[BCM] [Damanat] [E1] [C6] Composing BCM Team

Composing BCM Team

 

Introduction

An effective Business Continuity Management (BCM) programme depends not only on documented plans and recovery strategies but also on a clearly defined governance structure supported by competent personnel.

Even the most comprehensive continuity plans cannot be implemented successfully without leadership commitment, well-defined roles and responsibilities, effective coordination, and appropriate decision-making authority.

For The Saudi Mortgage Guarantees Services Company (Damanat), the BCM governance structure should provide strategic oversight, programme coordination, operational ownership, and specialist support across the organisation.

It should also establish accountability for maintaining BCM as an ongoing management programme rather than a one-time implementation project.

The governance structure should be proportionate to the organisation's size, complexity, and operating environment while ensuring that every Critical Business Function (CBF) has appropriate ownership and continuity responsibilities.

It is important to recognise that BCM governance is distinct from Crisis Management governance. The BCM team is responsible for developing, maintaining, exercising, and improving the continuity capability before a disruption occurs.

During a major incident, the Crisis Management Team assumes responsibility for strategic incident management, while the BCM team supports recovery activities and provides continuity expertise.

The proposed team composition presented in this section is indicative and should be reviewed and adapted to reflect Damanat's actual organisational structure, reporting relationships, and management responsibilities.

 

Principles of BCM Governance

The BCM governance structure should be based on the following principles:

Executive Leadership

Senior Management should demonstrate visible commitment to BCM by approving policies, allocating resources, establishing priorities, and reviewing programme performance.

Clear Accountability

Every BCM activity should have an identified owner who is responsible for implementation, maintenance, and continual improvement.

Cross-Functional Participation

Business continuity affects every department. The governance structure should therefore include representatives from both business and support functions.

Risk-Based Decision-Making

Recovery priorities and resource allocation should be guided by business impact, organisational risk, and regulatory obligations rather than organisational hierarchy alone.

Continual Improvement

The governance structure should promote regular reviews, exercises, lessons learned, and programme enhancement.

 

Senior Management

Senior Management provides strategic leadership and organisational sponsorship for the BCM programme.

Primary responsibilities include:

• Approving the BCM Policy.
• Establishing the BCM scope.
• Confirming organisational resilience objectives.
• Allocating financial and human resources.
• Approving recovery priorities.
• Reviewing programme performance.
• Supporting organisational awareness.
• Accepting significant residual continuity risks.
• Promoting a resilience culture throughout Damanat.
• Ensuring BCM remains aligned with strategic objectives.

Senior Management should receive regular reports regarding programme progress, exercise outcomes, major risks, and improvement initiatives.

 

BCM Steering Committee

The BCM Steering Committee provides enterprise oversight of the BCM programme.

The committee should include representatives from major business and support functions to ensure organisation-wide participation.

Key responsibilities include:

• Providing governance oversight.
• Reviewing BCM implementation progress.
• Approving programme priorities.
• Resolving cross-functional issues.
• Challenging planning assumptions.
• Reviewing Business Impact Analysis results.
• Reviewing recovery strategies.
• Monitoring corrective actions.
• Reviewing exercise outcomes.
• Supporting continual improvement initiatives.

The Steering Committee serves as the primary governance forum between Senior Management and the operational BCM implementation team.

 

BCM Programme Manager (or BCM Coordinator)

The BCM Programme Manager is responsible for coordinating the day-to-day implementation and maintenance of the BCM programme.

Typical responsibilities include:

• Managing the overall BCM implementation programme.
• Maintaining the BCM methodology.
• Coordinating Risk Analysis and Review activities.
• Facilitating Business Impact Analysis workshops.
• Consolidating continuity planning documentation.
• Coordinating Business Continuity Plan development.
• Managing document control.
• Organising training and awareness programmes.
• Planning continuity exercises.
• Reporting programme status to Senior Management.
• Monitoring corrective actions.
• Coordinating periodic programme reviews.

