---
title: [BCM] [CardX] [E1] [C1] Overview of BCM Case Study
description: [BCM] [CardX] [E1] [C1] Overview of BCM Case Study
image: https://blog.bcm-institute.org/hubfs/CardX%20Graphic%20Folder/CardX%20E1%20Morepost/%5BBCM%5D%20%5BCardX%5D%20%5BE1%5D%20%5BC1%5D%20Overview%20of%20BCM%20Case%20Study.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Planning for Resilience: A Methodology for Implementing BCM in CardX
# \[BCM\] \[CardX\] \[E1\] \[C1\] Overview of BCM Case Study
[![\[BCM\] \[CardX\] \[Full Banner\] Resilient Communities: Implementing Business Continuity Management](https://no-cache.hubspot.com/cta/default/3893111/2baa580e-44fd-47f4-b311-bf7cb8f807f5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2baa580e-44fd-47f4-b311-bf7cb8f807f5)
Business Continuity Management (BCM) is an essential management discipline that helps organisations prepare for, respond to, and recover from disruptive incidents while continuing to deliver critical products and services.
[![eBook Cover \[BCM\] \[CardX\] \[E1\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/ff317031-b993-499e-af86-e4be8c103df2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ff317031-b993-499e-af86-e4be8c103df2)For financial services organisations, BCM is particularly important because operational disruptions may affect customers, financial transactions, regulatory obligations, business partners, and confidence in the financial system.
CardX operates in Thailand's consumer finance and credit card services environment, where the availability, integrity, and continuity of financial services are fundamental to customer confidence and business sustainability.
As a financial services organisation, CardX depends on interconnected business processes, information technology systems, employees, service providers, payment networks, customer information, and supporting infrastructure to deliver its services effectively.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/26552c6a-ef41-48d4-b53d-d0b00b62e57f)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook/author/moh-heng-goh) Oct 19, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
### **[![\[BCM\] \[CardX\] \[Legal Disclaimer\] Implementing Business Continuity Management at CardX](https://no-cache.hubspot.com/cta/default/3893111/bce15e52-e708-41ce-81a2-33ef85210504.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bce15e52-e708-41ce-81a2-33ef85210504)**
### eBook 1: Chapter 1
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/26552c6a-ef41-48d4-b53d-d0b00b62e57f)
### Overview of Business Continuity Management for CardX
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/28094145-f399-44f4-96da-2b0beabfefb5)
For financial services organisations, BCM is particularly important because operational disruptions may affect customers, financial transactions, regulatory obligations, business partners, and confidence in the financial system.
CardX operates in Thailand's consumer finance and credit card services environment, where the availability, integrity, and continuity of financial services are fundamental to customer confidence and business sustainability.
As a financial services organisation, CardX depends on interconnected business processes, information technology systems, employees, service providers, payment networks, customer information, and supporting infrastructure to deliver its services effectively.
A significant disruption affecting any of these dependencies could interrupt customer transactions, payment processing, account servicing, collections, or other important business operations.
Consequently, BCM should not be regarded merely as an emergency response or IT disaster recovery activity. It should be established as an organisation-wide management programme that integrates operational risk management, crisis management, technology recovery, business recovery, and organisational resilience.
This chapter introduces the fundamental principles of BCM and explains how CardX can apply them in accordance with ISO 22301 and applicable Bank of Thailand regulatory expectations.
The chapter lays the foundation for understanding CardX's operations by defining BCM goals and objectives, setting planning assumptions, establishing BCM governance, analysing the operating environment, assessing risks and threats, and identifying Critical Business Functions (CBFs).
It also introduces the structured BCM planning methodology that will be developed in greater detail throughout the three-eBook series.
#### **Purpose of the three-eBook series**
The series, Planning for Resilience: A Methodology for Implementing BCM in CardX, guides CardX's BCM coordinators, business function owners, risk management professionals, technology teams, and management through a structured BCM implementation journey.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e9a39a85-2a0e-4b9f-9070-845e26391b34)
The three eBooks support a progressive implementation approach, starting with organisational understanding, moving to BCM methodology, and culminating in practical implementation.
#### **Introducing Business Continuity Management for CardX**
##### **Understanding Business Continuity Management**
Business Continuity Management is a holistic management process that identifies potential threats to an organisation and the impacts that disruption to business operations might cause.
It provides a framework to build organisational resilience and effective response capabilities that safeguard key business activities and stakeholder interests.
ISO 22301 provides internationally recognised requirements for establishing, implementing, maintaining, and continually improving a Business Continuity Management System (BCMS).
For CardX, BCM should focus on ensuring that essential consumer financial services can continue at acceptable levels during disruptive events.
These services may include:
- Credit card transaction processing and authorisation.
- Customer account access and servicing.
- Credit card billing and repayment processing.
- Customer payment and settlement operations.
- Loan servicing and collections.
- Fraud monitoring and transaction security.
- Customer communication and complaint management.
- Regulatory reporting and compliance-related activities.
These activities are illustrative candidates for continuity assessment, rather than a confirmed inventory of CardX's critical functions.
