[BCM] [JS] [E1] [C10] Identifying Critical Business Functions

 

Introduction

 

It helps an organisation determine which activities must be protected, maintained, or recovered within acceptable timeframes to prevent unacceptable consequences from disruptive incidents.

For Jamiyah Singapore (JS), identifying CBFs is particularly important because the organisation delivers charitable, welfare, residential care, educational, and community support services to individuals and families, including vulnerable beneficiaries who may depend on uninterrupted assistance.

Unlike organisations whose criticality assessments focus primarily on financial losses or commercial service interruptions, Jamiyah Singapore must place significant emphasis on beneficiary safety, continuity of care, safeguarding responsibilities, essential welfare assistance, regulatory obligations, and its ability to fulfil its charitable mission.

For example, an interruption to residential care services may immediately affect resident safety, supervision, meals, medication support, and access to essential facilities.

Similarly, disruptions to welfare assistance or food distribution could adversely affect beneficiaries who rely on timely support for their basic needs.

Consequently, identifying CBFs requires a structured assessment of Jamiyah Singapore's services, operational activities, supporting resources, internal and external dependencies, and the consequences of disruption over time.

This chapter introduces a practical methodology for identifying and prioritising CBFs within Jamiyah Singapore.

It provides an illustrative catalogue of critical functions, explains the criteria used to determine criticality, examines the relationship between CBFs and Business Impact Analysis (BIA), and outlines the governance arrangements required to maintain an accurate and approved CBF register.

The approach aligns with ISO 22301:2019, including Amendment 1:2024, and is supported by ISO 22313:2020. It also considers Singapore's charity governance framework and applicable sector-specific requirements administered by the Ministry of Social and Family Development (MSF), Ministry of Health (MOH), and Early Childhood Development Agency (ECDA).

 

Understanding Critical Business Functions

Definition of a Critical Business Function

A Critical Business Function is an organisational activity whose disruption could result in unacceptable consequences for the organisation, its beneficiaries, stakeholders, or the wider community.

In BCM planning, CBFs are the activities that require prioritised continuity and recovery arrangements.

Although BCM implementation methodologies commonly use the term Critical Business Function, ISO 22301 primarily addresses identifying and prioritising activities through the Business Impact Analysis process.

For Jamiyah Singapore, a CBF may involve an activity that:

• Protects the life, health, safety, or welfare of beneficiaries.
• Delivers essential residential, nursing, educational, or welfare services.
• Supports urgent financial or material assistance.
• Enables compliance with applicable statutory or licensing obligations.
• Maintains critical information, communications, and supporting resources.
• Prevents unacceptable operational, financial, or reputational consequences.

Why CBF Identification Matters

Jamiyah Singapore operates different services, each with distinct operational requirements and disruption consequences.

For example, resident supervision may require continuous availability, while routine administrative reporting may tolerate a longer interruption.

Without a structured CBF identification process, the organisation may allocate recovery resources to less time-sensitive activities while overlooking functions that directly affect beneficiary safety or essential service delivery.

Identifying CBFs enables Jamiyah Singapore to establish a defensible basis for prioritising resources, conducting BIA, selecting continuity strategies, and developing recovery procedures.

Distinguishing Products, Services, Functions and Processes

Maintain a clear distinction between products and services, business functions, and supporting processes.

 

Element	Description	Jamiyah Singapore example
Product or service	An outcome delivered to beneficiaries or stakeholders	Residential care services
Business function	A group of activities supporting service delivery	Residential Care and Resident Safety
Sub-business function	A component of a business function	Resident supervision and safeguarding
Business process	A sequence of activities used to perform the function	Conduct resident welfare checks and escalate concerns
Supporting resource	Personnel, technology, premises, information or supplies required	Care staff, resident records, facilities and utilities

 

This distinction helps prevent duplication and ensures that the BCM programme identifies both service delivery requirements and the resources needed to sustain them.

 

Regulatory and Standards Considerations

ISO 22301 Requirements

ISO 22301:2019 provides the primary framework for identifying and prioritising activities that support an organisation's products and services.

Clause 8.2 addresses Business Impact Analysis and risk assessment. The BIA process identifies activities that support product and service delivery, assesses the consequences of their disruption over time, and establishes priorities and requirements for continuity and recovery.

