[BCM] [Damanat] [E1] [C10] Identifying Critical Business Functions

 

 

Introduction

A Business Continuity Management (BCM) programme begins with understanding which parts of an organisation must continue operating, or be recovered within an acceptable timeframe, to achieve its objectives and fulfil its obligations.

For the Saudi Mortgage Guarantees Services Company (Damanat), identifying its Critical Business Functions (CBF) is a fundamental step in establishing an effective BCM framework.

As an organisation supporting Saudi Arabia's housing finance ecosystem through mortgage guarantee services, Damanat plays an important role in promoting financial stability, enabling access to home ownership, and supporting participating financial institutions.

Any prolonged disruption to these functions could affect customers, lenders, regulators, and confidence in the housing finance market.

This chapter explains the concept of Critical Business Functions, outlines the considerations for identifying them within Damanat, proposes a practical set of CBFs suitable for a mortgage guarantee organisation, and highlights the regulatory expectations that should influence the identification process.

These CBFs provide the foundation for subsequent Business Impact Analysis (BIA), Business Continuity Strategy development, recovery planning, and exercising activities.

 

What is a Critical Business Function (CBF)?

A Critical Business Function (CBF) is a business activity that must continue to operate, or be restored within a defined recovery timeframe, because its disruption would have unacceptable consequences for the organisation, its customers, regulators, financial stakeholders, or the wider economy.

Within a BCM programme, a CBF is not simply an important department or business unit. Rather, it represents an end-to-end business capability that delivers essential products or services.

A CBF typically consists of multiple interconnected business processes, people, technology platforms, facilities, third-party services, and information resources working together to achieve a specific business outcome.

Identifying CBFs enables an organisation to:

• determine which activities require the highest recovery priority;
• allocate BCM resources effectively;
• establish recovery time objectives (RTOs);
• conduct Business Impact Analysis (BIA);
• identify critical dependencies;
• develop appropriate continuity strategies; and
• demonstrate resilience to regulators and stakeholders.

For Damanat, the focus should be on business functions that directly support mortgage guarantee operations, financial commitments, regulatory compliance, customer confidence, and enterprise governance.

 

Key Considerations for Identifying CBF at The Saudi Mortgage Guarantees Services Company

The identification of Critical Business Functions should be based upon business impact rather than organisational structure. Several considerations should guide Damanat during this process.

Alignment with Organisational Objectives

Each CBF should directly contribute to Damanat's strategic mandate to support mortgage financing and facilitate sustainable housing finance in Saudi Arabia.

Financial Impact

Disruptions affecting guarantee processing, financial settlements, or risk management may expose Damanat and participating financial institutions to significant financial losses.

Regulatory Obligations

Functions supporting compliance with SAMA regulations, corporate governance requirements, financial reporting obligations, and risk management should receive high priority.

Customer and Partner Expectations

Mortgage lenders rely upon Damanat to process guarantees accurately and efficiently. Service interruptions may delay financing decisions and negatively affect customers and participating banks.

Reputation

Trust is central to the mortgage guarantee industry. Operational failures may reduce confidence among financial institutions, regulators, government agencies, and homebuyers.

Technology Dependency

Many mortgage guarantee services rely heavily upon digital platforms, secure data exchange, document management systems, and integrated banking interfaces.

Third-Party Dependencies

Critical outsourced services, cloud infrastructure, payment systems, telecommunications providers, cybersecurity vendors, and external data providers should all be considered during CBF identification.

Legal and Contractual Obligations

Guarantee agreements, contractual service commitments, and regulatory reporting obligations may require rapid recovery following a disruption.

Recovery Complexity

Functions requiring specialised expertise, unique systems, or highly integrated workflows generally warrant higher recovery priority due to the complexity of restoration.

 

Proposed Critical Business Functions of The Saudi Mortgage Guarantees Services Company

The following Critical Business Functions provide a practical foundation for implementing Business Continuity Management at Damanat.

These functions represent the organisation's core operational capabilities and can be further refined during Business Impact Analysis.

 

No.	Critical Business Function	Description	Typical BCM Priority
1	Mortgage Guarantee Origination	Processing and approving mortgage guarantee applications from participating financial institutions.	Very High
2	Guarantee Risk Assessment	Assessing applicant eligibility, underwriting criteria, and guarantee risk exposure.	Very High
3	Guarantee Issuance and Administration	Issuing, maintaining, renewing, and managing active mortgage guarantees.	Very High
4	Claims Assessment and Settlement	Managing guarantee claims, validating supporting evidence, approving payments, and settlement processing.	Very High
5	Financial and Treasury Management	Managing guarantee funds, liquidity, financial transactions, accounting, and treasury operations.	High
6	Enterprise Risk Management	Monitoring financial, operational, strategic, and emerging risks affecting Damanat.	High
7	Regulatory Compliance and Reporting	Meeting regulatory reporting obligations, governance requirements, and supervisory expectations.	High
8	Information Technology Services	Supporting critical applications, infrastructure, cybersecurity, data centres, cloud services, and business systems.	Very High
9	Information Security and Cyber Resilience	Protecting confidential information, managing cyber incidents, and ensuring secure operations.	Very High
10	Customer and Financial Institution Relationship Management	Supporting participating banks, financial institutions, business partners, and customer enquiries.	High
11	Legal and Corporate Governance	Managing legal advice, contracts, corporate governance, and regulatory documentation.	Medium-High
12	Human Resource Management	Supporting workforce continuity, payroll, staffing, and employee welfare during disruptions.	Medium
13	Procurement and Vendor Management	Managing suppliers, outsourced services, contracts, and third-party continuity arrangements.	Medium
14	Corporate Communications and Stakeholder Management	Coordinating internal communications, regulator liaison, media responses, and crisis communications.	High
15	Business Continuity and Crisis Management	Maintaining BCM governance, incident management, crisis response, recovery coordination, and lessons learned.	Very High