##### **Why BCM Is Important to CardX**
The financial services operating environment is increasingly dependent on digital platforms, interconnected systems, outsourced technology, and third-party service providers.
A disruption affecting CardX may result in financial losses, customer dissatisfaction, regulatory concerns, reputational damage, and operational backlogs.
For example, consider a scenario in which CardX experiences an extended interruption to its credit card transaction processing platform.
The disruption may prevent customers from completing transactions, delay payment authorisation, increase customer enquiries, and require coordination with payment network participants and technology service providers.
An effective BCM programme would enable CardX to:
1. Identify affected business functions and customers.
2. Assess the severity and likely duration of the disruption.
3. Escalate the incident to the appropriate management and response teams.
4. Activate approved business continuity and IT recovery arrangements.
5. Coordinate with relevant payment networks and service providers.
6. Communicate with affected customers and stakeholders.
7. Restore prioritised services within approved recovery objectives.
8. Evaluate the incident and implement improvements.
##### **BCM and Related Management Disciplines**
BCM must integrate with other management disciplines to coordinate responses to disruptions.
Although these disciplines have different responsibilities, they should operate through coordinated governance, escalation, recovery, and reporting arrangements.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/acdcec83-5ab9-4360-b668-cf37354bde84)**
**Understanding CardX's Operations**
##### **Overview of CardX's Business Operations**
CardX operates within Thailand's consumer financial services ecosystem, with business activities associated with credit card products and related customer financial services.
Its operations depend on the successful integration of customer-facing services, transaction processing capabilities, account administration, financial operations, information technology, regulatory compliance, and external service providers.
For BCM planning purposes, CardX should examine its operations from an end-to-end service delivery perspective rather than assessing individual departments in isolation.
This approach enables the organisation to identify how disruption to one process, system, or service provider may affect several business functions.
##### **Key Operational Areas**
The following operational areas provide an illustrative starting point for CardX's BCM assessment.
| Operational area | Main activities | Potential continuity concerns |
| --- | --- | --- |
| Credit Card Operations | Card issuance, account maintenance, card servicing | Inability to issue or maintain card services |
| Transaction Processing | Transaction authorisation, processing and reconciliation | Interrupted or delayed customer transactions |
| Customer Services | Enquiries, complaints, account assistance | Inability to support customers |
| Billing and Repayment | Statement generation, payment posting and reconciliation | Delayed billing or inaccurate account balances |
| Credit and Risk Management | Credit assessment, monitoring and portfolio management | Inability to manage credit exposure effectively |
| Collections | Delinquency monitoring, repayment arrangements and collections | Delayed collections and increased operational backlogs |
| Fraud and Security Operations | Fraud detection, transaction monitoring and investigations | Increased exposure to fraudulent transactions |
| Information Technology | Application support, infrastructure, cybersecurity and recovery | Unavailability of critical systems |
| Finance and Regulatory Compliance | Financial reporting, reconciliation and regulatory submissions | Delayed reporting or compliance failures |
CardX management and the relevant business function owners must confirm the actual operational structure, system ownership, and criticality of these activities.
##### **Understanding End-to-End Dependencies**
A critical business function rarely operates independently.
For example, successful credit card transaction processing may depend on:
- Customer Initiates Card Transaction
- Merchant and Payment Network
- Card Authorisation and Processing Systems
- Account and Credit Verification
- Transaction Approval or Decline
Illustrative end-to-end credit card transaction dependency chain for BCM planning. Actual architecture and responsibilities require validation by CardX.
A failure affecting telecommunications, authorisation systems, data centres, or external processing arrangements may interrupt the entire transaction chain.
CardX should therefore identify the people, processes, technology, information, facilities, and external dependencies that support each critical function.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/bf448584-ed62-43bf-830d-e8e73f606fa4)**
#### **Identifying BCM Goals for CardX**
##### **Purpose of BCM Goals**
BCM goals establish the strategic direction of the BCM programme and communicate what the organisation intends to achieve through its continuity arrangements.
These goals should support CardX's organisational objectives, risk management framework, customer service commitments, and regulatory obligations.
##### **Proposed BCM Goals**
The following goals are recommended for consideration by CardX.
| BCM goal | Intended outcome |
| --- | --- |
| Protect Critical Financial Services | Maintain essential customer-facing financial services during disruptions |
| Safeguard Customers | Minimise adverse impacts on customer transactions, account access, and financial information |
| Reduce Operational Disruption | Limit the duration and consequences of interruptions to critical operations |
| Strengthen Recovery Capability | Establish practical and tested recovery arrangements |
| Support Regulatory Compliance | Meet applicable BOT requirements and other relevant obligations |
| Improve Third-Party Resilience | Manage continuity dependencies involving external service providers |
| Strengthen Organisational Preparedness | Develop employee awareness, response capability, and recovery readiness |
| Enable Continual Improvement | Use exercises, incidents, audits, and management reviews to improve BCM effectiveness |
##### **Example of a BCM Goal**
Goal: Maintain Continuity of Critical Credit Card Services
CardX aims to maintain or restore its prioritised credit card services within recovery timeframes approved by management and justified through the Business Impact Analysis (BIA).
