---
title: "[CM] [JHA] [E2] [C4] Implementing Business Impact Analysis Phase as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged"
description: How the BCM team's business impact analysis gives JHA's crisis team critical functions, tiers and recovery targets for crisis management, ISO 22361 aligned.
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Crisis Management in Action: A Practical Implementation Guide for Jamiyah Home for the Aged
# \[CM\] \[JHA\] \[E2\] \[C4\] Implementing Business Impact Analysis Phase as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged
[![\[CM\] \[JHA\] \[Full Banner\] \[Haze\] A Practical Implementation Guide for Jamiyah Home for the Aged](https://no-cache.hubspot.com/cta/default/3893111/bdc00ed8-f19a-4103-a408-1d726db0e452.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bdc00ed8-f19a-4103-a408-1d726db0e452)
This chapter is part of eBook 2, *Implementing Crisis Management for Jamiyah Home for the Aged*, in the series *Crisis Management in Action: A Practical Implementation Guide for Jamiyah Home for the Aged*. The work aligns with ISO 22361, which expects crisis management to draw on the organisation's understanding of its critical activities and the effects of losing them.
The division of labour in this phase matters. The BIA is a specialist analysis, usually run through interviews and questionnaires with the managers who own each function. It belongs to the BCM team, which also owns the business continuity plans that restore functions after disruption. The crisis management team does not repeat the analysis. Instead, it takes the BIA findings as an input, checks that they cover the scenarios ranked in Chapter 3, and builds its decisions on them. The crisis team's first question in any serious event is which critical functions are at risk and how long they can tolerate disruption. The BIA is the written answer.
For this reason, the chapter has two audiences. The BCM team will recognise the steps as its own work. The crisis team, project sponsor and managing agent will see what they should expect to receive and how to read it. The worked examples use the 25 critical business functions listed for JHA. The tiers, recovery time objectives and recovery point objectives shown are illustrative. They show the form of a result, and the BCM team's analysis will set the real values.
[![\[Logo\] \[CM\] Certification Transparent](https://no-cache.hubspot.com/cta/default/3893111/93e4d869-8de4-4ffd-8aad-33538c5ce0ee.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/93e4d869-8de4-4ffd-8aad-33538c5ce0ee)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/cm-v2/author/dr-goh-moh-heng) Nov 12, 2026
Crisis decisions are easier when the people making them know which parts of the organisation cannot stop, which can wait, and for how long. The Business Impact Analysis (BIA) phase supplies that knowledge. In this methodology the Business Continuity Management (BCM) team manages and completes the BIA, and the crisis management team relies on its findings. This chapter describes the five steps of the phase and shows, for each, what the BCM team produces for Jamiyah Home for the Aged (JHA) and how the crisis management team uses it.
## [![\[CM\] \[JHA\] \[Full Banner\] \[Haze\] A Practical Implementation Guide for Jamiyah Home for the Aged](https://no-cache.hubspot.com/cta/default/3893111/bdc00ed8-f19a-4103-a408-1d726db0e452.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bdc00ed8-f19a-4103-a408-1d726db0e452)
## Introduction
[![\[CM\] \[JHA\] \[E2\] \[C4\] Business Impact Analysis](https://no-cache.hubspot.com/cta/default/3893111/d95c7c02-ed9e-48e8-a888-1e295cb747ac.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d95c7c02-ed9e-48e8-a888-1e295cb747ac)*Implementing Crisis Management for Jamiyah Home for the Aged*, in the series *Crisis Management in Action: A Practical Implementation Guide for Jamiyah Home for the Aged*. The work aligns with ISO 22361, which expects crisis management to draw on the organisation's understanding of its critical activities and the effects of losing them.
The division of labour in this phase matters. The BIA is a specialist analysis, usually run through interviews and questionnaires with the managers who own each function. It belongs to the BCM team, which also owns the business continuity plans that restore functions after disruption. The crisis management team does not repeat the analysis. Instead, it takes the BIA findings as an input, checks that they cover the scenarios ranked in Chapter 3, and builds its decisions on them. The crisis team's first question in any serious event is which critical functions are at risk and how long they can tolerate disruption. The BIA is the written answer.
For this reason, the chapter has two audiences. The BCM team will recognise the steps as its own work. The crisis team, project sponsor and managing agent will see what they should expect to receive and how to read it. The worked examples use the 25 critical business functions listed for JHA. The tiers, recovery time objectives and recovery point objectives shown are illustrative. They show the form of a result, and the BCM team's analysis will set the real values.
