CEOs question disaster plans. (IT Spending).

THE SURGE IN demand for disaster recovery services in the months since September 11 underscores how many senior managers have found their companies' contingency plans lacking. "I'm seeing a lot of CEOs questioning their company's disaster recovery strategy," says Terryn Barill, CEO of Princeton, NJ-based risk management consultant TBI.

Too often, Barill says, disaster recovery plans are updated annually as part of corporate strategy reviews, but not maintained as "living documents" by an in-house executive dedicated to updating them. Relegated to IT staffers who understand corporate computer architecture--but not necessarily which aspects of it are key to the business' most pressing financial goals--recovery plans are often inefficient, failing to consider global or departmental business priorities, she says.

For instance, many companies will claim that all their systems need to go live within one time frame following a disaster, when not all systems need that degree of urgency. "It could be that some functions need to return within eight hours, at a high cost, but others could wait 24 hours, at a lower cost," she says. Companies that don't look at the tiers of their business can spend more than they need to.

Given that disaster recovery is often one of the most expensive budget items, it's also one of the hardest to justify. "It's the return on investment story," says Kevin Suboski, president and CEO of Clarkston, MI-based Distributed Computing Consultants. "You're spending a lot of money on something which may never happen."

And if a company's biggest threat is keeping step with competitors and getting a product to market within six months, then spending money on disaster recovery might even be an "imprudent use of resources," says Suboski. "The challenge for the CEO is ensuring that the decisions made within IT are consistent with the business."

As companies review their disaster recovery plans, Barill suggests maintaining the disaster recovery plan as a live document and advises thinking internationally, as companies grow increasingly networked beyond their own borders. Keeping the disaster recovery plan updated "often falls under the role of the CIO," she adds, "but it's the CEO's responsibility."

Answering to the Chief

"To whom does the most senior IT official report?"

1,400 companies respond:

CEO                   45%
CFO                   15%
COO                    8%
President              6%
VP/Director/Manager    5%
Owner/Partner          4%
Other                 11%
Don't Know/No Answer   6%

Source: RHI Management Resources, November 2001.

Note: Table made from pie chart