The Programme Manager acts as the central coordinator linking business units, specialist functions, and executive management.

 

Critical Business Function (CBF) Owners

Each Critical Business Function should have an assigned owner who is accountable for ensuring the continuity of that function.

Responsibilities include:

• Confirming the scope of the Critical Business Function.
• Identifying business dependencies.
• Validating Business Impact Analysis results.
• Defining recovery priorities.
• Approving continuity strategies.
• Reviewing Business Continuity Plans.
• Participating in exercises.
• Maintaining recovery documentation.
• Reporting significant operational changes affecting continuity.

CBF Owners provide the business expertise required to ensure that continuity arrangements remain practical and aligned with operational requirements.

 

Business Unit Coordinators

Business Unit Coordinators provide departmental support for BCM implementation.

Their responsibilities typically include:

• Collecting Business Impact Analysis information.
• Maintaining departmental continuity plans.
• Updating contact information.
• Coordinating local continuity activities.
• Supporting continuity exercises.
• Maintaining departmental documentation.
• Reporting organisational changes affecting BCM.
• Supporting awareness programmes within their departments.

These coordinators act as the operational link between the BCM Programme Manager and individual business units.

 

Specialist Support Functions

Business Continuity Management depends upon numerous specialist support functions.

ICT and Disaster Recovery

Responsible for:

• ICT recovery planning.
• Infrastructure resilience.
• System restoration.
• Technology recovery testing.
• Backup management.

Cybersecurity

Responsible for:

• Cyber incident preparedness.
• Information protection.
• Identity and access management.
• Security monitoring.
• Cyber resilience.

Facilities Management

Responsible for:

• Building recovery.
• Alternate workplace arrangements.
• Utility coordination.
• Physical infrastructure support.
• Environmental safety.

Human Resources

Responsible for:

• Workforce continuity.
• Staff welfare.
• Emergency communications.
• Succession planning.
• Training coordination.

Finance

Responsible for:

• Emergency funding.
• Insurance coordination.
• Financial reporting.
• Recovery expenditure management.
• Procurement support.

Procurement and Vendor Management

Responsible for:

• Supplier resilience assessments.
• Emergency purchasing.
• Vendor communications.
• Contract continuity provisions.
• Alternative supplier arrangements.

Legal and Compliance

Responsible for:

• Regulatory advice.
• Contractual considerations.
• Legal obligations.
• Regulatory reporting.
• Compliance monitoring.

Corporate Communications

Responsible for:

• Internal communications.
• External communications.
• Media coordination.
• Stakeholder messaging.
• Reputation management.

Security

Responsible for:

• Physical security.
• Access control.
• Incident support.
• Asset protection.
• Emergency coordination.

Records and Information Management

 

Responsible for:

• Vital records protection.
• Information governance.
• Document recovery.
• Records retention.
• Information availability.

Crisis Management Team

Although separate from the BCM governance structure, the Crisis Management Team works closely with the BCM programme during major incidents.

Its responsibilities include:

• Executive decision-making.
• Incident escalation.
• Strategic direction.
• Resource prioritisation.
• Stakeholder engagement.
• Recovery oversight.

 

Table 1.6: Proposed BCM Team Composition

 