## What the BIA phase involves
The BCM Institute source page for this phase gives five steps: identify critical business functions; analyse their dependencies; map interdependencies; set recovery time objectives (RTOs); and set recovery point objectives (RPOs). It also notes that the BCM team manages and completes this phase so that the crisis management team can rely on the findings. A recovery time objective is the time within which a function must be restored after disruption. A recovery point objective is the amount of data loss, measured in time, that the organisation can tolerate.
## Steps for implementing the phase
### Step 1: Identify critical business functions
The first step identifies the functions that would be hit hardest by each crisis scenario. The source page gives examples such as production, financial operations, customer service and human resources. For a residential home, the list looks different: it starts with resident care and extends to the services that make care possible.
**Example for JHA:** The BCM team works from the list of 25 critical business functions, CBF-01 to CBF-25. In Chapter 3, the project team mapped each scenario to the functions it affects most. The BCM team now validates that map through interviews with the function owners and adds anything missing. The tables below present the functions in four groups so that a long list stays readable. They also show a tier and an illustrative RTO for each function, which are covered under Step 4.
**Group A: core care and safety**
| **Code** | **Critical business function** | **Tier** | **Illustrative RTO** |
| --- | --- | --- | --- |
| **CBF-01** | **Personal Care and 24-Hour Supervision** | **1** | **4 hours** |
| **CBF-02** | **Resident Safety, Security and Emergency Response** | **1** | **4 hours** |
| **CBF-03** | **Medication Management and Administration** | **1** | **4 hours** |
| **CBF-04** | **Nursing and Basic Health Care Coordination** | **1** | **4 hours** |
| **CBF-05** | **Meals, Nutrition and Dietary Management** | **1** | **4 hours** |
| **CBF-07** | **Infection Prevention and Control** | **1** | **4 hours** |
| **CBF-25** | **End-of-Life Care and Bereavement Support** | **1** | **4 hours** |
**Group B: accommodation, records, facilities and systems**
| **Code** | **Critical business function** | **Tier** | **Illustrative RTO** |
| --- | --- | --- | --- |
| **CBF-06** | **Accommodation, Housekeeping and Laundry** | **2** | **24 hours** |
| **CBF-09** | **Resident Records and Information Management** | **2** | **24 hours** |
| **CBF-19** | **Facilities, Utilities and Equipment Maintenance** | **1** | **4 hours** |
| **CBF-20** | **Information Technology and Communications** | **2** | **24 hours** |
**Group C: resident support and programmes**
| **Code** | **Critical business function** | **Tier** | **Illustrative RTO** |
| --- | --- | --- | --- |
| **CBF-08** | **Admission, Assessment and Resident Case Management** | **3** | **3 days** |
| **CBF-10** | **Physiotherapy and Rehabilitation Support** | **3** | **3 days** |
| **CBF-11** | **Counselling and Psycho-Social Support** | **2** | **24 hours** |
| **CBF-12** | **Resident Programmes, Activities and Daily Living Skills** | **4** | **7 days** |
| **CBF-13** | **Religious, Cultural and Spiritual Care** | **3** | **3 days** |
| **CBF-14** | **Home Employment, Day Release and Employment Support** | **4** | **7 days** |
| **CBF-15** | **Community Reintegration and Discharge Planning** | **4** | **7 days** |
| **CBF-16** | **Volunteer, School and Visitor Management** | **3** | **3 days** |
**Group D: people, governance and external relations**
| **Code** | **Critical business function** | **Tier** | **Illustrative RTO** |
| --- | --- | --- | --- |
| **CBF-17** | **Staff Rostering, Deployment and Welfare** | **1** | **4 hours** |
| **CBF-18** | **Staff Training and Competency** | **4** | **7 days** |
| **CBF-21** | **Finance, Funding and Procurement** | **3** | **3 days** |
| **CBF-22** | **Partner Agency and Regulator Liaison** | **2** | **24 hours** |
| **CBF-23** | **Governance, Compliance and Licensing Reporting** | **3** | **3 days** |
| **CBF-24** | **Crisis and Next-of-Kin Communications** | **1** | **4 hours** |
Tier 1 functions are those where an interruption would put residents at immediate risk. Tier 2 functions support Tier 1 directly or carry a short-term legal or welfare consequence. Tier 3 functions can pause for a few days without harm. Tier 4 functions can pause for a week or more. The functions on the home's list that are not described on its public pages, such as nursing coordination, infection prevention and control, finance and funding, and end-of-life care, are included because the home's management identified them; the BCM team should confirm their scope with the function owners.
