Understanding these interdependencies is a fundamental component of the Business Impact Analysis (BIA) because disruptions affecting one dependency can rapidly cascade across multiple business processes, delaying service delivery, increasing operational risk, and affecting compliance with regulatory obligations.
Dependency mapping enables The Saudi Mortgage Guarantees Services Company (Damanat) to identify the people, departments, suppliers, systems, information, and external organisations essential to maintaining mortgage guarantee services.
By documenting these relationships, management can identify single points of failure, assess the resilience of critical suppliers, and develop recovery strategies to address dependencies beyond Damanat's direct control.
Inter-dependencies generally fall into three categories. Upstream dependencies provide the resources, information, approvals, or services required before a Sub-CBF can begin. Downstream dependencies rely on the outputs generated by the Sub-CBF to perform subsequent activities.
Mutual dependencies exist where two parties continually exchange information or services, making each dependent upon the other for successful operations.
Understanding both internal and external dependencies also supports broader organisational objectives beyond Business Continuity Management. Dependency analysis strengthens Third-Party Risk Management (TPRM) by identifying critical vendors and outsourced services that require resilience assessments and contractual recovery obligations.
It also contributes to Operational Resilience by highlighting interconnections that could amplify disruption across business services, allowing Damanat to prioritise investment in redundancy, supplier resilience, contingency arrangements, and recovery planning.
The following assessment identifies the principal dependencies supporting each Sub-Critical Business Function within Mortgage Guarantee Origination. The analysis provides the foundation for continuity strategies, supplier management, recovery prioritisation, and enterprise-wide resilience planning.
|
Sub-CBF Code |
Sub-CBF |
Business Unit / Vendor / Outsource Partner |
Internal Dependency |
External Dependency |
Dependency Direction |
Description of Nature of Dependency |
|
1.1 |
Mortgage Guarantee Application Intake |
Participating Financial Institutions |
No |
Yes |
Upstream |
Mortgage applications, borrower information, and supporting documentation are submitted by participating financial institutions. Without timely submission, Damanat cannot initiate guarantee processing, resulting in delayed customer service and reduced operational throughput. |
|
1.2 |
Application Validation |
Operations Department |
Yes |
No |
Upstream |
The Operations Department validates the completeness of applications, the quality of documents, and compliance with submission requirements before the application proceeds to assessment. Delays in validation create bottlenecks throughout the guarantee origination process. |
|
1.3 |
Borrower Eligibility Assessment |
Credit Information Provider |
No |
Yes |
Mutual |
Eligibility assessments rely on external borrower credit information, financial history, and verification data. Damanat exchanges borrower details with authorised providers to support accurate eligibility decisions. Unavailability may increase manual verification and processing delays. |
|
1.4 |
Property Eligibility Assessment |
External Property Valuation Firms |
No |
Yes |
Upstream |
Independent property valuation reports and supporting property information are required before guarantee approval. Delays or unavailable valuation services postpone eligibility assessments and affect approval timelines. |
|
1.5 |
Mortgage Risk Assessment |
Enterprise Risk Management Department |
Yes |
No |
Mutual |
Risk specialists maintain guarantee risk methodologies, risk parameters, and portfolio monitoring information that support mortgage assessments. Continuous collaboration ensures risk models remain current and aligned with corporate risk appetite. |
|
1.6 |
Guarantee Policy Compliance Review |
Compliance Division |
Yes |
No |
Upstream |
Compliance personnel interpret guarantee policies, regulatory requirements, and internal governance standards. Their review confirms applications satisfy internal policy before approval decisions are issued. Failure of this dependency increases compliance and regulatory risks. |
|
1.7 |
Financial Institution Verification |
Saudi Central Bank (SAMA) and Participating Financial Institutions |
No |
Yes |
Mutual |
Verification activities depend on current licensing status, regulatory standing, and institutional information maintained by participating financial institutions and relevant regulatory authorities. Accurate information supports eligibility and regulatory compliance. |
|
1.8 |
Guarantee Approval Decision |
Executive Approval Authority / Delegated Approval Committee |
Yes |
No |
Upstream |
Approved delegated authorities provide formal guarantee approval following completion of all preceding assessments. The approval process depends upon complete assessment documentation and authorised decision-makers. Delays directly affect guarantee issuance and customer commitments. |
Several important dependency characteristics emerge from the first eight Sub-Critical Business Functions:
In Part 2, the assessment will continue with Sub-CBFs 1.9 to 1.15, followed by a comprehensive conclusion on how inter-dependency mapping strengthens Business Continuity Planning, Third-Party Risk Management, Operational Resilience, and enterprise recovery planning.
