Calculating return on investment for IT disaster recovery

By Anna Hobey

Expenditures on disaster recovery (DR) solutions are frequently considered a cost of doing business, not an investment. Or they may be viewed as insurance policies that, hopefully, will never be called on to pay out claims.

If it was true that DR solutions were merely insurance policies that pay out only when a disaster strikes then the "good enough" strategy might, indeed, be appropriate. To understand why, first consider the definition of "disaster."

The "Insurance" Value of DR

From the DR insurance viewpoint, a disaster is an event that causes a level of destruction that forces you to restore data and applications from backup media and/or transfer system operations to another site.

Economists generally suggest that the best way to value an uncertain outcome is with expected value theory. Put simply, the expected value is the value of the possible outcome times the probability of it occurring. Consider, for example, the following scenario (all numbers are hypothetical and likely bear little relationship to your circumstances):

• Disaster Angst Corp. (DAC) is considering an investment in DR technologies. With the technology in place, the improvement in disaster recovery time and completeness will reduce the cost of a disaster by $1 million compared to the status quo.
• DAC uses a five-year planning horizon for its technology investments.
• The probability of one and only one disaster occurring within DAC's planning horizon is 0.1 percent (=0.001).
• The probability of two and only two disasters occurring is 0.05 percent (=0.0005).
• The probability of three and only three disasters occurring is 0.005 percent (=0.00005).
• The probability of more than three disasters occurring within DAC's planning horizon is small enough to be ignored.

Under the above scenario, the expected value of the DR technology is ($1,000,000 * .001) + ($1,000,000 * .0005) + ($1,000,000 * .00005) = $1,550, minus the cost of the technology. Using these numbers, an investment in DR technology would be a losing proposition if the technology costs more than $1,550.

Even this overestimates the value because it does account for the time-value of money. The hardware and software costs associated with implementing DR solutions are incurred up-front, whereas the "insurance" benefits will be received only when and if a disaster occurs sometime down the road.

As can be seen, even when the payout from the insurance aspect of DR is large, because the probability of a disaster is so low, expected value theory suggests that a large investment in a DR solution is unwarranted.

There are a few problems with the insurance view of DR. For one thing, the expected value calculations are dubious. Their accuracy depends on the accuracy of two component forecasts: the probability of disasters and the cost of disaster-related downtime and data losses. Both of these estimates are typically fraught with error.

History generally provides the only readily available estimate of the probability of disasters, but history is, at best, a weak predictor. The problem is a paucity of data points. Disasters happen at random intervals and they occur only very rarely. Thus, historical averages are not statistically significant.

What's more, the historical data used must be restricted to companies in similar circumstances. Some geographic areas never see hurricanes, but others are at a high risk during hurricane seasons. The presence of nearby tectonic fault lines determines the probability of earthquakes. Clearly, a worldwide disaster frequency average would produce a poor disaster frequency prediction for a specific company. Yet, restricting the data to just companies in similar circumstances as yours forces you to base your forecast on a small subset of an already small set of data.

The costs of downtime and data losses can be forecast much more accurately than the disaster frequency. Nevertheless, most companies significantly underestimate these costs. Unless organizations perform a rigorous analysis, the true costs are likely multiples of their "back-of-the-envelope" estimates.

What's more, even when companies undertake a comprehensive analysis of their potential disaster-related costs, they often overlook one gloomy statistic. A sizeable proportion of companies that incur a cessation of operations lasting more than a couple of days never reopen or go bankrupt within a few years.

The "Insurance" Legacy of DR

DR became viewed as insurance because the traditional DR technology, which is still the primary or only DR technology used in many companies, was incapable of acting as little more than that. Tape-based backups are a very cumbersome and time-consuming way to recover data, particularly if the tapes have been sent to an offsite location. As a result, backup tapes are typically used as only a last resort.

Yet tape-based backups don't even provide an especially good insurance policy. In addition to being a comparatively slow medium, they are more fallible than disk. Hence, it is possible that when you go to recover data from tape you will find that the most recent version is unusable, forcing you to rely on backup tapes that are up to 48 hours old.

Beyond Insurance

Because of the difficulty in justifying large expenditures based solely on DR's insurance value, many companies don't move beyond tape-based backups, despite the considerable liabilities of this approach. Nevertheless, moving your DR strategy beyond tape into the multitude of advanced technologies, like high availability solutions,  that reduce downtime of many kinds unlocks significant ROI potential. This is ROI that  is above and beyond the mere insurance value of DR. And unlike "insurance," the ROI from reduced daily downtime is assured, which makes more advanced technologies easier to justify to a cautious CFO.

About the author:

Anna Hobey graduated with a Masters of Science in Marketing from University of Glamorgan after completing the Chartered Institute of Marketing Professional Postgraduate Diploma in Marketing and is currently managing the marketing and IBM relationship for Vision Solutions in the MENA, CIS and United Kingdom and Eastern European regions.