 

Regulatory Alignment for The Saudi Mortgage Guarantees Services Company

As a financial sector organisation operating within the Kingdom of Saudi Arabia, Damanat should ensure that its identification of Critical Business Functions aligns with the expectations of Saudi financial sector regulators and recognised international BCM standards.

Key regulatory considerations include:

• Saudi Central Bank (SAMA): SAMA expects regulated financial sector organisations to establish sound governance, operational resilience, risk management, cybersecurity, and business continuity capabilities. Identifying Critical Business Functions enables organisations to prioritise recovery activities, maintain essential financial services, and minimise disruption to the financial sector.
• SAMA Cybersecurity Framework: Critical Business Functions should be supported by resilient information systems and cybersecurity controls that protect confidentiality, integrity, and availability of critical services while ensuring rapid recovery from cyber incidents.
• National Cybersecurity Authority (NCA): The Essential Cybersecurity Controls (ECC) issued by the NCA require organisations to identify critical business processes, critical information assets, and supporting technologies as part of enterprise resilience and cybersecurity governance.
• ISO 22301 Business Continuity Management Systems: ISO 22301 requires organisations to identify products and services, determine supporting business activities, conduct Business Impact Analysis, and develop continuity strategies based upon business priorities. The proposed CBFs provide the foundation for fulfilling these requirements.
• ISO 31000 Risk Management: Enterprise risk management should complement BCM by identifying threats that may disrupt each Critical Business Function and by supporting informed risk treatment decisions.

By aligning CBF identification with these regulatory and international frameworks, Damanat can strengthen organisational resilience, improve governance, and demonstrate its capability to continue delivering essential mortgage guarantee services during periods of disruption.

 

Summary Table of Proposed Critical Business Functions

 

No.	Critical Business Function	Primary Purpose	Key Stakeholders	Recovery Priority
1	Mortgage Guarantee Origination	Process guarantee applications	Banks, Customers	Very High
2	Guarantee Risk Assessment	Evaluate guarantee eligibility and risk	Credit Teams, Banks	Very High
3	Guarantee Issuance and Administration	Manage active guarantees	Banks, Customers	Very High
4	Claims Assessment and Settlement	Process guarantee claims	Financial Institutions	Very High
5	Financial and Treasury Management	Manage finances and liquidity	Finance, Regulators	High
6	Enterprise Risk Management	Monitor enterprise risks	Executive Management	High
7	Regulatory Compliance and Reporting	Meet regulatory obligations	SAMA, Auditors	High
8	Information Technology Services	Support business systems	All Business Units	Very High
9	Information Security and Cyber Resilience	Protect critical systems and data	Entire Organisation	Very High
10	Customer and Financial Institution Relationship Management	Support customers and participating institutions	Banks, Customers	High
11	Legal and Corporate Governance	Manage legal and governance matters	Board, Regulators	Medium-High
12	Human Resource Management	Maintain workforce capability	Employees	Medium
13	Procurement and Vendor Management	Manage suppliers and outsourcing	Vendors	Medium
14	Corporate Communications and Stakeholder Management	Coordinate communications	Public, Regulators	High
15	Business Continuity and Crisis Management	Coordinate response and recovery	Entire Organisation	Very High

 

Identifying Critical Business Functions is one of the most important activities in establishing an effective Business Continuity Management programme.

For the Saudi Mortgage Guarantees Services Company, these functions define the services that must be protected to ensure operational stability, regulatory compliance, and continued confidence among financial institutions and other stakeholders.

They also provide a structured basis for prioritising recovery efforts, allocating resilience investments, and ensuring that continuity plans focus on the organisation's most essential operations.

The proposed CBFs presented in this chapter should be regarded as a starting point rather than a definitive list.

As Damanat's services, technology landscape, regulatory obligations, and strategic objectives evolve, these functions should be periodically reviewed and validated through Business Impact Analysis, risk assessments, and engagement with business owners.

Maintaining an up-to-date understanding of Critical Business Functions will enable Damanat to strengthen its organisational resilience and sustain the delivery of its essential mortgage guarantee services under a wide range of disruptive conditions.