---
title: [BCM] [CardX] [E1] [C10] Identifying Critical Business Functions
description: [BCM] [CardX] [E1] [C10] Identifying Critical Business Functions
image: https://blog.bcm-institute.org/hubfs/CardX%20Graphic%20Folder/CardX%20E1%20Morepost/%5BBCM%5D%20%5BCardX%5D%20%5BE1%5D%20%5BC10%5D%20Identifying%20Critical%20Business%20Functions.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Planning for Resilience: A Methodology for Implementing BCM in CardX
# \[BCM\] \[CardX\] \[E1\] \[C10\] Identifying Critical Business Functions
[![\[BCM\] \[CardX\] \[Full Banner\] Resilient Communities: Implementing Business Continuity Management](https://no-cache.hubspot.com/cta/default/3893111/2baa580e-44fd-47f4-b311-bf7cb8f807f5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2baa580e-44fd-47f4-b311-bf7cb8f807f5)
Business Continuity Management (BCM) is essential for financial institutions that provide services requiring high levels of availability, reliability, security, and customer confidence.
[![eBook Cover \[BCM\] \[CardX\] \[E1\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/ff317031-b993-499e-af86-e4be8c103df2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ff317031-b993-499e-af86-e4be8c103df2)For CardX, maintaining critical financial services during disruptions is particularly important because interruptions may affect customers' access to credit, payment processing, transaction authorisation, account servicing, and other essential financial activities.
As a financial services organisation operating in Thailand, CardX must consider the operational, technological, regulatory, and reputational consequences of disruptions. Its BCM framework should therefore align with ISO 22301 and the applicable requirements and supervisory expectations of the Bank of Thailand (BOT).
An important foundation of BCM planning is the identification of Critical Business Functions (CBFs). These are business functions whose disruption could result in unacceptable consequences for CardX, its customers, contractual counterparties, or other stakeholders.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fbb42012-8f64-401c-a56c-d84bdcfeee14)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook/author/moh-heng-goh) Oct 19, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
### [![\[BCM\] \[CardX\] \[Legal Disclaimer\] Implementing Business Continuity Management at CardX](https://no-cache.hubspot.com/cta/default/3893111/bce15e52-e708-41ce-81a2-33ef85210504.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bce15e52-e708-41ce-81a2-33ef85210504)
### eBook 1: Chapter 10
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fbb42012-8f64-401c-a56c-d84bdcfeee14)
### Identifying Critical Business Functions for CardX
#### Introduction
[![\[BCM\] \[CardX\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389)Business Continuity Management (BCM) is essential for financial institutions that provide services requiring high levels of availability, reliability, security, and customer confidence.
For CardX, maintaining critical financial services during disruptions is particularly important because interruptions may affect customers' access to credit, payment processing, transaction authorisation, account servicing, and other essential financial activities.
As a financial services organisation operating in Thailand, CardX must consider the operational, technological, regulatory, and reputational consequences of disruptions. Its BCM framework should therefore align with ISO 22301 and the Bank of Thailand's (BOT) applicable requirements and supervisory expectations.
A key foundation of BCM planning is identifying Critical Business Functions (CBFs). These are business functions whose disruption could result in unacceptable consequences for CardX, its customers, contractual counterparties, or other stakeholders.
Identifying CBFs enables CardX to establish which activities require priority protection, continuity arrangements, recovery resources, and management attention.
For example, a prolonged disruption to CardX's credit card transaction authorisation capability could prevent customers from completing purchases. Similarly, an outage affecting payment posting or customer account information could result in incorrect account balances, delayed repayments, customer complaints, and potential regulatory concerns.
The identification of CBFs should not be based solely on the organisational structure or the perceived importance of individual departments.
Instead, it should follow a systematic, impact-based assessment of the services CardX delivers and the business functions that support them.
This chapter provides a practical approach to identifying and documenting CardX's CBFs, establishing their preliminary criticality, understanding their dependencies, and preparing for the detailed Business Impact Analysis (BIA) undertaken during subsequent BCM implementation activities.
#### **Understanding Critical Business Functions**
##### **Definition of a Critical Business Function**
A Critical Business Function is a business activity or group of related activities that must be maintained or recovered within an acceptable period following a disruption to prevent unacceptable impacts on the organisation and its stakeholders.
Within the context of CardX, CBFs are those functions necessary to support the continued provision of essential credit card and related financial services.
Examples include:
- Processing credit card transactions and authorisation requests.
- Maintaining customer access to credit card accounts.
- Processing customer payments and repayments.
- Supporting fraud detection and transaction security.
- Managing essential customer servicing and dispute resolution.
- Maintaining the availability of critical financial transaction records.
A CBF may depend on several supporting processes, information systems, employees, service providers, and external financial infrastructure.
Consequently, identifying a CBF involves more than naming an important activity. It requires understanding how the activity contributes to delivering CardX's products and services and what would happen if the activity became unavailable.
