Ohio Society of CPAs: 10 Steps to Ensuring Business Continuity After a Disaster

Disasters come in all sizes and forms – from hurricanes, tornados or floods to a failed switch, a misplaced laptop or computer virus. Even a seemingly minor event can have a shocking impact on a business and bring operations to a standstill.

"The impact of a business interruption can be stunning," said Bob Boyd, president and CEO of Agility Recovery Solutions. "Statistics indicate that about 60% of the businesses affected by a disaster will not survive because they do not have a recovery plan in place."

Creating a basic, executable and up-to-date disaster recovery plan is one of the most important steps businesses can take to protect themselves and assure business as usual - no matter what the scenario.

When Kettering Tower in Dayton was devastated by fire in October 2006, Society member William Duncan’s CPA firm, Thorn, Lewis and Duncan, relied on their business continuity plan to keep their business operating.

About 60% of the businesses affected by a disaster will not survive because they do not have a recovery plan in place.

"We were very fortunate to suffer only minor water damage and no smoke damage," Duncan said "We had backed up our files daily; so when we were forced to evacuate our office, we could still access the files we needed to keep working."

Having the files, hardware and software your business depends upon, along with a secondary location from which to operate, are key features of any plan. Below are ten key steps to developing a successful business continuity plan.

1.  Assess your risk - both internally and externally.

Which disasters will most likely impact your business?! Though major disasters dominate the headlines, most business interruptions are caused by everyday events such as power outages, human error and technology failure. It is important to assess the risk for catastrophic occurrences, such as fire or flood. However, it is equally if not more important, to assess exposure to more commonplace risks.

When floods devastated many Findlay area businesses last August, Moses & Dieterly CPAs Inc. was spared, but they weren't as fortunate in regards to their water heater.  "We came in one morning and found the water heater had burst, leaving more than an inch of water in the office,"
Donald Dieterly, CPA said. "We keep all our paperwork away from the floor now."

2. Assess critical business functions.

Evaluate and document how your company functions and determine which processes, employees, equipment and materials are critical for your daily operations. Critical business functions include: billing, payroll and service fulfillment. List these functions and determine a process for restoring them in the event of an interruption.

3. Plan for an alternative site.

What would you do if your building was inaccessible tomorrow? Where would you go to continue basic business operations? Review your site requirements and determine a plan for recovery. Alternate site options include employee's homes, a branch or second location, the site of a similar business, or a vendor that provides mobile recovery.
For Thorn, Lewis and Duncan their alternate site included William Duncan's basement.
"Our plan was to move the server to my basement and that worked well for us," Duncan said. "We could access the files we needed to then work from our clients' offices."

4. Consider supply chain preparedness.

Even if your business has a continuity plan, what about key vendors? Business continuity plans include maintaining supply chain logistics in the event of a disaster. Talk to your key vendors and suppliers about their recovery plans. Develop relationships with alternate vendors in case your primary vendors experience an interruption.

5. Appoint a crisis manager and develop an emergency management plan.

Planning what to do after a disaster is just as important as what to do beforehand. A crisis manager and sound emergency management plan help facilitate a smooth transition between normal business operations and catastrophe response.

6. Back up your data.

In today's highly technical economy, information is more valuable than ever. Having an automated, daily backup system for important data is crucial. Be sure to store your data in an offsite, safe, and secure location, preferably 50 miles or more from your site. Periodically checking that the back-up is working correctly is also important, along with making sure your business has the hardware and software needed to successfully access this information.

"We did not have a list of each employee's hardware and software before the fire," Duncan said. "Had we experienced a catastrophic event, it would have taken us several days to figure out what equipment needed replaced." Realizing this deficiency in his continuity plan, Duncan's CPA firm now keeps an updated list, saved both on- and offsite, of all hardware and software used by the firm.

"In the case of a dire emergency, having that information will make it easier for us to order the computers and all the necessary software we require to be back up and running within three days," Duncan said.

Dieterly agrees that having a list of the hardware and software his firm needs would be invaluable in a dire emergency.  "If we had not been spared from the flood waters, we could have been at a total loss," Dieterly said. "We always back up our files offsite, but we did not have a list of computer vendors or the tax programs and other software we would need replaced to run effectively. In our new plan we will keep lists of all this information as well as the contact information for all our clients’ offsite."

7. Create an employee, vendor and key client communication plan.

Develop a 24-hour phone tree for all employees and their spouses or closest relatives and keep it up to date. Make sure your employees know ahead of time how to exchange or obtain information should standard lines of communication fail. Also, compile a list of your critical clients and vendors and store it in an offsite location. Determine a process for contacting them should your systems go down.

8. Assemble an emergency kit

An emergency or disaster recovery kit should contain items such as fresh water, non-perishable food, flashlights, extra batteries, battery-powered AM/FM radio, first aid kit and copies of important documents and records. For a complete list of recommended items, visit www.Ready.gov, an emergency preparedness site from the Department of Homeland Security.
9. Take a look at your insurance coverage.

Is your insurance coverage adequate? Sit down with your agent to make sure you are insured for potential risks. Make sure you keep photos of your building, equipment lists and policy information stored in a safe and secure offsite location.

10. Test your plan.

Make sure your plan is workable - annually test the plan and update it as necessary. Make sure to re-educate employees when any changes to the plan are made.

Having seen their plan in action, Thorn, Lewis and Duncan changed some key aspects of how the firm does business. "We were taking baby steps toward becoming paperless before the fire, but now we have accelerated that process," Duncan said.  “Last year, we successfully moved all our accounting and auditing files to a paperless format, and we are doing the same with our tax files in 2008. This way we can be sure we have all the information we need in case of another emergency."

The Ohio Society of CPAs has partnered with Agility Recovery Solutions to offer discounted services for Ohio Society members. Agility provides complete services, including power solutions, remote work spaces, computer equipment, data backup solutions, and emergency Internet connectivity. For information, call Agility at 866.364.9696 or visit www.agilityrecovery.com.

Additional Resources
A Guide, to Business Continuity Planning
By James C. Bames

Business Continuity Planning: A Step-by-Step Guide with Planning Forms on CD-ROM
By Kenneth L. Fulmer, CBCP

"CMRM: Advanced Business Continuity Planning & Management Course"
By Sentryx

Homeland Security’s Ready Business
http://www.ready.gov/business/index.html

FFIEC Information Technology Examination Handbook
http://www.ffiec.gov/ffiecinfobase/html_pages/it_0l.html