[BCM] [ALPS] [E1] [C1] Overview of BCM Case Study

Building Business Continuity Resilience  for ALPS Healthcare (ALPS)

 

 

Introduction

Implementing Business Continuity Management (BCM) effectively begins with understanding the organisation that the BCM programme is intended to protect.

For ALPS Healthcare (ALPS), this understanding extends beyond its internal organisational structure.

It requires consideration of ALPS's position within Singapore's public healthcare ecosystem, the healthcare institutions it supports, the suppliers and service providers on which it depends, the technology and logistics infrastructure that enable its operations, and the potential consequences of disruptions to essential activities in the healthcare supply chain.

ALPS was established in July 2018 as a national integrated supply-chain management agency supporting Singapore's public healthcare sector.

Its role includes consolidating and managing supply chain capabilities across the public healthcare ecosystem and developing procurement and supply chain models to enhance efficiency and resilience in medical supply.

This operating context makes BCM particularly important. A disruption affecting ALPS may propagate beyond the organisation itself.

Failure in procurement, inventory, warehousing, logistics, supplier coordination, or supporting technology could affect Public Healthcare Institutions (PHIs) and, if sufficiently severe or prolonged, the availability of medicines, medical supplies, equipment, and other resources required to support healthcare delivery.

The purpose of this chapter is therefore to establish the organisational foundation upon which ALPS can build its BCM programme.

It examines the organisation's operating context, establishes appropriate BCM goals and objectives, defines planning assumptions and governance arrangements, considers the Singapore operating environment, introduces the BCM planning methodology, and establishes the basis for identifying risks, threats and Critical Business Functions (CBFs).

 

 Introducing BCM for ALPS Healthcare

Business Continuity Management is a management discipline through which an organisation prepares for disruptive incidents and develops the capability to continue or recover prioritised activities within acceptable timeframes.

The current published edition of ISO 22301:2019 provides the international requirements framework for Business Continuity Management Systems (BCMS).

It addresses the establishment, implementation, operation, monitoring, review, maintenance, and continual improvement of arrangements intended to protect organisations from disruption and support recovery.

For ALPS, BCM should answer a fundamental question:

How will ALPS continue or recover the healthcare supply-chain functions required by its stakeholders when normal operating arrangements are significantly disrupted?

This question changes BCM from a document-development exercise into an organisational capability.

ALPS's importance to healthcare supply chain continuity is evident in its operational responsibilities.

The organisation purchases drugs, medical and non-medical supplies, equipment and services for Singapore's three Public Healthcare Clusters and their PHIs, while supporting national, cluster and PHI-level contracting arrangements.

BCM should consequently address disruption across the end-to-end supply chain rather than focus exclusively on office availability or traditional disaster recovery.

For example, ALPS may remain operational as an organisation while a major supplier is unable to provide an essential medicine.

Similarly, employees may remain available even when a critical warehouse, procurement platform, or logistics service becomes unavailable.

The relevant BCM question is therefore not simply:

"Can ALPS continue operating?"

It is:

"Can ALPS continue delivering its prioritised supply-chain outcomes at an acceptable predefined capacity?"

This outcome-based perspective should underpin the entire BCM implementation.

 

Understanding ALPS Healthcare's Operations

Understanding ALPS's operational model is essential before determining what needs to be protected and recovered.

ALPS operates as a national integrated supply-chain management agency supporting Singapore's public healthcare sector. Its model brings together procurement, supply-chain and logistics capabilities that support PHIs and broader healthcare requirements.

From a BCM perspective, ALPS's operating environment can be viewed as an interconnected ecosystem:

Healthcare Demand → Procurement and Sourcing → Suppliers → Inventory → Warehousing → Distribution → Public Healthcare Institutions → Healthcare Delivery

Each stage creates dependencies that may affect continuity elsewhere in the chain.

Strategic Procurement and Sourcing

ALPS procures drugs, medical and non-medical supplies, equipment and services for Singapore's public healthcare clusters and PHIs. Procurement arrangements include national-level contracts as well as cluster and institution-specific arrangements where appropriate.

This creates continuity dependencies involving suppliers, procurement specialists, contracts, sourcing platforms, approval processes and market availability.

National Logistics and Warehousing

A further dimension is the development of centralised logistics capabilities.

ALPS's Central Warehouse One (CWH1) provides integrated logistics capabilities supporting PHIs. It handles inventory ranging from cold-chain products to ambient medical supplies and incorporates environmental controls and centralised inventory-management capabilities.