The CBF identification process described in this chapter informs the formal BIA.

 

ISO 22301 requirement	Application to Jamiyah Singapore
Clause 4.1 — Understanding the organisation and its context	Understand services, beneficiaries, operating conditions and relevant disruptions
Clause 4.2 — Needs and expectations of interested parties	Identify beneficiary, family, regulator, donor and stakeholder requirements
Clause 4.3 — BCMS scope	Determine services, locations and activities covered by BCM
Clause 5 — Leadership	Establish management accountability for continuity priorities
Clause 6.2 — Business continuity objectives	Define measurable objectives consistent with organisational priorities
Clause 8.2 — Business Impact Analysis and risk assessment	Identify and prioritise activities, impacts, dependencies and recovery requirements
Clause 8.3 — Business continuity strategies and solutions	Select strategies to maintain and recover prioritised activities
Clause 8.4 — Business continuity plans and procedures	Establish arrangements for responding to and recovering from disruption

 

ISO 22301 Amendment 1:2024 also requires consideration of whether climate change is relevant to the organisation's context.

For Jamiyah Singapore, climate-related disruption could affect residential facilities, transport arrangements, vulnerable beneficiaries, utility availability, and community outreach services.

Singapore Charity Governance Requirements

Jamiyah Singapore's BCM programme should consider its obligations under the Charities Act 1994 and applicable regulations, together with the Code of Governance for Charities and IPCs (2023).

These frameworks support good governance, accountability, appropriate oversight, and responsible stewardship of charitable resources.

Identifying CBFs supports these governance objectives by helping management determine which activities are essential to fulfilling the organisation's mission.

However, the charity governance framework should not be interpreted as universally requiring ISO 22301 certification.

Sector-Specific Regulatory Considerations

Certain Jamiyah Singapore services may be subject to additional regulatory or licensing requirements.

 

Authority	Relevant service area	BCM considerations
Commissioner of Charities	Charitable governance and administration	Accountability, governance, financial stewardship and organisational sustainability
MSF	Applicable social service and residential care operations	Beneficiary safeguarding, resident welfare, care continuity and emergency arrangements
MOH	Applicable licensed healthcare and nursing services	Patient safety, continuity of care, staffing and healthcare operational requirements
ECDA	Applicable licensed early childhood development centres	Child safety, supervision, emergency preparedness and parent communications
PDPC	Personal data protection	Protection and secure recovery of beneficiary, employee and donor information
SCDF	Fire safety and emergency preparedness	Fire prevention, evacuation and emergency response

The applicable obligations should be verified for each operating entity and service. ISO 22301 and ISO 22313 are standards, not regulators or legislation.

 

Establishing the Objectives of CBF Identification

The primary objective of CBF identification is to determine which Jamiyah Singapore activities require prioritised continuity arrangements to prevent unacceptable consequences.

The process should support six organisational objectives.

 

Objective	Application to Jamiyah Singapore
Protect beneficiary safety	Identify activities whose interruption could endanger residents, children or vulnerable individuals
Maintain essential services	Prioritise services required to meet urgent care, welfare and community needs
Support regulatory compliance	Identify functions necessary to fulfil applicable legal and licensing obligations
Establish recovery priorities	Determine which activities require the earliest resumption
Allocate resources effectively	Direct continuity investment towards functions with the greatest disruption consequences
Strengthen organisational resilience	Improve preparedness across people, facilities, technology, suppliers and supporting processes

Aligning CBFs with BCM Goals

Jamiyah Singapore should ensure that its CBF catalogue reflects the BCM goals established in earlier chapters.

For example, the goal of protecting vulnerable beneficiaries should influence the priority assigned to residential care and essential healthcare support.

The goal of maintaining community welfare services should influence the assessment of urgent assistance, food distribution, and beneficiary case management.

The goal of protecting organisational information should support identifying critical ICT systems and information management activities.

Defining the Expected Outputs

The CBF identification exercise should produce:

1. An approved list of Critical Business Functions.
2. A description of each CBF and its service delivery purpose.
3. An accountable owner for each CBF.
4. A preliminary assessment of the consequences of disruption.
5. A preliminary prioritisation for detailed BIA.
6. An initial list of critical resources and dependencies.
7. A record of assumptions, exclusions and management decisions.

These outputs become the foundation for subsequent BIA and recovery strategy development.

