[BCM] [GRA] [E1] [C5] Determining BC Assumptions

Determining BC Assumptions

 

 

Introduction

Business Continuity Management (BCM) planning requires organisations to establish a set of planning assumptions that define the conditions under which continuity strategies, recovery procedures, and response arrangements will operate.

These assumptions provide a realistic planning foundation and help ensure that BCM plans are practical, achievable, and aligned with the organisation's operating environment.

Under ISO 22301, organisations are expected to understand their context, identify dependencies, assess risks, and establish continuity arrangements based on credible disruption scenarios.

One of the key outputs of this process is the development of BCM assumptions that guide decision-making during disruptions.

For the Gambling Regulatory Authority (GRA), BCM assumptions are particularly important because the organisation operates in a highly regulated environment that involves licensing, compliance monitoring, enforcement, stakeholder engagement, regulatory intelligence, and inter-agency coordination.

The assumptions developed for GRA must reflect its operational realities, regulatory obligations, technology dependencies, and stakeholder expectations.

This chapter identifies the key business continuity assumptions to consider when designing, implementing, and maintaining GRA's BCM programme.

 

Purpose of Business Continuity Assumptions

Business continuity assumptions serve several important purposes:

• Provide a consistent basis for BCM planning.
• Support realistic recovery strategy development.
• Establish planning boundaries and expectations.
• Facilitate resource planning.
• Improve decision-making during incidents.
• Support testing and exercising activities.
• Align continuity plans with organisational realities.

Without documented assumptions, continuity plans may be based on unrealistic expectations that are difficult to execute during actual disruptions.

 

What Are Business Continuity Assumptions?

Business continuity assumptions are conditions believed to be true for planning purposes and are used when designing recovery arrangements.

Examples include assumptions regarding:

• Staff availability.
• Technology availability.
• Alternative work arrangements.
• Supplier support.
• Communications capabilities.
• Recovery locations.
• Government support.

These assumptions should be periodically reviewed to ensure they remain valid.

 

Proposed BCM Assumptions for GRA

 

Assumption 1: Senior Management Will Support BCM Activation

Statement

Senior management will provide the timely direction, authority, and resources required to activate BCM and recovery arrangements.

Planning Implication

Recovery activities can proceed without significant delays caused by governance uncertainty.

BCM Consideration

Clearly defined authority levels should be documented within BCM and Crisis Management plans.

 

Assumption 2: Critical Regulatory Functions Must Continue

Statement

GRA's critical regulatory services cannot be suspended indefinitely and must continue at an acceptable level during disruptions.

Planning Implication

Alternative operating arrangements must be available for critical functions.

Examples

• Licensing and approvals.
• Compliance monitoring.
• Enforcement activities.
• Regulatory communications.

 

Assumption 3: Staff Availability May Be Reduced

Statement

Not all employees will be available during a disruption.

Planning Implication

Cross-training and succession planning are necessary.

Examples

• Pandemic outbreaks.
• Public health emergencies.
• Transport disruptions.
• Personal emergencies.

 

Assumption 4: Remote Working Will Be Required

Statement

Certain disruption scenarios may prevent access to normal office facilities.

Planning Implication

Remote working capabilities must be maintained.

Requirements

• Secure VPN access.
• Multi-factor authentication.
• Remote collaboration tools.
• Remote access to critical systems.

 

Assumption 5: Critical ICT Systems May Become Unavailable

Statement

A disruption may affect the availability of key technology systems.

Planning Implication

Disaster recovery arrangements must be available.

Examples

• Licensing systems.
• Regulatory databases.
• Document management systems.
• Communications platforms.

 

Assumption 6: Vital Records Must Remain Accessible

Statement

Critical information and records must be available during disruptions.

Planning Implication

Data backup and recovery arrangements must be maintained.

Examples

• Licensing records.
• Enforcement records.
• Compliance reports.
• Regulatory correspondence.

 

Assumption 7: Alternative Communication Channels Will Be Required

Statement

Primary communication methods may become unavailable.

Planning Implication

Multiple communication channels must be maintained.

Examples

• Mobile phones.
• Secure messaging platforms.
• Government communication systems.
• Emergency contact trees.

 

Assumption 8: Third-Party Service Providers May Be Impacted

Statement

External suppliers may experience disruptions that affect GRA operations.