##### **Distinguishing Business Functions from Supporting Resources**
Distinguish between business functions and the resources that support them.
| Component | CardX example |
| --- | --- |
| Product or service | Credit card payment services |
| Critical Business Function | Credit Card Transaction Authorisation |
| Supporting business processes | Transaction validation, credit limit verification, authorisation response |
| Supporting applications | Card management system, transaction authorisation platform |
| Supporting infrastructure | Servers, networks, databases, telecommunications |
| Supporting personnel | Card operations, IT operations, fraud management personnel |
| External dependencies | Card networks, payment processors, telecommunications and technology service providers |
For example, a transaction authorisation platform is an important supporting technology resource, but it is not itself the business function.
The business function is the ability to evaluate and approve or decline a transaction in accordance with CardX's operating requirements.
This distinction is essential because BCM planning should begin with business service requirements rather than technology recovery capabilities.
##### **Criticality Versus Operational Importance**
Not every important business function is necessarily critical for BCM purposes.
A function may matter to CardX's long-term commercial success but may tolerate a temporary interruption without unacceptable immediate consequences.
Conversely, a relatively small operational function may be critical because its failure would interrupt a large volume of financial transactions or prevent CardX from meeting important obligations.
Criticality should therefore be determined through an assessment of:
- Financial and operational impacts.
- Customer and service delivery consequences.
- Regulatory and legal obligations.
- Reputational consequences.
- Dependencies and potential cascading disruptions.
- The time within which disruption becomes unacceptable.
#### **Organisational Context of CardX**
##### **Nature of CardX's Operations**
For BCM planning purposes, CardX should be assessed as a financial services organisation whose credit card operations depend on integrated customer servicing, transaction processing, financial records, technology infrastructure, and external payment ecosystems.
Its business continuity requirements are driven by the need to maintain reliable financial services, protect customer information, and ensure critical transaction-processing activities can continue or be recovered after a disruption.
Potential operational disruptions include cyberattacks, application failures, telecommunications outages, payment processing interruptions, third-party service failures, natural disasters, and unavailability of critical personnel.
##### **Regulatory Considerations in Thailand**
CardX should develop its BCM framework in line with applicable BOT requirements and supervisory expectations, including those on operational risk management, business continuity, information technology risk, outsourcing, cybersecurity, and customer protection.
Confirm the applicability of individual BOT notifications or requirements against CardX's legal entity classification, licensing arrangements, and regulated activities.
The following considerations are particularly relevant.
| Regulatory or standards considerations | BCM implications for CardX |
| --- | --- |
| ISO 22301:2019 | Establish, implement, maintain and continually improve a structured BCMS |
| BOT business continuity expectations | Maintain appropriate arrangements for important financial operations during disruptions |
| BOT IT risk and resilience expectations | Address technology availability, information security, recovery and operational dependencies |
| BOT outsourcing and third-party expectations | Assess the continuity capabilities of material service providers |
| Customer protection requirements | Consider the impact of service interruptions on customers and their financial transactions |
| Applicable privacy and data protection obligations | Protect personal information and maintain appropriate security and recovery arrangements |
Implementation consideration: ISO 22301 Clause 8.2 establishes requirements for Business Impact Analysis and risk assessment.
CardX should use the identification of CBFs as an input to the BIA rather than treating the initial CBF catalogue as a substitute for the formal assessment.
#### **Objectives of Identifying Critical Business Functions**
The primary objective is to establish a defensible, business-driven understanding of the functions that CardX must prioritise during a disruption.
Specifically, the exercise should enable CardX to:
1. Identify the business functions supporting its important products and services.
2. Determine which functions could cause unacceptable impacts if disrupted.
3. Establish a preliminary hierarchy of business recovery priorities.
4. Identify business owners accountable for each CBF.
5. Understand important internal and external dependencies.
6. Provide the foundation for determining recovery time objectives and resource requirements.
7. Support the development of appropriate business continuity strategies.
8. Facilitate BCM governance, management approval, and regulatory review.
The identification process should also promote a common understanding among business units, technology teams, risk management, compliance, and senior management regarding the functions that require priority continuity arrangements.
#### **Proposed Critical Business Functions for CardX**
The following catalogue presents a proposed set of Critical Business Functions relevant to CardX's credit card and associated financial services operations.
These functions are illustrative candidates for validation, not a representation of CardX's formally approved internal CBF register.
CardX should confirm the descriptions and preliminary criticality ratings through discussions with business owners and a formal BIA.
**Table 10.1: Proposed Catalogue of Critical Business Functions for CardX**
Note: Ratings are indicative planning assumptions. CBF-12 is an enabling function and should be assessed alongside the business services it supports. Final classifications depend on CardX's BIA, approved impact criteria and recovery priorities.
##### **CBF-1: Credit Card Transaction Authorisation**
Credit Card Transaction Authorisation is a potential highest-priority function because it enables customers to use their credit cards for purchases and other permitted transactions.
