Who decides the mode has changed

The first lost hours almost always go to hesitation: are we still waiting for it to come back, or do we switch to the fallback. So the plan records a name — who is entitled to declare fallback mode, and after how long without the system it happens automatically.

A threshold along the lines of "if the system is down for more than 60 minutes on a working day, we switch to the backup process" costs nothing and saves half a day of argument.

How the company works without the system

Every critical process needs a fallback that people have seen at least once. Usually that is paper or a simple spreadsheet: taking orders, issuing goods, recording hours.

The key requirement of the fallback is that it captures enough for everything to be entered into the system afterwards — including the time of the event. A missing timestamp is what turns re-entry into guesswork.

Coming back is riskier than going down

The moment the system comes back is the moment of highest risk to data. If the backlog from paper is entered while current work also flows in, duplicates and discrepancies follow.

So the order is fixed in advance: the backlog is entered first, in chronological order, by designated people; only then does the system open for normal work. A short delay now saves days of cleanup later.

Who talks to customers

Customers are rarely annoyed by the outage. They are annoyed by the silence. The plan records who informs them, through which channel and what exactly is said — including an honest "we do not yet know when".

One prepared message, written calmly, beats ten improvised explanations from different people.

Frequently asked questions