This goal requires CardX to identify the relevant critical functions, determine their dependencies, establish recovery requirements, and implement appropriate continuity arrangements.
The goal should also be supported by measurable objectives and periodic performance reviews.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f0f119d-fad1-42d6-9d33-a8190502e6c0)
#### **Establishing Business Continuity Objectives for CardX**
##### **Distinguishing Goals from Objectives**
BCM goals describe the intended strategic outcomes of the BCM programme.
Business Continuity (BC) objectives translate these goals into measurable targets that can be monitored and evaluated.
ISO 22301 Clause 6.2 requires organisations to establish business continuity objectives at relevant functions and levels.
For CardX, these objectives should align with the business continuity policy, be measurable where practicable, and be monitored, communicated, and updated as appropriate.
##### **Proposed BC Objectives**
| **BC objective** | **Illustrative performance measure** | **Responsible function** |
| --- | --- | --- |
| Identify Critical Business Functions | All in-scope functions assessed and approved | BCM Coordinator / Business Owners |
| Complete Business Impact Analysis | 100% of identified CBFs have approved BIAs | Business Function Owners |
| Establish Recovery Requirements | Approved RTOs and RPOs where applicable | Business and IT Owners |
| Develop Business Continuity Plans | All designated CBFs have approved and current plans | Business Function Owners |
| Conduct BCM Exercises | Critical recovery arrangements exercised according to approved schedule | BCM Team |
| Strengthen Third-Party Continuity | Material service providers assessed against defined continuity requirements | Third-Party Risk / Procurement |
| Improve BCM Awareness | Relevant employees complete assigned BCM training | Human Resources / BCM Team |
| Close BCM Improvement Actions | Corrective actions completed within approved deadlines | Assigned Action Owners |
These measures are proposed planning targets and should not be interpreted as CardX's existing approved objectives.
##### **Example: Transaction Processing Recovery Objective**
CardX may establish a proposed objective requiring the credit card transaction authorisation function to be recoverable within a defined timeframe.
For illustration only:
- Proposed Recovery Time Objective (RTO): 2 hours.
- Proposed Recovery Point Objective (RPO): 15 minutes for applicable transaction data.
- Minimum recovery capability: Ability to process prioritised transaction authorisation requests.
- Responsible owners: Transaction Processing and IT Recovery Teams.
These figures are hypothetical and must not be adopted without BIA validation, technical feasibility assessment, management approval, and consideration of applicable regulatory requirements.
CardX should also assess whether the selected RTO and RPO meet customer, payment network, contractual, and regulatory obligations.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c338a09a-7f6f-47e5-a008-c9d4d3aa9653)**
#### **Determining Business Continuity Assumptions for CardX**
##### **Purpose of BC Assumptions**
Business continuity assumptions set the planning conditions for developing continuity strategies and recovery procedures.
They help business function owners define realistic disruption scenarios, resource constraints, and recovery expectations.
For CardX, assumptions should reflect the characteristics of financial services operations, including dependence on transaction processing systems, external networks, digital channels, customer information, and third-party providers.
##### **Proposed Planning Assumptions**
| Planning area | Illustrative assumption | BCM implication |
| --- | --- | --- |
| Premises | A primary office or operational location becomes inaccessible | Alternative working arrangements may be required |
| Technology | A critical application becomes unavailable for an extended period | Recovery procedures and alternate processing arrangements are needed |
| Personnel | A significant proportion of employees are unavailable | Cross-training and alternate staffing arrangements are necessary |
| Telecommunications | Primary network connectivity is disrupted | Redundant communication and connectivity solutions should be assessed |
| Cybersecurity | A cyberattack affects production systems and data integrity | Secure recovery and data validation procedures are required |
| Third Parties | A material service provider cannot deliver contracted services | Alternative arrangements and escalation procedures may be needed |
| Payment Networks | External transaction processing connectivity is interrupted | Coordination with payment ecosystem participants is required |
| Concurrent Disruptions | More than one critical resource is affected simultaneously | Strategies must be evaluated against severe but plausible scenarios |
##### **Example: Major Technology Disruption**
Assume CardX's primary transaction-processing environment becomes unavailable due to a major technology failure.
The BCM planning assumptions might include:
1. The disruption occurs during a period of high transaction volume.
2. Normal transaction authorisation services are unavailable.
3. Customer enquiries increase significantly.
4. The incident affects one or more supporting applications.
5. Recovery depends on internal technology teams and external providers.
6. The disruption duration is initially uncertain.
7. Customer communication and regulatory assessment may be required.
Use these assumptions to evaluate whether existing recovery arrangements are sufficiently robust.
##### **Validation of Assumptions**
BCM assumptions should not remain static.
CardX should periodically review them against changes in technology architecture, business volumes, outsourcing arrangements, operating locations, customer expectations, and regulatory requirements.
