[BCM] [Damanat] [E3] [BIA] [P6] [CBF] [1] Vital Records

Vital records are the foundation upon which critical business operations continue during and after a disruptive incident.

As part of the Business Impact Analysis (BIA), identifying these records enables The Saudi Mortgage Guarantees Services Company (Damanat) to determine which information assets are indispensable for delivering mortgage guarantee services, meeting regulatory obligations, protecting legal rights, and supporting recovery activities.

Without timely access to essential records, even fully restored systems and personnel may be unable to resume normal business operations effectively.

Within the Mortgage Guarantee Origination process, vital records include borrower applications, supporting documentation, eligibility assessments, risk evaluations, guarantee approvals, financial records, and regulatory reporting information.

These records provide the evidence supporting operational decisions, demonstrate compliance with internal policies and regulatory requirements, and ensure the integrity and traceability of every mortgage guarantee issued.

Effective Records and Information Management is closely integrated with Business Continuity Management. ISO 22301 emphasises the availability of critical information during disruptions, while ISO 15489 provides internationally recognised principles for managing records throughout their lifecycle.

Together, these disciplines ensure that critical records remain authentic, reliable, complete, accessible, and protected regardless of the type of disruption affecting the organisation.

Organisations must also recognise that vital records exist in multiple formats.

Although many operational records are maintained electronically within enterprise systems, physical documents, signed agreements, legal correspondence, and certified copies may still be required for regulatory, contractual, or evidential purposes.

Consequently, Business Continuity Planning should include arrangements for protecting both electronic and physical records through secure storage, backups, replication, controlled access, off-site storage, and disaster recovery facilities.

The following assessment identifies the principal vital records supporting each Sub-Critical Business Function within Mortgage Guarantee Origination, together with their primary media type, storage location, and designated custodian.

This information forms an important component of Damanat's Business Continuity, Records Management, and Information Governance programmes.

 

Table BIA P6: Vital Records for CBF-1 Mortgage Guarantee Origination (Part 1)

Sub-CBF Code	Sub-CBF	Description of Vital Records	Media Type	Location	In Whose Care
1.1	Mortgage Guarantee Application Intake	Mortgage guarantee application forms, borrower identification documents, supporting financial documents, application acknowledgements, correspondence with participating financial institutions	Hybrid (Electronic and Paper)	Mortgage Guarantee Management System, Enterprise Document Management System (EDMS), secure document repository	Mortgage Origination Department
1.2	Application Validation	Document validation records, completeness checklists, document verification results, deficiency notices, validation audit trail	Electronic	Workflow Management System, Enterprise Document Management System	Operations Department
1.3	Borrower Eligibility Assessment	Borrower eligibility assessments, income verification records, employment verification, affordability assessments, credit assessment reports, supporting evidence	Electronic	Mortgage Guarantee Management System, Secure Database Repository	Credit Assessment Unit
1.4	Property Eligibility Assessment	Property valuation reports, property ownership verification, property inspection reports, title documentation, property eligibility assessment records	Hybrid (Electronic and Paper)	Enterprise Document Management System, Secure Property Assessment Repository	Property Assessment Unit
1.5	Mortgage Risk Assessment	Mortgage risk assessment reports, risk scoring results, guarantee exposure calculations, portfolio risk analyses, supporting risk model outputs	Electronic	Enterprise Risk Management System, Risk Analytics Database	Enterprise Risk Management Department
1.6	Guarantee Policy Compliance Review	Compliance review reports, regulatory compliance checklists, policy exception approvals, internal control documentation, compliance correspondence	Electronic	Compliance Management System, Enterprise Document Management System	Compliance Division
1.7	Financial Institution Verification	Participating financial institution registration records, accreditation documentation, due diligence reports, verification records, regulatory correspondence	Electronic	Financial Institution Management System, Secure Vendor Repository	Institutional Relationship Management Unit
1.8	Guarantee Approval Decision	Guarantee approval recommendations, delegated approval records, approval committee decisions, electronic approvals, digital signatures, approval audit logs	Hybrid (Electronic and Paper)	Mortgage Guarantee Management System, Electronic Approval Repository, Corporate Records Archive	Executive Approval Authority / Corporate Secretariat

 

Observations from Part 1

The first eight Sub-Critical Business Functions demonstrate several important characteristics regarding the management of vital records:

Electronic records predominate. Most operational activities depend upon electronic records maintained within enterprise applications, workflow platforms, and document management systems.

These records should be protected through resilient storage, routine backups, replication, encryption, and tested disaster recovery procedures.

Hybrid record management remains important. Certain records—particularly property documentation, signed approvals, delegated authority records, and legal evidence—may exist in both electronic and physical formats.

Business continuity arrangements should therefore address the protection and recovery of both media types.

Authoritative record repositories should be clearly identified. Enterprise Document Management Systems (EDMS), Mortgage Guarantee Management Systems, Compliance Management Systems, and Risk Management Systems should serve as the official repositories for business-critical information.

Duplicate repositories should be avoided unless established as part of approved resilience or disaster recovery arrangements.

Clear record ownership strengthens accountability. Each category of vital records has an identified business custodian responsible for maintaining record integrity, ensuring appropriate retention, protecting confidentiality, and supporting retrieval during normal operations and disruptive events.