 

Methodology for Identifying Critical Business Functions

Jamiyah Singapore should use a consistent process to identify CBFs across its services.

Step 1: Identify Products and Services

The exercise begins by identifying the services Jamiyah Singapore delivers to beneficiaries and stakeholders.

Illustrative categories include residential care, nursing support, early childhood education, student care, welfare assistance, food distribution and community services.

Document each service with its purpose, beneficiaries, service owner, and operating location.

Step 2: Identify Supporting Business Functions

Next, identify the business functions needed to deliver each service.

For residential care, these may include resident supervision, daily care, food provision, essential healthcare coordination, resident records and emergency communications.

Step 3: Identify Sub-Functions and Processes

Break each business function into operational components that can be assessed during the BIA.

For example, food assistance may involve beneficiary eligibility verification, stock receipt, storage, packing, distribution scheduling and delivery.

Step 4: Assess Consequences of Disruption

Jamiyah Singapore should evaluate the consequences of interrupting each function over progressively longer periods.

The assessment should consider safety, beneficiary welfare, regulatory consequences, financial effects, service delivery and stakeholder confidence.

Step 5: Identify Dependencies

The function owner should identify the resources required to perform the activity.

These may include personnel, facilities, information systems, records, equipment, suppliers, volunteers and external service partners.

Step 6: Determine Preliminary Criticality

Provisionally classify functions according to the severity and timing of disruption consequences.

The preliminary classification should not replace the formal BIA, which establishes detailed impact profiles and recovery requirements.

Step 7: Validate and Approve the Catalogue

The proposed catalogue should be reviewed by service owners, the BCM Coordinator and relevant supporting functions.

Senior management should approve the final catalogue and ensure that any exclusions are justified and documented.

 

Proposed Critical Business Functions for Jamiyah Singapore

Establishing the CBF Catalogue

The proposed CBF catalogue provides a structured starting point for Jamiyah Singapore's BCM planning programme.

The catalogue considers the organisation's charitable mission, the needs of vulnerable beneficiaries, service delivery responsibilities, supporting operational resources, and applicable governance and regulatory considerations.

The ten proposed CBFs are intended to represent distinct but interconnected operational capabilities.

Validate them against Jamiyah Singapore's actual organisational structure and service portfolio.

Proposed Critical Business Function Catalogue

 

Note: Function-owner titles are proposed roles. They do not represent verified Jamiyah Singapore appointments. Management should confirm the catalogue through management interviews, service mapping, and BIA workshops.

Proposed Preliminary Criticality Assessment

To guide the initial BIA programme, Jamiyah Singapore may classify functions into three preliminary priority levels.

• Priority 1 — Immediate or Very High Criticality: Interruption may rapidly threaten life, safety, essential care or other urgent beneficiary needs.
• Priority 2 — High Criticality: Interruption may cause significant consequences within a relatively short period.
• Priority 3 — Significant Supporting Criticality: Interruption may progressively undermine service delivery, governance or recovery capability.

Table 10.2: Preliminary CBF Prioritisation

CBF	Critical Business Function	Preliminary Priority	Primary Impact
CBF-1	Residential Care and Resident Safety	Priority 1	Resident safety and continuity of essential care
CBF-2	Nursing and Essential Healthcare Support	Priority 1	Patient safety and essential healthcare delivery
CBF-3	Early Childhood Care and Education	Priority 1	Child safeguarding and supervision
CBF-4	Student Care and Educational Support	Priority 2	Student safety and essential service continuity
CBF-5	Emergency Welfare and Financial Assistance	Priority 2	Beneficiary welfare and urgent financial needs
CBF-6	Food Assistance and Essential Distribution	Priority 2	Food access and beneficiary well-being
CBF-7	Critical Beneficiary Case Management and Referral	Priority 2	Safeguarding, case coordination and timely intervention
CBF-8	Beneficiary, Family and Emergency Communications	Priority 1	Emergency coordination and stakeholder safety
CBF-9	Critical ICT Systems and Information Management	Priority 2	Availability of essential information and digital services
CBF-10	Essential Finance, Procurement and Resource Support	Priority 3	Sustained operations and access to recovery resources

 

These classifications are illustrative and should not be treated as final recovery priorities.

