[BCM] [Damanat] [E2] [C2] Project Management

Project Management Phase for BCM Planning Methodology for The Saudi Mortgage Guarantees Services Company

 

 

The Project Management (PM) phase is the first implementation phase of the Business Continuity Management (BCM) Planning Methodology for The Saudi Mortgage Guarantees Services Company (Damanat). It establishes the governance, scope, responsibilities, resources, work plan and management controls required to implement BCM systematically across the organisation.

For Damanat, successful BCM implementation requires more than assigning responsibility to a Business Continuity Manager and asking individual business functions to prepare Business Continuity Plans.

BCM involves multiple functions and dependencies and therefore requires a formally managed implementation programme with clear executive sponsorship, defined accountability and coordinated participation across the organisation.

The Project Management phase provides this foundation.

It establishes who will govern BCM, what will be included within its scope, who will perform the required activities, what deliverables must be produced, when they must be completed and how progress and issues will be reported to management.

This phase also provides the management structure for the subsequent phases of the BCM Planning Methodology:

Project Management (PM) → Risk Analysis and Review (RAR) → Business Impact Analysis (BIA) → Business Continuity Strategy (BCS) → Plan Development (PD) → Testing and Exercising (TE) → Program Management (PgM).

The Project Management phase should be implemented in a manner consistent with the principles of ISO 22301 and applicable regulatory expectations in Saudi Arabia, particularly those relevant to governance, accountability, business continuity capability and organisational resilience.

 

Purpose of the Project Management Phase

The primary purpose of the PM phase is to establish a controlled environment within which Damanat can develop and implement its BCM capability.

The phase should ensure that BCM implementation is:

• formally authorised by management;
• aligned with organisational objectives;
• appropriately scoped;
• supported by adequate resources;
• assigned to accountable owners;
• implemented according to an agreed schedule;
• coordinated across business and support functions;
• documented consistently;
• monitored against agreed milestones; and
• escalated to management when significant issues arise.

Project Management therefore acts as the implementation control mechanism for BCM.

Without effective project management, individual BCM activities may still be completed, but they can become fragmented.

Different functions may apply inconsistent assumptions, recovery terminology or assessment criteria. Dependencies may be overlooked, deliverables may not receive appropriate approval, and recovery requirements may conflict.

For Damanat, the PM phase should establish one common BCM implementation framework.

BCM implementation should begin with a formal mandate from Damanat's management.

The mandate provides organisational authority for the project and establishes BCM as an enterprise requirement rather than an optional activity undertaken independently by individual departments.

The mandate should define:

• the purpose of the BCM initiative;
• expected organisational outcomes;
• executive sponsorship;
• governance arrangements;
• project scope;
• key responsibilities;
• required participation;
• reporting requirements; and
• management expectations.

Example for Damanat

A project mandate could state:

Damanat will establish and maintain an enterprise Business Continuity Management capability to ensure that priority business activities supporting mortgage guarantee services and associated obligations can continue or be recovered within approved timeframes following a disruptive incident.

The mandate should also require relevant business and support functions to participate in risk assessments, BIAs, strategy development, plan preparation, exercises and subsequent maintenance activities.

 

Defining the BCM Project Objectives

The BCM project should have clear and measurable objectives.

For Damanat, these could include:

1. Establishing a formal BCM governance and management structure.
2. Identifying business functions within the BCM scope.
3. Identifying disruption threats and vulnerabilities.
4. Determining the business impacts arising from prolonged interruption.
5. Establishing recovery priorities and recovery objectives.
6. Identifying dependencies and minimum recovery resource requirements.
7. Developing appropriate continuity and recovery strategies.
8. Preparing Business Continuity Plans for relevant business functions.
9. Establishing escalation, notification and activation procedures.
10. Conducting exercises to validate the BCM capability.
11. Identifying and remediating BCM capability gaps.
12. Establishing an ongoing BCM maintenance and improvement programme.

These objectives provide the basis for measuring project progress and determining whether implementation has achieved its intended outcomes.

 

Defining the BCM Scope

One of the most important Project Management activities is defining the scope of the BCM programme.

The scope determines which organisational activities, locations, resources, technologies, suppliers and dependencies will be examined.

