[BCM] [SHINE] [E1] [C10] Identifying Critical Business Functions

What are the SHINE Children and Youth Services’ Critical Business Functions Concerning Business Continuity Management?

In line with ISO 22301 (Business Continuity Management System – BCMS), an essential first step in SHINE’s continuity planning is identifying its “critical business functions.”

These are the services and operations essential to fulfilling SHINE’s mission—providing care, social work, educational psychology, and supportive services to vulnerable children and youth—and their disruption would materially impair SHINE's ability to fulfil it.

For a social-service and charity organisation such as SHINE, continuity is not just about organisational survival — it is about ensuring uninterrupted “continuity of care.”

This means that any disruption (e.g., pandemic, natural disaster, cyber incident, major staffing crisis, funding shortage) must not derail the delivery of services to children, youth, and families who depend on them.

For a social-service and charity organisation such as SHINE, continuity is not just about organisational survival — it is about ensuring uninterrupted “continuity of care.”

This means that any disruption (e.g., pandemic, natural disaster, cyber incident, major staffing crisis, funding shortage) must not derail the delivery of services to children, youth, and families who depend on them.

Accordingly, the critical business functions identified here serve as the foundation for SHINE’s BCM strategy: by protecting and recovering these functions, SHINE ensures resilience, fulfilment of its charitable mission, regulatory compliance (as an IPC), and trust among beneficiaries, partners and donors.

SHINE’s Core Service-Based Critical Business Functions (CBF)

Based on SHINE’s publicly stated programmes and services, the following are its primary critical business functions (CBF).

Each represents a service line that is central to SHINE’s purpose, and thus must be preserved or recovered quickly under a continuity plan.

Supporting Functions — Enablers of Critical Services

In addition to direct service lines, SHINE relies on a set of supporting, enabling functions that, while not outward-facing, are critical to sustaining core operations. Without these, critical services cannot be delivered effectively.

Under ISO 22301, these should also be included in the business impact analysis and continuity planning. Key enablers include:

• Human Resource Management & Staff Capability — SHINE’s staff of social workers, psychologists, counsellors, administrative personnel, and, where applicable,  volunteers are essential. Their availability, well-being, and competence are fundamental. According to SHINE, they employ professional staff and support their development.
  
  
• Information Management & Client Records (Data Management, Confidentiality) — SHINE deals with sensitive client data (children’s assessments, counselling records, family history, casework). Proper data protection and access continuity are vital (e.g., secure client records, confidentiality, access to therapy and support history, and privacy protection). The presence of a “Data Protection Notice” on SHINE’s website suggests that data handling is a formal concern.
  
  
• Communication & Stakeholder Engagement Infrastructure — Effective communication with stakeholders (clients, families, schools, community partners, donors, volunteers) is vital to coordinating interventions, referrals, scheduling, outreach, fundraising, and volunteer mobilisation. Loss of communication channels (e.g., due to IT failures or disasters) would impair delivery.
  
  
• Funding & Resource Management / Financial Continuity — As a registered charity and IPC member, SHINE depends on budgetary support, donations, grants, and in-kind support. Maintaining financial inflows and resource allocation is critical to sustain services. Disruption to funding or resource allocation (e.g., food distribution, in-kind support) would jeopardise service delivery.
  
  
• Partnerships, External Collaborations & Community Network Management — Many of SHINE’s programmes rely on partnerships with schools, other social organisations, volunteers, and community stakeholders to effectively reach beneficiaries.
  
  
• Governance, Compliance & Reporting Functions — As a registered charity under regulatory oversight (IPC status, possibly data protection and child-safety regulations), SHINE must maintain governance, compliance, reporting, and transparency. Disruption here could impair its regulatory standing, donor trust, or its legal ability to operate. SHINE’s public receipt of a “Charity Transparency Award” underscores the importance of governance and accountability.

Table: SHINE Children and Youth Services — Critical Business Functions (ISO 22301)

Prioritisation — Which Functions Are “Critical” Under ISO 22301

Under ISO 22301, critical business functions are those whose loss would:

• severely impact the delivery of SHINE’s mission (continuity of care for children and youth), or
• cause unacceptable harm to beneficiaries, or
• jeopardise regulatory or donor confidence / organisational viability.

Based on that principle, the highest-priority critical functions for SHINE are:

1. Direct Service Delivery Functions — Educational Psychology, Community & School Social Work, Counselling/Therapy Services, Targeted Interventions.
2. Staff & Human Resource Capacity — Without suitably qualified and available staff, service delivery cannot be restored.
3. Client Data & Information Management — Loss or corruption of records would undermine the ability to continue casework, therapy, and interventions.
4. Communication & Stakeholder Engagement — Ensures effective coordination with clients, families, schools, partners, and volunteers.
5. Funding/Resource Management & Donor/Partnership Network Management — Cash flow, in-kind donations, and volunteer support are essential for sustainability.
6. Governance & Compliance — Ensures legitimacy and trust; without it, SHINE risks regulatory or reputational damage, possibly leading to service suspension.

Other enabling functions — such as training & capacity building, long-term research, outreach activities — while vital for long-term sustainability and quality improvement, may be considered lower priority for immediate recovery if resources are constrained.

However, they still need to be addressed in the BCMS to ensure full organisational resilience.

Implications for SHINE’s BCM / Continuity-of-Care Strategy

Identifying these critical business functions had direct consequences for how SHINE designs its BCM program:

• Business Impact Analysis (BIA): For each critical business function above, SHINE must assess the impact of disruption (e.g., immediate loss of counselling services; medium-term degradation of data integrity; long-term donor fatigue) and classify acceptable downtime (Recovery Time Objective — RTO) and recovery point (Recovery Point Objective — RPO, especially for data).
  
  
• Business Continuity (BC) Plans: Develop tailored BC Plans — e.g., for staff shortages (backup workforce, flexible work, volunteer surge), for data/information system failure (data backup, secure cloud storage, manual fallback), for loss of premises (alternate service locations or remote delivery), for funding disruption (diverse funding sources, contingency funds), for communication breakdown (redundant communication channels), and for partner/volunteer disruption (alternative partners, volunteer pools).
  
  
• Emergency Response & Crisis Management: For sudden events affecting children and youth (e.g., pandemic, national crisis, community-wide disruption), SHINE should be ready to switch to remote/virtual delivery of services (e.g., online counselling, remote psycho-educational assessment, remote casework), ensure data protection, maintain contact with families, and coordinate with the social service ecosystem.
  
  
• Training & Awareness: Ensure staff are trained in BCM, including operational procedures, child safety, confidentiality, remote delivery, and alternative modalities.
  
  
• Governance & Review Mechanism: Embed BCM into SHINE’s governance and quality assurance processes; regular review of BIA, BCP, testing, exercising, and updating based on changing risks (e.g., cyber-risks, climate-related, public health).

Why Protecting SHINE’s Critical Functions Matters

For SHINE, continuity is not merely a business objective — it is a moral and social imperative. The children, youth and families it serves often rely on timely, trusted, and sometimes lifesaving support.

Disruptions to SHINE’s services risk not only organisational harm but potentially long-term adverse outcomes for vulnerable individuals.

By clearly identifying critical business functions and building a robust BCMS in line with ISO 22301, SHINE can safeguard its capacity to deliver “continuity of care” — ensuring that, even in times of crisis, children and youth in need continue to receive the support, stability, and hope that SHINE strives to provide.