For example, an ICT system supporting immediate resident care could require Priority 1 recovery even though the wider ICT function has been provisionally classified as Priority 2.

Similarly, urgent medication procurement or emergency accommodation may require immediate action even if the broader finance and procurement function is assigned Priority 3.

The formal BIA should establish recovery requirements at the activity and resource level.

 

Detailed Description of Jamiyah Singapore's Proposed CBFs

CBF-1: Residential Care and Resident Safety

Purpose: To maintain residents' safety, supervision, welfare, and essential daily care during normal operations and disruptive incidents.

This function is particularly important because residents may depend on Jamiyah Singapore for accommodation, meals, supervision, hygiene support, and assistance with daily living.

Illustrative sub-critical business functions include:

 

Sub-CBF	Activity
1.1	Maintain resident supervision and safeguarding
1.2	Provide essential meals and hydration
1.3	Maintain daily personal care and hygiene support
1.4	Coordinate essential medication and healthcare-related needs
1.5	Maintain resident accommodation and environmental safety
1.6	Provide emergency response and first aid
1.7	Maintain access to essential resident information
1.8	Coordinate emergency relocation and alternative accommodation
1.9	Communicate with families, caregivers and relevant authorities
1.10	Restore normal residential care operations

Illustrative disruption scenario: A major water supply interruption affects a residential care facility.

Jamiyah Singapore would need to assess the impact on sanitation, hydration, meal preparation and resident welfare.

Continuity arrangements could include emergency water supplies, alternative hygiene facilities, supplier support and relocation where necessary.

CBF-2: Nursing and Essential Healthcare Support

Purpose: Maintain essential nursing and healthcare activities required to protect patient safety and well-being.

Illustrative sub-functions include patient monitoring, nursing assessments, medication administration by authorised personnel, care documentation, infection prevention, and coordination with healthcare providers.

Illustrative disruption scenario: A prolonged ICT outage prevents access to electronic care records.

The nursing team may need to activate approved downtime procedures, access securely maintained essential patient information, document care manually, and reconcile records after system restoration.

Any such procedures must remain consistent with applicable clinical safety and licensing requirements.

CBF-3: Early Childhood Care and Education

Purpose: To protect children and maintain essential childcare, supervision, and educational arrangements.

Illustrative sub-functions include child supervision, attendance management, emergency evacuation, parent communications, child safeguarding, and continuity of essential childcare activities.

Illustrative disruption scenario: A fire renders an early childhood centre temporarily unusable.

The immediate priority would be evacuation, child accountability, safeguarding, and notifying parents.

Subsequent arrangements may include temporary closure, approved alternative premises or other arrangements permitted by applicable licensing requirements.

CBF-4: Student Care and Educational Support

Purpose: Maintain student safety, essential supervision, and prioritised educational support activities.

Illustrative sub-functions include student attendance, supervision, safeguarding, learning support, emergency contact arrangements and coordination with parents or caregivers.

Illustrative disruption scenario: A prolonged transport disruption prevents many employees from reaching the service location.

The service owner would assess minimum supervision requirements, activate staffing contingencies, communicate with families and determine whether safe service delivery can continue.

CBF-5: Emergency Welfare and Financial Assistance

Purpose: To maintain essential assistance for beneficiaries experiencing urgent financial or social hardship.

Illustrative sub-functions include emergency needs assessment, eligibility verification, assistance approval, payment or distribution coordination, beneficiary notification and essential records management.

Illustrative disruption scenario: An electronic payment or approval system becomes unavailable during a period of increased demand for assistance.

Approved manual procedures or alternative payment arrangements may be required, supported by appropriate authorisation, financial controls and audit records.

CBF-6: Food Assistance and Essential Distribution

Purpose: To maintain essential food support for beneficiaries who depend on regular or emergency assistance.

Illustrative sub-functions include food procurement, receipt, storage, safety checks, packing, distribution scheduling, transportation and beneficiary handover.

Illustrative disruption scenario: A major supplier fails to deliver essential food items.

The recovery team may activate approved alternative suppliers, review available stocks, prioritise urgent beneficiary needs and adjust distribution arrangements.

CBF-7: Critical Beneficiary Case Management and Referral

Purpose: Maintain essential case management activities and provide timely support for vulnerable beneficiaries.

Illustrative sub-functions include urgent case assessment, safeguarding escalation, referrals, inter-agency coordination, case records and follow-up.

