[BCM] [Damanat] [E1] [C5] Determining BC Assumptions

Determining BC Assumptions

 

Introduction

Business Continuity Management (BCM) planning is based on a series of assumptions regarding how the organisation, its people, technology, facilities, suppliers, and external environment are expected to behave during a disruptive incident.

Because it is impossible to predict every circumstance surrounding a future disruption, planners must make reasonable assumptions to enable the development of practical and achievable continuity strategies.

For The Saudi Mortgage Guarantees Services Company (Damanat), planning assumptions provide the foundation upon which recovery strategies, Business Continuity Plans (BCPs), resource requirements, and testing scenarios are developed.

These assumptions establish the operating conditions that planners expect to exist during an incident and enable the organisation to prepare realistic response and recovery arrangements.

However, assumptions are not facts. They represent informed expectations based on current organisational knowledge, operating practices, technology capabilities, contractual arrangements, regulatory obligations, and recognised BCM good practices.

As organisational conditions evolve, assumptions should be reviewed, validated, tested, and revised to ensure they remain appropriate.

Planning assumptions should therefore be:

• Clearly documented.
• Reasonable and evidence-based.
• Reviewed by relevant business owners.
• Formally approved by management.
• Tested through exercises and simulations.
• Updated whenever significant organisational or environmental changes occur.

Failure to validate planning assumptions may result in unrealistic recovery strategies, inadequate resource allocation, ineffective response procedures, and prolonged service disruption.

 

Categories of Planning Assumptions

To ensure comprehensive BCM planning, assumptions should be considered across six principal categories:

• People
• Premises
• Technology
• Information
• Third Parties
• Disruption Conditions

Each category addresses different aspects of organisational resilience and collectively supports the development of realistic continuity arrangements.

 

People Assumptions

People are the most important resource during any disruption. Damanat's ability to maintain mortgage guarantee services depends upon the availability, competence, and wellbeing of its personnel.

Indicative planning assumptions include:

• Key employees will remain available unless directly affected by the incident.
• Delegated authority arrangements exist for critical decision-making roles.
• Alternate personnel can perform essential business activities following appropriate cross-training.
• Remote working capability is available for designated business functions where appropriate.
• Emergency contact information is current and accessible.
• Staff welfare arrangements will be activated during prolonged disruptions.
• Human Resources will coordinate workforce accountability and employee communications.
• Specialist expertise may be limited during major regional incidents and should therefore be supported through succession planning.

These assumptions should be validated through workforce planning, training programmes, and continuity exercises.

 

Premises Assumptions

Although Damanat may operate from primary office facilities, BCM planning should assume that access to those facilities may be partially or completely unavailable.

Indicative assumptions include:

• The primary office may become inaccessible without prior warning.
• Alternative workspace arrangements can be activated if required.
• Secure physical access controls remain available at alternate locations.
• Essential utilities such as electricity, water, and telecommunications may experience temporary disruption.
• Facilities management personnel can support building recovery activities.
• Emergency evacuation procedures remain operational.
• Physical security controls continue to protect critical assets and information.

These assumptions should be periodically tested through workplace recovery exercises.

 

Technology Assumptions

Technology enables nearly every aspect of Damanat's business operations. Consequently, BCM planning must consider the availability and recoverability of ICT services.

Indicative assumptions include:

• Critical business applications can be restored using documented ICT Disaster Recovery procedures.
• Secure network connectivity will be available from alternate work locations.
• Backup systems are operational and recoverable.
• Cybersecurity controls remain effective throughout the recovery process.
• End-user devices can be deployed or replaced within acceptable operational timeframes.
• Identity and access management services remain available for authorised personnel.
• Cloud-based services will continue to operate in accordance with contractual service levels.
• Technology recovery priorities are aligned with business recovery priorities identified during the Business Impact Analysis.

Technology assumptions should be validated jointly by ICT Operations, Cybersecurity, and Business Unit representatives.

 

Information Assumptions

Business continuity depends upon timely access to accurate and reliable information.

Indicative assumptions include:

• Vital records have been identified and appropriately protected.
• Electronic information is backed up regularly.
• Data integrity can be verified following restoration.
• Confidential information remains protected during manual and alternate processing.
• Essential business documentation is available in both electronic and, where appropriate, alternative formats.
• Regulatory records remain accessible during disruption.
• Manual forms and procedures are available should automated systems become unavailable.

Testing should verify both the availability and integrity of recovered information.

 

Third-Party Assumptions

Damanat relies upon numerous external organisations to support its operations. BCM planning therefore assumes a minimum level of continuity capability among these providers.