From a BCM perspective, centralisation can create substantial benefits while simultaneously increasing the importance of managing concentration risk.

If multiple healthcare institutions depend on a common facility, system, logistics provider, or supply chain process, disruption to that common dependency could have widespread consequences.

Technology and Information

Supply chain operations are increasingly dependent on technology.

ALPS uses procurement technology such as SAP Business Network for sourcing activities, while its logistics environment incorporates inventory-control technology that supports real-time tracking, demand forecasting, and management of adverse supply-chain events.

Technology continuity should therefore be integrated into business continuity rather than treated solely as an IT responsibility.

Suppliers and External Dependencies

ALPS's operational capability depends upon an extended supplier ecosystem.

This means the organisation's BCM boundary should not stop at its own premises. Manufacturers, distributors, logistics providers, technology vendors, infrastructure providers and specialist service providers may all represent continuity dependencies.

The BCM programme should therefore establish visibility across the end-to-end delivery chain.

 

Identifying BCM Goals for ALPS Healthcare

BCM goals describe the broad outcomes ALPS seeks to achieve through its continuity programme.

A suitable overarching goal is:

To strengthen ALPS Healthcare's capability to anticipate, prepare for, respond to and recover from disruptive incidents while maintaining the prioritised supply-chain activities required to support Singapore's public healthcare institutions.

Supporting goals should include:

• Protect healthcare supply continuity by reducing the likelihood that disruption to ALPS results in unacceptable interruption to essential supplies and services.

• Protect patients and healthcare outcomes indirectly by recognising the downstream consequences of supply chain failures for PHIs.

• Maintain critical procurement and sourcing capabilities required to obtain essential medicines, medical supplies, equipment and services.

• Strengthen logistics resilience across inventory, warehousing, controlled-storage and distribution activities.

• Manage supply chain dependencies by understanding critical suppliers, logistics providers, facilities, technology platforms, and other third parties.

• Establish effective incident response and recovery capabilities so that disruptive events can be assessed, escalated and managed promptly.

• Strengthen organisational resilience by integrating BCM with enterprise risk management, crisis management, information technology, cybersecurity, procurement, logistics and supplier management.

These goals should provide the strategic direction from which measurable BC objectives can subsequently be developed.

 

Establishing BC Objectives for ALPS Healthcare

Where goals describe desired outcomes, Business Continuity objectives translate those goals into measurable implementation expectations.

ALPS should establish objectives that can be monitored and reviewed by management.

 

BC Objective	Intended Outcome
Identify Critical Business Functions	Establish which activities require prioritised continuity and recovery
Conduct Business Impact Analysis	Determine impacts of disruption over time and establish recovery priorities
Assess continuity risks	Identify threats, vulnerabilities and disruption scenarios affecting critical activities
Define recovery requirements	Establish MBCOs, RTOs and resource requirements where appropriate
Identify critical dependencies	Map people, premises, technology, information, suppliers and logistics dependencies
Develop continuity strategies	Establish practical alternatives for maintaining or recovering critical activities
Develop Business Continuity Plans	Document response, continuity and recovery arrangements
Establish crisis escalation arrangements	Ensure significant incidents are escalated and managed at the appropriate level
Exercise BCM arrangements	Validate plans, teams, strategies and assumptions through exercises
Strengthen third-party resilience	Address dependencies on critical suppliers and service providers
Maintain BCM competency	Ensure relevant employees understand their continuity responsibilities
Continually improve BCM	Capture lessons from exercises, incidents, audits and reviews

Objectives should eventually be supported by indicators, accountable owners, target dates and evidence of achievement.

 

Determining BC Assumptions for ALPS Healthcare

Business Continuity Plans are developed before the precise circumstances of a future disruption are known. Planning assumptions are therefore required.

The assumptions should be realistic without becoming predictions.

ALPS may initially adopt assumptions such as:

• normal operating premises may become partially or completely inaccessible;
• critical employees may be unavailable;
• disruption may occur without significant advance warning;
• technology systems or telecommunications may become unavailable;
• cyber incidents may affect systems while physical facilities remain available;
• suppliers may experience production, transportation or inventory disruption;
• international supply routes may be constrained;
• logistics providers may be unable to meet normal delivery requirements;
• warehouse operations may be partially or completely interrupted;
• cold-chain or controlled-storage infrastructure may fail;
• utilities may become unavailable;
• multiple PHIs may simultaneously require scarce products;
• demand for certain medical supplies may increase significantly during a crisis;
• normal procurement lead times may become unreliable;
• alternative suppliers may have limited capacity;
• a disruption may extend beyond the duration initially anticipated; and
• multiple disruptive events may occur concurrently.

