--- title: When BIA Recovery Priorities Need Judgment description: Learn when to adjust a calculated RTO, when to record a capability gap, and how to keep BIA recovery priorities defensible. image: https://bcmmetrics.com/hubfs/When%20BIA%20Recovery%20Priorities%20Need%20Judgment.png --- [Skip to content](https://bcmmetrics.com/blog/adjust-bia-recovery-priorities#main-content) SOLUTIONS [PRICING](https://bcmmetrics.com/pricing) USE CASES RESOURCES [ABOUT US](https://bcmmetrics.com/about-bcmmetrics) Flexible BCM software solutions [See all solutions →](https://bcmmetrics.com/business-continuity-solutions) [![Group 1171274363](https://bcmmetrics.com/hubfs/Group%201171274363.svg) **REGULATORY COMPLIANCE** A self-assessment tool to evaluate the level of compliance of your business continuity program](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence) [![Frame 16367](https://bcmmetrics.com/hubfs/Frame%2016367.svg) **BUSINESS CONTINUITY PLANNING** A single platform where you can build and share business continuity plans (BCPS) across your entire team](https://bcmmetrics.com/business-continuity-solutions/bcm-planner) [![Frame 16365](https://bcmmetrics.com/hubfs/Frame%2016365.svg) **BUSINESS IMPACT ANALYSIS** An everyday business impact analysis (BIA) software to help you prepare and plan for anything](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand) [![Group 1171274403](https://bcmmetrics.com/hubfs/Group%201171274403.svg) **FACILITIES MANAGEMENT** An intuitive icon-based mapping tool to better manage your facilities around the globe](https://bcmmetrics.com/business-continuity-solutions/bcm-one) [**INSURANCE** Identify critical systems and create streamlined response plans](https://bcmmetrics.com/industry/insurance) [**HEALTHCARE** Simplify compliance and risk assessments in one platform](https://bcmmetrics.com/industry/healthcare) [**FINANCE** Manage audits and meet standards with ease](https://bcmmetrics.com/industry/finance) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/case-studies.svg) CASE STUDIES** Learn how others have redefined their BC management with BCMMetrics](https://bcmmetrics.com/business-continuity-case-studies) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/resource-library.svg) RESOURCE LIBRARY** Access our collection of free downloadable resources](https://bcmmetrics.com/business-continuity-resources) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/blog.svg) BLOG** Read along for expert BC advice from our senior consultants](https://bcmmetrics.com/blog) [LOG IN](https://app.bcmmetrics.com/Portal/login.aspx) [VIRTUAL TOUR](https://bcmmetrics.com/virtual-tour-form) [BOOK YOUR DEMO](https://bcmmetrics.com/demo) ![Mask group (7)](https://bcmmetrics.com/hubfs/Mask%20group%20(7).png) ![Mask group (6)](https://bcmmetrics.com/hubfs/Mask%20group%20(6).png) # When BIA Recovery Priorities Need Judgment: How to Adjust a Calculated RTO Michael Herrera Published on: September 10, 2026 ### Prepare For the Worst with the Best in the Business Experience capable, consistent, and easy-to-use business continuity management software. [BOOK YOUR DEMO](https://bcmmetrics.com/demo) A calculated Recovery Time Objective can inform BIA recovery priorities, but it does not settle them automatically. An RTO defines how quickly a process, service, or system should be restored.A recovery priority describes its relative urgency and place in the recovery sequence. Changing an RTO can affect that sequence, but the two are not interchangeable. When a calculated RTO appears wrong, validate the inputs and calculation first. If evidence or an authorized business decision still supports a different target, document the adjustment so another reviewer can reconstruct it. **In short** - Confirm whether the issue is the input, calculation method, business requirement, or recovery capability. - Correct and recalculate before creating an exception. - Adjust a calculated RTO only when the reason is specific, supported, and approved. - Do not change a sound business target merely to match current capability. - Retain the original result, revised result, evidence, owner, approval, and review trigger. ## Start by Separating RTO, Recovery Priority, and Capability - **RTO:** How quickly should this process, service, or system be restored? - **Recovery priority:** Where does it sit relative to other recovery work? - **Recovery capability:** How quickly can the organization currently restore it under defined conditions? A four-hour RTO may place a process ahead of one with a 24-hour RTO, but recovery order can also depend on shared