[BCM] [KKH] [E1] [C8] Implementing the BCM Planning Methodology

Business Continuity Management Planning Methodology for KK Women's and Children's Hospital

 

 

Introduction

Implementing an effective Business Continuity Management System (BCMS) requires a structured, disciplined methodology to ensure all aspects of organisational resilience are addressed systematically.

ISO 22301:2019 provides the requirements for establishing, implementing, maintaining, and continually improving a BCMS, but it does not prescribe a specific implementation methodology.

Organisations therefore adopt structured frameworks that translate the standard's requirements into practical implementation activities.

For KK Women's and Children's Hospital (KKH), the implementation of BCM must recognise the complexity of healthcare delivery, the interdependencies between clinical and support services, and the overriding priority of patient safety.

A structured planning methodology enables KKH to identify critical healthcare services, assess operational risks, develop appropriate recovery strategies, prepare practical Business Continuity Plans (BCPs), validate their effectiveness through exercises, and sustain organisational resilience through continual improvement.

This eBook adopts a Seven-Phase Business Continuity Management Planning Methodology, which aligns with ISO 22301 and reflects internationally recognised BCM good practices.

The methodology provides a logical sequence for planning, implementing, maintaining, and improving the BCMS while ensuring that every stage builds upon the previous one.

Although presented sequentially, BCM is a continuous management process, with regular reviews and updates to respond to organisational changes, emerging risks, and lessons learned.

 

Overview of the Seven-Phase BCM Planning Methodology

 

The BCM Planning Methodology consists of the following seven phases:

• Project Management (PM)

• Risk Analysis and Review (RAR)

• Business Impact Analysis (BIA)

• Business Continuity Strategy (BCS)

• Plan Development (PD)

• Testing and Exercising (TE)

• Programme Management (PgM)

Together, these phases establish a comprehensive Business Continuity Management lifecycle that supports continual improvement and organisational resilience.

 

Phase	Primary Purpose	Key Deliverables
Project Management	Establish and govern the BCM project	Project Charter, Scope, Governance Structure
Risk Analysis and Review	Identify threats and vulnerabilities	Risk Register, Risk Assessment Report
Business Impact Analysis	Identify critical business functions and recovery requirements	BIA Reports, Recovery Priorities
Business Continuity Strategy	Determine recovery solutions	Continuity Strategy, Resource Requirements
Plan Development	Prepare continuity and recovery plans	Business Continuity Plans, Incident Management Plans
Testing and Exercising	Validate plans and capabilities	Exercise Reports, Improvement Actions
Programme Management	Sustain and continually improve the BCMS	Programme Reviews, KPIs, Audit Reports

 

The Seven-Phase BCM Planning Methodology

Phase 1: Project Management (PjM)

Project Management establishes the foundation for implementing the BCMS by defining governance, objectives, scope, responsibilities, timelines, and resource requirements.

 

Objectives

• Obtain executive sponsorship.
• Define project scope.
• Establish BCM governance.
• Allocate project resources.
• Develop implementation schedules.
• Engage stakeholders.
• Monitor project progress.

 

Key Activities

• Develop the BCM Project Charter.
• Establish the BCM Steering Committee.
• Appoint the BCM Manager and Department Coordinators.
• Define project milestones.
• Develop communication plans.
• Identify project risks.

 

Deliverables

• BCM Project Charter
• Project Plan
• Governance Structure
• Stakeholder Register
• Communication Plan

 

Example – KKH

KKH establishes a BCMS implementation project covering all clinical and corporate departments.

Senior management appoints an Executive Sponsor, forms a BCM Steering Committee, and develops a phased implementation schedule beginning with high-priority clinical services such as the Neonatal Intensive Care Unit (NICU), Labour and Delivery, and Children's Emergency Department.

 

Phase 2: Risk Analysis and Review (RAR)

Purpose

Risk Analysis and Review identifies threats, vulnerabilities, and risks that may disrupt healthcare operations.

 

Objectives

• Identify operational threats.
• Evaluate organisational vulnerabilities.
• Assess risk likelihood and consequences.
• Determine risk treatment priorities.

 

Key Activities

• Conduct risk workshops.
• Identify internal and external threats.
• Assess existing controls.
• Evaluate residual risks.
• Develop a Risk Register.