Clearly defined ownership also facilitates recovery prioritisation and regulatory compliance.

In Part 2, the assessment will continue with Sub-CBF 1.9 to 1.15, followed by a comprehensive conclusion explaining how effective Vital Records Management strengthens Business Continuity Planning, regulatory compliance, operational resilience, and long-term information governance.

Table BIA P6: Vital Records for CBF-1 Mortgage Guarantee Origination (Part 2)

Sub-CBF Code	Sub-CBF	Description of Vital Records	Media Type	Location	In Whose Care
1.9	Guarantee Certificate Generation	Mortgage guarantee certificates, certificate serial numbers, digital certificates, issuance logs, certificate templates, distribution records	Electronic	Mortgage Guarantee Management System, Enterprise Document Management System (EDMS), Digital Certificate Repository	Mortgage Operations Department
1.10	Guarantee Registration	Official guarantee register, registration records, guarantee reference numbers, audit trails, registration confirmations, historical guarantee database	Database Record	Mortgage Guarantee Registry Database, Disaster Recovery Data Centre	Records Management Unit
1.11	Stakeholder Notification	Notification letters, email correspondence, SMS notification logs, communication records, acknowledgement receipts, distribution lists	Electronic	Customer Relationship Management (CRM) System, Email Archive, Enterprise Document Management System	Corporate Communications Department
1.12	Documentation and Record Management	Electronic case files, document indexes, records retention schedules, archive registers, document version history, records access logs	Hybrid (Electronic and Paper)	Enterprise Document Management System, Off-site Records Storage Facility, Archive Repository	Records Management Unit
1.13	Guarantee Fee Administration	Fee schedules, invoices, payment confirmations, receipts, financial reconciliation reports, bank transaction records, accounting journals	Electronic	Financial Management System, Enterprise Resource Planning (ERP) System, Secure Finance Database	Finance Department
1.14	Post-Issuance Quality Assurance	Quality assurance review reports, internal audit findings, corrective action records, compliance review reports, quality metrics, exception registers	Electronic	Quality Management System, Compliance Management System, Enterprise Document Management System	Quality Assurance Department
1.15	Management Reporting and Regulatory Monitoring	Executive management reports, regulatory submissions, performance dashboards, Key Risk Indicator (KRI) reports, portfolio analytics, management information reports, regulatory correspondence	Electronic	Business Intelligence Platform, Regulatory Reporting System, Enterprise Data Warehouse	Enterprise Risk Management Department

 

The identification and protection of vital records are essential elements of the Business Impact Analysis and provide a critical foundation for Business Continuity Planning.

For The Saudi Mortgage Guarantees Services Company (Damanat), the Mortgage Guarantee Origination process depends on the continuous availability of reliable information throughout the lifecycle of a mortgage guarantee—from the receipt of an application through assessment, approval, registration, financial administration, quality assurance, and regulatory reporting.

Without timely access to these records, business operations cannot be resumed effectively, regardless of the availability of personnel or technology.

Protecting vital records is also fundamental to maintaining regulatory compliance within Saudi Arabia's financial services sector.

Mortgage guarantee operations generate records that demonstrate compliance with internal policies, contractual obligations, governance requirements, audit expectations, and the supervisory requirements of the Saudi Central Bank (SAMA) and other relevant authorities.

The loss, corruption, or inaccessibility of these records could delay customer service, compromise decision-making, weaken auditability, expose the organisation to legal and financial risks, and affect stakeholder confidence.

Effective Records and Information Management contributes significantly to successful recovery during disruptive events.

By identifying the authoritative version of each record, determining where it is stored, assigning ownership, and implementing appropriate protection measures, Damanat can ensure that critical information remains available even when primary facilities or information systems are unavailable.

Recovery arrangements should include secure backups, data replication, off-site storage, disaster recovery data centres, cloud resilience, encryption, controlled access, and periodic recovery testing to validate the accessibility and integrity of essential records.

Equally important is the assignment of clear custodianship for every category of vital records. Business owners, Records Management personnel, ICT administrators, Compliance specialists, Finance teams, and Corporate Secretariat functions all play distinct roles in maintaining the authenticity, integrity, confidentiality, and availability of business-critical information.

Clearly defined ownership supports accountability throughout the records lifecycle and enables coordinated recovery activities during incidents.

The assessment also highlights the importance of protecting both electronic and physical records.

Although most operational information is maintained in enterprise applications and digital repositories, certain documents—including signed approvals, contractual agreements, legal correspondence, and archived records—may still exist in paper or hybrid formats.

Business Continuity Plans should therefore address the protection, storage, transportation, retrieval, and restoration of records regardless of their media type.

Ultimately, effective Vital Records Management strengthens organisational resilience by ensuring that critical information remains available to support operational decision-making, customer service, financial accountability, regulatory compliance, and organisational governance throughout a disruption.

When integrated with Business Continuity Management, Information Governance, and IT Disaster Recovery, the protection of vital records enables Damanat to restore Mortgage Guarantee Origination activities more efficiently, minimise operational disruption, preserve stakeholder confidence, and support the long-term resilience of its mortgage guarantee services.