### Step 2: Analyse business function dependencies
The second step identifies the activities that deliver each function and what each activity relies on: people, premises, systems, suppliers and information. The BCM team gathers this through interviews, asking each owner what would stop the function and what it needs to restart.
**Example for JHA:** The analysis for medication management (CBF-03) might find that it depends on trained staff on every shift (CBF-17), nursing oversight (CBF-04), accurate resident records (CBF-09), a working communications link to the supplier of medication, and a secure storage area with working power (CBF-19). For meals (CBF-05), it might rely on kitchen utilities (CBF-19), staff (CBF-17), supplies from outside vendors (CBF-21), and dietary information held in resident records (CBF-09). For crisis and next-of-kin communications (CBF-24), it might rely on up-to-date contact details in the records (CBF-09), phone and messaging services (CBF-20), and a designated spokesperson, as identified in Chapter 5.
### Step 3: Map interdependencies
The third step shows how a failure in one function cascades into others. The source page suggests flowcharts or dependency matrices. A simple matrix is often enough: list each critical function with the other functions it relies on, and the functions that appear most often as dependencies are the ones whose failure would spread furthest.
**Example for JHA:** A fragment of an illustrative matrix follows.
| **Function** | **Relies on** |
| --- | --- |
| **CBF-01 Personal care and supervision** | **CBF-17, CBF-19, CBF-06** |
| **CBF-03 Medication management** | **CBF-04, CBF-09, CBF-17, CBF-19, CBF-20** |
| **CBF-05 Meals and nutrition** | **CBF-09, CBF-17, CBF-19, CBF-21** |
| **CBF-09 Resident records** | **CBF-19, CBF-20** |
| **CBF-24 Crisis and next-of-kin communications** | **CBF-09, CBF-20, CBF-22** |
| **CBF-22 Partner agency and regulator liaison** | **CBF-09, CBF-20** |
The pattern is clear. Facilities and utilities (CBF-19), information technology and communications (CBF-20) and resident records (CBF-09) sit beneath many other functions. A prolonged power failure (scenario CS-05) would therefore reach far beyond the building: it would weaken records, communications, medication routines, and the ability to inform families. This is the sort of cascade that a crisis team needs to see before an event, because it explains why a plain-looking technical failure can become a care crisis within hours.
### Step 4: Set recovery time objectives
The fourth step defines how much downtime each critical function can tolerate. The source page names function criticality, financial impact and regulatory requirements as factors, and advises setting targets that are ambitious but achievable. In a residential home, the dominant factor is the effect on residents' health and safety, and the achievable target depends on the resources in place.
**Example for JHA:** The tables above show the illustrative RTOs. Tier 1 functions carry a four-hour target. For several of them, such as personal care and supervision, the practical meaning is that no gap in service is acceptable: the target limits how long the home may operate on emergency arrangements before it must return to normal. The BCM team should also test whether each target is achievable. A four-hour RTO for medication administration is meaningful only if the home has a fallback, such as paper medication charts and a second authorised person, that can start within that time. Where a target cannot be met, the BCM team records the gap, and the crisis team treats that function as a priority risk in its protocols.
### Step 5: Set recovery point objectives
The fifth step defines how much data loss is tolerable. The source page lists data sensitivity, backup procedures, and business needs as factors and advises realistic targets given available backup capability. RPOs apply only to functions that depend on data.
**Example for JHA:** The BCM team might set the following illustrative targets.
| **Function** | **Data at risk** | **Illustrative RPO** |
| --- | --- | --- |
| **CBF-03 Medication management** | **Records of doses given and due** | **1 hour** |
| **CBF-04 Nursing and basic health care coordination** | **Health observations and care notes** | **4 hours** |
| **CBF-08 Admission, assessment and case management** | **Assessments and case files** | **24 hours** |
| **CBF-09 Resident records and information management** | **Core resident records and contact details** | **4 hours** |
| **CBF-21 Finance, funding and procurement** | **Financial records** | **24 hours** |
The medication records carry the tightest target because an out-of-date record could lead to a missed or duplicated dose. The BCM team should check that the current backup arrangements can meet each RPO. If they cannot, the BCM team and the information technology representative record the shortfall, and the crisis team gains a defined risk to account for in the strategy phase.
