[BCM] [Damanat] [E2] [C9] Summary

Purpose of the BCM Planning Methodology

The purpose of the BCM Planning Methodology is to provide Damanat with a repeatable, structured approach to developing organisational continuity capability.

The methodology enables Damanat to answer seven fundamental questions.

BCM Phase	Fundamental Question
Project Management	How should BCM implementation be organised and governed?
Risk Analysis and Review	What could disrupt Damanat?
Business Impact Analysis	What would be the consequences and what must be recovered first?
Business Continuity Strategy	How will Damanat prevent, mitigate and recover from disruption?
Plan Development	What actions must be taken when disruption occurs?
Testing and Exercising	Can Damanat actually execute its recovery arrangements?
Program Management	How will Damanat maintain and continually improve its BCM capability?

Each question represents an important component of organisational preparedness.

No single phase is sufficient by itself.

A BIA without recovery strategies identifies requirements but does not provide solutions.

A strategy without a BCP identifies the solution but does not tell employees how to execute it.

A BCP without exercising provides documentation but limited assurance that the arrangements will work.

Testing without Program Management may demonstrate capability at one point in time but does not ensure that the capability remains effective.

The seven phases must therefore operate as an integrated lifecycle.

 

The Seven-Phase BCM Planning Methodology

The complete methodology for Damanat can be represented as:

Phase 1: PM – Project Management

↓

Phase 2: RAR – Risk Analysis and Review

↓

Phase 3: BIA – Business Impact Analysis

↓

Phase 4: BCS – Business Continuity Strategy

↓

Phase 5: PD – Plan Development

↓

Phase 6: TE – Testing and Exercising

↓

Phase 7: PgM – Program Management

↓

Continual Improvement

Each phase produces outputs that become inputs into subsequent phases.

This traceability is fundamental to effective BCM implementation.

 

Phase 1 — Project Management

The Project Management phase establishes the foundation for implementing BCM within Damanat.

Before conducting detailed risk assessments, BIAs or developing plans, Damanat must determine how the BCM implementation will be organised.

The phase establishes:

• executive sponsorship;
• project objectives;
• BCM scope;
• governance;
• roles and responsibilities;
• BCM team structure;
• Business Unit BCM Coordinators;
• project schedule;
• resources;
• documentation requirements;
• reporting arrangements; and
• implementation milestones.

For Damanat, Project Management ensures that BCM is implemented consistently across relevant business and support functions, rather than through separate, disconnected departmental initiatives.

Example for Damanat

For a function such as Mortgage Guarantee Origination, Project Management establishes who owns the continuity requirements, who participates in the BIA, who provides technology information, who validates dependencies and who ultimately approves the BCP.

The primary question answered by this phase is:

“How will Damanat organise and manage its BCM implementation?”

The principal output is a formally established and governed BCM implementation program.

 

Phase 2 — Risk Analysis and Review

The Risk Analysis and Review phase identifies the threats, vulnerabilities, and single points of failure that could disrupt Damanat's operations.

The methodology involves four principal steps:

Identify Risks → Assess Risks → Mitigate Risks → Continuously Review Risks

Threats should be considered across:

• people;
• processes;
• technology;
• premises;
• information;
• suppliers; and
• external dependencies.

Potential threats to Damanat may include:

• critical application failure;
• cyberattack;
• data corruption;
• telecommunications outage;
• workplace loss;
• critical personnel unavailability;
• third-party service-provider failure;
• external interface failure; and
• infrastructure disruption.

Example for Damanat

A prolonged outage affecting Damanat's mortgage guarantee processing platform could prevent application intake, eligibility assessment, mortgage risk assessment, approval and guarantee issuance.

The RAR examines:

Threat → Vulnerability → Existing Controls → Likelihood → Impact → Residual Risk → Treatment

The primary question answered by this phase is:

“What could disrupt Damanat and what should be done to reduce the risk?”

The principal outputs are Damanat's Threat and Risk Register and the associated Risk Treatment Plan.

 

Phase 3 — Business Impact Analysis

While RAR examines the causes of disruption, the Business Impact Analysis examines the consequences.

The BIA identifies Damanat's priority activities and determines how the impact of interruption increases over time.