For Damanat, scope determination should consider:

• mortgage guarantee operations;
• guarantee application processing;
• assessment and approval activities;
• guarantee issuance;
• guarantee administration;
• claims-related activities;
• financial operations;
• customer and financial-institution interactions;
• regulatory and statutory obligations;
• information technology;
• cybersecurity dependencies;
• data and records;
• premises and facilities;
• employees and specialist personnel;
• telecommunications;
• third-party service providers; and
• external stakeholders and infrastructure dependencies.

The scope should also identify exclusions. Any material exclusion should be documented, along with its rationale, and approved through the appropriate governance process.

 

Establishing BCM Governance

Effective governance ensures that BCM has appropriate authority, accountability and management oversight.

Damanat should establish a governance structure that connects senior management, the BCM function, business functions and supporting functions.

A practical governance structure could include:

 

BCM Role	Primary Responsibility
Board / Senior Management	Provide oversight and ensure BCM supports organisational and regulatory requirements
Executive Sponsor	Champion BCM and resolve significant organisational or resource issues
BCM Steering Committee	Provide governance, review progress and approve major BCM decisions
BCM Manager / BCM Function	Coordinate implementation and maintain the BCM methodology
Business Function Heads	Own continuity requirements and plans for their functions
BCM Coordinators	Coordinate BCM activities within individual functions
IT / Technology Representatives	Establish technology resilience and recovery requirements
Risk and Compliance	Support risk, regulatory and assurance alignment
HR	Support workforce continuity and personnel arrangements
Facilities / Administration	Support premises and physical-resource continuity
Procurement / Third-Party Management	Address critical supplier and service-provider dependencies
Communications	Support internal and external communications arrangements

Governance should establish clear decision-making and escalation pathways rather than merely identifying participants.

 

Roles and Responsibilities

BCM responsibilities should be formally assigned.

Senior Management

Senior management should provide direction, approve significant BCM requirements, ensure adequate resources are available and review the organisation's BCM capability.

BCM Manager

The BCM Manager should coordinate the implementation programme, establish methodologies and templates, facilitate assessments, monitor deliverables and report implementation status.

Business Function Heads

Business Function Heads should remain accountable for continuity within their respective operations.

BCM should not become solely the responsibility of the BCM Manager.

BCM Coordinators

BCM Coordinators act as the operational link between the central BCM function and individual business functions.

Their responsibilities may include:

• coordinating RAR and BIA workshops;
• gathering information;
• identifying dependencies;
• documenting recovery requirements;
• maintaining Business Continuity Plans;
• supporting exercises; and
• tracking corrective actions.

 

Identifying BCM Stakeholders

 

The BCM project should identify stakeholders who may influence, participate in or depend upon Damanat's continuity arrangements.

Stakeholders may be internal or external.

Internal stakeholders may include:

• senior management;
• business-function owners;
• operational employees;
• technology teams;
• risk management;
• compliance;
• legal;
• human resources;
• finance;
• facilities;
• procurement;
• information security; and
• corporate communications.

External stakeholders may include:

• participating financial institutions;
• technology and telecommunications providers;
• outsourced service providers;
• professional advisers;
• government agencies;
• regulators; and
• other organisations supporting mortgage guarantee operations.

 

Stakeholder identification is particularly important because some recovery solutions may depend upon parties outside Damanat's direct operational control.

 

Identifying Damanat's Critical Business Functions

The Project Management phase should establish the process through which Damanat's business functions will be identified and subsequently assessed.

At this stage, the purpose is not yet to determine final recovery priorities. That will be undertaken through the BIA.

Instead, Damanat should establish a sufficiently complete catalogue of business functions to ensure that relevant activities are included within the BCM assessment.

For example, a business function associated with Mortgage Guarantee Origination could contain activities such as:

Application Intake → Application Validation → Borrower Eligibility Assessment → Property Eligibility Assessment → Mortgage Risk Assessment → Policy Compliance Review → Financial Institution Verification → Guarantee Approval → Guarantee Certificate Generation → Guarantee Registration → Stakeholder Notification.

This process view becomes important during subsequent phases because interruption at one activity may prevent completion of downstream activities even when those downstream systems and resources remain available.

