[BCM] [ALPS] [E1] [C5] Determining BC Assumptions

Determining BC Assumptions

 

Introduction

 

Business Continuity Management (BCM) planning is based on a series of assumptions about the organisation, its operating environment, available resources, and the nature of disruptive events.

These assumptions form the foundation for Business Impact Analyses (BIAs), continuity strategies, recovery procedures, and Business Continuity Plans (BCPs).

Without clearly defined planning assumptions, BCM plans may be unrealistic, incomplete, or based on conditions that no longer exist when a disruption occurs.

ISO 22301 emphasises the importance of understanding the organisation and its context before establishing the Business Continuity Management System (BCMS).

Determining BCM assumptions is a practical extension of this requirement.

It enables ALPS Healthcare (ALPS) to identify conditions expected to remain valid during an incident, recognise dependencies, and acknowledge uncertainties that could affect the organisation's ability to continue delivering critical healthcare supply chain services.

For ALPS Healthcare, BCM assumptions must reflect its role as a strategic procurement and healthcare supply chain organisation supporting Singapore's public healthcare system.

Assumptions should consider the resilience of suppliers, logistics providers, information technology, workforce availability, healthcare institutions, and government agencies.

They should also align with Singapore's regulatory expectations relating to healthcare resilience, emergency preparedness, cybersecurity, workplace safety, and organisational governance.

This chapter presents a structured approach to identifying, validating, documenting, and maintaining BCM assumptions to support the subsequent phases of Business Continuity Management planning.

 

Chapter Objectives

This chapter aims to:

• Explain the purpose of BCM planning assumptions.
• Describe the role of assumptions within ISO 22301 implementation.
• Identify categories of assumptions relevant to ALPS Healthcare.
• Recommend planning assumptions appropriate for a healthcare supply chain organisation.
• Demonstrate how assumptions influence continuity strategies and plans.
• Provide examples relevant to ALPS Healthcare.

 

What Are BCM Assumptions?

BCM assumptions are statements describing conditions that are expected to exist before, during, or after a disruptive incident. They form the basis for continuity planning decisions.

Assumptions are not guarantees. Rather, they are reasonable expectations that allow planners to develop practical continuity arrangements while recognising that actual events may differ.

Typical BCM assumptions relate to:

• Availability of people.
• Accessibility of facilities.
• Availability of technology.
• Performance of suppliers.
• Availability of logistics services.
• Government support.
• Communication capabilities.
• Recovery resources.
• Financial resources.
• Regulatory flexibility during emergencies.

These assumptions should be documented, reviewed, and periodically validated as part of the BCMS.

Example – ALPS Healthcare

A continuity strategy may assume that a contracted third-party logistics provider can provide additional transportation capacity during a regional disruption. If this assumption proves invalid during an incident, alternative logistics arrangements may be required.

 

Why BCM Assumptions Are Important

Clearly defined assumptions improve the quality and practicality of Business Continuity planning.

They help the organisation to:

• Establish realistic recovery strategies.
• Define planning boundaries.
• Identify operational dependencies.
• Highlight potential vulnerabilities.
• Support resource planning.
• Improve decision-making during incidents.
• Facilitate scenario testing.
• Strengthen governance.
• Reduce planning uncertainty.
• Support continual improvement.

Without explicit assumptions, recovery strategies may rely on resources or conditions that are unavailable during disruptions.

Example – ALPS Healthcare

If warehouse recovery plans assume uninterrupted telecommunications but fail to consider a prolonged network outage, manual inventory management procedures may not be adequately developed or tested.

 

Relationship Between Assumptions and ISO 22301

Although ISO 22301 does not prescribe a fixed list of planning assumptions, the standard requires organisations to understand their context, identify internal and external issues, determine interested parties, and establish appropriate continuity arrangements.

BCM assumptions support these requirements by providing practical planning foundations for:

• Risk Analysis and Review (RAR).
• Business Impact Analysis (BIA).
• Business Continuity Strategy (BCS).
• Business Continuity Plan (BCP) development.
• Testing and exercising.
• Performance evaluation.
• Continual improvement.

