Keeping your feathers numbered: the Foghorn Leghorn approach to disaster recovery planning: having a disaster recovery plan that anticipates and systematically prepares for disasters can make all the difference.

• Author: Austin, Kent
• Position: Best Practices

A selection from this article originally appeared in the May 2012 issue of the GFOA's Treasury Management Newsletter.

In the 1954 Looney Tunes classic cartoon, "All Fowled Up," mischievous rooster Foghorn Leghorn genially schemes to silently send a lit dynamite stick through a series of hastily assembled pipes. The dynamite is intended to emerge from the pipes and explode just behind Leghorn's nemesis, the barnyard dog, fast asleep next to his doghouse. In traditional Looney Tunes fashion, however, the scheme backfires--literally--resulting in a torrent of white feathers shooting from the pipe next to the chuckling dog. As the scene closes, the half-naked Leghorn is seen gathering up his loose feathers, sheepishly drawling, "Fortunately, I always keep my feathers numbered for just such an emergency." As unlikely as it might seem, Foghorn Leghorn is an appropriate mascot for the practice of disaster recovery planning. "Keeping your feathers numbered" is shorthand for anticipating and systematically preparing for disasters.

THE DISASTER RECOVERY PLANNING PROCESS

The GFOA training course, Disaster Recovery and Business Continuity Planning, provides a concise five-step description of a common approach to disaster recovery planning.

1. Identify and Prioritize Risks. The nature of risks (threats) must first be identified and their likelihood assessed, allowing planners to focus their efforts on the most immediate risks. Exhibit 1 provides a useful format for identifying and narrowing these risks. A simple three- or five-point scale helps rank likelihood and impact. Multiplying the likelihood score by the impact score produces a total amount that can be used to zero in on the most immediate risks.

The list of potential risks can go on forever, but for the first disaster recovery planning effort, some planners recommend limiting the scope to the top five potential disasters, and then performing more in-depth risk assessments for the organization's facilities, technology, and operations areas. (1)

When performing risk assessments, planners need to consider not just facilities and physical damage but also loss of personnel and key suppliers, including banks and electricity providers. An organization's location might be unscathed by an event, but if the building has no power or employees cannot get to the facility, business cannot continue.

2. Identify Goals and Prioritize Services. Early in the disaster recovery planning process, two important goals need to be articulated: RPO and RTO. The recovery point objective (RPO) is the amount of data that can be lost without causing serious damage to a function. For example, can the organization stand to lose one day's worth of transactions, one hour, or none? The shorter the RPO, the more expensive the preparations. The cost of the recovery solution will typically increase as the RPO decreases. (2) The recovery time objective (RTO) is the amount of time a function can be unavailable before the organization is negatively affected. This will be the single biggest driver in developing a disaster recovery plan. For banks and other institutions that hold large amounts of other people's money, the RTO must be very short. For local governments, the RTO can be longer without causing...