|
Sub-CBF Code |
Sub-CBF |
Business Unit / Vendor / Outsource Partner |
Internal Dependency |
External Dependency |
Dependency Direction |
Description of Nature of Dependency |
|
1.9 |
Guarantee Certificate Generation |
ICT Department / Digital Certificate Service |
Yes |
No |
Upstream |
Certificate generation depends on the availability of the Mortgage Guarantee Management System, digital certificate infrastructure, document templates, and secure printing or electronic distribution services. Failure of these services delays the issuance of legally recognised guarantee certificates. |
|
1.10 |
Guarantee Registration |
Enterprise Records Management Unit |
Yes |
No |
Downstream |
Registration records are created after the guarantee is approved and the certificate is issued. The Records Management Unit maintains the official guarantee register, ensuring that authorised guarantees are accurately recorded, traceable, and available for audit, reporting, and future servicing activities. |
|
1.11 |
Stakeholder Notification |
Corporate Communications and Email Service Provider |
No |
Yes |
Downstream |
Notifications to participating financial institutions, applicants, regulators, and internal stakeholders rely on secure communication channels, messaging platforms, and email services. Service interruptions may delay customer communication, contractual obligations, and regulatory notifications. |
|
1.12 |
Documentation and Record Management |
Records Management Unit |
Yes |
No |
Mutual |
Business units continuously exchange operational documents, approval records, correspondence, and supporting evidence with the Records Management Unit. The integrity, accessibility, and retention of these records are essential throughout the mortgage guarantee lifecycle. |
|
1.13 |
Guarantee Fee Administration |
Finance Department / Banking and Payment Service Providers |
No |
Yes |
Mutual |
Fee collection depends upon banking infrastructure, electronic payment services, and internal financial processing. Payment confirmations, invoices, reconciliations, and financial records are exchanged between Damanat, participating financial institutions, and payment providers. Service disruption affects revenue collection and financial reconciliation. |
|
1.14 |
Post-Issuance Quality Assurance |
Internal Audit and Quality Assurance Department |
Yes |
No |
Downstream |
Quality Assurance reviews completed guarantee cases to verify compliance with policies, procedures, and regulatory requirements. Audit findings, corrective actions, and process improvement recommendations support continuous improvement across the mortgage guarantee programme. Delays reduce organisational oversight and may increase compliance risk. |
|
1.15 |
Management Reporting and Regulatory Monitoring |
Executive Management, Risk Management Department and The Saudi Central Bank (SAMA) |
No |
Yes |
Mutual |
Operational, financial, portfolio, and regulatory information is consolidated for management oversight and regulatory reporting. Executives rely on accurate reports for strategic decision-making, while regulators require timely submissions demonstrating compliance and prudent risk management. Inaccurate or delayed reporting may affect governance, regulatory confidence, and organisational reputation. |
Inter-dependency mapping is a critical component of the Business Impact Analysis (BIA) because it identifies the operational relationships that enable Mortgage Guarantee Origination to function as an integrated end-to-end business process.
While individual Sub-Critical Business Functions may appear independent, they rely extensively on internal business units, external organisations, technology providers, financial institutions, and regulatory stakeholders.
Understanding these relationships enables Damanat to evaluate how disruptions may propagate across the organisation and affect the timely delivery of mortgage guarantee services.
The analysis demonstrates that successful recovery depends on more than restoring individual business activities.
Critical internal functions—including Operations, Enterprise Risk Management, Compliance, Finance, Records Management, ICT, Executive Management, and Internal Audit—provide essential support that enables guarantee processing, governance, decision-making, and regulatory compliance.
Equally important are external dependencies, including participating financial institutions, property valuation firms, banking and payment service providers, telecommunications providers, cloud service providers, software vendors, and regulatory authorities such as
The Saudi Central Bank (SAMA). Disruptions affecting these external parties may significantly delay or prevent the recovery of Damanat's critical business functions.
Documenting both internal and external dependencies also strengthens Third-Party Risk Management (TPRM) by identifying suppliers and outsourcing partners whose resilience directly influences organisational performance.
These dependencies should be supported by appropriate contractual arrangements, service-level agreements, resilience assessments, business continuity requirements, disaster recovery capabilities, and periodic testing to ensure that critical services remain available during major disruptions.
From an Operational Resilience perspective, dependency mapping provides visibility into the interconnected ecosystem that supports mortgage guarantee services.
Understanding upstream, downstream, and mutual dependencies enables Damanat to identify potential single points of failure, evaluate concentration risks, establish contingency arrangements, and develop recovery strategies that protect the continuity of important business services rather than individual organisational functions.
Finally, dependency information provides management with a practical basis for prioritising recovery activities during a disruption.
By understanding which dependencies are critical to restoring each Sub-Critical Business Function, Damanat can allocate resources more effectively, coordinate recovery across internal departments and external stakeholders, reduce recovery time, and maintain confidence among customers, participating financial institutions, regulators, and other stakeholders.
This comprehensive understanding of organisational dependencies significantly enhances Business Continuity Planning, supplier resilience, enterprise risk management, and the organisation's overall ability to withstand and recover from disruptive events.
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S | RAR T1 | RAR T2 | RAR T3 | BCS T1 | CBF |
| CBF-1 Mortgage Guarantee Origination | ||||||
| DP | BIAQ P1 | BIAQ P2 | BIAQ P3 | BIAQ P4 | BIAQ P5 | BIAQ P6 |
| BCS T2 | BCS T3 | PD | ||||
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].
|
Please feel free to send us a note if you have any questions. |
||