## Questions for the BCM team
The handover is more useful when the crisis management team arrives with questions. Five are worth asking at every hand-off. First, does the analysis cover every scenario from Chapter 3, CS-01 to CS-08, or only the most obvious ones? Second, which Tier 1 functions cannot currently meet their RTO, and what is the plan to close each gap? Third, what manual workarounds exist, such as paper medication charts, printed resident contact lists or a fallback roster, and who has the authority to switch to them? Fourth, what staffing levels does each target assume, and what happens when a shift falls below them? Fifth, when was the analysis last reviewed, and what has changed since?
The answers shape the crisis plan directly. A workaround that exists on paper but has never been used is a weak assumption, and the exercises in Chapter 7 should test it. A target that rests on full staffing is exposed in scenario CS-07, a severe staff shortage, and the response protocol for that scenario should say what the home does when the assumption fails. Gaps that the BCM team cannot close within its own resources should be escalated to the project sponsor and the managing agent as decisions, with the risk to residents stated plainly.
It also helps to agree how the two teams will work together once the plan is live. In a real event, the BCM team is likely to lead the restoration of functions while the crisis management team handles strategic decisions and communication. The two should share a common picture of which functions are down, which are degraded and which are running normally, updated at an agreed interval. A one-page status board listing the Tier 1 functions, with a simple colour or status code, is often enough, and it can be rehearsed in the exercises.
## How the crisis management team uses the BIA
The BCM team should hand over the BIA as a short, signed-off pack: the list of functions with tiers, the dependency map, the RTOs and RPOs, the assumptions made and the gaps found. The crisis management team then uses it in four ways. It sets activation criteria in Chapter 5, for example by defining a crisis as any event that threatens a Tier 1 function beyond its RTO. It sets resource priorities, so that scarce staff and supplies go first to Tier 1 functions. It shapes the communication plan, since families and MSF will want to know which services are affected. And it feeds the plan in Chapter 6, which includes the business continuity plans for critical functions where they exist. The crisis team should also check the pack against the scenarios from Chapter 3 and send any gaps back to the BCM team.
The pack needs a review cycle. The home's functions and dependencies change as programmes, staffing, systems and suppliers change. The BCM team should refresh the BIA on a defined schedule and after any significant change, and notify the crisis team when it does.
## Outputs of the phase
- A validated list of critical business functions, CBF-01 to CBF-25, with owners.
- A tier for each function.
- A dependency map and interdependency matrix.
- RTOs for all functions and RPOs for data-dependent functions.
- A record of assumptions and of gaps between targets and current capability.
- A handover pack from the BCM team to the crisis management team.
## [![x \[CM\] \[JHA\] \[Haze\] Summing Up Banner](https://no-cache.hubspot.com/cta/default/3893111/bad7a111-1867-45a8-8fc3-ce1000eed090.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bad7a111-1867-45a8-8fc3-ce1000eed090)
## Conclusion
The BIA gives the crisis team facts to work from. At JHA, the illustrative results show ten Tier 1 functions at the heart of resident care, a handful of enabling functions such as utilities, records and communications that sit beneath many others, and a set of programmes that can pause when care is at risk. With these findings in hand, the crisis team can decide how the home will respond. Chapter 5 takes the next step, setting out the response protocols, the strategy the home will adopt and the communication plan.
## Sources
- [BCM Institute, CM Phase 3: Business Impact Analysis](https://blog.bcm-institute.org/en/ebook-cm/cm-phase-3-business-impact-analysis)
- [Jamiyah Home for the Aged, programmes and activities](https://jha.jamiyah.org.sg/programmes-activities/)
- [ISO 22361:2022 listing, AFNOR](https://www.boutique.afnor.org/en-gb/standard/iso-223612022/security-and-resilience-crisis-management-guidelines/xs140281/336670)
**Continue reading:** Chapter 5, *Implementing Crisis Management Strategy Phase, as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged*, sets out response protocols, mitigation measures, response strategies and the communication plan.
## **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/cm-v2/author/dr-goh-moh-heng"
},
"dateModified" : "2026-11-12T08:37:38.268Z",
"datePublished" : "2026-11-12T08:37:38.000Z",
"headline" : "[CM] [JHA] [E2] [C4] Implementing Business Impact Analysis Phase as part of the Crisis Management Planning Methodology for Jamiyah Home for the Aged",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/cm-v2/cm-jha-e2-c4-implementing-business-impact-analysis-phase-as-part-of-the-crisis-management-planning-methodology-for-jamiyah-home-for-the-aged",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```