Impact considerations may include:

• financial impact;
• operational impact;
• regulatory impact;
• legal impact;
• stakeholder impact;
• reputational impact; and
• strategic impact.

The BIA also establishes recovery requirements such as:

• Maximum Acceptable Outage (MAO);
• Recovery Time Objective (RTO);
• Recovery Point Objective (RPO);
• Minimum Business Continuity Objective (MBCO);
• minimum staffing;
• technology requirements;
• information requirements;
• premises requirements; and
• internal and external dependencies.

Example for Damanat

If Mortgage Guarantee Origination cannot operate, Damanat should determine:

• how quickly significant impact develops;
• when the disruption becomes unacceptable;
• which activities require priority recovery;
• what minimum processing capacity must be maintained;
• which employees are essential;
• which applications must be available; and
• which participating financial institutions or suppliers are critical dependencies.

The primary question answered by this phase is:

“If disruption occurs, what must Damanat recover, by when and with what resources?”

The principal outputs are the Business Impact Analysis Report and the approved recovery requirements.

 

Phase 4 — Business Continuity Strategy

Once Damanat understands its disruption risks and recovery requirements, it must determine how to meet those requirements.

The Business Continuity Strategy phase develops solutions across three complementary dimensions:

Prevention

Reduce the likelihood of disruption.

Mitigation

Reduce the consequences when disruption occurs.

Recovery

Restore affected activities within approved recovery objectives.

Strategies should consider:

People + Processes + Technology + Information + Premises + Suppliers + Communications + External Dependencies

Example for Damanat

For Mortgage Guarantee Origination, possible strategies could include:

• cross-trained employees;
• alternative approval authorities;
• remote working;
• resilient technology;
• disaster recovery;
• alternative communication channels;
• manual processing procedures;
• data recovery;
• alternative supplier arrangements; and
• alternative interfaces with participating financial institutions.

The primary question answered by this phase is:

“How will Damanat maintain or recover priority business activities?”

The principal outputs are the approved Business Continuity Strategy and the Strategy Implementation Plan.

 

Phase 5 — Plan Development

The Plan Development phase converts approved continuity strategies into actionable Business Continuity Plans.

The process consists of three principal stages.

Stage 1 — Determine the Organisation of the BCP

Damanat establishes:

• the standard BCP template; and
• the recovery organisation.

Stage 2 — Conduct BCP Writing Workshops

Business Unit BCM Coordinators are guided through completion of their plans using the results from the RAR, BIA and BCS phases.

Stage 3 — Finalise and Validate the BCP

Plans are reviewed by:

• Business Unit BCM Coordinators;
• Heads of Business Units;
• the central BCM function; and
• relevant supporting functions.

The resulting BCP should provide practical guidance covering:

Detection → Escalation → Activation → Notification → Mobilisation → Continuity → Recovery → Stabilisation → Return to Normal

Example for Damanat

If the primary Mortgage Guarantee Origination platform becomes unavailable, the BCP should identify:

1. who confirms the disruption;
2. who receives notification;
3. who decides whether to activate the BCP;
4. which applications are prioritised;
5. which temporary processing procedures are used;
6. how participating financial institutions are informed;
7. how technology recovery is coordinated;
8. how transactions are reconciled; and
9. how normal processing resumes.

The primary question answered by this phase is:

“Exactly what will Damanat do when disruption occurs?”

The principal output is a set of approved and controlled Business Continuity Plans.

 

Phase 6 — Testing and Exercising

Having a Business Continuity Plan does not guarantee it will work.

The Testing and Exercising phase validates Damanat's continuity capability.

The methodology uses a progressive exercise model.

Initial Tests

Component Tests

Validate individual recovery capabilities.

Call Notification Tests

Validate communication and mobilisation arrangements.

Walkthrough Exercises

Validate understanding of plans and procedures.

Advanced Tests

Integrated Tests

Validate multiple interconnected recovery capabilities.

Simulation Tests

Validate response and decision-making under realistic disruption conditions.

Live Tests

Physically activate selected recovery arrangements under controlled conditions.

The progression is:

Component → Call Notification → Walkthrough → Integrated → Simulation → Live

Example for Damanat

A simulation could involve a cyberattack affecting the mortgage guarantee processing platform.