Indicative assumptions include:

• Critical suppliers maintain appropriate business continuity arrangements.
• Telecommunications providers restore priority services within agreed service levels.
• Cloud service providers maintain resilient infrastructure.
• Outsourced service providers communicate significant disruptions promptly.
• Financial institutions maintain operational interfaces required for guarantee processing.
• Government agencies continue to provide essential regulatory support where practicable.
• Contractual arrangements include appropriate service continuity provisions.

These assumptions should be validated through supplier due diligence, contractual reviews, and resilience assessments.

 

Disruption Scenario Assumptions

BCM planning should consider a range of disruptive conditions rather than focusing on a single event.

Indicative assumptions include:

• Disruptions may affect multiple business functions simultaneously.
• Recovery activities may extend over several days or weeks.
• Transport disruptions may limit employee access to offices.
• Workforce availability may be significantly reduced.
• Supply chain interruptions may delay replacement equipment and specialist support.
• Public utilities may experience extended outages.
• Communication networks may operate at reduced capacity.
• Multiple concurrent incidents may occur during regional emergencies.

These assumptions should be incorporated into scenario testing and crisis exercises to evaluate the organisation's resilience under realistic operating conditions.

 

Managing Planning Assumptions

Planning assumptions should not remain static throughout the BCM lifecycle. Instead, Damanat should establish a structured process for regularly reviewing and validating assumptions.

Typical validation activities include:

• Annual management reviews.
• Business Impact Analysis workshops.
• Risk Analysis and Review updates.
• Business Continuity exercises.
• ICT Disaster Recovery tests.
• Internal audits.
• Supplier resilience assessments.
• Regulatory reviews.
• Lessons learned from actual incidents.

Where assumptions prove to be inaccurate, continuity strategies and recovery plans should be updated accordingly to maintain programme effectiveness.

 

Table 1.5: Indicative Business Continuity Planning Assumptions

Assumption Code	Planning Assumption	Rationale	Risk if Incorrect	Validation Owner	Test or Review Method
BA-01	Key personnel or trained alternates will be available to perform critical functions.	Ensures continuity of essential operations.	Recovery delays due to insufficient staffing.	Human Resources & Business Unit Heads	Workforce continuity exercise and annual review
BA-02	Alternative work arrangements can be activated if primary premises become unavailable.	Supports continuity during facility disruption.	Inability to resume operations promptly.	Facilities Management	Workplace recovery exercise
BA-03	Critical ICT systems and infrastructure can be restored using ICT Disaster Recovery procedures.	Enables recovery of technology-dependent services.	Extended service outage.	Chief Information Officer	ICT Disaster Recovery testing
BA-04	Secure network connectivity and remote access will be available to authorised personnel.	Supports remote operations during disruption.	Reduced productivity and delayed recovery.	ICT Operations	Remote access testing
BA-05	Vital records and critical business information are protected and recoverable.	Preserves operational capability and compliance.	Loss of critical information and regulatory exposure.	Records Management & Information Security	Backup restoration and data integrity testing
BA-06	Cybersecurity controls remain effective throughout response and recovery activities.	Protects systems and information during disruption.	Cyber compromise during recovery.	Cybersecurity Manager	Cyber resilience exercises
BA-07	Critical suppliers and service providers maintain appropriate continuity capabilities.	Supports continuity of dependent services.	Supplier failure affects business operations.	Procurement & Vendor Management	Supplier assurance reviews
BA-08	Government agencies and financial institutions remain available for essential coordination where practicable.	Supports regulatory and operational continuity.	Delays in decision-making and service delivery.	Executive Management	Inter-agency coordination exercises
BA-09	Disruptions may affect multiple business functions simultaneously.	Supports realistic planning assumptions.	Recovery strategies become inadequate.	BCM Steering Committee	Multi-scenario exercise
BA-10	BCM assumptions will be reviewed, validated, and updated regularly.	Ensures assumptions remain relevant.	Continuity plans become outdated.	BCM Programme Manager	Annual BCM management review

 

Business Continuity planning assumptions provide the essential bridge between organisational understanding and practical implementation.

They establish the expected operating conditions that shape recovery strategies, Business Impact Analysis, continuity plans, resource requirements, and testing activities.

For Damanat, planning assumptions should never be regarded as permanent truths.

They are indicative planning inputs that require continuous validation through management review, operational experience, testing, supplier engagement, and organisational change management.

By maintaining accurate and well-governed planning assumptions, Damanat can develop Business Continuity strategies that are realistic, resilient, and aligned with its operational and regulatory responsibilities.

eBook 1: Understanding Your Organisation
C1	C2	C3	C4	C5	C6
C7	C8	C9	C10	C11	C12

More Information About Business Continuity Management Courses