Consistency of a shared disk is secured in system switching in a hot standby system. In the standby system in which an active computer and standby computer share the shared disk, when a write I/O request is issued from the active computer, information about a start of the I/O is recorded in, for example, a memory. When the I/O is completed, the information is deleted from the memory. When a failure occurs in the active computer, the active computer transmits the record of the information about the start of the I/O, to the standby computer. The standby computer verifies the record to recover a disk in which the I/O is to be executed.