Planning Implication

Supplier continuity risks must be managed.

Examples

• Cloud service providers.
• Telecommunications providers.
• Software vendors.
• Managed service providers.

 

Assumption 9: Government Agencies Will Continue to Operate

Statement

Key government agencies will maintain essential functions during disruptions.

Planning Implication

Inter-agency coordination arrangements can continue.

Examples

• Law enforcement agencies.
• Cybersecurity authorities.
• Government ministries.
• Financial intelligence agencies.

 

Assumption 10: Regulatory Obligations Continue During Disruptions

Statement

Legal and regulatory responsibilities remain applicable even during emergencies.

Planning Implication

Recovery priorities must consider statutory obligations.

Examples

• Licensing decisions.
• Regulatory reporting.
• Compliance monitoring.
• Enforcement actions.

 

Assumption 11: Public Confidence Must Be Maintained

Statement

Stakeholders expect continuity of regulatory oversight during disruptions.

Planning Implication

Communication and transparency must remain priorities.

Examples

• Public announcements.
• Operator communications.
• Government reporting.
• Media engagement.

 

Assumption 12: Cybersecurity Risks Increase During Disruptions

Statement

Threat actors may exploit disruptions to launch cyberattacks.

Planning Implication

Cybersecurity controls must remain operational throughout recovery.

Examples

• Phishing attacks.
• Ransomware.
• Credential theft.
• Data exfiltration attempts.

 

Assumption 13: Crisis Events May Escalate Rapidly

Statement

Operational incidents may develop into organisational crises.

Planning Implication

Integration between BCM and Crisis Management is necessary.

Examples

• Cyber incidents.
• Regulatory failures.
• Data breaches.
• Public controversies.

 

Assumption 14: BCM Plans Will Be Tested and Maintained

Statement

Plans cannot remain effective without ongoing validation.

Planning Implication

Exercises and reviews must be conducted regularly.

Examples

• Tabletop exercises.
• Simulation exercises.
• ICT disaster recovery tests.
• Call tree tests.

 

Assumption 15: Continuous Improvement Is Required

Statement

Threats, technologies, regulations, and organisational structures will evolve over time.

Planning Implication

The BCM programme must be regularly reviewed and updated.

Examples

• Regulatory changes.
• Emerging gambling technologies.
• New cyber threats.
• Organisational restructuring.

 

Alignment with Singapore Government BCM Policy

The Singapore Government BCM Policy emphasises continuity of essential public services and resilience across public sector agencies.

Accordingly, GRA's BCM assumptions should support:

 

Government BCM Expectation	Related GRA BCM Assumption
Continuity of Essential Services	Critical functions must continue
Whole-of-Government Coordination	Government agencies continue to operate
Public Confidence	Public confidence must be maintained
Information Protection	Vital records remain accessible
ICT Resilience	Critical systems may become unavailable
Workforce Continuity	Staff availability may be reduced
Continuous Improvement	BCM plans will be tested and maintained

 

Using Assumptions During BCM Planning

The assumptions identified in this chapter should be used during:

Risk Analysis and Review (RAR)

To identify vulnerabilities and risks.

Business Impact Analysis (BIA)

To determine critical functions and dependencies.

Business Continuity Strategy (BCS)

To develop realistic recovery solutions.

Plan Development (PD)

To establish response and recovery procedures.

Testing and Exercising (TE)

To validate assumptions through exercises.

Programme Management (PgM)

To review and update assumptions as circumstances change.

 

Business continuity assumptions form the foundation of the Gambling Regulatory Authority's BCM programme.

They establish realistic planning conditions, support the development of continuity strategies, and help ensure that recovery arrangements remain practical and achievable during disruptions.

The assumptions outlined in this chapter reflect GRA's regulatory responsibilities, operational environment, technology dependencies, stakeholder expectations, and obligations under the Singapore Government BCM Policy.

By documenting and periodically reviewing these assumptions, GRA strengthens its ability to anticipate disruptions, plan effectively, and maintain continuity of critical regulatory services.

Ultimately, well-defined BCM assumptions support organisational resilience, improve preparedness, and enable GRA to continue fulfilling its mission of safeguarding the integrity of Singapore's gambling regulatory framework under both normal and disrupted operating conditions.