RTO), recovery point objective (RPO) for data, and minimum business continuity objective (MBCO). It also records the resources each prioritised activity depends on. This phase corresponds to clause 8.2.2, and Chapter 10 applies it to SAESL.

Risk analysis and BIA complement each other. The BIA tells SAESL what matters and how fast; the risk assessment tells it what could go wrong. Many organisations run the two in parallel, sharing workshops to save the business's time.

SAESL example: the BIA might show that the impact of stopping engine testing grows sharply after a certain number of days, as finished engines queue for release and customer aircraft remain on the ground.

Phase 4: Business Continuity Strategy (BCS)

Purpose: choose how SAESL will continue or recover its prioritised activities.

Strategies address each resource type: people, premises, equipment, technology, information, and suppliers. Options are compared for cost, effectiveness and compliance, and leadership selects the preferred solutions. This phase corresponds to clause 8.3.

SAESL example: for engine testing, options might include protecting the existing facility, agreeing mutual-aid arrangements within the wider Trent MRO network, or prioritising which engines are tested first during recovery. Every option must be checked against SAESL's approvals from the Civil Aviation Authority of Singapore (CAAS) and the other 12 authorities.

Phase 5: Plan Development (PD)

Purpose: document how SAESL will respond and recover.

This phase produces the incident response structure, warning and communication procedures, business continuity plans and recovery procedures required by clause 8.4. Plans should be short, action-focused and easy to use under pressure.

SAESL example: SAESL might develop a crisis management plan for the crisis management team, a business continuity plan for each service line, an IT disaster recovery plan, and a customer communication procedure that sets out how and when airline customers are told about delays.

Phase 6: Testing and Exercising (TE)

Purpose: prove that plans work and that people know how to use them.

Clause 8.5 requires an exercise programme, and clause 8.6 requires the organisation to evaluate its BC documentation and capabilities. Exercises range from simple walkthroughs to tabletop scenarios and full simulations. Each should have clear objectives and a written report with improvement actions.

SAESL example: a first-year programme might include a tabletop exercise on loss of the test facility, a technical test restoring engineering records from backup, and a call-tree test reaching staff across all shifts.

Phase 7: Program Management (PgM)

Purpose: keep the BCMS effective over time.

This phase covers monitoring and measurement, internal audit, management review, and the handling of nonconformities and improvement actions. It corresponds to clauses 9 and 10. It also includes routine maintenance: updating contact lists, reviewing plans after organisational changes and refreshing training.

SAESL example: the BCM coordinator might run an annual cycle in which each departmental plan is reviewed, an internal audit is carried out, and the steering committee holds a management review that considers exercise results, audit findings and changes in the operating environment.

An Indicative Roadmap

The phases overlap in practice. An indicative first-cycle roadmap for SAESL might look like this, with all durations illustrative:

1. Months 1–2: Project Management. Approve policy, scope and team.
2. Months 2–5: Risk Analysis and Review and Business Impact Analysis, run in parallel.
3. Months 5–7: Business Continuity Strategy. Select and approve solutions.
4. Months 7–10: Plan Development. Write and approve plans.
5. Months 10–12: Testing and Exercising. Run the first exercises.
6. Month 12 onward: Program Management. Internal audit, management review and the next cycle.

Summary Table

Table 8: Business Continuity Management Planning Methodology for Singapore Aero Engine Services Private Limited

Conclusion

The seven-phase methodology gives SAESL a clear, repeatable path from commitment to a working BCMS. Each phase has a defined purpose, produces specific deliverables and maps to ISO 22301, so following the method also builds the evidence an auditor will look for.

The next two chapters apply the analytical heart of the method. Chapter 9 assesses the risks and threats SAESL faces, and Chapter 10 identifies its critical business functions.

Continue reading: Chapter 9, Assessing Risks and Threats for Singapore Aero Engine Services Private Limited, shows how SAESL can identify, rate and treat the risks of disruption to its operations.