applications, suppliers, staffing, and prerequisite services. A calculated RTO is an important input, not a complete recovery sequence. [ISO/TS 22317:2021](https://www.iso.org/standard/79000.html) provides guidance for maintaining a formal, documented BIA process without prescribing one uniform method. Calculation creates consistency, while documented judgment addresses material conditions the shared method cannot represent accurately. [NIST SP 800-34 Rev. 1](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf), published in 2010 for US federal information systems, connects recovery priorities to criticality, outage impacts, tolerable downtime, and system resources. Its sample BIA asks for the drivers behind MTD, RTO, and RPO values. NIST uses maximum tolerable downtime, or MTD, while many continuity programs use maximum tolerable period of disruption, or MTPD. Neither source requires the method below. They reinforce the need for documented drivers and review rather than unexplained numbers. ## Correct, Recalculate, Adjust, or Record a Gap? Before changing a result, identify the decision you are actually making. | What the review finds | Appropriate treatment | Why | | --- | --- | --- | | An input is incorrect, incomplete, or misunderstood | Correct the input and recalculate | The model received weak information. | | A scoring rule or time band omits a condition that affects many processes | Improve the model, test it, and recalculate affected BIAs | A recurring issue should not become a collection of exceptions. | | A documented, process-specific condition cannot be represented accurately by the shared model | Adjust the calculated RTO and create an exception record | Judgment is needed, but the departure must remain visible and reviewable. | | Leadership authorizes a different service commitment, tolerance, or risk position | Update the business requirement through the approved governance process | This is a business decision, not merely a correction to the calculation. | | Current capability cannot meet a sound business target | Retain the target and record a capability gap | Changing the target to match performance would hide the exposure. | | Evidence is incomplete or disputed | Keep the result provisional and assign follow-up | A permanent adjustment would imply more certainty than the evidence supports. | These conditions should trigger review, not an automatic override: - a regulatory, legal, contractual, or customer deadline; - a transaction cutoff, patient-care requirement, production window, or seasonal constraint; - a dependency that changes what can recover first; - a tested workaround that changes how long work can continue; - incident or exercise evidence that challenges an assumption; or - inconsistent results across comparable processes. First determine whether the condition reveals a bad input or model weakness. Adjust only when it is supported and too specific for the shared method. Pressure from a process owner, an expensive strategy, an existing plan, or an unmet technology target is not evidence by itself. Those facts may require investment, risk acceptance, or a changed service commitment, but they do not automatically change business tolerance. [![bcmmetrics-logo-new-white](https://no-cache.hubspot.com/cta/default/46578083/interactive-220966548664.png)](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJBLuHUHMbwjNfJVEkWPfNe3VtoLKoPH8ym2zlBoMon4vuNHY%2FhlmPukNzKdJaPSiQP2R8mBlfEeDgipA%2FZtVfDRaFI%2FFhFoP%2BzqeGy3qxuDcsjVJQQZvrUXfpyFgt3wSUy2afuQ1Ahq9G%2FL1ToHzkSvovm4kjZc79gz5qzM9g2IWDS1y78kDXS3ko6fkzgYD9L5XsC9WkF%2FRmW1vrde%2BxlutFCrw%3D%3D&webInteractiveContentId=220966548664&portalId=46578083) ## Build a Defensible Adjustment Record An adjustment does not automatically make a BIA less defensible. It becomes difficult to defend when its evidence, rationale, authority, or downstream consequences are unclear. The record should retain: | Field | What to document | | --- | --- | | **Process or service** | The business activity affected by the decision | | **Original result** | The calculated RTO and related recovery-priority output | | **Approved result** | The revised RTO and any resulting change in recovery order | | **Reason and evidence** | Why the calculation was insufficient and what supports the change | | **Assumptions** | Conditions that must remain true for the adjustment to hold | | **Dependency and capability effect** | Whether applications, suppliers, facilities, staffing, and workarounds support the decision | | **Owner and authority** | Who proposed, reviewed, and approved the change | | **Decision date and