An IS auditor is reviewing the results of a recently completed business impact analysis (BIA) for a financial services firm. The BIA identifies several business processes but does not rank them or specify the maximum tolerable downtime for each. Management wants to proceed directly to selecting recovery technologies based on the BIA. What should the auditor recommend as the MOST important missing element before recovery solutions are chosen?