Recovery

A disruption ends twice: once when the cause is contained, and again when the business is actually back to agreed levels — and only the second ending counts. Recovery exists as a managed phase so that this return follows the priorities the organisation set in calmer times. The executive decision it carries is about sequence and sufficiency: what comes back first, at what level of service, and when it is safe to declare normal operations. Declared too early, recovery collapses into a second incident; declared too late, it burns money and customer patience.

In practice, recovery follows the order established by the business impact analysis (BIA) and the targets attached to it — recovery time objectives (RTO) and minimum service levels (MBCO). A recovery coordinator tracks progress against these targets and reports to the crisis team at fixed intervals, typically every 4 to 12 hours. After a warehouse fire, that means shipping the top-priority contracts from the backup site within 24 hours at reduced volume, then restoring full throughput over one to two weeks. The formal decision to stand down the crisis structure is minuted, with named owners for what remains.

The common mistake is treating recovery as a technical afterthought — systems are up, so the incident is closed — while backlogs, quality issues and exhausted teams are still degrading the business. Another is recovering everything at once, which protects nothing in particular. In the ERGP programme, recovery targets and their sequence are the subject of module M3, Impact analysis and the economics of recovery.