Assumptions should also be challenged during BCM exercises and scenario testing to determine whether the organisation's recovery capabilities remain realistic.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/7d3edc55-29ae-4482-b5f0-90d2063aa09e)
#### **Developing the BCM Team Composition for CardX**
##### **Establishing BCM Governance**
Effective BCM implementation requires clearly defined governance, accountability, authority, and responsibilities.
ISO 22301 emphasises leadership commitment, assigning responsibilities, providing resources, and integrating business continuity into organisational processes.
For CardX, BCM governance should involve senior management, business function owners, risk management professionals, technology teams, and relevant support functions.
##### **Proposed BCM Organisational Structure**
- Board / Senior Management
- Oversight and accountability
- BCM Steering Committee
- Direction, prioritisation and oversight
- BCM Programme Manager / Coordinator
- Programme coordination and reporting
- Business Function Owners
- IT Disaster Recovery Team
- Risk and Compliance Team
- Human Resources and Facilities
- Third-Party Management
- Crisis Management and Communications
Proposed BCM governance structure for CardX. Actual reporting lines and committee responsibilities should follow CardX's approved governance framework.
##### **BCM Team Roles and Responsibilities**
****
##### **Example: BCM Activation During a Payment Processing Disruption**
If CardX experiences a prolonged payment processing disruption, the IT team would investigate the technical failure and initiate approved recovery procedures.
Affected business function owners would assess operational consequences, set service priorities, and activate relevant business continuity arrangements.
The BCM Programme Manager would coordinate continuity activities and consolidate recovery status information.
When disruption exceeds established escalation thresholds, the Crisis Management Team would provide strategic direction, approve exceptional decisions, and oversee major stakeholder communications.
The BCM Steering Committee and senior management would receive reports in accordance with the organisation's escalation and governance arrangements.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/26315a0c-e417-4811-9a9a-4083209ce9b9)**
#### **Analysing the Operating Environment for CardX**
##### **Understanding the Organisational Context**
ISO 22301 Clause 4 requires organisations to understand their context, the needs and expectations of interested parties, and the scope of the BCMS.
For CardX, this means examining internal and external factors that may influence the ability to maintain critical business activities.
##### **Internal Operating Environment**
Important internal factors include:
- Organisational structure and governance.
- Business strategy and financial service delivery priorities.
- Technology architecture and application dependencies.
- Availability and capability of employees.
- Operational processes and internal controls.
- Existing risk management and cybersecurity capabilities.
- Business continuity and disaster recovery arrangements.
- Management commitment and resource availability.
For example, if several customer-facing processes depend on a common account management platform, that platform may represent a concentration of operational dependency.
CardX should evaluate the potential consequences of its unavailability and determine whether existing recovery capabilities are adequate.
##### **External Operating Environment**
CardX operates within a broader financial services ecosystem that includes regulatory authorities, payment networks, technology providers, customers, and business partners.
| External factor | Potential influence on BCM |
| --- | --- |
| BOT regulatory requirements | Establishes applicable governance, continuity, technology risk, and reporting expectations |
| Payment Networks | Influence transaction processing availability and service dependencies |
| Cyber Threat Landscape | Creates exposure to ransomware, data compromise, and service disruption |
| Technology Service Providers | Creates dependencies on outsourced platforms, telecommunications, and infrastructure |
| Customer Expectations | Increases the importance of timely service restoration and communication |
| Economic Conditions | May affect business volumes, financial exposures, and resource priorities |
| Natural Hazards | Flooding, storms, and other events may affect facilities and infrastructure |
| Supply Chain and Third Parties | Disruptions may affect technology support, processing, and essential services |
##### **Identifying Interested Parties**
CardX should identify interested parties whose needs and expectations may affect its BCM requirements.
These may include customers, employees, shareholders, regulators, payment network participants, technology service providers, outsourced service partners, and relevant financial institutions.
For each interested party, CardX should determine applicable continuity requirements, communication expectations, contractual commitments, and dependencies.
##### **Defining the BCMS Scope**
The BCMS scope should identify the organisational boundaries, products and services, business activities, locations, and relevant dependencies covered by the programme.
For example, CardX may initially prioritise critical credit card services and their supporting business processes, technology systems, employees, facilities, and material third-party providers.
However, authorised management should determine the final scope through a documented assessment of organisational context and approve it.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/087d509d-3aea-4a9d-b16b-25b27f8e4623)**
#### **Implementing the BCM Planning Methodology**
##### **Overview of the Planning Methodology**
A structured BCM planning methodology enables CardX to translate business continuity requirements into practical recovery capabilities.
The methodology should align with ISO 22301 and include the key activities needed to establish, implement, maintain, and improve business continuity arrangements.
For this eBook series, the implementation methodology is organised into seven phases.