The function typically involves receiving authorisation requests, validating account and card status, checking available credit, applying fraud and transaction controls, and returning an approval or decline response.
Example: If CardX experiences a major failure affecting its authorisation capability, customers may be unable to complete transactions at merchants or through digital commerce channels. Prolonged disruption could result in customer dissatisfaction, transaction failures, financial consequences, and reputational damage.
The BIA should evaluate transaction volumes, alternative processing arrangements, service provider dependencies, and the maximum acceptable disruption duration.
##### **CBF-2: Credit Card Payment Processing and Settlement**
This function supports the financial processing and settlement activities associated with credit card transactions.
It is important because it supports accurate transaction processing, meeting applicable settlement obligations, and reconciling financial positions.
Example: A failure affecting transaction settlement interfaces could delay settlement processing, leave transactions unreconciled, or create operational backlogs that require urgent intervention.
CardX should identify relevant settlement windows, external processing dependencies, and the consequences of missing critical processing deadlines.
##### **CBF-3: Customer Credit Card Account Access and Management**
This function supports customers' ability to obtain important account information and manage their credit card services.
It may include account balance enquiries, access to transaction history, card status enquiries, and account servicing requests.
Example: An extended outage affecting CardX's digital servicing channels could prevent customers from checking available credit or reviewing recent transactions.
Evaluate the criticality of individual channels alongside the availability of alternative customer servicing arrangements.
##### **CBF-4: Credit Card Repayment Processing and Posting**
This function enables CardX to receive, recognise, reconcile, and post customer credit card repayments.
It is important for maintaining accurate balances, recognising customer payments, and updating available credit.
Example: A disruption occurring near a major repayment due date could prevent timely posting of repayments, potentially creating incorrect outstanding balances, customer complaints, or inappropriate overdue classifications.
Continuity arrangements should consider repayment channels, payment cut-off times, reconciliation controls, and procedures for correcting delayed postings.
##### **CBF-5: Fraud Detection and Transaction Risk Monitoring**
Fraud detection and transaction risk monitoring support the protection of CardX and its customers against unauthorised or suspicious financial activity.
The function may involve monitoring transactions, generating alerts, investigating, escalating, and responding to fraud.
Example: If fraud monitoring becomes unavailable during a cyber incident, CardX may not identify or act on suspicious transactions promptly.
CardX should assess the feasibility of alternative monitoring arrangements, enhanced transaction controls, and temporary risk mitigation measures.
##### **CBF-6: Credit Card Account and Ledger Management**
This function maintains the integrity and accuracy of customer account records and associated financial information.
It supports balances, credit limits, transaction postings, interest calculations, fees, and account-related financial records.
Example: A database corruption incident affecting cardholder account records could compromise the accuracy of customer balances and transaction processing.
Continuity planning should consider data integrity, reconciliation, recovery point objectives, and controlled restoration procedures.
##### **CBF-7: Customer Support and Critical Service Communication**
Customer support becomes particularly important during disruptions affecting financial services.
The function should let customers report urgent problems, get service information, and receive guidance on available alternatives.
Example: During a prolonged card processing outage, CardX may see more customer enquiries about declined transactions, repayment arrangements, and card availability.
The BCM plan should provide for alternative contact channels, approved customer messages, and prioritisation of urgent customer requests.
##### **CBF-8: Credit Card Blocking, Replacement and Security Management**
The ability to block compromised, lost, or stolen cards is an important customer protection capability.
This function may require immediate action to prevent further unauthorised transactions.
Example: If the primary card management platform is unavailable, customers may be unable to request urgent card blocking through normal channels.
CardX should consider whether it can establish secure alternative arrangements with relevant service providers to execute emergency card-blocking instructions.
##### **CBF-9: Dispute Resolution and Chargeback Management**
This function supports the investigation of disputed transactions and the management of applicable chargeback procedures.
Although some activities may tolerate a limited delay, specific dispute deadlines and customer protection obligations can make certain subprocesses time-sensitive.
Example: An extended outage affecting dispute case management could result in missed processing deadlines or delays in resolving unauthorised transaction complaints.
CardX should distinguish urgent dispute activities from those that can be deferred temporarily.
##### **CBF-10: Credit Assessment, Approval and Credit Limit Management**
This function supports credit assessment, approval decisions, and ongoing credit limit management.
Its disruption could affect new customer applications, credit availability, and credit risk controls.
Example: A system outage could delay credit approval decisions and prevent authorised credit limit changes.
The BIA should distinguish activities essential to maintaining existing customer services from those that may be temporarily suspended without unacceptable consequences.
##### **CBF-11: Regulatory Reporting and Critical Financial Information Management**
This function supports CardX's ability to maintain accurate financial information and meet applicable regulatory reporting obligations.
Criticality may increase significantly when a disruption coincides with a statutory or regulatory submission deadline.
Example: A reporting system failure immediately before a required BOT submission could create compliance concerns if the report cannot be completed or submitted on time.