Illustrative disruption scenario: Case management systems become unavailable following a cyber incident.

Authorised personnel may need secure offline access to essential case information and documented procedures to manage urgent cases without exposing sensitive personal data.

CBF-8: Beneficiary, Family and Emergency Communications

Purpose: Ensure critical information can be communicated during disruptive incidents.

Illustrative sub-functions include emergency notifications, staff mobilisation, family contact, regulator communications where required, public information coordination and communication with service partners.

Illustrative disruption scenario: A telecommunications outage prevents normal telephone communications.

The organisation may activate approved alternative communication channels and designated contact arrangements while ensuring that messages are accurate, authorised and appropriately protected.

CBF-9: Critical ICT Systems and Information Management

Purpose: To maintain or restore the information and technology capabilities supporting Jamiyah Singapore's critical services.

Illustrative sub-functions include application recovery, data restoration, network connectivity, access management, cybersecurity response, backup management and IT service coordination.

Illustrative disruption scenario: A ransomware incident affects beneficiary administration and financial systems.

ICT recovery arrangements should coordinate containment, integrity verification, restoration from protected backups, and controlled system resumption, with priorities determined by the business functions they support.

CBF-10: Essential Finance, Procurement and Resource Support

Purpose: Maintain the financial and administrative capabilities needed to support critical service delivery and organisational recovery.

Illustrative sub-functions include emergency procurement, urgent payments, payroll support, supplier coordination, resource allocation, insurance administration and financial records management.

Illustrative disruption scenario: A prolonged financial system outage delays payment to essential suppliers.

The finance team may activate approved alternative payment arrangements, emergency authorisation procedures, and manual reconciliation controls to avoid interrupting critical supplies.

 

Assessing the Criticality of Business Functions

Establishing Criticality Criteria

Jamiyah Singapore should use consistent criteria to assess each business function's importance.

The criteria should reflect the organisation's charitable mission and the potential consequences of service interruption.

Table 10.3: Proposed CBF Criticality Criteria

Impact Area	Assessment Considerations	Illustrative Impact
Life, health and safety	Potential harm to residents, patients, children, staff or beneficiaries	Failure to maintain essential resident supervision
Beneficiary welfare	Interruption of essential assistance or support	Delay in food or urgent financial assistance
Legal and regulatory compliance	Breach of applicable statutory, licensing or reporting obligations	Failure to maintain required safeguarding arrangements
Service delivery	Inability to deliver prioritised charitable services	Suspension of essential care or welfare operations
Financial impact	Additional expenditure, loss of resources or financial disruption	Emergency accommodation and transport costs
Reputation and stakeholder confidence	Loss of confidence among beneficiaries, families, donors or authorities	Inadequate communication during a serious incident
Information and data protection	Loss, corruption or unauthorised disclosure of essential information	Unavailability or compromise of beneficiary records
Operational dependencies	Disruption of other critical functions	ICT outage affecting residential care and welfare services

Assessing Impact Over Time

Assess criticality based on how disruption consequences change over time.

For example, interrupting a residential care activity may create immediate safety concerns, while interrupting a routine administrative process may become significant only after several days.

The BIA should assess impacts at agreed time intervals.

An illustrative set of intervals is:

 

Disruption duration	Assessment focus
Immediate to 2 hours	Immediate safety, essential care and emergency response
2 to 4 hours	Short-term service interruption and initial resource constraints
4 to 8 hours	Increasing operational and beneficiary consequences
8 to 24 hours	Sustained disruption to service delivery and supporting resources
1 to 3 days	Significant operational, financial and stakeholder impacts
More than 3 days	Prolonged service interruption and organisational sustainability concerns

Adapt these intervals to each function. Life-critical activities may require assessment in minutes rather than hours.

Establishing Maximum Tolerable Period of Disruption

The Maximum Tolerable Period of Disruption (MTPD) represents the period after which the adverse consequences of not providing a product or service, or performing an activity, become unacceptable.

For Jamiyah Singapore, the MTPD should reflect beneficiary needs, service obligations and operational consequences.

For example, a function involving continuous resident supervision may have an effectively immediate tolerance for interruption, whereas certain non-urgent administrative activities may have a longer MTPD.