BCM Role	Primary Responsibilities	Decision Authority	Required Competencies	Proposed Representation	Alternate Required
Senior Management	Approve BCM policy, strategy, scope and resources	Enterprise-wide	Executive leadership, governance, strategic decision-making	CEO and Executive Management	Yes
BCM Steering Committee	Oversight, programme governance, issue resolution	Programme-level	Governance, risk management, business knowledge	Cross-functional senior representatives	Yes
BCM Programme Manager	Coordinate BCM implementation and maintenance	Operational coordination	BCM methodology, project management, facilitation	Enterprise BCM Office	Yes
Critical Business Function Owners	Define recovery requirements and approve business continuity arrangements	Business function	Operational expertise, decision-making	Business Unit Heads	Yes
Business Unit Coordinators	Maintain departmental BCM information and plans	Departmental	Business knowledge, planning, coordination	Department representatives	Yes
ICT Disaster Recovery Manager	Recover technology services	ICT recovery	ICT infrastructure, disaster recovery	ICT Department	Yes
Cybersecurity Manager	Protect information and cyber resilience	Cybersecurity	Information security, cyber incident management	Information Security Office	Yes
Facilities Manager	Manage alternate facilities and building recovery	Facilities	Property management, workplace recovery	Corporate Services	Yes
Human Resources Manager	Workforce continuity and staff welfare	HR	Workforce planning, employee support	Human Resources	Yes
Finance Manager	Financial support and recovery funding	Finance	Financial management	Finance Department	Yes
Procurement & Vendor Manager	Supplier continuity and emergency procurement	Procurement	Vendor management, contracts	Procurement Department	Yes
Legal & Compliance Manager	Regulatory compliance and legal advice	Legal	Legal, regulatory compliance	Legal & Compliance	Yes
Communications Manager	Internal and external communications	Communications	Crisis communication, media management	Corporate Communications	Yes
Records Manager	Protect vital records and information	Information Governance	Records management	Information Management	Yes
Crisis Management Team Leader	Strategic incident management during crises	Crisis response	Executive leadership, crisis management	Crisis Management Team	Yes

 

Figure 1.1: Indicative BCM Governance Structure

Senior Management
│
│
BCM Steering Committee
│
│
BCM Programme Manager
│
┌──────────────┬──────────────┐
Critical Business Unit Specialist,
Function Owners,  Coordinators, Support Functions
│
┌───────────────┬───────────────┬───────────────┐
ICT & DR Cybersecurity,  Facilities, HR, Finance, Procurement, Legal, Communications, Security, Records Management, Crisis Management

Competency Development

An effective BCM governance structure requires appropriately trained personnel. Damanat should establish a competency framework that identifies the knowledge and skills required for each BCM role. This framework should include:

• Executive awareness for Senior Management.
• BCM methodology training for the BCM Programme Manager and Coordinators.
• Business Impact Analysis and continuity planning workshops for CBF Owners.
• ICT Disaster Recovery training for technology teams.
• Crisis Management exercises for executive leadership.
• Role-specific simulation exercises for all participants.

Competency assessments should be reviewed periodically to ensure that personnel remain capable of fulfilling their continuity responsibilities.

Continual Review of the BCM Team Structure

The BCM governance structure should be reviewed regularly to ensure it remains aligned with organisational changes, strategic priorities, regulatory expectations, and operational risks. Reviews should be triggered by:

• Organisational restructuring.
• Changes to Critical Business Functions.
• Regulatory developments.
• Major technology transformations.
• Significant supplier changes.
• Lessons learned from incidents or exercises.
• Internal and external audit findings.

By maintaining an effective governance structure with clearly defined responsibilities and competent personnel, Damanat can ensure that its BCM programme remains sustainable, coordinated, and capable of supporting the continuity of critical business functions during disruptive events.

 

A well-defined governance structure ensures that Business Continuity Management is supported by clear leadership, accountability, and enterprise-wide coordination.

By assigning responsibilities to Senior Management, the BCM Steering Committee, the BCM Programme Manager, Business Unit Coordinators, Critical Business Function Owners, and specialist support teams, Damanat establishes the organisational capability needed to implement and sustain its BCM programme.

Having established governance, the next step is to examine the environment in which the organisation operates.

Understanding both internal capabilities and external influences enables Damanat to design a BCM programme that reflects its actual operating conditions and evolving business environment.

eBook 1: Understanding Your Organisation
C1	C2	C3	C4	C5	C6
C7	C8	C9	C10	C11	C12

More Information About Business Continuity Management Courses