##### **Seven Phases of BCM Planning**
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fbeb1a05-a26a-4e83-bdf5-200a565fd721)
##### **Applying the Methodology to CardX**
| Phase | Application to CardX | Principal deliverable |
| --- | --- | --- |
| PM | Establish BCM governance, identify stakeholders, and define implementation scope | BCM Project Plan |
| RAR | Assess cyberattacks, system failures, facility disruptions, and third-party failures | Risk Assessment and Treatment Register |
| BIA | Determine critical functions, disruption impacts, recovery priorities, and dependencies | Approved BIA Reports |
| BCS | Evaluate alternate processing, technology recovery, remote working, and third-party arrangements | Business Continuity Strategy |
| PD | Develop response, recovery, escalation, and communication procedures | Business Continuity Plans |
| TE | Conduct tabletop exercises, technical recovery tests, and integrated simulations | Exercise Reports and Improvement Actions |
| PgM | Maintain plans, conduct reviews, provide training, and monitor corrective actions | BCM Programme and Management Review Reports |
##### **Integrating the Methodology with ISO 22301**
Implement the seven phases as an integrated management process rather than independent activities.
Project management and organisational analysis support establishing the BCMS.
Risk assessment and BIA provide the information needed to develop the continuity strategy.
Approved strategies are translated into operational plans and recovery procedures.
Testing and exercising evaluate whether the arrangements can achieve the required continuity outcomes.
Programme management provides ongoing monitoring, evaluation, maintenance, and continual improvement.
The methodology should also incorporate ISO 22301 requirements for leadership, planning, support, performance evaluation, and improvement throughout the implementation lifecycle.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a4fa9f02-e184-43b1-8a52-230bf302dd76)**
#### **Assessing Risks and Threats for CardX**
##### **Purpose of Risk Assessment**
Risk assessment enables CardX to identify events that may disrupt its business activities and evaluate the effectiveness of existing controls.
ISO 22301 Clause 8.2.3 requires the organisation to identify, analyse, and evaluate risks that could disrupt prioritised activities and their required resources.
The assessment should focus on threats and vulnerabilities that could affect the continuity of CardX's business operations.
##### **Illustrative Risk and Threat Register**
| Threat category | Example scenario | Potential business impact |
| --- | --- | --- |
| Cybersecurity | Ransomware compromises critical systems | Transaction disruption, data integrity concerns, and recovery delays |
| Technology Failure | Card processing application becomes unavailable | Inability to process or authorise transactions |
| Telecommunications | Loss of critical network connectivity | Interruption to customer and payment network services |
| Third-Party Failure | External technology or processing provider experiences an outage | Loss of dependent operational capabilities |
| Data Integrity | Corruption of account or transaction records | Incorrect balances, reconciliation issues, and processing delays |
| Personnel | Significant employee unavailability | Reduced customer servicing and operational processing capacity |
| Premises | Flooding or fire affects an operational location | Loss of workspace and interruption to supporting activities |
| Power Supply | Extended electrical failure affects a critical facility | Technology and workplace disruption |
| Fraud | Major fraud incident affects transaction operations | Financial losses, investigations, and potential processing restrictions |
| Payment Ecosystem | Disruption to a payment network or settlement dependency | Transaction delays and reconciliation backlogs |
##### **Example: Ransomware Affecting CardX**
Consider a hypothetical ransomware attack that compromises a critical application supporting CardX's credit card operations.
The incident may cause:
- Unavailability of transaction processing systems.
- Loss of access to customer account information.
- Potential compromise of data integrity.
- Interruption to customer servicing.
- Increased fraud and cybersecurity concerns.
- Significant operational and reputational consequences.
CardX should assess the likelihood and consequences of the scenario using its approved risk assessment criteria.
The assessment should consider existing preventive controls, detection capabilities, incident response arrangements, backup protection, recovery infrastructure, and external dependencies.
##### **Risk Treatment and Control Measures**
Potential treatment measures include:
1. Strengthening cybersecurity monitoring and access controls.
2. Implementing resilient technology architecture.
3. Maintaining protected and recoverable backups.
4. Establishing alternate processing and recovery arrangements.
5. Conducting regular recovery and cyber-resilience exercises.
6. Assessing continuity capabilities of material service providers.
7. Establishing incident escalation and crisis communication procedures.
8. Monitoring the effectiveness of implemented controls.
Risk assessment results should inform continuity strategies and should be reviewed when significant changes occur.
#### **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fbb42012-8f64-401c-a56c-d84bdcfeee14)**
#### **Identifying Critical Business Functions for CardX**
##### **Understanding Critical Business Functions**
Critical Business Functions are activities whose disruption could result in unacceptable consequences for an organisation, its customers, or other interested parties.
In the context of ISO 22301, the Business Impact Analysis supports the identification and prioritisation of activities.
For CardX, identifying CBFs is a fundamental step because it enables management to determine which operations require priority continuity and recovery arrangements.
The assessment should consider customer impacts, financial consequences, regulatory obligations, operational dependencies, reputational effects, and the duration of disruption.
##### **Proposed Critical Business Functions**
The following catalogue provides an illustrative starting point for CardX's BCM programme.