Assumptions should therefore be reviewed whenever organisational changes, regulatory developments, or operational experiences indicate that they may no longer be valid.

Example – ALPS Healthcare

Following the implementation of a new cloud-based procurement platform, assumptions relating to system availability, cyber resilience, and third-party service providers should be reassessed and updated.

 

Categories of BCM Assumptions for ALPS Healthcare

The following categories provide a practical framework for documenting BCM planning assumptions.

Leadership and Governance

Typical assumptions include:

• Executive management remains committed to BCM.
• Crisis Management Teams can be activated promptly.
• Decision-making authority is clearly defined.
• Governance structures remain operational during incidents.

Example

The BCM Steering Committee can convene virtually if physical meetings are not possible.

 

People

Typical assumptions include:

• Key personnel remain contactable.
• Employees understand their BCM responsibilities.
• Cross-trained staff are available.
• Workforce welfare arrangements are established.
• Remote working arrangements can be activated where appropriate.

Example

If procurement specialists are unavailable because of illness, trained deputies can continue supplier engagement activities.

 

Facilities

Typical assumptions include:

• Alternate office facilities are available if required.
• Warehousing capacity exists at secondary locations.
• Cold-storage facilities can support temperature-sensitive inventory.
• Physical security arrangements remain effective.

Example

If a primary warehouse is inaccessible due to flooding, inventory can be transferred to an approved alternate facility.

 

Information and Technology

Typical assumptions include:

• Critical business systems have recovery capabilities.
• Network connectivity can be restored within agreed recovery objectives.
• Data backups remain recoverable.
• Cybersecurity monitoring continues during disruptions.
• Cloud service providers maintain contracted resilience capabilities.

Example

Warehouse Management Systems (WMS) can be recovered from backup environments without unacceptable data loss.

 

Supply Chain and Suppliers

Typical assumptions include:

• Strategic suppliers maintain their own continuity capabilities.
• Alternative suppliers are available for critical products.
• Transportation providers remain operational.
• Customs and import processes continue functioning.

Example

If an overseas pharmaceutical manufacturer experiences production disruption, pre-qualified alternative suppliers can be activated.

 

Logistics and Distribution

Typical assumptions include:

• Transportation routes remain partially accessible.
• Emergency delivery arrangements can be activated.
• Cold-chain logistics remain available.
• Priority deliveries receive expedited handling.

Example

Alternative delivery routes are available if major expressways are temporarily closed following a severe incident.

 

Regulatory Environment

Typical assumptions include:

• Government agencies continue coordinating national emergency responses.
• Regulatory communication channels remain available.
• Temporary emergency guidance may be issued when required.
• Healthcare governance requirements remain applicable.

Example

Relevant authorities provide timely guidance during public health emergencies that affect healthcare supply chains.

 

External Environment

Typical assumptions include:

• Utility providers restore services according to emergency priorities.
• Telecommunications services remain partially operational.
• Banking services continue functioning.
• Fuel supplies remain available.
• Public infrastructure is progressively restored.

Example

Power utilities prioritise restoration to healthcare-related facilities during major outages.

 

Recommended BCM Assumptions for ALPS Healthcare

The following table illustrates representative planning assumptions for ALPS Healthcare.

Assumption Category	Representative Assumption	BCM Planning Implication
Leadership	Executive management supports BCM implementation.	Enables timely strategic decisions during disruptions.
People	Cross-trained personnel are available.	Supports workforce continuity.
Facilities	Alternate warehousing capacity exists.	Enables continuity of inventory operations.
Technology	Critical ICT systems can be recovered within agreed Recovery Time Objectives (RTOs).	Supports procurement and logistics operations.
Information	Data backups remain available and recoverable.	Protects operational information.
Suppliers	Strategic suppliers maintain continuity arrangements.	Supports procurement resilience.
Logistics	Alternative transportation providers are available.	Enables uninterrupted deliveries.
Communications	Multiple communication channels remain operational.	Supports coordination and stakeholder engagement.
Finance	Emergency procurement funding is available.	Facilitates rapid acquisition of essential supplies.
Government	National emergency coordination mechanisms remain operational.	Supports healthcare sector resilience.