CardX should identify time-sensitive reporting obligations and establish appropriate contingency arrangements.
##### **CBF-12: Critical Technology Operations and Service Recovery Coordination**
Technology operations support the availability and recoverability of systems CardX uses for its business functions.
This function may involve monitoring critical applications, coordinating incident response, managing technology service providers, and restoring disrupted technology services.
Example: A failure affecting CardX's transaction processing infrastructure may require coordinated recovery of databases, applications, networks, and external connectivity.
Although technology recovery is an enabling capability rather than an end-customer service, its failure can prevent multiple CBFs from operating. Its recovery priorities should therefore be derived from the needs of the supported business functions.
#### **Additional Considerations for CardX's Lending Services**
CardX's publicly described offerings extend beyond conventional credit cards and include personal lending, cash access, and instalment-related products, such as CardX FLEX and CardX SPEEDY LOAN.
Consequently, the initial CBF catalogue should also consider whether these activities require separate critical business functions or can be included within existing CBFs.
**Table 10.2: Additional Lending-Related Functions for Assessment**
| Function | Example of disruption | Proposed treatment |
| --- | --- | --- |
| Personal Loan Disbursement | Approved customers cannot receive scheduled loan proceeds | Assess as a separate CBF where time-sensitive disbursements are material |
| Cash Advance and Cash Transfer Processing | Customers cannot access permitted cash advances | Assess separately or under CBF-1, depending on processing dependencies |
| Loan Repayment and Servicing | Loan repayments are not recorded or balances become inaccurate | Assess under CBF-4 or establish a separate lending CBF |
| Instalment Conversion and Management | Customers cannot convert eligible transactions into instalment plans | Evaluate time sensitivity and customer consequences |
| Credit Limit and Loan Account Maintenance | Credit information or account limits cannot be updated | Assess under CBF-6 and CBF-10 |
Evaluate these functions against CardX's actual product portfolio, operating arrangements, and contractual obligations.
#### **Methodology for Identifying Critical Business Functions**
CardX should adopt a structured methodology to identify business functions consistently across its operations.
##### **CBF Identification Methodology**
[![PIC \[BCM\] \[BIA\] Critical Business Function Identification Process](https://no-cache.hubspot.com/cta/default/3893111/eb56002c-6cbe-4d3d-8158-1b8f22504535.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/eb56002c-6cbe-4d3d-8158-1b8f22504535)
##### **Step 1: Identify Products and Services**
Begin by identifying the products and services CardX delivers.
These may include credit card payment services, customer account servicing, repayment services, personal lending, cash advances, and associated financial services.
The BCM team should work with product owners and business units to determine which services are most important to customers and to CardX's contractual and regulatory obligations.
##### **Step 2: Identify Supporting Business Functions**
Map each product or service to the business functions required to deliver it.
For example, credit card payment services may depend on transaction authorisation, fraud monitoring, account and ledger management, and settlement-related activities.
The exercise should identify both direct service delivery functions and essential supporting functions.
##### **Step 3: Assess Disruption Consequences**
CardX should evaluate the potential consequences of disrupting each function.
The assessment should consider customer impact, financial loss, regulatory obligations, operational disruption, reputational damage, and the potential for cascading failures.
Pay particular attention to functions where even a short interruption could have unacceptable consequences.
##### **Step 4: Determine Preliminary Criticality**
Classify business functions according to agreed criticality criteria.
Preliminary classifications should support prioritisation during the initial BCM planning exercise.
However, the formal BIA should establish final recovery priorities and recovery objectives.
##### **Step 5: Identify Owners and Dependencies**
Each proposed CBF should have an accountable business owner.
The BCM team should also identify the people, technology, information, facilities, service providers, and external infrastructure required to perform the function.
##### **Step 6: Validate and Approve the CBF Catalogue**
Review the proposed catalogue with relevant business owners and supporting functions.
Resolve differences in criticality assessments through an agreed governance process.
The designated management authority should endorse the final catalogue and maintain it as a controlled BCM document.
#### **Criteria for Assessing Criticality**
CardX should establish consistent criteria for evaluating the criticality of business functions.
**Table 10.3: Suggested Criticality Assessment Criteria**
| Impact area | Assessment consideration | CardX example |
| --- | --- | --- |
| Financial | Potential financial losses, penalties or processing costs | Losses arising from disrupted transactions |
| Customer | Number of customers affected and severity of inconvenience or harm | Customers unable to complete card transactions |
| Regulatory | Potential breaches of applicable regulatory obligations | Failure to meet a time-sensitive BOT reporting obligation |
| Operational | Extent of disruption to essential operations | Unavailability of transaction processing |
| Reputational | Potential loss of customer and stakeholder confidence | Prolonged outage attracting public complaints |
| Legal and contractual | Failure to meet contractual or legal obligations | Missed settlement or dispute processing deadlines |
| Dependency | Extent to which other critical functions depend on the activity | Account management failure affecting authorisation and repayment processing |
##### **Illustrative Criticality Rating Scale**
| Rating | Description | BCM planning implication |
| --- | --- | --- |
| Very High | Disruption may rapidly result in unacceptable consequences | Highest priority for detailed BIA and continuity planning |
| High | Disruption may cause serious consequences within a limited period | Priority continuity arrangements required |
| Medium | Disruption may be tolerated temporarily with appropriate controls | Recovery arrangements based on BIA results |
| Low | Disruption is unlikely to cause unacceptable short-term consequences | Managed through appropriate operational recovery arrangements |
These ratings should not be treated as fixed recovery time objectives. A function rated Very High may have a different recovery requirement from another function with the same rating.