 

Establishing the BCM Work Plan

A formal work plan should translate the BCM methodology into manageable implementation activities.

An illustrative project plan for Damanat could include:

 

Workstream	Key Deliverable
PM	BCM project charter and implementation plan
PM	BCM governance and team structure
PM	Scope and stakeholder register
RAR	Threat and Risk Register
BIA	Business Impact Analysis reports
BIA	Recovery objectives and resource requirements
BCS	Business Continuity Strategy
PD	Business Continuity Plans
TE	Exercise programme and exercise reports
TE	Corrective-action register
PgM	BCM maintenance programme
PgM	Training and awareness programme
PgM	BCM performance and management reporting

Each deliverable should have an owner, target completion date, review requirement and approval authority.

 

Establishing BCM Documentation and Templates

Consistency is essential when multiple business functions participate in BCM implementation.

Damanat should therefore establish standard templates before commencing detailed assessment activities.

These may include:

• Project Charter;
• BCM Scope Document;
• BCM Organisation Chart;
• Responsibility Assignment Matrix;
• Stakeholder Register;
• RAR questionnaire;
• Threat Register;
• BIA questionnaire;
• BIA report;
• dependency mapping template;
• Business Continuity Strategy template;
• Business Continuity Plan template;
• exercise plan;
• exercise evaluation report;
• corrective-action register; and
• BCM management report.

Standardisation allows information from different functions to be compared, consolidated and reviewed using consistent criteria.

 

Project Schedule and Milestones

The implementation schedule should establish realistic milestones.

An example sequence could be:

 

Stage	Illustrative Milestone
1	BCM project approved
2	Governance and project team established
3	BCM scope confirmed
4	RAR workshops completed
5	BIA workshops completed
6	Recovery requirements approved
7	Continuity strategies developed
8	Strategies approved
9	Business Continuity Plans completed
10	Training conducted
11	Exercises completed
12	Corrective actions identified
13	Management review completed
14	BCM transferred into ongoing Program Management

 

The schedule should recognise dependencies between activities.

For example, detailed continuity strategies should not be finalised before the recovery requirements arising from the BIA are sufficiently understood.

 

Resource Planning

BCM implementation requires appropriate resources.

Damanat should determine the personnel, budget, technology, specialist support and management time required to complete the project.

Resource planning should consider:

People

Availability of business representatives, BCM specialists, IT specialists and management reviewers.

Time

Workshops, interviews, documentation, validation, training and exercises require participation from employees who also have operational responsibilities.

Technology

BCM tools, emergency communications capabilities, document repositories and recovery technology may require investment.

External Expertise

Specialist assistance may be required for particular technical assessments, exercises, audits or independent reviews.

Resource constraints that could affect BCM implementation should be identified early and escalated through the governance structure.

 

Managing BCM Project Risks

The BCM implementation project itself can face risks.

Examples include:

• insufficient management participation;
• unclear accountability;
• incomplete business information;
• unavailable subject-matter experts;
• conflicting priorities;
• delayed approvals;
• inadequate budget;
• inconsistent assessment methods;
• organisational changes during implementation;
• technology transformation;
• dependency on external suppliers; and
• insufficient participation in exercises.

 

A BCM Project Risk and Issue Register should therefore be maintained.

Each significant issue should have:

Issue → Impact → Owner → Required Action → Target Date → Status → Escalation Requirement

This prevents implementation problems from remaining unresolved until the later stages of the BCM programme.

 

Communication and Reporting

Regular communication helps maintain organisational participation.

The BCM Manager should establish a reporting cycle covering:

• project progress;
• completed activities;
• upcoming milestones;
• outstanding information;
• overdue deliverables;
• resource constraints;
• significant risks;
• decisions required;
• issues requiring escalation; and
• overall implementation status.

For example

Damanat's BCM Steering Committee could receive a dashboard showing:

RAR: 100% Complete

BIA: 80% Complete

BCS: 40% Complete

BCP Development: 20% Complete

Testing: Not Started

 

The purpose of the dashboard is not merely to report percentages. It should highlight decisions and obstacles requiring management intervention.

