Meridian Freight: Rebuilding a BIA Under Contractual Pressure

The existing BIA cannot safely be used to design DR. Rating all 47 applications as critical with the same four-hour RTO produces no prioritisation, so funding and recovery effort cannot be targeted. The work was IT-led, which means process impacts, contractual exposure and manual workarounds were never assessed. Copying the previous template suggests the ratings were inherited rather than analysed. No business sign-off means the results have no ownership and no defensible basis for an RTO commitment.

A redo in ten weeks should be business-led and process-based:

• Identify the small number of processes that directly affect order capture, dispatch and customer commitments.
• Run workshops with process owners and the contract owner to establish impact over time at 1 hour, 4 hours, 24 hours and 3 days across financial, contractual, regulatory, safety and reputational categories.
• Derive MTPD for each process, then set RTO below it with a margin, and set RPO from data-loss tolerance. The new contract fixes order capture at a two-hour RTO and a five-minute RPO; validate whether those are achievable and where they apply.
• Map process dependencies to the WMS, TMS, interfaces and infrastructure, and record manual workarounds separately.
• Analyse normal and peak conditions, because doubled volumes and temporary staff change both impact and recovery capacity.
• Obtain written sign-off from process owners and the COO.

This is a BIA, not a threat risk assessment: it establishes time tolerances, while a separate risk assessment evaluates which threats could breach them.

The contract sets two distinct requirements. Order capture must be recovered within two hours, so its RTO is at most two hours. No more than five minutes of order data may be lost, so its RPO is at most five minutes. These are contractual minima, not targets to be averaged with the existing four-hour rating.

Implications:

• Nightly backup almost certainly gives an RPO of up to 24 hours, which breaches the five-minute requirement. Continuous replication or journaling is needed for order data, or a store-and-forward design that holds transactions locally until the central system returns.
• A two-hour RTO requires pre-planned capacity, tested runbooks, automated DNS or traffic switching and staff who can execute under pressure. It cannot rely on rebuilding 11-year-old WMS components after an incident.
• The legacy WMS may not support modern replication. If not, the interim control must be a tested local order-capture procedure at each distribution centre, with unique order numbering, reconciliation and a defined maximum backlog.
• The €40,000 per hour service credit gives a financial basis for investment. Compare the cost of replication and testing with the credit exposure during peak season.
• Tier the remaining applications: dispatch and customer tracking may need short RTOs, while reporting and archive systems can tolerate much longer outages. A uniform four-hour RTO wastes money and distracts from the contractual risk.

A provisional top-ten list is useful as a working hypothesis, but it must not become an unexamined commitment. I would tell the COO that we will use a provisional tiering to start work immediately, then validate it against impact criteria and the contract within the ten-week window.

The response should separate speed from rigour:

• Use available evidence now: the customer contract, order volumes, manual workaround capacity and recent incident data.
• Hold short workshops with only the process owners for order capture, dispatch, billing and customer service.
• Record assumptions explicitly, including peak volumes and temporary staff capability.
• Have the COO sign a provisional tiering decision with a review date after peak season.

The danger of 'declaring' criticality is that systems become critical because of seniority or habit, not impact. That leads to spending on the wrong recovery capability and leaving the contractual two-hour order-capture requirement exposed. The COO's instruction can be honoured as a decision to prioritise, provided the basis is documented and revisited. This avoids both paralysis and arbitrary prioritisation.