Mortgage Guarantee Origination (CBF-1) is the primary business function through which The Saudi Mortgage Guarantees Services Company (Damanat) fulfils its statutory role of supporting Saudi Arabia's housing finance ecosystem by providing mortgage guarantee services to participating financial institutions.
The function encompasses the complete lifecycle of processing mortgage guarantee applications—from application intake and borrower assessment through guarantee approval, certificate issuance, registration, fee administration, and regulatory reporting.
Because Mortgage Guarantee Origination directly supports financial institutions, borrowers, regulators, and government housing initiatives, prolonged disruption could delay financing decisions, increase operational risk, affect regulatory compliance, and reduce stakeholder confidence.
Consequently, the Business Continuity Strategy for this Critical Business Function (CBF) must ensure that critical activities can continue or be recovered within acceptable timeframes while maintaining service quality, regulatory compliance, information integrity, and prudent risk management.
Unlike incident response, which focuses on managing the immediate effects of a disruptive event, recovery strategies define how critical activities will resume.
They identify the people, facilities, technology, information, suppliers, and operational arrangements required to restore business services until normal operations can be fully reinstated.
The strategies presented in this chapter are aligned with recognised Business Continuity Management practices and are intended to support the development of Business Continuity Plans for Mortgage Guarantee Origination.
Where Recovery Time Objectives (RTOs) are proposed, they are indicative values requiring validation through the Business Impact Analysis (BIA) and approval by Damanat's management.
The recovery strategy for CBF-1 is built upon six complementary resilience pillars:
|
Sub-CBF |
Business Activity |
Recovery Strategy |
Recovery Location |
People Strategy |
Technology Strategy |
Information Strategy |
Third-Party Strategy |
Indicative RTO (Requires Validation) |
Key Recovery Assumptions |
|
1.1 |
Mortgage Guarantee Application Intake |
Resume electronic application receipt using secure online channels. Manual submission accepted only under approved contingency procedures. |
Primary office, alternate workplace or secure remote operations. |
Cross-trained operations staff and team supervisors. |
Mortgage Origination System, secure email, workflow platform and internet connectivity. |
Electronic application repository restored from replicated storage. |
Financial institutions continue secure submission of applications. |
4 hours |
Application portal available or manual intake procedures activated. |
|
1.2 |
Application Validation |
Resume validation of application completeness and documentation using predefined validation procedures. |
Alternate workplace or remote operations. |
Cross-trained validation officers. |
Workflow management system and document management platform. |
Restored document repository and validation checklists. |
Access to supporting documents from participating banks. |
4 hours |
Document repository available and validation criteria remain accessible. |
|
1.3 |
Borrower Eligibility Assessment |
Continue borrower assessment using available financial and identity information. Manual verification procedures used if automated interfaces fail. |
Alternate workplace or secure remote access. |
Qualified credit assessment officers. |
Credit assessment applications and identity verification systems. |
Secure borrower information restored from backup. |
Credit bureau and identity verification providers operational. |
8 hours |
Credit bureau services available or manual verification arrangements activated. |
|
1.4 |
Property Eligibility Assessment |
Resume assessment of property eligibility using available valuation reports and approved assessment procedures. |
Alternate workplace or remote operations. |
Property assessment specialists. |
Property assessment applications and document repository. |
Electronic property records restored. |
Property valuation firms and participating lenders available. |
8 hours |
Property documentation accessible. |
|
1.5 |
Mortgage Risk Assessment |
Restore mortgage risk analysis using approved underwriting methodology and available financial information. |
Alternate workplace or remote operations. |
Senior mortgage risk analysts and cross-trained personnel. |
Risk assessment applications and analytical models. |
Mortgage assessment records restored from replicated databases. |
Banking partners continue providing required information. |
8 hours |
Risk models available and financial data remains accessible. |
|
1.6 |
Guarantee Policy Compliance Review |
Resume compliance verification against approved guarantee policies and regulatory requirements. |
Alternate workplace or secure remote operations. |
Compliance officers and policy specialists. |
Compliance management system and regulatory knowledge repository. |
Policy documents and compliance records restored. |
Regulatory guidance remains accessible. |
8 hours |
Current policies available electronically. |
|
1.7 |
Financial Institution Verification |
Verify participating financial institution eligibility, authority and supporting information before guarantee approval. |
Alternate workplace or remote operations. |
Relationship managers and verification officers. |
CRM system, partner database and secure communications. |
Partner records restored from backup. |
Financial institutions maintain communication capability. |
8 hours |
Participating institutions remain operational. |
|
1.8 |
Guarantee Approval Decision |
Resume approval workflow using delegated approval authority and predefined contingency approval procedures where necessary. |
Alternate workplace or secure remote operations. |
Authorised approving officers and delegated approvers. |
Approval workflow system with secure authentication. |
Decision records stored in replicated databases. |
Internal governance committees available where required. |
12 hours |
Delegated approval authority remains available and secure authentication is operational. |
The first eight Sub-CBFs represent the operational front-end of Mortgage Guarantee Origination and are highly interdependent.