The MTPD should be supported by documented impact assessments and approved by the relevant authority within Jamiyah Singapore.

Establishing Recovery Time Objectives

The Recovery Time Objective (RTO) specifies the timeframe within which an activity or resource is to be resumed following disruption.

The RTO should be established within the applicable maximum tolerable disruption period and should account for the time needed to deliver the minimum acceptable level of service.

For example, an approved recovery strategy for essential welfare assistance might involve activating an alternative processing arrangement before delayed assistance becomes unacceptable.

The selected RTO should be achievable and validated through exercises or other appropriate evidence.

 

Identifying Critical Resources and Dependencies

Importance of Dependency Analysis

Critical Business Functions rarely operate independently.

Jamiyah Singapore's frontline services may depend on shared employees, volunteers, facilities, ICT systems, suppliers, transportation, financial resources and external service partners.

A disruption to one shared resource may interrupt several CBFs at once.

Illustrative CBF Resource Dependencies

 

CBF	People	Facilities and Equipment	ICT and Information	External Dependencies
CBF-1 Residential Care	Care personnel and supervisors	Residential premises, utilities, care equipment	Resident records and communications	Food suppliers, transport and emergency services
CBF-2 Nursing Support	Nurses and authorised healthcare personnel	Clinical facilities and equipment	Care records and clinical information	Healthcare providers and medical suppliers
CBF-3 Early Childhood Care	Educators and childcare personnel	Classrooms and child-safe facilities	Attendance and parent contact records	Parents, transport and approved service providers
CBF-4 Student Care	Supervisors and education staff	Student care premises and learning facilities	Student records and communications	Parents, caregivers and education partners
CBF-5 Welfare Assistance	Welfare officers and approving authorities	Service offices and distribution points	Beneficiary and financial records	Banks, donors and community partners
CBF-6 Food Distribution	Employees, volunteers and logistics personnel	Storage, packing and transport facilities	Stock and distribution records	Food suppliers and transport providers
CBF-7 Case Management	Case workers and authorised specialists	Private consultation facilities	Confidential case records	Social service agencies and referral partners
CBF-8 Communications	Communications personnel and service representatives	Communication equipment	Contact databases and messaging platforms	Telecommunications providers
CBF-9 ICT Services	ICT personnel and external technical specialists	Network and computing equipment	Applications, backups and infrastructure	Cloud and managed service providers
CBF-10 Finance and Procurement	Finance, procurement and administration personnel	Office facilities	Finance, payment and procurement systems	Banks, suppliers and professional service providers

Identifying Single Points of Failure

Jamiyah Singapore should assess whether critical functions rely too heavily on a single resource.

Examples may include:

• One employee possessing essential operational knowledge.
• A single supplier providing critical food or medical supplies.
• One information system supporting multiple essential services.
• A single location housing essential records or equipment.
• One communication platform used for emergency notifications.

Where such dependencies are identified, the organisation should consider alternative arrangements, cross-training, redundancy, contractual contingencies or other appropriate controls.

Assessing Third-Party Dependencies

External service providers may play a significant role in sustaining Jamiyah Singapore's operations.

The BCM programme should determine which third parties support critical functions and whether they have adequate continuity capabilities.

For critical suppliers, Jamiyah Singapore may request information about recovery arrangements, alternative delivery capabilities, escalation procedures, and service restoration commitments.

The depth of supplier assessment should be proportionate to the potential consequences of supplier failure.

 

Validating and Approving the CBF Catalogue

Management Validation

The BCM Coordinator, service owners, supporting departments, and senior management should review the initial CBF catalogue through structured discussions.

The review should confirm whether the identified functions accurately reflect Jamiyah Singapore's operations and whether any important activities have been omitted.

Validation should address the following questions:

1. Does the catalogue cover all essential services within the approved BCMS scope?
2. Are the descriptions of CBFs sufficiently clear to support BIA?
3. Have vulnerable beneficiaries and their continuity needs been adequately considered?
4. Are all applicable statutory, regulatory and licensing requirements reflected?
5. Are the function owners and supporting dependencies correctly identified?
6. Are preliminary criticality ratings reasonable and supported by evidence?
7. Have we overlooked any shared resources or single points of failure?

