Bottom line first: WMS disaster recovery is not a backup product you buy and forget. It is an answer to three executable questions: when the system goes down, can the warehouse still ship? How much data are you willing to lose? And how long until you can take orders again? If those three answers are not written down, the go-live night checklist does not get a tick. I have seen this exact failure three times, and every warehouse involved believed it had backups.
What WMS Disaster Recovery Actually Has to Cover
When a WMS goes down, the whole chain stops. Receiving stalls at the first gate: loads arrive with no putaway tasks, so pallets pile up on the dock. Picking unravels: no tasks are released, veterans work from memory, new hires wait. Shipping hurts most: labels cannot print, the carrier truck leaves empty, and missed cutoff pushes orders to tomorrow. Billing is the forgotten failure: shipped goods without a written-back outbound record surface at month-end as stock gone and revenue unreconciled.
A recovery plan must therefore protect four operations, not one database: receiving, picking, shipping, and billing. A backup file on a disk while all four are stopped is reassurance, and reassurance does not ship orders.
A 3 a.m. Lesson: The Backup Existed, the Restore Did Not
In November 2024, a third-party warehouse in East China called me mid-failure. Around 3 a.m., a system disk failed and the WMS would not start: six trucks waited to unload, over 4,000 orders waited to pick. The duty manager did the right thing first, restore from backup, but it stalled halfway. The newest full backup was three days old; the incrementals in between had failed for two days because the disk was full.
Worse, nobody had ever walked the full restore end to end. The engineer hunted down database credentials, backup file locations, and the restore tool version; finding those three items alone took nearly two hours. The system returned around 10 a.m., but its data stopped three days earlier, and three days of records had to be re-entered by hand from paper slips and carrier label copies. Finance spent a full week reconciling.
Two sentences are worth remembering: a backup from three days ago is the same as no backup, and a restore procedure living only in one engineer's head is the same as no procedure. I have seen this pitfall three times; only the name on the door changes.
RPO and RTO in Plain Terms, With a Worked Example
RPO answers how much data you can lose; RTO, how long you can be down. RPO, the recovery point objective, is the gap between failure and the point your restored data reaches; everything in it is gone. RTO, the recovery time objective, is the time allowed until the system can take orders, release picks, and print labels again.
Run the numbers with your own volume. Suppose a warehouse processes 6,000 orders a day over a 12-hour shift, averaging 500 an hour. With a 24-hour RPO, the worst case loses a full day, roughly 6,000 orders to re-enter. Tighten the RPO to one hour and the worst case drops to about 500. Those figures are an illustration, not a benchmark, but the method transfers directly: plug in your volume and shift length and the workload appears.
RTO works the same way and cannot be set by the tech team alone. If the carrier cutoff is 4 p.m. and the system fails at 10 a.m., an eight-hour RTO finishes recovery at 6 p.m., after every order missed cutoff. Cutoff, pickup window, and customer ship promise set the RTO ceiling. Here is the counter-intuitive judgment: smaller is not always better. A small warehouse writing down a 15-minute RTO sets a target it can never meet, and in a real failure nobody knows what to protect first.
Choosing a Backup Approach: Three Options Compared
| Approach | Restore speed | Data you keep | Best fit |
|---|---|---|---|
| Local full plus incremental | Fast, restored over the local network | Depends entirely on backup frequency | Mid-size to large warehouses with someone owning maintenance |
| Offsite cloud backup | Depends on network and data volume | Usually workable down to hourly | Multi-site operations without dedicated tech staff |
| Local plus offsite copies | Most resilient, one copy covers the other | Both copies back each other up | Warehouses whose ship promises are written into contracts |
Set the RPO first, then derive backup frequency from it: an RPO of one hour cannot be met by a daily full backup. And confirm one thing that sounds obvious until it fails: the backup must not live on the same machine or room as production. I have watched one incident take out both together. Separate storage plus a routine check that files actually open beats a pricier product.
A WMS Disaster Recovery Drill That Proves the Backup Works
A drill is not an annual performance. It is a rehearsed procedure, run until the steps are muscle memory. Record an owner and elapsed time for every step:
- Set the drill window a week ahead, avoiding peak season and cutoffs; notify customer service and carriers.
- Confirm the drill uses copy data only; no production record is touched.
- Restore from the backup file per the written manual, logging actual time per step against the RTO target.
- Spot-check three data types: last-day receiving records, open picking tasks, and orders shipped but not billed back.
- Run one full cycle: create a receiving task, release a picking task, print a test label. All three must pass.
- Within 24 hours, write the review: elapsed time, stalled steps, missing credentials, and a fix date per gap.
In June 2023, an auto-parts warehouse in South China showed why step 5 matters. Its backups ran cleanly for months, but the first real restore revealed the product barcode cross-reference table was missing. The system started, yet every scan failed to match a product. Found in a drill, it took one afternoon to fix; in a real failure, it would have cost a full day of shipping. A backup that has never been restored is not a backup.
The Paper Fallback That Keeps the Dock Moving
Even a good recovery takes time, and the dock cannot stop during it. Print the paper fallback kit in advance and store it on the floor: blank receiving logs, blank pick sheets, blank shipping registers, and a way to print the day's pending orders.
Fix the paper sequence in advance. Receiving logs supplier, product, quantity, and location; picking works off the sheet with a tick per order; shipping records order number, carrier, and label number. After recovery, every paper record is re-entered in order, and no slip is destroyed until re-entry is complete. Re-entry gets a second pair of eyes, because one person re-entering under pressure is how wrong orders get baked into the recovered system.
Paper fallback is the buffer that buys recovery time: a two-hour outage covered by two hours of paper flow protects the ship promise, while two idle hours plus the backlog costs four.
The Go-Live Night Checklist: No Tick, No Sign-Off
This is the checklist I close every implementation with. Do not sign off on go-live with any box empty:
- Backup frequency derived from the RPO; frequency, retention, and location documented.
- Backup stored separately from production; offsite copy verified downloadable and openable.
- Restore manual holds credentials, tool version, and file path, findable without asking anyone.
- Full restore drill completed before go-live; elapsed time checked against RTO, overruns fixed.
- Paper kits printed and placed in receiving and shipping; supervisors know where.
- Re-entry and second-checker rule briefed to night and early shifts, not only day shift.
- Notification chain tested: who spots failure, calls the vendor, and notifies customers, each with a backup contact.
Common Failure Points: One Last Check
Failures hide in gaps nobody owns. The backup job runs unwatched, so a full disk goes unnoticed for two days. The restore manual sits on one person's laptop, and that person is on leave when failure hits. The drill restores the database yearly but never runs a full business cycle, so a missing reference table stays hidden. The paper kit is printed, then locked in the supervisor's cabinet, unreachable on nights.
Recovery comes down to whether the restore has been practiced until routine. Tonight, three actions cost nothing: check last week's backup jobs for errors, confirm the restore manual's credentials and paths are complete, and ask the night supervisor where the paper kit is kept. Then the plan has moved from paper to the floor, the only place it counts.
By Lin Xiao, WMS Implementation Consultant