 

Deliverables

• Risk Assessment Report
• Risk Register
• Threat Catalogue
• Risk Treatment Recommendations

 

Examples of Risks for KKH

• Cyberattacks affecting Electronic Medical Records.
• Pandemic outbreaks increasing patient demand.
• Utility failures affecting operating theatres.
• Medical gas supply interruptions.
• Pharmaceutical shortages.
• Flooding affecting hospital infrastructure.

 

 

Phase 3: Business Impact Analysis (BIA)

Purpose

The Business Impact Analysis determines the consequences of disruptions and identifies the hospital's Critical Business Functions.

 

Objectives

• Identify critical business functions.
• Determine operational impacts.
• Establish Recovery Time Objectives (RTOs).
• Identify resource requirements.
• Prioritise recovery.

 

Key Activities

• Conduct departmental interviews.
• Identify business processes.
• Determine operational dependencies.
• Assess financial, clinical, legal, and reputational impacts.
• Establish recovery priorities.

 

Deliverables

• Business Impact Analysis Reports
• Critical Business Function Register
• Recovery Priority Matrix
• Resource Requirements

 

Example – KKH

The BIA identifies that the Neonatal Intensive Care Unit (NICU), Emergency Obstetric Services, Children's Emergency Department, Pharmacy, Laboratory Services, and Electronic Medical Records are Priority 1 services requiring rapid recovery to minimise patient safety risks.

Phase 4: Business Continuity Strategy (BCS)

Purpose

Business Continuity Strategy identifies practical solutions that enable critical services to continue or recover within established recovery objectives.

 

Objectives

• Select recovery strategies.
• Determine resource requirements.
• Reduce operational vulnerabilities.
• Improve resilience.

 

Key Activities

• Evaluate recovery options.
• Identify alternate facilities.
• Develop workforce continuity strategies.
• Strengthen supply chain resilience.
• Enhance ICT resilience.

 

Deliverables

• Business Continuity Strategy Document
• Recovery Resource Plan
• Alternate Site Strategy
• ICT Recovery Strategy
• Workforce Continuity Strategy

 

Example – KKH

To ensure continuity of critical maternity and neonatal services, KKH develops strategies that include redundant power supplies, emergency medical gas systems, alternative suppliers for essential neonatal medications, cross-trained clinical staff, and high-availability ICT infrastructure.

 

Phase 5: Plan Development (PD)

Purpose

Plan Development documents the procedures required to respond to and recover from disruptive incidents.

 

Objectives

• Prepare Business Continuity Plans.
• Develop Incident Management Plans.
• Document recovery procedures.
• Assign responsibilities.
• Establish communication protocols.

 

Key Activities

• Develop departmental BCPs.
• Prepare Incident Response Plans.
• Document manual workarounds.
• Develop notification procedures.
• Establish escalation criteria.

 

Deliverables

• Business Continuity Plans
• Incident Management Plan
• Department Recovery Procedures
• Emergency Contact Lists
• Communication Templates

 

Example – KKH

The Pharmacy Department develops a Business Continuity Plan that details emergency medication dispensing procedures, alternative storage arrangements, communication with suppliers, and manual documentation processes during prolonged system outages.

 

Phase 6: Testing and Exercising (TE)

Purpose

Plan Development documents the procedures required to respond to and recover from disruptive incidents.

 

Objectives

• Prepare Business Continuity Plans.
• Develop Incident Management Plans.
• Document recovery procedures.
• Assign responsibilities.
• Establish communication protocols.

 

Key Activities

• Develop departmental BCPs.
• Prepare Incident Response Plans.
• Document manual workarounds.
• Develop notification procedures.
• Establish escalation criteria.

 

Deliverables

• Business Continuity Plans
• Incident Management Plan
• Department Recovery Procedures
• Emergency Contact Lists
• Communication Templates

 

Example – KKH

The Pharmacy Department develops a Business Continuity Plan that details emergency medication dispensing procedures, alternative storage arrangements, communication with suppliers, and manual documentation processes during prolonged system outages.

 

Phase 7: Programme Management (PgM)

Purpose

Programme Management ensures the BCMS remains effective through governance, monitoring, review, and continual improvement.