![PIC \[BCM\] \[CardX\] \[E1\] \[C10\] Critical Business Function](https://blog.bcm-institute.org/hs-fs/hubfs/PIC%20%5BBCM%5D%20%5BCardX%5D%20%5BE1%5D%20%5BC10%5D%20Critical%20Business%20Function.png?width=1536&height=1024&name=PIC%20%5BBCM%5D%20%5BCardX%5D%20%5BE1%5D%20%5BC10%5D%20Critical%20Business%20Function.png)
| CBF code | Proposed Critical Business Function | Principal continuity concern |
| --- | --- | --- |
| CBF-1 | Credit Card Transaction Authorisation and Processing | Ability to process and authorise customer transactions |
| CBF-2 | Customer Account and Card Servicing | Ability to access, maintain, and service customer accounts |
| CBF-3 | Billing and Repayment Processing | Timely processing of statements, repayments, and account balances |
| CBF-4 | Card Issuance and Activation | Ability to issue, activate, and manage customer cards |
| CBF-5 | Fraud Monitoring and Transaction Security | Ability to identify and respond to suspicious transactions |
| CBF-6 | Customer Support and Complaint Management | Ability to assist customers during normal operations and disruptions |
| CBF-7 | Credit and Loan Servicing | Ability to administer credit and relevant loan accounts |
| CBF-8 | Collections and Delinquency Management | Ability to manage overdue accounts and repayment arrangements |
| CBF-9 | Financial Reconciliation and Settlement Support | Ability to reconcile transactions and meet relevant financial obligations |
| CBF-10 | Regulatory Reporting and Compliance Operations | Ability to meet applicable reporting and compliance requirements |
This catalogue is a proposed training and assessment model. It does not assert that CardX has formally designated these ten functions as critical.
##### **Criteria for Determining Criticality**
CardX should establish documented criteria for determining whether a business function is critical.
Relevant criteria may include:
- Financial impact arising from disruption.
- Number and type of customers affected.
- Legal, regulatory, and contractual consequences.
- Reputational damage and loss of customer confidence.
- Operational and technology dependencies.
- Maximum tolerable duration of disruption.
- Availability of alternate processing arrangements.
- Impact on other business functions or external stakeholders.
##### **Example: CBF-1 Credit Card Transaction Authorisation and Processing**
CBF-1 may be considered a high-priority candidate because disruption to transaction authorisation could prevent customers from completing card transactions.
The function may depend on:
| Resource category | Illustrative dependencies |
| --- | --- |
| People | Transaction operations personnel, IT support, fraud specialists |
| Processes | Transaction validation, authorisation, exception handling |
| Technology | Card processing applications, account databases, network connectivity |
| Information | Customer account data, transaction records, authorisation parameters |
| Facilities | Technology hosting environments and operational workspaces |
| Third Parties | Payment networks, telecommunications providers, technology service providers |
The BIA should determine the impacts of disruption over time and establish appropriate recovery requirements.
##### **Identifying Supporting Sub-Critical Business Functions**
CBF-1 can be further decomposed into supporting activities to facilitate detailed BIA and recovery planning.
An illustrative breakdown is:
| Sub-CBF | Supporting activity |
| --- | --- |
| 1.1 | Receive Credit Card Transaction Requests |
| 1.2 | Validate Transaction Information |
| 1.3 | Authenticate Card and Account Credentials |
| 1.4 | Verify Account Status |
| 1.5 | Check Available Credit Limits |
| 1.6 | Perform Fraud Screening |
| 1.7 | Execute Transaction Authorisation Decision |
| 1.8 | Communicate Authorisation Response |
| 1.9 | Record Transaction Information |
| 1.10 | Monitor Transaction Processing Exceptions |
| 1.11 | Perform Transaction Reconciliation |
| 1.12 | Coordinate Payment Network and Processing Support |
This decomposition enables CardX to identify specific process owners, system dependencies, minimum resource requirements, and recovery arrangements.
##### **Prioritising CBFs Through the BIA**
Base the final prioritisation of CBFs on documented BIA results rather than assumptions about departmental importance.
For example, transaction authorisation may require rapid recovery because customer impacts arise immediately.
Other functions, such as certain administrative or periodic reporting activities, may have different recovery requirements depending on regulatory deadlines, customer consequences, and business conditions.
CardX should establish recovery priorities that reflect the actual consequences of disruption over time.
The approved CBF catalogue should form the foundation for subsequent risk assessment, BIA, strategy development, continuity planning, and exercising.
#### **Alignment with ISO 22301 and Bank of Thailand Expectations**
##### **ISO 22301 Requirements**
CardX's BCM programme should be structured around ISO 22301:2019 requirements, including the applicable 2024 amendment on climate change considerations in the organisational context.
The standard provides a systematic framework to ensure BCM is governed, implemented, evaluated, and continually improved.
| ISO 22301 clause | Requirement | Application to CardX |
| --- | --- | --- |
| Clause 4 | Context of the Organisation | Understand business operations, stakeholders, dependencies, and BCMS scope |
| Clause 5 | Leadership | Establish BCM policy, accountability, governance, and responsibilities |
| Clause 6 | Planning | Address BCMS risks and opportunities and establish measurable objectives |
| Clause 7 | Support | Provide resources, competencies, awareness, communications, and documented information |
| Clause 8 | Operation | Conduct BIA and risk assessment, establish strategies, develop plans, and exercise arrangements |
| Clause 9 | Performance Evaluation | Monitor performance, conduct internal audits, and undertake management reviews |
| Clause 10 | Improvement | Address nonconformities and continually improve BCM effectiveness |
##### **Bank of Thailand Regulatory Considerations**
The Bank of Thailand has published guidance on BCM and BCP for financial institutions.