Proposed Approval Responsibilities

 

Role	Responsibility
BCM Coordinator	Consolidates and maintains the CBF catalogue
Business Function Owners	Verify functions, processes, impacts and dependencies
Supporting Function Representatives	Validate ICT, HR, facilities, finance and supplier dependencies
BCM Steering Committee	Reviews prioritisation, gaps and resource implications
Senior Management	Approves the catalogue and preliminary priorities
Board or Designated Governance Committee	Provides oversight of material continuity risks and organisational resilience

Maintaining the CBF Register

Treat the approved CBF register as controlled BCM documented information.

It should contain the function code, name, description, owner, service supported, preliminary criticality, key dependencies, approval status and review date.

Review the register at planned intervals and whenever material organisational changes occur.

Examples of changes requiring review include new service programmes, changes to residential care arrangements, relocation of facilities, introduction of critical technology systems, changes in service providers and revised regulatory obligations.

 

Integrating CBF Identification with Business Impact Analysis

Relationship Between CBF Identification and BIA

Identifying CBFs establishes the initial scope and priorities for detailed Business Impact Analysis.

The BIA then determines the consequences of disruption over time, recovery requirements, minimum acceptable service capacity, and resources required to support recovery.

The relationship can be represented as follows:

Illustrative BIA for CBF-1

The following example demonstrates how Jamiyah Singapore may assess the recovery requirements of Residential Care and Resident Safety.

Table 10.5: Illustrative BIA Summary — CBF-1

BIA Element	Illustrative Assessment
Critical Business Function	CBF-1 Residential Care and Resident Safety
Service supported	Residential care and accommodation
Business Function Owner	Designated Head of Residential Care
Primary impact area	Resident safety, welfare and continuity of essential care
Maximum Tolerable Period of Disruption	Effectively immediate for essential supervision and safety activities
Recovery Time Objective	Continuous provision of essential care, using alternate arrangements where necessary
Minimum acceptable capacity	Sufficient personnel, facilities and supplies to maintain safe essential care
Essential personnel	Care staff, supervisors and designated emergency personnel
Essential resources	Safe premises, utilities, meals, water, hygiene supplies and resident information
Critical dependencies	Staffing, suppliers, transportation, utilities and communications
Potential recovery strategies	Backup supplies, emergency staffing, alternative premises and relocation arrangements
Recovery validation	Emergency exercises, staffing contingency tests and relocation simulations

All values and arrangements in this table are illustrative. Establish specific recovery requirements through a formal BIA, safety assessment, applicable licensing requirements, and management approval.

Translating BIA Findings into Recovery Strategies

Once the BIA is complete, Jamiyah Singapore should determine whether existing arrangements meet approved recovery requirements.

For example, if a residential care facility must maintain essential services continuously, management should evaluate whether emergency staffing, alternative accommodation, backup utilities, and essential supplies are adequate.

Where gaps are identified, the BCM programme should recommend additional mitigation or recovery measures.

Document, resource, approve, and test the resulting strategies.

 

Common Challenges in Identifying CBFs

Jamiyah Singapore may face several challenges in identifying CBFs.

 

Challenge	Potential Consequence	Recommended Approach
Treating every activity as equally critical	Unclear priorities and inefficient resource allocation	Apply consistent impact and time-criticality criteria
Focusing only on financial impacts	Underestimation of beneficiary safety and welfare consequences	Include safety, safeguarding and social impact criteria
Insufficient involvement of service owners	Incomplete understanding of operations	Conduct facilitated workshops with relevant personnel
Overlooking supporting functions	Recovery plans cannot operate effectively	Map ICT, finance, facilities, staffing and supplier dependencies
Using unverified recovery targets	Strategies may not meet actual service requirements	Validate targets through formal BIA and management approval
Failing to consider multiple-site disruptions	Recovery arrangements may rely on unavailable resources	Assess severe but plausible scenarios
Inadequate documentation	Decisions cannot be readily justified or maintained	Maintain a controlled CBF register and supporting evidence
Failure to update the catalogue	BCM priorities become outdated	Establish periodic and change-triggered reviews

An important principle is that criticality should reflect the consequences of interruption, not the organisational seniority of the function owner or the perceived importance of a department.

 

Expected Deliverables from CBF Identification

By the end of this activity, Jamiyah Singapore should have a documented, approved set of outputs to support the subsequent BIA phase.