#### **Mapping Critical Business Functions to Supporting Resources**
Once CardX has identified CBFs, it should determine the resources and dependencies required to deliver them.
This mapping helps identify potential single points of failure, shared technology dependencies, and exposure to external service providers.
**Table 10.4: Illustrative CBF Dependency Mapping**
| CBF | Key supporting resources | External dependencies |
| --- | --- | --- |
| CBF-1 Transaction Authorisation | Authorisation application, cardholder database, network connectivity, operations personnel | Card networks, processing partners |
| CBF-2 Payment Processing and Settlement | Transaction records, reconciliation systems, finance personnel | Settlement and payment counterparties |
| CBF-3 Customer Account Access | Customer application, account database, authentication services | Cloud, connectivity and authentication providers, where applicable |
| CBF-4 Repayment Processing | Payment posting system, reconciliation records, operations personnel | Payment collection channels and banking partners |
| CBF-5 Fraud Monitoring | Fraud monitoring tools, transaction data, security analysts | Fraud technology and monitoring service providers |
| CBF-6 Account and Ledger Management | Card management system, ledger databases, data integrity controls | Technology and infrastructure providers |
| CBF-7 Customer Support | Contact centre systems, customer records, trained personnel | Telecommunications and outsourced servicing providers |
| CBF-8 Card Blocking and Security | Card management system, customer authentication, security personnel | Card networks and processing partners |
| CBF-9 Dispute Management | Dispute records, case management system, specialist personnel | Card schemes and relevant counterparties |
| CBF-10 Credit Assessment | Credit assessment applications, customer data, credit personnel | Credit information providers, where applicable |
| CBF-11 Regulatory Reporting | Reporting applications, financial data, compliance personnel | Reporting gateways and supporting technology providers |
| CBF-12 Technology Operations | Infrastructure monitoring, recovery tools, IT personnel | Technology vendors, hosting and connectivity providers |
The listed dependencies are illustrative and do not establish CardX's actual technology architecture or outsourcing arrangements.
##### **Example: Transaction Authorisation Dependency Chain**
****
Illustrative logical processing flow.
CardX must validate actual routing and processing responsibilities.
The dependency mapping should identify which resources must be recovered to restore the business function, rather than simply listing every system the business unit uses.
#### **Relationship Between CBF Identification and Business Impact Analysis**
CBF identification and Business Impact Analysis are closely related but serve different purposes.
CBF identification establishes which functions may require priority continuity arrangements.
The BIA then evaluates the consequences of disruption over time and determines the requirements to maintain or recover those functions.
**Table 10.5: Relationship Between CBF Identification and BIA**
| Component | CBF identification | Business Impact Analysis |
| --- | --- | --- |
| Primary purpose | Identify potentially critical functions | Determine disruption impacts and recovery requirements |
| Main question | Which functions require continuity attention? | How quickly and to what level must functions recover? |
| Assessment | Preliminary criticality | Detailed impact over time |
| Dependencies | Initial identification | Detailed resource and interdependency assessment |
| Recovery requirements | Preliminary assumptions | Evidence-based recovery priorities and objectives |
| Output | Approved CBF catalogue | Approved BIA results and recovery requirements |
##### **Establishing Recovery Time Objectives**
Derive Recovery Time Objectives (RTOs) from the BIA and the organisation's acceptable disruption limits.
For example, CardX may determine that transaction authorisation requires a shorter RTO than certain administrative activities because disruption escalates more rapidly.
The RTO must also reflect the time required to restore supporting technology, personnel, information, and external services.
##### **Illustrative Recovery Requirements**
| CBF | Illustrative RTO | Important consideration |
| --- | --- | --- |
| CBF-1 Transaction Authorisation | 1 hour | Continuous customer transaction requirements |
| CBF-2 Payment Processing and Settlement | 4 hours | Settlement deadlines and transaction backlogs |
| CBF-4 Repayment Processing | 4 hours | Repayment deadlines and accurate posting |
| CBF-5 Fraud Monitoring | 1 hour | Exposure to fraudulent transactions |
| CBF-7 Customer Support | 4 hours | Urgent customer assistance and alternative channels |
| CBF-11 Regulatory Reporting | Deadline-dependent | Statutory or regulatory submission windows |
Important: These RTOs are hypothetical examples for training and methodology illustration.