Its policy statement emphasises board and senior management involvement, organisation-wide continuity arrangements, and the continuation or timely resumption of critical business functions following disruptive incidents.
For CardX, the BCM programme should consider the relevant BOT supervisory framework, applicable financial business group requirements, technology risk management expectations, outsourcing arrangements, and customer protection obligations.
Because CardX operates in the credit card and consumer lending sector, it should verify whether individual BOT requirements apply based on CardX's legal entity status, licences, and current supervisory obligations.
Requirements applying specifically to commercial banks should not automatically be treated as directly applicable to CardX.
##### **Integrating Regulatory Compliance with BCM**
CardX should establish a documented process to:
1. Identify applicable BOT requirements and relevant regulatory obligations.
2. Map those requirements to BCM policies, processes, and controls.
3. Assign accountable owners for regulatory compliance.
4. Maintain evidence of continuity planning and recovery capability.
5. Evaluate regulatory notification and communication obligations.
6. Conduct periodic reviews to identify compliance gaps.
7. Report material deficiencies and improvement actions to management.
This approach enables CardX to demonstrate that appropriate governance, documentation, operational controls, and management oversight support BCM.
#### **Key Takeaways**
Business Continuity Management provides CardX with a structured approach to protecting essential financial services and preparing for disruptive incidents.
The principal lessons from this chapter are:
- BCM is an organisation-wide responsibility. It requires coordinated participation from management, business functions, technology, risk management, compliance, and service providers.
- Understanding operations is the starting point. CardX must understand how credit card services, customer servicing, lending operations, and supporting processes depend on interconnected resources.
- BCM goals must be translated into measurable objectives. Align recovery capabilities with business needs, customer expectations, and applicable regulatory requirements.
- Planning assumptions must be realistic. Develop and evaluate continuity arrangements against severe but plausible disruptions.
- Governance and accountability are essential. Clear responsibilities support effective programme implementation, incident escalation, and decisions on recovery.
- Risk assessment and BIA provide the analytical foundation. They enable CardX to identify threats, determine disruption consequences, and establish recovery priorities.
- Critical Business Functions require prioritised protection. Recovery strategies and plans should reflect the consequences of disrupting essential services.
- BCM requires continual improvement. Exercises, audits, incident reviews, and management evaluations should inform ongoing enhancements.
### [![Banner \[Summary\] \[BCM\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/f008eb8e-2d77-4964-abfa-a4ef718b1284.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f008eb8e-2d77-4964-abfa-a4ef718b1284)
Business Continuity Management is fundamental to CardX's ability to maintain reliable financial services, protect customer interests, and respond effectively to operational disruptions.
As an organisation operating in Thailand's credit card and consumer lending environment, CardX faces continuity challenges arising from technology dependence, cyber threats, payment processing requirements, third-party relationships, workforce availability, and changing customer expectations.
An effective BCM programme must therefore go beyond preparing Business Continuity Plans.
It requires a comprehensive understanding of the organisation, clear governance, measurable continuity objectives, systematic risk assessment, business impact analysis, appropriate recovery strategies, and regular validation of recovery capabilities.
This chapter has established the conceptual and organisational foundations for implementing BCM at CardX. It has introduced the organisation's operational environment, proposed BCM goals and objectives, planning assumptions, governance arrangements, risk considerations, and an illustrative catalogue of Critical Business Functions.
These elements provide the starting point for developing a structured BCM programme aligned with ISO 22301 and applicable Bank of Thailand requirements.
CardX management and business function owners should validate the proposed Critical Business Functions, recovery objectives, governance arrangements, and operational dependencies before incorporating them into approved BCM documentation.
The next stage of the implementation journey is to examine CardX's organisational context in greater detail, including its business environment, stakeholders, operational dependencies, and continuity requirements.
This understanding will support the systematic application of the seven-phase BCM planning methodology introduced in this chapter.
Ultimately, CardX's BCM programme should be measured not simply by the existence of policies and plans, but by the organisation's demonstrated ability to maintain or recover its critical financial services within acceptable timeframes when disruptions occur.
#### **Reference Materials**
The following references provide the foundation for further development and validation of the chapter:
1. ISO 22301:2019, Security and Resilience — Business Continuity Management Systems — Requirements, including Amendment 1:2024.
2. ISO 22313:2020, Security and Resilience — Business Continuity Management Systems — Guidance on the Use of ISO 22301.
3. Bank of Thailand, Policy Statement on Business Continuity Management and Business Continuity Plans of Financial Institutions.