Table 10.6: CBF Identification Deliverables

 

Recommended CBF Register Fields

For practical implementation, the CBF register should contain:

 

Field	Information Required
CBF Code	Unique function identifier
CBF Name	Approved function name
Function Description	Purpose and scope of the function
Product or Service Supported	Service delivered to beneficiaries or stakeholders
Function Owner	Accountable department or designated officer
Sub-CBFs	Supporting activities and processes
Preliminary Criticality	Initial priority classification
Impact Areas	Safety, welfare, regulatory, operational, financial and reputational impacts
Critical Dependencies	People, facilities, ICT, suppliers and records
BIA Status	Not started, in progress, completed or approved
Approval Authority	Designated management approver
Review Date	Date of the next scheduled review

The register should serve as a central reference for subsequent BIA, continuity strategy development, recovery planning and BCM programme maintenance.

 

Chapter Summary

Identifying Critical Business Functions is a foundational step in implementing an effective BCM programme for Jamiyah Singapore.

The exercise establishes which organisational activities are essential to sustaining services, safeguarding beneficiaries, meeting applicable obligations and fulfilling the organisation's charitable mission.

This chapter introduces a structured approach to identifying CBFs, including service mapping, function decomposition, impact assessment, dependency analysis, preliminary prioritisation, validation, and management approval.

It also proposes a catalogue of ten Critical Business Functions covering residential care, nursing support, early childhood education, student care, welfare assistance, food distribution, beneficiary case management, emergency communications, ICT, and essential finance and procurement support.

These functions provide a practical starting point for the organisation's formal BIA programme.

Key Takeaways

1. CBF identification should be beneficiary-centred. Safety, welfare and continuity of essential support must be prominent considerations when determining criticality.

2. CBF identification is not a substitute for BIA. The catalogue identifies activities requiring further assessment, while the BIA establishes detailed impacts, recovery priorities and resource requirements.

3. Critical functions depend on supporting resources. When developing continuity arrangements, consider people, premises, ICT, information, suppliers, and external partners.

4. Regulatory applicability must be verified. The organisation should identify the legal, governance, and licensing requirements for each service.

5. Management approval is essential. The CBF catalogue and resulting recovery priorities should be validated and formally approved.

6. The catalogue must remain current. Reviews should reflect changes in services, operating arrangements, dependencies and the organisation's external environment.

 

Identifying Critical Business Functions gives Jamiyah Singapore a structured foundation for protecting essential services and strengthening organisational resilience.

By understanding which activities are most time-sensitive and which disruptions could produce unacceptable consequences, the organisation can make informed decisions about recovery priorities, resource allocation, continuity strategies and emergency preparedness.

For Jamiyah Singapore, this process matters beyond maintaining operational efficiency.

The organisation's services may directly affect the safety, health, welfare and well-being of vulnerable beneficiaries.

Consequently, the CBF identification methodology must recognise the different levels of dependency associated with residential care, nursing support, childcare, educational services, welfare assistance and community support programmes.

The proposed catalogue of ten Critical Business Functions offers a practical starting point for the BCM programme.

However, the catalogue is not final until relevant service owners have reviewed it, it has been validated against the organisation's actual operating arrangements, and authorised management has approved it.

Pay particular attention to identifying essential supporting processes, resource dependencies, shared services, and potential single points of failure.

The methodology presented in this chapter supports the activity identification and prioritisation aspects of ISO 22301:2019, including Amendment 1:2024, and is consistent with the implementation guidance of ISO 22313:2020.

It also provides a basis for considering Singapore's charity governance requirements and applicable sector-specific obligations.

Most importantly, identifying CBFs should not be treated as a one-time administrative exercise.

It is an ongoing governance and planning activity that should evolve alongside Jamiyah Singapore's services, organisational structure, technology, partnerships and operating environment.

The approved CBF catalogue will form the foundation for the next stage of BCM implementation: conducting a detailed Business Impact Analysis to determine disruption impacts, recovery priorities, minimum service requirements, resource dependencies, and appropriate continuity strategies.

Through this systematic approach, Jamiyah Singapore can move from identifying its essential functions to establishing practical, tested, and sustainable arrangements to maintain critical community services during disruption.

The ultimate objective is to ensure Jamiyah Singapore remains prepared to protect its beneficiaries, sustain its charitable mission, and continue serving the community when it needs its services most.