These assumptions should subsequently be tested through scenario exercises.

An important BCM principle is that the plan should not depend on the disruption occurring exactly as assumed. Plans should provide adaptable capabilities that management can apply across multiple scenarios.

 

Developing the BCM Team Composition for ALPS Healthcare

Effective BCM requires clear governance and distributed ownership.

BCM should not be owned solely by a Business Continuity Manager or coordinator. Business units own their operational risks, dependencies and recovery requirements, while senior management provides governance and organisational direction.

A practical structure for ALPS could include:

 

BCM Role	Principal Responsibility
Senior Management / BCM Sponsor	Provide leadership, authority, resources and strategic oversight
BCM Steering Committee	Review BCM priorities, resolve cross-functional issues and oversee implementation
BCM Programme Manager	Coordinate methodology, implementation, maintenance and reporting
Business Continuity Coordinators	Coordinate BCM activities within respective business areas
Business Function Owners	Validate criticality, impacts, dependencies and recovery requirements
Procurement Representatives	Address sourcing, contracting and supplier continuity
Supply Chain and Logistics Representatives	Address inventory, warehousing, transportation and distribution continuity
Technology Representatives	Align system recovery with business recovery requirements
Cybersecurity Representatives	Address cyber disruption and information-security scenarios
Risk Management	Integrate BCM risks with enterprise risk-management processes
Facilities Representatives	Address workplace, warehouse and infrastructure dependencies
Human Resources	Address workforce availability, welfare and alternative work arrangements
Finance	Support financial continuity and emergency expenditure arrangements
Corporate Communications	Coordinate internal and external crisis communications
Legal/Compliance	Address legal, contractual and compliance considerations
Supplier/Vendor Management	Coordinate critical third-party resilience requirements

During a significant incident, this governance structure should integrate with ALPS's crisis management and operational response arrangements.

 

BCM does not operate independently of the organisation's external environment.

ALPS should consider Singapore's healthcare environment, economic and infrastructure dependencies, regulatory expectations, international supply chain exposure, and an evolving risk landscape.

A particularly important consideration is healthcare supply resilience.

Singapore's Ministry of Health (MOH) has previously described working with ALPS, healthcare institutions, pharmaceutical companies and distributors to maintain drug supply resilience.

MOH has also referenced measures, including buffer stocks and alternative suppliers, as part of arrangements to manage potential supply disruptions.

This demonstrates an important principle for ALPS's BCM programme: healthcare supply resilience requires coordination across multiple organisations.

Regulatory and Governance Context

ALPS should therefore identify all applicable legal, regulatory, contractual, and governmental requirements when establishing the BCM context, rather than forcing the organisation into a single-regulator model.

International Standards

The BCM programme can be structured with reference to ISO 22301:2019, together with its 2024 climate-action amendment. ISO 22301 remains the published international BCMS standard as of July 2026, although ISO is developing its next edition.

Climate change should consequently also be considered when determining whether climate-related issues are relevant to ALPS's BCMS context and interested parties.

 

Implementing the BCM Planning Methodology

ALPS should implement BCM using a consistent enterprise methodology rather than allowing individual departments to determine their own approaches.

For this implementation guide, the BCM planning methodology consists of seven phases:

• Project Management (PM)

• Risk Analysis and Review (RAR)

• Business Impact Analysis (BIA)

• Business Continuity Strategy (BCS)

• Plan Development (PD)

• Testing and Exercising (TE)

• Programme Management (PgM)

 

Phase 1 — Project Management

Establish the BCM project, scope, governance, stakeholders, implementation schedule and resources.

Phase 2 — Risk Analysis and Review

Identify threats that could disrupt ALPS's operations and evaluate existing controls, vulnerabilities, and residual continuity risks.

Phase 3 — Business Impact Analysis

Identify CBFs and analyse how the consequences of disruption increase over time. Establish recovery priorities and continuity requirements.

Phase 4 — Business Continuity Strategy

Determine appropriate preventive, mitigation, continuity, and recovery strategies based on the requirements established by the RAR and BIA.

Phase 5 — Plan Development

Translate strategies into actionable Business Continuity Plans that include escalation, response, continuity, and recovery procedures.