review trigger** | When it took effect and what requires reconsideration | This is practitioner guidance, not a field set prescribed by ISO, NIST, or every regulator. Map it to your policies, obligations, approval authorities, and retention requirements. ### Example: A Process-Specific Deadline Changes the RTO Assume a payment-settlement process receives a calculated RTO of 24 hours. During review, the team confirms that missing a same-day settlement window creates a contractual and financial consequence. The team verifies the inputs, then determines that the cutoff is too process-specific to add to the shared model without distorting other assessments. It adjusts the RTO to eight hours and retains the original result, contract, cutoff schedule, critical dependencies, approval, and contract-renewal review trigger. The example is hypothetical. In practice, the obligation and its interpretation should be verified with the appropriate legal, compliance, and business authorities. ### Counterexample: Current Capability Cannot Meet the Target Assume a BIA produces a four-hour business RTO, but the supporting application has demonstrated only a 12-hour recovery capability. If the four-hour requirement remains sound, changing it to 12 hours would hide the gap. Retain the target, document current capability, and decide whether to improve recovery, establish a tested workaround, change the service commitment, or accept the risk formally. A business target should change only when new evidence or an authorized decision changes the underlying tolerance, commitment, or risk position. Current capability alone does not make the business requirement inaccurate. ## Match Review and Approval to the Consequence Not every change needs executive approval. Authority should reflect what the decision affects. - **Data correction:** The BIA owner can correct a demonstrably inaccurate input and preserve the change record. - **Limited exception:** The program owner may approve an adjustment within a defined tolerance when it does not change a major obligation, investment, or enterprise recovery sequence. - **Material change:** The designated risk owner or executive should approve changes affecting regulatory duties, customer commitments, significant investment, risk acceptance, or enterprise recovery order. A faster process RTO may require different application targets, supplier commitments, staffing, exercises, or procedures. If those capabilities do not support it, keep the gap visible to the person accepting the exposure or approving the investment. For regulated activities, document the exact obligation, source, effective date, and interpretation used. “Required by regulation” is not enough for a later reviewer to validate the decision. [ISO 22301:2019](https://www.iso.org/standard/75106.html), including Amendment 1:2024, supports operating, reviewing, maintaining, and improving documented continuity work. It does not prescribe this approval structure. [![bcmmetrics-new-logo-navy](https://no-cache.hubspot.com/cta/default/46578083/interactive-212381418862.png)](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJw%2FrmdbhlfrFJJ%2Fr%2BP7g3JYukh4%2BxAMy0l1IokSK4BD312hLtTfo7AkF%2Bje2i4fTEN1ZlSIY1IZyVcqIUF9WEva%2BUGbQglTw6GKXutrhovXkyLVgD4nwEnoeiANMn7%2BwF34UHz3yclu5ZakOZrtflqFYYBUJPWIhKrfFzxkqEtr3XyVJx7pFG3f6GL9g6tZiYjtiquAKiACNnFJ0f%2Fsw%3D%3D&webInteractiveContentId=212381418862&portalId=46578083) ## Evaluate How BIA Software Supports the Decision Software should make the method more consistent without concealing the judgment applied afterward. [BIA On-Demand](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand) supports configurable scoring structures, impact categories, RTO and RPO inputs, dependencies, calculations, reports, and process rankings by RTO. This provides a structured basis for reviewing how inputs lead to recovery outputs. When evaluating BIA software, ask the vendor to demonstrate what happens when a reviewer challenges a calculated value: - Can users distinguish a calculated value from an approved adjustment? - Can reviewers see both values and understand the reason for the change? - Where are the evidence, owner, approval, and review trigger recorded? - Do reports identify adjusted values clearly? - Can the team find all exceptions for periodic review? - Is a business target kept separate from current recovery capability? - What change history remains when an assessment is updated or copied forward? Do not infer these controls from calculation features. Ask to see the workflow using one of your own examples. The [BIA scoring-model