They are not CardX-approved recovery targets or BOT-prescribed recovery periods.
CardX must support actual RTOs with its BIA, regulatory obligations, contractual requirements, and management approval.
#### **Governance and Accountability**
Effective CBF identification requires clearly defined responsibilities across CardX.
**Table 10.6: Proposed Governance Responsibilities**
| Role | Responsibility |
| --- | --- |
| Board of Directors or designated governing authority | Provide oversight of BCM policy and material resilience risks |
| Senior Management | Approve the CBF identification approach and associated priorities |
| BCM Steering Committee | Review and challenge CBF classifications and resolve cross-functional issues |
| BCM Coordinator | Facilitate the identification process and maintain the CBF catalogue |
| Business Function Owners | Identify functions, assess consequences and validate dependencies |
| IT and Technology Teams | Identify supporting systems, infrastructure and technology recovery requirements |
| Risk Management | Review operational risks and consistency with risk appetite |
| Compliance | Identify applicable regulatory and legal obligations |
| Third-Party Management | Evaluate material external service dependencies |
| Internal Audit | Independently assess the adequacy of the methodology and supporting controls |
CardX should formally document business function ownership and ensure accountability does not rest solely with the BCM coordinator.
#### **Documentation and Approval of the CBF Catalogue**
The CBF identification exercise should produce a controlled document containing sufficient information to support the next stage of BCM planning.
**Table 10.7: Recommended CBF Register Template**
| Field | Description |
| --- | --- |
| CBF Code | Unique reference identifier |
| CBF Name | Approved business function name |
| Description | Purpose and scope of the function |
| Product or Service Supported | Relevant customer-facing or internal service |
| Business Owner | Accountable function owner |
| Department | Responsible organisational unit |
| Preliminary Criticality | Initial impact-based rating |
| Customer Impact | Potential consequences for customers |
| Regulatory Impact | Relevant obligations and potential compliance consequences |
| Supporting Applications | Critical technology systems |
| Key Dependencies | Internal and external resources |
| Alternative Arrangements | Existing workarounds or continuity capabilities |
| BIA Status | Pending, in progress, completed or approved |
| Approval Status | Draft, validated or approved |
| Review Date | Next scheduled reassessment |
The catalogue should be reviewed periodically and whenever significant changes occur in CardX's products, processes, systems, outsourcing arrangements, or regulatory environment.
#### **Common Challenges in Identifying CBFs**
CardX may encounter several challenges during the identification process.
##### **Classifying Too Many Functions as Critical**
Business owners may consider all their activities critical.
This can dilute BCM priorities and create unrealistic expectations for recovery resources.
CardX should apply consistent impact criteria and challenge classifications that are not supported by evidence.
##### **Confusing Business Functions with IT Systems**
A business unit may identify a particular application as its CBF.
However, the BCM assessment should focus on the business activity supported by the application.
Document technology systems as supporting resources.
##### **Overlooking External Dependencies**
Credit card operations may depend heavily on payment networks, service providers, telecommunications, and external processing arrangements.
Failure to identify these dependencies could result in continuity plans that cannot be executed effectively.
##### **Failing to Consider Time-Sensitive Activities**
Some functions become critical only during particular processing windows or regulatory deadlines.
CardX should consider daily, monthly, and event-driven activities when assessing criticality.
##### **Inadequate Management Validation**
A CBF catalogue prepared without appropriate management review may not reflect enterprise-wide priorities.
The approval process should ensure consistency across business units and provide a defensible basis for recovery planning.
#### **Expected Deliverables**
At the conclusion of the CBF identification exercise, CardX should have the following outputs.
| Deliverable | Purpose |
| --- | --- |
| Approved CBF Catalogue | Establish the organisation's identified critical business functions |
| CBF Criticality Assessment | Document preliminary importance and disruption consequences |
| CBF Ownership Register | Establish accountability for each function |
| Product and Service Mapping | Demonstrate relationships between products, services and functions |
| Preliminary Dependency Register | Identify supporting people, systems, information and third parties |
| Management Approval Record | Provide evidence of governance and endorsement |
| BIA Preparation Register | Identify functions requiring detailed impact assessment |
Incorporate these deliverables into CardX's BCMS documentation and make them available for subsequent BIA, continuity strategy development, and management review activities.
#### **Alignment with ISO 22301 and BOT Expectations**
ISO 22301 requires organisations to establish a structured approach to understanding disruption impacts and determining continuity requirements.
Identifying CBFs supports several key elements of the standard.