A disruption affecting application intake, validation, borrower assessment or mortgage risk assessment will inevitably delay downstream approval and guarantee issuance activities.
Accordingly, Damanat should prioritise the recovery of the supporting ICT infrastructure—including application processing systems, document repositories, workflow engines, authentication services and external connectivity to financial institutions—before restoring higher-level decision-making activities.
To improve resilience, Damanat should adopt common recovery capabilities across all front-end processes.
These include secure remote-working arrangements, cross-trained personnel, replicated electronic records, resilient network connectivity, predefined manual workarounds, and documented delegated authorities.
These capabilities enable continuity across multiple disruption scenarios while reducing dependence on individual staff, specific locations, or single technology platforms.
The next section will continue with Sub-CBFs 1.9 to 1.15, covering Guarantee Certificate Generation, Registration, Stakeholder Notification, Documentation and Records Management, Guarantee Fee Administration, Post-Issuance Quality Assurance, and Management Reporting and Regulatory Monitoring, and will be followed by enterprise recovery dependencies and implementation guidance.
This section completes the recovery strategy for CBF-1: Mortgage Guarantee Origination by addressing the remaining Sub-Critical Business Functions (Sub-CBFs).
The proposed Recovery Time Objectives (RTOs) are indicative and should be validated through Damanat's approved Business Impact Analysis (BIA).
|
Sub-CBF |
Business Activity |
Recovery Strategy |
Recovery Location |
People Strategy |
Technology Strategy |
Information Strategy |
Third-Party Strategy |
Indicative RTO (Requires Validation) |
Key Recovery Assumptions |
|
1.9 |
Guarantee Certificate Generation |
Resume automated generation of mortgage guarantee certificates using the recovered guarantee management system. Where necessary, issue temporary manual certificates subject to management approval. |
Alternate workplace or secure remote operations. |
Authorised guarantee officers supported by cross-trained operations personnel. |
Guarantee Management System, document generation software and digital signature capability. |
Certificate templates, guarantee records and approval logs restored from replicated storage. |
Digital certificate service providers and participating financial institutions remain available. |
12 hours |
Approval records have been successfully restored and certificate templates remain available. |
|
1.10 |
Guarantee Registration |
Continue registration of approved guarantees within the enterprise guarantee register using restored systems or controlled manual procedures until normal operations resume. |
Alternate workplace or remote operations. |
Registration officers and operations supervisors. |
Guarantee Register database and workflow application. |
Electronic guarantee register restored from backup. |
Financial institutions continue submitting confirmation information. |
12 hours |
Registration database remains recoverable and integrity is maintained. |
|
1.11 |
Stakeholder Notification |
Restore communications with financial institutions, borrowers and regulators through approved communication channels. Prioritise notifications relating to service availability and operational status. |
Corporate communications centre or alternate workplace. |
Relationship managers, communications officers and customer service personnel. |
Customer Relationship Management (CRM) system, email platform, SMS gateway and corporate website. |
Contact databases restored from replicated storage. |
Telecommunications providers and messaging services remain operational. |
8 hours |
Contact information remains current and communication infrastructure is available. |
|
1.12 |
Documentation and Record Management |
Resume controlled management of mortgage guarantee documentation using the electronic document management system. Manual filing procedures should only be used under exceptional circumstances. |
Alternate workplace or secure remote operations. |
Records management personnel and operations staff. |
Electronic Document Management System (EDMS), secure storage and backup infrastructure. |
Electronic records restored from off-site backup or replicated storage. |
Off-site records storage provider available where physical records are required. |
8 hours |
Records remain complete, accessible and protected from unauthorised alteration. |
|
1.13 |
Guarantee Fee Administration |
Restore calculation, invoicing and reconciliation of guarantee fees using financial management systems. Manual calculations may be used temporarily subject to verification controls. |
Alternate workplace or remote operations. |
Finance officers and guarantee administration staff. |
Financial management system, billing application and banking interfaces. |
Financial transaction records restored and reconciled. |
Banking partners remain available to process payments. |
24 hours |