guide](https://bcmmetrics.com/blog/bia-scoring-models-impact-scales-time-bands) explains how to improve inputs and calculation logic before an exception is considered. The [RTO, RPO, and MTPD guide](https://bcmmetrics.com/blog/rto-rpo-mtpd-setting-time-targets) explains how the time targets relate. This article addresses the governed decision that sometimes follows. ## Keep the Judgment and the Evidence Together A defensible BIA does not require automatic acceptance of every calculated value. It requires a visible reason, authority, downstream effect, and review trigger for each change. Use the model first. Correct weak inputs and recurring model problems. Apply an exception only when evidence or an authorized decision warrants it, and keep capability gaps visible. [![SEE BCMMETRICS IN ACTION](https://no-cache.hubspot.com/cta/default/46578083/interactive-184669086823.png)](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKcWtOat2L%2BoLpoNazf%2FoteYGt9jhsuXQh5vvYE1J8KKB6SPj5%2F5a0VHscDpLF9tn3vCFTkSLGljGyAtEmoq6csc%2FgQyVGXXPlBYxmc%2BGLIr28lWWYt8%2Fk7ISm4SugtPy3uEdqEj9MXwypjWRJjGv0s1K5bDANrmhHbrpYvIqAGldgmkcFpGQc1OBeusTEq6OXjA%2FwJN8y1SfmhLuMWsg%3D%3D&webInteractiveContentId=184669086823&portalId=46578083) --- ![](https://bcmmetrics.com/hubfs/Website%20design/Michael-Herrera-MHA-Consulting.jpg) #### Michael Herrera Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region. ## Other resources you might enjoy ![business recovery checklists](https://bcmmetrics.com/hs-fs/hubfs/Imported_Blog_Media/business-recovery-checklist.jpg?height=245&name=business-recovery-checklist.jpg) #### [The 4-3-3 Rule for Writing Business Recovery Checklists](https://bcmmetrics.com/blog/business-recovery-checklists) Michael Herrera [Read More](https://bcmmetrics.com/blog/business-recovery-checklists) ![calculator notebook and pen on dollar bills](https://bcmmetrics.com/hs-fs/hubfs/business-continuity-cost-of-downtime%E2%80%8B.webp?height=245&name=business-continuity-cost-of-downtime%E2%80%8B.webp) #### [Why Business Continuity Spend Beats the Cost of Downtime](https://bcmmetrics.com/blog/business-continuity-cost-of-downtime) Michael Herrera [Read More](https://bcmmetrics.com/blog/business-continuity-cost-of-downtime) ![Business continuity vs disaster recovery](https://bcmmetrics.com/hs-fs/hubfs/Imported_Blog_Media/fotolia_34271205_subscription_monthly_m.jpg?height=245&name=fotolia_34271205_subscription_monthly_m.jpg) #### [Business Continuity vs. Disaster Recovery](https://bcmmetrics.com/blog/business-continuity-vs-disaster-recovery) Michael Herrera [Read More](https://bcmmetrics.com/blog/business-continuity-vs-disaster-recovery) ## Ready to start focusing on higher-level challenges? ### ![Group 1171274345](https://bcmmetrics.com/hubfs/Website%20Images/Footer/bcmmetrics-logo-new-white.svg) 3820 W Happy Valley Road Glendale, AZ 85310 USA [SOLUTIONS](https://bcmmetrics.com/business-continuity-solutions) - [Regulatory Compliance](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence) - [Business Impact Analysis](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand) - [Business Continuity Planning](https://bcmmetrics.com/business-continuity-solutions/bcm-planner) - [Facilities Management](https://bcmmetrics.com/business-continuity-solutions/bcm-one) PRICING - [Our Pricing Model](https://bcmmetrics.com/pricing) RESOURCES - [Case Studies](https://bcmmetrics.com/business-continuity-case-studies) - [Resource Library](https://bcmmetrics.com/business-continuity-resources) - [Blog](https://bcmmetrics.com/blog) COMPANY - [About us](https://bcmmetrics.com/about-bcmmetrics-old) - [Contact](https://bcmmetrics.com/demo) - [MHA Consulting](https://www.mha-it.com/) © 2026 BCMMetrics. All rights reserved. [Privacy Policy](https://bcmmetrics.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://bcmmetrics.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://bcmmetrics.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "When BIA Recovery Priorities Need Judgment: How to Adjust a Calculated RTO", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michael Herrera", "url" : "https://bcmmetrics.com/blog/author/michael-herrera" }, "dateModified" : "2026-09-10T22:35:09.697Z", "datePublished" : "2026-09-10T22:34:32.000Z", "headline" : "When BIA Recovery Priorities Need Judgment", "image" : [ "https://bcmmetrics.com/hubfs/When%20BIA%20Recovery%20Priorities%20Need%20Judgment.png" ], "mainEntityOfPage" : { "@id" : "https://bcmmetrics.com/blog/adjust-bia-recovery-priorities", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://bcmmetrics.com/hubfs/Group%201171274345.svg" } } } ```