The exercise might require Damanat to:

• assess the disruption;
• activate BCPs;
• escalate to senior management;
• invoke temporary processing arrangements;
• coordinate technology recovery;
• communicate with participating financial institutions;
• manage a supplier failure;
• restore systems; and
• reconcile transactions.

The primary question answered by this phase is:

“Can Damanat actually execute its plans and achieve its recovery requirements?”

The principal outputs are exercise reports, lessons learned, corrective actions and evidence of validated recovery capability.

 

Phase 7 — Program Management

The Program Management phase ensures that Damanat's BCM capability remains current and effective after initial implementation.

BCM cannot be treated as a one-time project because Damanat's organisation will continue to change.

Program Management therefore addresses:

• BCM governance;
• policy maintenance;
• RAR review;
• BIA review;
• strategy maintenance;
• BCP maintenance;
• exercise management;
• training;
• awareness;
• third-party continuity;
• corrective-action management;
• performance measurement;
• assurance;
• management review; and
• continual improvement.

Example for Damanat

Suppose Damanat implements a new mortgage guarantee processing platform.

Program Management should trigger consideration of:

RAR → BIA → Technology Dependency → Recovery Strategy → BCP → DR Procedures → Exercise

The change is therefore assessed throughout the BCM lifecycle rather than merely recorded as an IT change.

The primary question answered by this phase is:

“How will Damanat keep its BCM capability effective as the organisation changes?”

The principal outcome is an ongoing and continually improving BCM program.

 

How the Seven Phases Work Together

The strength of the BCM Planning Methodology lies in the relationships among the phases.

Consider a technology disruption affecting Mortgage Guarantee Origination.

RAR

Identifies failure of the mortgage guarantee processing platform as a credible threat.

↓

BIA

Determines that Mortgage Guarantee Origination must recover within its approved RTO and identifies the minimum resources required.

↓

BCS

Establishes resilient technology, disaster recovery and temporary processing arrangements.

↓

PD

Documents how those arrangements will be activated.

↓

TE

Tests whether the processing capability can actually recover within the required timeframe.

↓

PgM

Ensures that exercise findings are corrected and that the capability remains current.

This provides end-to-end traceability:

Threat → Impact → Recovery Requirement → Strategy → Procedure → Exercise → Improvement

That traceability is one of the most important outcomes of a structured BCM methodology.

 

BCM Deliverables Across the Methodology

The seven phases collectively create an integrated set of BCM deliverables.

Phase	Principal Deliverables
PM	Project Charter, Scope, Governance, BCM Team, Implementation Plan
RAR	Threat Register, Risk Assessment, SPOF Register, Risk Treatment Plan
BIA	BIA Report, Recovery Priorities, RTO, RPO, MBCO, Dependency Requirements
BCS	Continuity Strategies, Strategy Options, Gap Analysis, Implementation Plan
PD	BCP Template, Recovery Organisation, Business Unit BCPs, Recovery Procedures
TE	Exercise Program, Exercise Reports, Lessons Learned, Corrective Actions
PgM	Maintenance Program, Training, Awareness, Performance Reporting, Assurance, Management Review

These should not be managed as independent documents.

Together they form Damanat's BCM evidence framework.

 

From Documentation to Capability

An important theme throughout this eBook is the distinction between BCM documentation and BCM capability.

An organisation may have:

• a BCM Policy;
• a BIA;
• a Risk Register;
• a Business Continuity Strategy;
• multiple Business Continuity Plans; and
• an exercise schedule.

These documents alone do not demonstrate resilience.

Damanat should be able to demonstrate that:

• employees understand their responsibilities;
• plans contain current information;
• recovery resources exist;
• alternative workplaces are usable;
• technology can recover;
• critical data can be restored;
• suppliers can support required recovery;
• external communication arrangements function;
• recovery objectives can be achieved; and
• deficiencies are corrected.

The progression should therefore be:

Documented → Implemented → Exercised → Demonstrated → Maintained → Improved

This represents the transition from BCM compliance to BCM capability.

 

Applying the Methodology to Damanat's Critical Business Functions

The seven-phase methodology should ultimately be applied to each relevant Critical Business Function.

For example, consider Mortgage Guarantee Origination.

