One of the typical outputs from a business impact analysis is a list of recovery time objectives for the infrastructure, systems and services – workspace, IT systems, plant, equipment, telephony, etc – that support the organisation’s key activities. This information is extremely useful, if not essential, to those determining the business continuity strategy and the solutions that underpin it.

But there’s an important and all-too-commonly experienced issue to watch out for. It involves our old friends communication and assumption.

As often as not there will be gaps between the identified and the achievable recovery time objectives. This in itself isn’t the problem. The issue comes when those gaps aren’t communicated back to the business. Because, in the absence of any information to the contrary, their assumption is likely to be that they’ll get what they asked for during the business impact analysis. And incorrect assumptions lead to invalid plans and a lack of continuity capability.

The solution is simple. All it requires is that we close the loop and communicate the reality back to those who contributed to the business impact analysis. Whilst they may not like what they hear, it will at least allow them to plan their contingencies, manual workarounds or other mitigation measures, based on assumptions that are realistic. And, therefore, to develop plans that stand a chance of actually working.