Information Age: News, analysis & insight for IT & business leaders

Finance officers tend to be keen on investments which give a tangible return, and at a time when most of the IT budget is under closer scrutiny than ever before, some organisations are finding that business continuity expenditure no longer makes the cut.

While few take the extreme path of removing the safety net altogether, analyst surveys reveal that organisations are re-examining their financial commitment to business continuity. Forrester Research recently observed that many recovery site strategies are being brought back in-house, prompted by vendors' price increases and stinging mid-contract change costs.

There is evidence that the enthusiasm for disaster recovery and business continuity spending sparked by terrorist attacks in 2001, which crowned a decade of growth in the sector, is now going off the boil.

Many predicted that, post-9/11, organisations would spread their operations across the globe in an attempt to mitigate the risk against a single site. But cost imperatives have overshadowed this. Instead, companies are consolidating and centralising the IT function, and are in many cases looking to reduce the distance between production and recovery sites.

Adopting this type of strategy means that the focus shifts from recovering from catastrophes towards preventing more common, small-scale problems, such as server outages. Only in some cases will the cost of the disaster - either in lost business or in reputation - be greater than the total cost of the measures implemented to prevent it from happening.

To this end, comprehensive risk assessment and costing plays a crucial role in getting executive sign-off for such expenditure. Spending on continuity and recovery is therefore dictated by the amount of time that businesses are prepared to be offline for and how much of their information they are prepared to lose.

Different kinds of back-up enable differing speeds of recovery - and differing costs. Gartner says that the traditional measure of business continuity spending - 4% of the data centre budget - is no longer sufficient to maintain operations in the event of a disaster. Cost and resources are now shared across more departments in the company than simply IT.

"The cost of the PR campaign to repair a reputation exceeds the price tag of that famous ounce of protection," says Gartner. Sceptical CFOs can only be won around with this sort of justification and the language of acceptable risk.