Project Management

Identify the owner, scope, participants and implementation responsibilities.

Risk Analysis and Review

Identify disruption threats affecting application intake, assessment, approval and issuance.

Business Impact Analysis

Determine the consequences of disruption and establish recovery requirements.

Business Continuity Strategy

Develop people, technology, workplace, information and supplier recovery solutions.

Plan Development

Document activation and recovery procedures.

Testing and Exercising

Validate whether Mortgage Guarantee Origination can operate through the approved continuity arrangements.

Program Management

Maintain the BIA, strategy, plan, training and testing as the business environment changes.

The same logic should be progressively applied to other Damanat Critical Business Functions.

 

Specific Considerations for Damanat

Damanat's BCM program should reflect its role within Saudi Arabia's financial and mortgage guarantee ecosystem.

Particular attention should therefore be given to dependencies involving:

• participating financial institutions;
• mortgage guarantee processing;
• technology platforms;
• critical data;
• authorised decision-makers;
• financial operations;
• telecommunications;
• outsourced technology providers;
• external service providers;
• regulatory obligations; and
• specialist personnel.

The loss of one dependency may have consequences across several business activities.

For example:

External Interface Failure

→ Application Intake Interrupted

→ Assessments Delayed

→ Approvals Delayed

→ Guarantee Issuance Delayed

Similarly:

Critical Database Failure

→ Application Information Unavailable

→ Assessment Interrupted

→ Decision-Making Affected

→ Guarantee Processing Delayed

The BCM methodology should therefore emphasise end-to-end recovery of the business function rather than isolated recovery of individual resources.

 

Management Responsibilities

Senior management plays an essential role throughout the BCM lifecycle.

Management should provide:

• direction;
• governance;
• resources;
• accountability;
• approval;
• risk acceptance;
• oversight; and
• continual support.

Business Unit Heads should remain accountable for continuity of their respective activities.

The central BCM function should facilitate and coordinate the methodology but should not become the sole owner of business continuity.

The operating principle should be:

BCM is centrally coordinated but operationally owned by the business.

This encourages continuity considerations to become part of normal business management.

 

Building a Culture of Preparedness

The ultimate objective of BCM extends beyond plans, templates and exercises.

Damanat should progressively establish a culture in which employees understand that continuity is part of their normal responsibilities.

A preparedness culture exists when:

• employees understand escalation procedures;
• Business Unit Heads understand recovery priorities;
• BCM Coordinators maintain current plans;
• technology teams understand business recovery requirements;
• procurement considers supplier resilience;
• change projects consider BCM implications;
• senior management understands significant continuity risks;
• exercises are treated as learning opportunities; and
• lessons result in measurable improvements.

This cultural integration strengthens the organisation's ability to adapt to unexpected disruption.

 

The BCM Continual Improvement Cycle

Completion of this eBook does not imply completion of Damanat's BCM journey.

The methodology should continue as a cycle:

Understand Change

→ Review Risk

→ Review Business Impact

→ Review Strategy

→ Update Plans

→ Exercise

→ Identify Lessons

→ Implement Improvements

→ Review Again

Triggers may include:

• actual incidents;
• exercise findings;
• organisational restructuring;
• new technology;
• process changes;
• new suppliers;
• new operating locations;
• regulatory changes;
• audit findings; and
• emerging threats.

The BCM capability therefore evolves alongside the organisation.

 

What Successful Implementation Should Achieve

Successful implementation of the methodology should enable Damanat to answer the following questions confidently:

• Do we know which business activities require priority recovery?

• Do we understand what could disrupt them?

• Do we know how quickly they must recover?

• Do we understand their people, technology, information, premises and supplier dependencies?

• Have we established practical continuity strategies?

• Are those strategies documented in usable Business Continuity Plans?

• Do employees understand their roles?

• Have the plans and strategies been exercised?

• Can recovery objectives actually be achieved?

• Are deficiencies being corrected?

• Are senior management and relevant governance bodies informed of significant gaps?

• Does the BCM program remain current as Damanat changes?

If these questions can be supported by appropriate evidence, Damanat has progressed beyond BCM planning to a demonstrable capability for continuity.

 

Preparing for BCM Implementation

This eBook has explained how Damanat should structure its BCM Planning Methodology.

