A server to be changed is added to a destination unit in terms of configuration. The server to be changed is started to restore the database in the database storage region to which the server has access and to restore the transaction for the process that was executed when the server failed. The destination of the failed server (a system destination unit) when failure occurs is determined to stabilize the throughput of the entire system after the switchover of the system in the event of failure. The destination server is determined according to an instruction given in advance by the user. The database management system statistically determines the destination server in accordance with a policy designated by the user. Alternatively, the database management system dynamically determines the destination server according to the policy designated by the user when failure occurs.