Financial systems and payment channels are operational or suitable contingency arrangements exist. |
|
1.14 |
Post-Issuance Quality Assurance |
Resume quality assurance reviews of completed guarantee transactions to verify compliance with internal standards and regulatory requirements. |
Alternate workplace or remote operations. |
Quality assurance officers and compliance specialists. |
Quality management system, reporting tools and document repository. |
Audit trails, review checklists and transaction records restored. |
Internal Audit and participating financial institutions remain available for clarification where necessary. |
48 hours |
Quality assurance activities can be temporarily deferred without affecting immediate service continuity. |
|
1.15 |
Management Reporting and Regulatory Monitoring |
Restore management dashboards, operational reporting and regulatory submissions to support executive decision-making and compliance obligations. Priority should be given to mandatory regulatory reporting. |
Executive management offices or secure remote operations. |
Management reporting analysts, compliance officers and senior management. |
Business Intelligence platform, reporting systems and regulatory reporting tools. |
Operational data warehouse and reporting databases restored. |
Regulatory reporting portals and communication channels remain available. |
24 hours |
Core operational data has been successfully restored and reporting integrity has been validated. |
Although each Sub-CBF has its own recovery requirements, Mortgage Guarantee Origination operates as an integrated end-to-end business process. Recovery activities should therefore follow the operational workflow rather than treating each activity independently.
The recommended recovery sequence is:
|
Recovery Priority |
Business Activities |
Reason for Priority |
|
Priority 1 |
Application Intake, Validation, ICT Infrastructure, Identity Management |
Enables new guarantee requests to be received and processed while preventing backlog growth. |
|
Priority 2 |
Borrower Assessment, Property Assessment, Mortgage Risk Assessment |
Supports core underwriting decisions and risk evaluation. |
|
Priority 3 |
Policy Compliance Review, Financial Institution Verification, Guarantee Approval |
Enables authorised guarantee decisions while maintaining regulatory compliance. |
|
Priority 4 |
Certificate Generation, Registration, Stakeholder Notification |
Completes guarantee issuance and assures participating financial institutions. |
|
Priority 5 |
Documentation Management, Fee Administration, Quality Assurance and Management Reporting |
Supports administrative, financial, audit and regulatory activities following restoration of operational services. |
This phased approach allows Damanat to restore customer-facing and revenue-generating activities before recovering supporting administrative functions.
Several recovery strategies apply consistently across all fifteen Sub-CBFs and should form part of Damanat's enterprise Business Continuity Strategy.
Personnel remains the most critical recovery resource. Damanat should maintain cross-trained teams, succession plans, delegated authorities and competency matrices to minimise dependence on individual employees.
During major disruptions, staff should be redeployed according to predefined recovery priorities, supported by remote working arrangements where appropriate.
Operations should be recoverable from multiple locations, including the primary office, designated alternate workplaces and secure remote-working environments.
Recovery facilities should provide adequate workspace, secure network connectivity, telecommunications and access to business applications.
Critical ICT services supporting Mortgage Guarantee Origination—including workflow systems, document management, guarantee processing, identity management, databases, and communications infrastructure—should be protected through a resilient architecture, high availability, regular backups, and tested Disaster Recovery capabilities.
Business information should remain accurate, complete and available throughout recovery.
Electronic records should be replicated to secure off-site locations, protected through encryption and integrity controls, and periodically tested through restoration exercises.
Damanat should work closely with financial institutions, telecommunications providers, cloud service providers, software vendors, banking partners, and outsourced service providers to ensure that continuity arrangements are contractually defined, periodically reviewed, and validated through supplier resilience assessments.
The next part, BCS P3, will cover Minimum Resources Required During a Disaster.
BCS P2 complete the Business Continuity Recovery Strategy for CBF-1 Mortgage Guarantee Origination.
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S | RAR T1 | RAR T2 | RAR T3 | BCS T1 | CBF |
| CBF-1 Mortgage Guarantee Origination | ||||||
| DP | BIAQ P1 | BIAQ P2 | BIAQ P3 | BIAQ P4 | BIAQ P5 | BIAQ P6 |
| BCS T2 | BCS T3 | PD | ||||
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].
|
Please feel free to send us a note if you have any questions. |
||