**Table 10.8: ISO 22301 Alignment**
| ISO 22301 clause | Relevance to CardX |
| --- | --- |
| Clause 4.1 — Understanding the organisation and its context | Understand the operating environment and factors influencing continuity requirements |
| Clause 4.2 — Interested parties | Identify customer, regulatory and contractual continuity expectations |
| Clause 4.3 — Scope of the BCMS | Establish the products, services, activities and organisational boundaries covered |
| Clause 5.3 — Organisational roles and responsibilities | Assign accountability for CBF identification and management |
| Clause 6.2 — Business continuity objectives | Establish measurable BCM objectives informed by critical service requirements |
| Clause 8.2 — Business Impact Analysis and risk assessment | Identify priority activities, assess impacts and determine continuity requirements |
| Clause 8.3 — Business continuity strategies and solutions | Select continuity arrangements addressing identified recovery requirements |
| Clause 8.4 — Business continuity plans and procedures | Develop response and recovery arrangements for priority activities |
| Clause 8.5 — Exercise programme | Validate continuity arrangements and recovery capabilities |
| Clause 9.1 — Monitoring, measurement, analysis and evaluation | Evaluate BCM performance and the effectiveness of continuity arrangements |
The BOT has also published BCM and BCP policy guidance addressing critical business functions, BIA, recovery objectives, and continuity planning.
Its financial-institution policy statement emphasises governance and the ability to continue or resume critical functions within appropriate timeframes.
CardX should verify the current applicability of this guidance and any subsequent BOT requirements to its specific regulated activities.
CardX should not automatically treat the historical BOT policy statement as a currently binding requirement without regulatory confirmation.
#### **Practical Implementation Example for CardX**
Consider a hypothetical scenario in which CardX experiences a major technology disruption affecting credit card transaction authorisation.
The incident also affects customer account access and fraud monitoring.
The BCM team should use the approved CBF catalogue to identify the functions requiring Immediate attention.
**Table 10.9: Illustrative Disruption Response**
| Affected CBF | Potential consequence | Continuity consideration |
| --- | --- | --- |
| CBF-1 Transaction Authorisation | Card transactions may be declined or unavailable | Activate approved transaction processing continuity arrangements |
| CBF-3 Customer Account Access | Customers cannot access account information | Provide alternative servicing and customer communications |
| CBF-5 Fraud Monitoring | Fraud detection capability may be reduced | Apply approved compensating controls and enhanced monitoring |
| CBF-7 Customer Support | Increased customer enquiries and complaints | Expand support capacity and activate disruption communication procedures |
| CBF-12 Technology Operations | Recovery of critical platforms may be delayed | Coordinate technology restoration based on business recovery priorities |
CardX should coordinate the response through its established incident management, crisis management, BCM, and IT disaster recovery arrangements.
The objective is not necessarily to restore every affected system simultaneously. Instead, CardX should prioritise recovering the capabilities needed to maintain or resume its most critical business functions.
#### **Preparing for the Next Stage of BCM Implementation**
The approved CBF catalogue provides the foundation for subsequent BCM planning activities.
The next stage should involve detailed BIA workshops with the owners of the identified functions.
These workshops should assess disruption impacts over time, establish recovery requirements, identify minimum resource needs, and evaluate dependencies.
The resulting BIA findings should inform CardX's Business Continuity Strategies, recovery procedures, and testing arrangements.
For example, CardX could select CBF-1 Credit Card Transaction Authorisation as an initial detailed BIA case study.
Its assessment should examine transaction processing requirements, customer impacts, authorisation dependencies, technology recovery capabilities, alternative arrangements, and potential financial and regulatory consequences.
This approach enables CardX to translate the CBF catalogue into practical, measurable continuity capabilities.
#### [![Banner \[Summary\] \[BCM\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/0e59113c-d17a-48a8-8c28-bb1bcf487857.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0e59113c-d17a-48a8-8c28-bb1bcf487857)
Identifying Critical Business Functions is essential to establishing an effective Business Continuity Management System at CardX.
By systematically identifying the activities that support essential credit card and related financial services, CardX can better understand its operational priorities, disruption exposures, and continuity requirements.
The proposed catalogue of 12 CBFs provides a structured starting point for assessing the importance of transaction authorisation, payment processing, repayment management, fraud monitoring, customer servicing, financial information management, and other essential operational capabilities.
The catalogue should align with CardX's actual organisational structure, product portfolio, technology arrangements, external dependencies, and regulatory obligations.
Importantly, CBF identification should not be treated as a one-time documentation exercise.
It should form part of an ongoing BCM governance process in which business owners periodically reassess criticality, review dependencies, and update continuity priorities as CardX's operating environment evolves.
By aligning CBF identification with ISO 22301 and applicable Bank of Thailand requirements, CardX can establish a sound basis for conducting detailed Business Impact Analysis, selecting appropriate recovery strategies, and developing business continuity plans that protect customers, support regulatory compliance, and strengthen organisational resilience.