4. Bank of Thailand, Financial Institutions Supervisory Framework.
5. CardX, Official Corporate Website — information on credit card, lending, and customer financial services.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
[![\[BCM\] \[CardX\] \[3/4 Banner\] Resilient Communities: Implementing Business Continuity Management](https://no-cache.hubspot.com/cta/default/3893111/9f845ac2-5b4f-49ad-bae6-a8e36eeb7f88.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9f845ac2-5b4f-49ad-bae6-a8e36eeb7f88)
| **eBook 1: Understanding Your Organisation** | | | | | |
| --- | --- | --- | --- | --- | --- |
| **C1** | **C2 \[x\]** | **C3 \[x\]** | **C4 \[x\]** | **C5 \[x\]** | **C6 \[x\]** |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/28094145-f399-44f4-96da-2b0beabfefb5) | [![\[BCM\] \[CardX\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/5846f309-4455-4ac8-b950-1078d1747107.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5846f309-4455-4ac8-b950-1078d1747107) | [![\[BCM\] \[CardX\] \[E1\] \[C3\] Establishing Organisational Goals](https://no-cache.hubspot.com/cta/default/3893111/2b176e3a-1abd-4a79-9071-91e2fbf44bb4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2b176e3a-1abd-4a79-9071-91e2fbf44bb4) | [![\[BCM\] \[CardX\] \[E1\] \[C4\] Establishing Business Continuity Objectives](https://no-cache.hubspot.com/cta/default/3893111/64ad404d-4a6c-485a-9518-a487bfde4484.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/64ad404d-4a6c-485a-9518-a487bfde4484) | [![\[BCM\] \[CardX\] \[E1\] \[C5\] Determining BC Assumptions](https://no-cache.hubspot.com/cta/default/3893111/528fdb09-98e5-4d29-83de-59af9c0c9ddc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/528fdb09-98e5-4d29-83de-59af9c0c9ddc) | [![\[BCM\] \[CardX\] \[E1\] \[C6\] Composing BCM Team](https://no-cache.hubspot.com/cta/default/3893111/877e6059-71e4-48dc-b23f-33ec1fa861fa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/877e6059-71e4-48dc-b23f-33ec1fa861fa) |
| **C7 \[x\]** | **C8 \[x\]** | **C9 \[x\]** | **C10** | **C11 \[x\]** | **C12 \[x\]** |
| [![\[BCM\] \[CardX\] \[E1\] \[C7\] Analysing Operating Environment](https://no-cache.hubspot.com/cta/default/3893111/3421cd27-ec8e-40ff-8d84-bacb120123b1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3421cd27-ec8e-40ff-8d84-bacb120123b1) | [![\[BCM\] \[CardX\] \[E1\] \[C8\] Implementing the BCM Planning Methodology](https://no-cache.hubspot.com/cta/default/3893111/b52110ba-8b68-45e1-b612-01d20ce4cba7.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b52110ba-8b68-45e1-b612-01d20ce4cba7) | [![\[BCM\] \[CardX\] \[E1\] \[C9\] Assessing Risks and Threats](https://no-cache.hubspot.com/cta/default/3893111/8d773d38-27d9-4428-ab38-9833e177b2f4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8d773d38-27d9-4428-ab38-9833e177b2f4) | [![\[BCM\] \[CardX\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389) | [![\[BCM\] \[CardX\] \[E1\] \[C11\] Summary](https://no-cache.hubspot.com/cta/default/3893111/ebd11878-bbac-4dac-885f-d2dbd51555b8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ebd11878-bbac-4dac-885f-d2dbd51555b8) | [![\[BCM\] \[CardX\] \[E1\] \[C12\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/4b167117-f071-4cab-a24a-a57b65273e90.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b167117-f071-4cab-a24a-a57b65273e90) |
| | | | | | |
More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for BCM-300 Business Continuity Management Implementer \[BCM-3\] and BCM-5000 Business Continuity Management Expert Implementer \[BCM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f3922b80-e96a-46d6-8993-dc150a5de2d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9ff8a3dc-e39a-465b-929f-72e232cdd5fb) | [![Register \[BL-B-3\]\*](https://no-cache.hubspot.com/cta/default/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21525c10-4003-4934-95fc-fe218174bc5b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/46460171-c91a-4936-9bb2-8dc5928a0e02) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1cb17ac7-50b2-4f88-bc4b-c7444e4b57b5) |
| [![FAQ \[BL-B-3\]](https://no-cache.hubspot.com/cta/default/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c199ae8-c470-4bb7-9612-73c7a084e94c) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/8999211a-2c51-4be7-bf49-c393f6c67974) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5c1aa95d-f6dd-4067-a95c-5cc0c32d7ed8) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/086ab3b9-4d66-4a95-b2f7-1148e9803a9c) |
### Your Comments Here :
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook/author/moh-heng-goh"
},
"dateModified" : "2026-10-22T01:41:48.951Z",
"datePublished" : "2026-10-19T07:36:49.000Z",
"headline" : "[BCM] [CardX] [E1] [C1] Overview of BCM Case Study",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-cardx-e1-c1-overview-of-bcm-case-study",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```