The Uniform RTO Mandate
A regional health insurer has just completed its first business impact analysis. The claims vice president assigned claims adjudication an RTO of 8 hours, saying he 'could not imagine' a longer outage. The analyst documented two hard dependencies: a mainframe data feed from the parent company that recovers in 48 hours, and a print-and-mail vendor with a contractual recovery commitment of five business days. The COO, under budget pressure, wants one enterprise-wide RTO of 24 hours applied uniformly to simplify planning and cut recovery costs. The continuity manager has three weeks, no new software, and a CIO who wants defensible numbers before the board meeting.
1. How should the continuity manager reconcile the 8-hour claims RTO with the 48-hour upstream dependency? What does the BIA actually support?
Read the worked answer
- The BIA cannot assert an RTO shorter than the longest critical upstream dependency unless a validated alternative exists. The 8-hour business requirement and the 48-hour achievable recovery are different facts, and both belong in the record.
- Separate three numbers: business requirement (8h), maximum tolerable downtime (what the business can actually absorb before unacceptable harm), and achievable recovery time given current dependencies (48h for the automated feed).
- Then ask the only useful question: is there a workaround that meets the business need? Examples: manual intake and queued adjudication with later batch posting, an interim data extract from the parent, or a renegotiated feed recovery commitment. Test whether the workaround is operationally feasible at acceptable cost and quality during the 48-hour window.
- If a workaround exists, document it as the strategy and note that automated recovery still lags.
- If no workaround exists, escalate as a documented risk with business-owner acceptance and a remediation plan. Do not silently rewrite the RTO to 48 hours to match the dependency; that erases the business requirement and removes any pressure to improve the dependency.
2. Evaluate the COO's proposal for a single 24-hour enterprise RTO.
Read the worked answer
- A uniform RTO is a budgeting shortcut that conflates process criticality. It will over-invest in low-impact processes and under-protect tier-1 ones, and it does not even solve the claims problem: 24 hours still exceeds the 8-hour requirement and sits inside the 48-hour dependency gap.
- Present tiers, not a single number: for example 4/24/72 hours, derived from financial, regulatory, and customer impact, with a documented cost-of-downtime estimate for each tier.
- Show the trade: uniform recovery spend spread across non-critical processes versus focused spend on the few processes that drive loss.
- Offer a compromise that addresses the COO's real goal (simplicity): reduce the number of custom RTOs by standardizing on a small set of bands, so most processes fall into one of three tiers rather than dozens.
- Record the decision either way, including residual risk if the COO overrules.
3. Given three weeks and no tools, what should the BIA deliver to be defensible?
Read the worked answer
- Scope to the 5-8 processes carrying the most revenue, regulatory exposure, or customer harm; do not attempt complete coverage.
- Run facilitated dependency-mapping workshops rather than send forms; capture RTO, RPO, minimum resources, and upstream/downstream dependencies in a simple spreadsheet.
- Capture assumptions and confidence levels explicitly. A number with its basis stated survives scrutiny; an unsupported precise number does not.
- Obtain business-owner sign-off on each RTO - defensibility comes from method and accountability, not software.
- Produce a one-page gap register (requirement versus achievable) for the board, and schedule a second wave after the board meeting.
- State clearly in the report what was not assessed.