Assessing the Risks

This model is then used in the other part of this workshop process, which is to rank the importance of processes and to assess risks. Disaster recovery specialists are more concerned about specific risks, such as hurricanes, but business continuity planners tend to talk more in systems and processes. "I need a plan to tell me what to do when the power goes out," Protiviti's Porier says. "It doesn't matter what caused it."

In assessing risks, it's also important to understand the importance of manual work-arounds. "Right-sizing is really important. Payroll may say that if the payroll system fails on Tuesday, they can't pay anyone on Thursday," Cohen says. "But actually they could make copies of last week's pay stubs and use those until the system is up and running. That stretches their recovery time to a week or more."

Some of these processes may already be in place. "An executive may tell you that sales can't be without their systems for more than a half hour," Cohen says. "Then you talk with the salespeople, and they say, 'Oh, we have outages longer than that all the time. We know what to do.'" The lesson: You have to talk to a lot of people.

Be aware of the tendency of many departments to label their functions mission-critical. That's why, after mapping out processes and risks with each business unit, it's essential to go back to senior management for a reality check on what really is a Tier 1 process and what is more likely Tier 2 or 3. "We call it the management filter," Protiviti's Porier says.