These assumptions should be validated through exercises, supplier engagement, audits, and management reviews.

 

Validating BCM Assumptions

Assumptions should never remain static. They must be tested periodically to ensure they continue to reflect operational reality.

Validation methods include:

• Business Impact Analysis workshops.
• Risk assessments.
• Supplier resilience assessments.
• Scenario exercises.
• Business continuity exercises.
• Internal audits.
• Incident reviews.
• Lessons learned programmes.
• Management reviews.
• Regulatory inspections.

Validation helps identify assumptions that may no longer be appropriate.

Example – ALPS Healthcare

A continuity exercise may reveal that an assumed alternate warehouse lacks sufficient cold-chain capacity for vaccine storage. This finding would require the assumption to be revised and alternative arrangements established.

 

Managing Changes to BCM Assumptions

Organisational assumptions should be reviewed whenever significant changes occur.

Examples include:

• New technology implementation.
• Organisational restructuring.
• Introduction of new suppliers.
• New warehousing facilities.
• Regulatory changes.
• Changes in healthcare demand.
• Lessons from incidents.
• Major procurement strategy changes.
• Supply chain redesign.
• Significant geopolitical developments.

A formal change management process helps ensure that continuity plans remain current and effective.

Example – ALPS Healthcare

If ALPS adopts a new regional distribution model with additional fulfilment centres, assumptions relating to logistics, inventory management, transportation, and warehouse recovery should be updated accordingly.

 

Relationship Between BCM Assumptions and Subsequent ISO 22301 Activities

The assumptions established in this chapter support every subsequent stage of the BCMS.

 

ISO 22301 Activity	Relationship to BCM Assumptions
Risk Analysis and Review	Identifies threats that may invalidate planning assumptions.
Business Impact Analysis	Confirms assumptions relating to critical resources and dependencies.
Business Continuity Strategies	Develops strategies based on validated assumptions.
Business Continuity Plans	Documents recovery procedures using approved assumptions.
Testing and Exercising	Validates whether assumptions remain accurate under realistic scenarios.
Performance Evaluation	Assesses whether assumptions continue to support organisational resilience.
Continual Improvement	Updates assumptions based on audits, exercises, incidents, and organisational change.

 

Key Takeaways

• BCM assumptions provide the foundation for planning in Business Continuity Management.
• Assumptions define the conditions on which recovery strategies and continuity plans are based.
• ALPS Healthcare should establish assumptions relating to governance, people, facilities, technology, suppliers, logistics, communications, finance, and the external environment.
• Assumptions must be validated regularly through exercises, audits, supplier engagement, and management reviews.
• Maintaining accurate, up-to-date assumptions improves the effectiveness of the Business Continuity Management System and supports compliance with ISO 22301.

 

Determining BCM assumptions is a critical activity that strengthens the quality and credibility of Business Continuity Management planning.

For ALPS Healthcare, these assumptions provide the practical foundation for risk assessments, business impact analyses, recovery strategies, and continuity plans.

By documenting the expected availability of people, facilities, technology, suppliers, logistics providers, communications, and governance arrangements, the organisation can develop continuity measures that are realistic, achievable, and aligned with its operational responsibilities.

Because ALPS Healthcare operates within Singapore's highly interconnected public healthcare ecosystem, planning assumptions should also recognise the organisation's dependencies on healthcare institutions, strategic suppliers, third-party logistics providers, government agencies, and digital technologies.

These assumptions should not be treated as permanent truths but as working hypotheses that are continuously validated through exercises, supplier assessments, incident reviews, audits, and management reviews.

As the BCMS progresses into the Risk Analysis and Review, Business Impact Analysis, and Business Continuity Strategy phases, the assumptions established in this chapter will guide the identification of vulnerabilities, the design of resilient operating arrangements, and the development of practical recovery plans.

Maintaining accurate and up-to-date assumptions will help ensure that ALPS Healthcare remains prepared to continue supporting Singapore's public healthcare supply chain during disruptions while fulfilling the intent and requirements of ISO 22301.