 

Regulatory Alignment for Damanat

As a Saudi financial-sector organisation, Damanat should ensure that the Project Management phase reflects applicable regulatory requirements and supervisory expectations.

Particular attention should be given to requirements associated with:

• BCM governance;
• senior management oversight;
• defined responsibilities;
• business impact assessment;
• risk assessment;
• recovery requirements;
• continuity and disaster-recovery planning;
• third-party dependencies;
• testing and exercising;
• awareness and competency;
• documentation;
• periodic review; and
• independent assurance.

Regulatory requirements should therefore be incorporated into the BCM project requirements from the beginning rather than assessed only after Business Continuity Plans have been completed.

Damanat should maintain a BCM Regulatory Requirements Register mapping relevant requirements to BCM activities, deliverables, responsible owners and supporting evidence.

An illustrative structure is:

 

Requirement	BCM Phase	Damanat Evidence
BCM governance	PM / PgM	Governance structure and committee records
Risk assessment	RAR	Threat and Risk Register
Business impact assessment	BIA	Approved BIA
Recovery requirements	BIA / BCS	RTO, RPO, MBCO and strategy documentation
Continuity arrangements	BCS / PD	Approved strategies and BCPs
Testing	TE	Exercise plans and reports
Corrective actions	TE / PgM	Improvement register
Management oversight	PM / PgM	Management reports and review records

This provides traceability between regulatory expectations and Damanat's BCM implementation evidence.

 

Example: Applying Project Management to Mortgage Guarantee Origination

Consider a BCM project covering Damanat's Mortgage Guarantee Origination function.

Rather than immediately preparing a BCP, the Project Management phase would first establish:

Step 1 – Scope

Determine which mortgage guarantee origination activities are included.

Step 2 – Ownership

Appoint the business-function owner and BCM Coordinator.

Step 3 – Participants

Identify representatives from operations, technology, risk, compliance and other supporting functions.

Step 4 – Dependencies

Identify relevant financial institutions, systems, data, personnel, premises and third parties that must be assessed.

Step 5 – Deliverables

Specify that the function must complete RAR, BIA, strategy and BCP documentation.

Step 6 – Schedule

Establish workshop, review and approval dates.

Step 7 – Governance

Define who reviews recovery requirements and who approves the resulting strategy.

Step 8 – Validation

Schedule an exercise after the BCP has been developed.

This demonstrates why Project Management precedes the technical BCM phases. It establishes the conditions necessary for those phases to be completed consistently and accountably.

 

Project Management Phase Deliverables

At the conclusion of the PM phase, Damanat should have established, at minimum:

No.	Deliverable	Purpose
PM-01	BCM Project Charter	Formally authorises the implementation
PM-02	BCM Scope	Defines organisational coverage
PM-03	BCM Governance Structure	Establishes oversight and decision-making
PM-04	Roles and Responsibilities	Defines accountability
PM-05	BCM Team and Coordinator Register	Identifies implementation participants
PM-06	Stakeholder Register	Identifies internal and external stakeholders
PM-07	BCM Implementation Plan	Defines activities and milestones
PM-08	Project Risk and Issue Register	Controls implementation risks
PM-09	Communication and Reporting Plan	Establishes reporting arrangements
PM-10	BCM Templates and Methodology	Ensures consistency
PM-11	Regulatory Requirements Register	Maps obligations to implementation evidence
PM-12	Project Status Reporting	Provides management visibility

These deliverables form the foundation for the next phase of the BCM Planning Methodology.

 

Completion Criteria for the PM Phase

Damanat should not consider the Project Management phase complete simply because a project meeting has been held or a project plan has been produced.

The phase should be considered sufficiently established when:

• executive sponsorship has been confirmed;
• BCM governance has been approved;
• scope has been documented;
• roles and responsibilities have been assigned;
• participating business functions have been identified;
• BCM Coordinators have been appointed;
• stakeholders have been identified;
• implementation methodology has been agreed;
• standard templates are available;
• project milestones have been established;
• resources have been allocated;
• project risks and issues are being tracked;
• regulatory requirements have been considered; and
• management reporting arrangements are operating.

The BCM project can then move systematically into detailed Risk Analysis and Review.