The next practical challenge is implementation.

Damanat should translate the methodology into structured working activities involving Business Units and supporting functions.

The implementation journey can be summarised as:

Methodology → Templates → Workshops → Analysis → Decisions → Plans → Exercises → Improvements

For example:

• RAR Methodology becomes RAR workshops and a Threat Register.

• BIA Methodology becomes Business Unit BIA workshops and approved recovery requirements.

• BCS Methodology becomes strategy decisions and recovery investments.

• PD Methodology becomes Business Unit BCP-writing workshops.

• TE Methodology becomes exercises and capability validation.

• PgM Methodology becomes the recurring BCM management cycle.

This transition from methodology to implementation is critical.

A methodology explains how BCM should be done.

Implementation demonstrates that BCM is being done.

 

Summary of eBook 2

This eBook has provided Damanat with an integrated seven-phase approach for implementing Business Continuity Management.

The complete methodology is:

Phase 1 — Project Management

Establish governance, scope, resources and implementation arrangements.

Phase 2 — Risk Analysis and Review

Identify, assess, mitigate and continually review disruption risks.

Phase 3 — Business Impact Analysis

Identify priority activities, impacts, recovery requirements and dependencies.

Phase 4 — Business Continuity Strategy

Establish prevention, mitigation and recovery solutions.

Phase 5 — Plan Development

Translate strategies into actionable Business Continuity Plans.

Phase 6 — Testing and Exercising

Validate plans and recovery capabilities through progressive exercises.

Phase 7 — Program Management

Maintain governance, competency, assurance and continual improvement.

Collectively, the methodology moves Damanat through seven essential questions:

• How do we organise?

• What could disrupt us?

• What must recover?

• How will we recover?

• What exactly will we do?

• Does it actually work?

• How do we keep it working?

These questions provide a practical foundation for Damanat's BCM implementation.

 

The Business Continuity Management Planning Methodology presented in eBook 2, Implementing Business Continuity Management for The Saudi Mortgage Guarantees Services Company, provides Damanat with a structured pathway from BCM planning to demonstrable organisational capability.

The methodology integrates seven phases:

Project Management → Risk Analysis and Review → Business Impact Analysis → Business Continuity Strategy → Plan Development → Testing and Exercising → Program Management

Each phase serves a distinct purpose, but the greatest value is achieved when they operate together.

• Project Management establishes the foundation.

• Risk Analysis and Review establishes the disruption landscape.

• Business Impact Analysis establishes recovery priorities.

• Business Continuity Strategy establishes the recovery solutions.

• Plan Development establishes the operational procedures.

• Testing and Exercising establishes confidence through validation.

• Program Management establishes sustainability and continual improvement.

For Damanat, the ultimate objective is not simply to demonstrate that a BCM framework, BIA or Business Continuity Plan exists.

The objective is to develop the organisational capability to continue or recover priority mortgage guarantee and supporting activities when normal operating arrangements are disrupted.

This requires Damanat to understand the complete chain of resilience:

Critical Business Function

→ Supporting Activities

→ People, Process, Technology, Information, Premises and Suppliers

→ Disruption Risks

→ Business Impacts

→ Recovery Requirements

→ Continuity Strategies

→ Business Continuity Plans

→ Exercises

→ Lessons Learned

→ Continual Improvement

When this chain is understood, documented, implemented and regularly validated, BCM becomes more than emergency planning. It becomes part of how Damanat manages operational uncertainty and protects the continuity of its important activities.

The completion of this eBook therefore represents not the end of Damanat's BCM implementation, but the transition from understanding the methodology to applying it in practice.

The next stage is to operationalise the methodology across Damanat's Critical Business Functions through detailed assessments, workshops, templates, recovery decisions, Business Continuity Plans and exercises.

The progression can therefore be expressed simply as:

Understand the Organisation → Establish the BCM Methodology → Start the BCM Implementation → Validate the Capability → Sustain and Improve

Through this structured approach, Damanat can progressively develop a BCM capability that is risk-informed, business-driven, recovery-focused, testable and continually improved, supporting both organisational resilience and the continuity of its responsibilities within Saudi Arabia's mortgage guarantee ecosystem.