RTO Conflict After Vendor Hosting Migration
A regional insurance claims processor moved its policy administration system to a vendor's SaaS platform 14 months ago. During the original BIA, the system was rated with a 12-hour RTO because claims intake fed a regulatory 24-hour acknowledgment requirement. The vendor's standard contract now guarantees only a 24-hour recovery objective, with a 4-hour RPO, and offers a premium tier at 8-hour RTO for an additional 38% annual fee. The internal BIA has not been refreshed since the migration. Last quarter, two unplanned vendor outages each lasted 6-9 hours; during both, intake staff manually logged 1,100-1,400 claims per day on spreadsheets, and the compliance team confirmed no acknowledgment deadlines were missed because manual workarounds covered the gap. The CIO wants to drop the premium tier and rewrite the RTO to 24 hours to save cost. The compliance officer is uneasy. The business unit manager says the manual workaround 'worked fine, mostly.'
1. Should the RTO be changed to 24 hours? Justify your recommendation using BIA reasoning and identify what evidence is missing.
Read the worked answer
The RTO should not simply be rewritten to match the vendor's capability; it must be derived from business and regulatory impact, then reconciled against delivery capability. Key reasoning:
- RTO is an impact-driven target, not a procurement artifact. The original 12-hour figure traced to a 24-hour regulatory acknowledgment clock. That dependency still exists unless the regulation or the manual workaround has been formally validated as an acceptable compensating control.
- The two outages are suggestive but not sufficient. Manual logging covered 6-9 hour gaps at 1,100-1,400 claims/day. That demonstrates feasibility for outages of that duration, not for a 24-hour-plus recovery. Workaround sustainability (overtime, error rates, backlog aging, fraud controls) was not measured.
- Missing evidence: refreshed BIA with current claim volumes and staffing; measured error/rework rates during the manual periods; the maximum duration the manual process can be sustained before compliance or financial thresholds breach; documented compliance sign-off on the workaround as a control; and the true cost of the premium tier versus the cost of a compliance breach.
Recommendation: Do not unilaterally move to 24 hours. Commission a targeted BIA refresh, obtain written compliance acceptance of the workaround with a defined maximum duration, and only then decide. If the workaround is validated to, say, 16 hours, an 8-hour or intermediate tier may be justified; if not, the premium tier is the cheaper risk.
2. The CIO argues the 38% premium is pure cost with no benefit because 'nothing bad happened.' How should the continuity professional frame this to management?
Read the worked answer
Reframe from 'nothing happened' to 'what did we accept, and at what exposure?'
- Absence of loss is not evidence of adequate control. Two near-misses within a quarter is a signal of frequency, not proof of safety. The relevant question is the loss distribution: probability of an outage exceeding the workaround's sustainable duration, multiplied by the cost of that breach (regulatory penalty, claim delays, reputational and remediation cost).
- Quantify the exposure. Estimate the cost per day of an intake failure beyond manual capacity, including penalty exposure, customer harm, and recovery backlog. Compare that expected loss against the 38% premium.
- Present options, not a binary. Lay out: (a) keep premium tier, (b) drop tier with validated workaround and a documented risk acceptance signed by the business owner and compliance, (c) intermediate investment in workaround automation to extend sustainable duration. Each with cost and residual risk.
- Make the decision owner explicit. The continuity professional advises; the accountable executive accepts residual risk in writing. That converts an unmanaged gap into a governed decision.