A business continuity manager asks for your disaster recovery plan. You give them the RTO/RPO matrix and they say it is not what they need. What is missing?

They are asking about the business process, not the system

Disaster recovery restores technology. Business continuity keeps the business operating, which includes the periods when technology is unavailable and the work of catching up afterwards.

The matrix answers "how long until the system is back". They need "how does the business function meanwhile, and what happens to the work done in the interim".

What to add

The manual workaround. For each critical process, what people do without the system — paper, a spreadsheet, a phone call to the partner. Someone has to have designed this, and usually nobody has.

Capacity of the workaround. A manual process that handles ten percent of normal volume gives a different tolerable outage than one handling eighty.

Reconciliation. Work done during the outage has to enter the system afterwards. That backlog is frequently larger than the outage itself, and it is where errors are introduced.

Dependency inversions. A tier-0 service depending on a tier-2 one has the tier-2 recovery time in practice. This is where system tiering and business continuity meet, and where the honest answer usually differs from the stated one.

The exercise that tests it

Not a technical failover. A scenario walkthrough with the business: the system is unavailable for four hours on the last day of the month — what actually happens, who does what, and what does the reconciliation look like.

That exercise routinely finds the stated RTO was never the binding constraint.