 

Objectives

• Maintain BCM documentation.
• Monitor programme performance.
• Conduct internal audits.
• Review management performance.
• Coordinate continual improvement.

 

Key Activities

• Annual BCMS reviews.
• Internal audits.
• KPI monitoring.
• Management reviews.
• Updating BIA and Risk Assessments.
• Training and awareness.
• Regulatory compliance reviews.

 

Deliverables

• BCMS Performance Reports
• Audit Reports
• Management Review Minutes
• Improvement Plans
• Updated BCM Documentation

Example – KKH

Following an annual BCM exercise, KKH reviews recovery performance, updates departmental continuity plans, revises recovery priorities where necessary, and incorporates new cybersecurity measures into the BCMS.

 

Relationship Between the Seven Phases

The seven phases are interdependent.

Project Management
│
▼
Risk Analysis & Review
│
▼
Business Impact Analysis
│
▼
Business Continuity Strategy
│
▼
Plan Development
│
▼
Testing & Exercising
│
▼
Programme Management
│
└───────────────► Continual Improvement

The methodology supports the Plan–Do–Check–Act (PDCA) cycle that underpins ISO 22301.

 

Alignment with ISO 22301

The seven-phase methodology aligns closely with the major requirements of ISO 22301.

 

BCM Phase	ISO 22301 Alignment
Project Management	Clauses 4, 5 and 6 – Context, Leadership, Planning
Risk Analysis and Review	Clause 6 – Planning and Risk Management
Business Impact Analysis	Clause 8 – Operational Planning and Control
Business Continuity Strategy	Clause 8 – Business Continuity Strategies and Solutions
Plan Development	Clause 8 – Business Continuity Procedures
Testing and Exercising	Clause 8 – Exercising and Testing
Programme Management	Clauses 9 and 10 – Performance Evaluation and Improvement

 

This alignment ensures that KKH's BCMS implementation is consistent with internationally recognised business continuity practices.

 

Practical Example

KKH decides to strengthen the resilience of its Labour and Delivery services.

Using the seven-phase methodology:

• Project Management establishes the project team and defines implementation milestones.
• Risk Analysis and Review identifies potential disruptions such as power failures, ICT outages, infectious disease outbreaks, and medical gas interruptions.
• Business Impact Analysis confirms Labour and Delivery as a Priority 1 Critical Business Function and establishes recovery requirements.
• Business Continuity Strategy recommends redundant utilities, emergency staffing arrangements, alternative pharmaceutical suppliers, and backup communication systems.
• Plan Development documents response procedures, escalation processes, and manual clinical workflows.
• Testing and Exercising validates the plan through a simulated utility outage affecting delivery suites.
• Programme Management reviews lessons learned, updates documentation, monitors performance indicators, and schedules future exercises.

This structured methodology ensures that BCM implementation is comprehensive, repeatable, and continually improved.

Summary of the Seven-Phase BCM Planning Methodology

Phase	Focus	Primary Outcome
Project Management	Governance and project planning	Organised implementation programme
Risk Analysis and Review	Threat identification	Understanding of organisational risks
Business Impact Analysis	Criticality assessment	Recovery priorities established
Business Continuity Strategy	Recovery solutions	Resilient operational strategies
Plan Development	Documentation	Practical continuity and recovery plans
Testing and Exercising	Validation	Proven recovery capability
Programme Management	Governance and improvement	Sustainable and continually improving BCMS

 

A structured planning methodology is essential for implementing an effective and sustainable Business Continuity Management System.

The Seven-Phase BCM Planning Methodology presented in this chapter provides KK Women's and Children's Hospital with a practical framework for translating the requirements of ISO 22301 into a comprehensive programme of governance, risk assessment, impact analysis, strategy development, plan preparation, testing, and continual improvement.

Each phase builds upon the previous one, ensuring that continuity planning is systematic, evidence-based, and aligned with the hospital's strategic priorities.

For KKH, this methodology supports more than regulatory compliance—it strengthens the hospital's ability to safeguard patients, maintain critical maternity, neonatal, paediatric, and specialist healthcare services, and respond effectively to disruptive events.

By embedding the seven phases into routine organisational management and continually reviewing their effectiveness, KKH can enhance its operational resilience, adapt to emerging risks, and sustain the delivery of safe, reliable, and high-quality healthcare services for the communities it serves.