Phase 6 — Testing and Exercising

Validate BCM arrangements through structured exercises of increasing scope and complexity.

Phase 7 — Programme Management

Maintain BCM as an ongoing management programme through training, awareness, reviews, exercises, audits, reporting and continual improvement.

This methodology supports the broader BCMS principles embodied in ISO 22301, which emphasises establishing, implementing, maintaining and continually improving organisational continuity capabilities.

 

Assessing Risks and Threats for ALPS Healthcare

Risk assessment provides insight into events that could disrupt ALPS's ability to deliver its prioritised activities.

The assessment should consider both internal and external threats, as well as the dependencies through which disruption can propagate.

Relevant threat categories may include:

Supply-Chain Disruption

Supplier insolvency, manufacturing disruptions, shortages, transportation disruptions, geopolitical instability, border restrictions, and supply concentration.

Pharmaceutical and Medical-Supply Shortages

Unexpected demand, manufacturing problems, product withdrawal, quality issues or constrained availability of critical products.

Warehouse and Logistics Disruption

Fire, flood, facility failure, equipment breakdown, automation failure, transportation interruption or loss of environmental controls.

Technology Failure

Failure of procurement, inventory, warehouse management, financial, or communication systems.

Cybersecurity Incident

Ransomware, malicious intrusion, data compromise, denial-of-service attacks or supply-chain cyber compromise.

Utility and Infrastructure Failure

Loss of electricity, telecommunications, water, transportation or other essential infrastructure.

Workforce Disruption

Pandemic, infectious disease, industrial constraints, transportation disruption or loss of specialist personnel.

Third-Party Failure

Failure of logistics providers, technology vendors, outsourced service providers, manufacturers or distributors.

Extreme Weather and Climate-Related Events

Severe weather or climate-related events affecting facilities, transport routes, overseas suppliers or regional supply networks.

Major Public Health Emergency

An outbreak or pandemic could simultaneously increase demand for healthcare products while reducing supplier, workforce and logistics capacity.

The RAR should avoid considering these threats independently. Some of the most challenging BCM scenarios involve compound disruption.

For example:

Regional emergency → sudden healthcare demand increase → supplier shortage → transportation constraints → depleted inventory → PHI prioritisation requirement.

The ability to manage cascading consequences should therefore form part of ALPS's resilience planning.

 

Identifying Critical Business Functions

The final foundational activity is to identify the functions whose disruption could lead to unacceptable consequences.

For ALPS, criticality should not be determined simply by organisational hierarchy or departmental importance. It should be determined through impact over time.

CBF areas of ALPS include strategic procurement and sourcing, pharmaceutical procurement and supply management, medical supplies and equipment procurement, supplier management, demand and supply planning, inventory management, warehouse operations, cold-chain logistics, healthcare distribution, supply-shortage management, supply-chain information systems, product quality and traceability, financial operations, cybersecurity, stakeholder coordination, and business continuity and crisis management.

ALPS should therefore assess criticality through an end-to-end perspective:

Disrupted Function → Operational Consequence → Supply-Chain Consequence → PHI Consequence → Potential Healthcare/Patient Consequence

The resulting CBF catalogue provides the bridge between understanding the organisation and undertaking detailed BCM analysis.

 

Understanding ALPS Healthcare is the essential first step in implementing an effective Business Continuity Management programme.

ALPS operates within an interconnected public healthcare supply chain in which procurement, suppliers, inventory, warehousing, logistics, technology and healthcare institutions form a network of interdependent capabilities.

Its national supply chain role means that continuity planning must consider not only direct impacts on ALPS but also the potential downstream consequences for Singapore's Public Healthcare Institutions.

This chapter has established the principal foundations for the BCM implementation:

• defining the purpose of BCM;

• understanding ALPS's operating model;

• establishing BCM goals and objectives; defining planning assumptions;

• creating an appropriate BCM governance structure;

• understanding the Singapore operating environment;

• introducing the seven-phase BCM planning methodology;

• identifying relevant threats; and establishing the basis for determining Critical Business Functions.

These elements create the organisational context needed to move from understanding ALPS to the systematic implementation of BCM across ALPS.

The next chapter should build upon this foundation by defining the BCM goals in greater detail and translating ALPS's organisational context and continuity expectations into clear strategic outcomes that guide the subsequent Risk Analysis and Review, Business Impact Analysis, strategy development, planning, and exercising activities.