I think something that is often missed is monitoring - people set up lots of lovely processes and systems, backup plans, etc.etc. - but then they (or management, or management don't allow them to...) fail to monitor if what they set up works, backs up ok, restores, monitor the data for quality and issues, etc. etc.
Case in point somewhere not so far from where I sit, where an entire years worth of work was lost for a couple of thousand people when a raid system failed. The official word was that they had `had a failure on all 3 levels of their backup systems`. The raid failed, its backup systems failed, and the daily backups being made failed.
The actual word was actually that the backups failed as no-one had made any backup's for over a year. No-one checked the backup's were being made, what was happening to them, if they worked, what the person responsible for making the backups was doing, etc.etc.etc.
I think management often like to fire and forget - i.e. buy in something, get it set up and installed and then assume that it will magically take care of itself. Resources can then be moved onto other things. (Even if those resources kick up a fuss about it
). Certainly in my experience anyway!