The ultimate objective is to ensure that CardX understands which business functions must be protected, why they are critical, who is accountable for them, and what capabilities are required to maintain or recover them when disruption occurs.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
[![\[BCM\] \[CardX\] \[3/4 Banner\] Resilient Communities: Implementing Business Continuity Management](https://no-cache.hubspot.com/cta/default/3893111/9f845ac2-5b4f-49ad-bae6-a8e36eeb7f88.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9f845ac2-5b4f-49ad-bae6-a8e36eeb7f88)
| **eBook 1: Understanding Your Organisation** | | | | | |
| --- | --- | --- | --- | --- | --- |
| **C1** | **C2 \[x\]** | **C3 \[x\]** | **C4 \[x\]** | **C5 \[x\]** | **C6 \[x\]** |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/28094145-f399-44f4-96da-2b0beabfefb5) | [![\[BCM\] \[CardX\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/5846f309-4455-4ac8-b950-1078d1747107.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5846f309-4455-4ac8-b950-1078d1747107) | [![\[BCM\] \[CardX\] \[E1\] \[C3\] Establishing Organisational Goals](https://no-cache.hubspot.com/cta/default/3893111/2b176e3a-1abd-4a79-9071-91e2fbf44bb4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2b176e3a-1abd-4a79-9071-91e2fbf44bb4) | [![\[BCM\] \[CardX\] \[E1\] \[C4\] Establishing Business Continuity Objectives](https://no-cache.hubspot.com/cta/default/3893111/64ad404d-4a6c-485a-9518-a487bfde4484.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/64ad404d-4a6c-485a-9518-a487bfde4484) | [![\[BCM\] \[CardX\] \[E1\] \[C5\] Determining BC Assumptions](https://no-cache.hubspot.com/cta/default/3893111/528fdb09-98e5-4d29-83de-59af9c0c9ddc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/528fdb09-98e5-4d29-83de-59af9c0c9ddc) | [![\[BCM\] \[CardX\] \[E1\] \[C6\] Composing BCM Team](https://no-cache.hubspot.com/cta/default/3893111/877e6059-71e4-48dc-b23f-33ec1fa861fa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/877e6059-71e4-48dc-b23f-33ec1fa861fa) |
| **C7 \[x\]** | **C8 \[x\]** | **C9 \[x\]** | **C10** | **C11 \[x\]** | **C12 \[x\]** |
| [![\[BCM\] \[CardX\] \[E1\] \[C7\] Analysing Operating Environment](https://no-cache.hubspot.com/cta/default/3893111/3421cd27-ec8e-40ff-8d84-bacb120123b1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3421cd27-ec8e-40ff-8d84-bacb120123b1) | [![\[BCM\] \[CardX\] \[E1\] \[C8\] Implementing the BCM Planning Methodology](https://no-cache.hubspot.com/cta/default/3893111/b52110ba-8b68-45e1-b612-01d20ce4cba7.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b52110ba-8b68-45e1-b612-01d20ce4cba7) | [![\[BCM\] \[CardX\] \[E1\] \[C9\] Assessing Risks and Threats](https://no-cache.hubspot.com/cta/default/3893111/8d773d38-27d9-4428-ab38-9833e177b2f4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8d773d38-27d9-4428-ab38-9833e177b2f4) | [![\[BCM\] \[CardX\] \[E1\] \[C10\] Identifying Critical Business Functions](https://no-cache.hubspot.com/cta/default/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b44390b1-f1e4-42b5-81fc-27265eb7b389) | [![\[BCM\] \[CardX\] \[E1\] \[C11\] Summary](https://no-cache.hubspot.com/cta/default/3893111/ebd11878-bbac-4dac-885f-d2dbd51555b8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ebd11878-bbac-4dac-885f-d2dbd51555b8) | [![\[BCM\] \[CardX\] \[E1\] \[C12\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/4b167117-f071-4cab-a24a-a57b65273e90.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b167117-f071-4cab-a24a-a57b65273e90) |
| | | | | | |
#### More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for BCM-300 Business Continuity Management Implementer \[BCM-3\] and BCM-5000 Business Continuity Management Expert Implementer \[BCM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f3922b80-e96a-46d6-8993-dc150a5de2d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9ff8a3dc-e39a-465b-929f-72e232cdd5fb) | [![Register \[BL-B-3\]\*](https://no-cache.hubspot.com/cta/default/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21525c10-4003-4934-95fc-fe218174bc5b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/46460171-c91a-4936-9bb2-8dc5928a0e02) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1cb17ac7-50b2-4f88-bc4b-c7444e4b57b5) |
| [![FAQ \[BL-B-3\]](https://no-cache.hubspot.com/cta/default/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c199ae8-c470-4bb7-9612-73c7a084e94c) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/8999211a-2c51-4be7-bf49-c393f6c67974) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5c1aa95d-f6dd-4067-a95c-5cc0c32d7ed8) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/086ab3b9-4d66-4a95-b2f7-1148e9803a9c) |
### Your Comments Here :
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook/author/moh-heng-goh"
},
"dateModified" : "2026-10-22T01:43:11.551Z",
"datePublished" : "2026-10-19T07:36:47.000Z",
"headline" : "[BCM] [CardX] [E1] [C10] Identifying Critical Business Functions",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-cardx-e1-c10-identifying-critical-business-functions",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```