A fire at Joanne Day's office didn't cause her consulting firm to lose any money, time or even paperwork. That's because it was a fire drill that Day had staged in order to test whether her disaster recovery plan would work in case of a real fire or other emergency. Trumpet Inc., which provides workflow and technology consulting to financial services firms, is based in Phoenix. So the likelihood of experiencing a natural disaster like a hurricane is low. But Day knows she needs to plan for other scenarios that could potentially stop her employees from working. That could be anything from a fire to a dishwasher breaking, which happened to a financial advisory firm she knows of that had to rent enormous fans to remove water from the carpet as a result.
Like what you see? Click here to sign up for Accounting Today's daily newsletter to get the latest news and behind the scenes commentary you won't find anywhere else.
And a plan doesn't amount to much if companies don't test it when there isn't a problem to figure out what the holes are and detect areas for improvement.
"The best kind of test is putting a sign on the door that says 'fire' and not telling [the staff] in advance so you can simulate the real world as much as possible," Day says. She recommends running a full test every nine to 12 months and testing backup software by doing a full recovery every six to nine months depending on how much things are changing and how often new applications are installed. "This is by far the most important thing to do on a periodic basis," she says. "Every time you test your disaster recovery plan, you learn something new."
Florida-based firms like Goldstein Schechter Price Lucas Horwitz & Co. have disaster recovery top of mind, with hurricanes making backing up data offsite and having more of an extensive action plan the chief concern.
That's because the 85-person firm, which provides a broad range of accounting, tax and consulting work to its clients, was closed down for a week in 2005 following Hurricane Wilma because inspectors would not grant employees access to the building due to the damage sustained from the storm.
Like many other companies, Goldstein Schechter stored its data on tapes and brought home a "weekend tape" in case of an emergency like this.
"The problem was there wasn't a whole lot of work that could be done," says Zvi Gold, partner in charge of IT. "The servers saved us, so we had access to our data from the network, [but] we decided Web-based backup was better than tape."
Now, the firm uses Evault to electronically back up its files, although it still is backing up information with tape as an additional safeguard.
Evault's founder, Phil Gilmour, an accountant himself, established the company as a way for smaller businesses to have an effective backup system following the crash of his own database.
"Legacy tape backup requires human intervention. It needs someone physically there to take the tape out and put the fresh tape in and runs the risk of that person accidentally reusing a tape from yesterday, forgetting or not being there," says Richard Heitmann, Evault's VP of product management.
Online backup, on the other hand, is usually automatic and can run in the background while employees are still working, and it comes with the added benefit of offering offsite storage so users can access data even when they can't enter their own buildings.
As companies become more comfortable with remote storage, Heitmann is seeing an increasing number of competitors creep into the space.
One is Middleboro, Mass.-based More Group, which in April 2006 launched MoreStor Vault, a backup and recovery service for small and midsize businesses. Its services start as low as $5 per month and rise to $3,000 depending on the amount of data stored, type of database and recovery-time objectives. A typical 30-person accounting firm would pay roughly $100 per month to back up its file systems, SQL and Exchange, according to Brian Baker, director of the MoreStor Vault service.
Evault's monthly pricing is based on similar factors, with the company estimating that a small business can get its data protected and offsite for less than $40 per month.
Thinking beyond data backup is the next wave of disaster preparedness.
"As companies' awareness about the need to find a better way to protect data increases, we're seeing a greater interest in establishing formal disaster recovery planning and testing and business continuity planning," says Evault's Heitmann, whose company counts about 100 accounting firms as customers.
Last year the vendor started a professional services group that provides operational assessments to help companies understand what's going on with their business from a disaster recovery standpoint, as well as test their plans.
More Group offers a similar service, which Baker says can be anything from a simple one-page document to an extensive plan outlining where employees should go, how to get the system up and how to deal with phone line and fax machine problems.
Starting from the basics, one thing to keep in mind is where to keep the plan once it's written. After all, if it's stored on a computer in an office no one can enter, it's not serving any purpose.
Gold's staff can dial an extension number that contains a message informing them where to go and what to do in an emergency.
At the Braintree, Mass.-based KAF Financial Group some employees keep the plan in their cars or their homes. But the company is also considering creating a task in XCM, an Internet-based workflow automation application marketed by XCM Services, a sister organization. In XCM, all the information is stored so that everyone can log on from home or elsewhere and know the exact steps to take if they aren't already at work when a crisis happens.
The 55-member firm currently incorporates XCM into its disaster plan because managers can see everything their staff is working on in one spot on the Web.
"CPAs in the paper world manage projects based on piles of paper on their desk and everyone having their own little private to-do lists. That goes away with XCM," says Barry MacQuarrie, the firm's director of technology. "XCM can look at all projects going on in my office and control workflow. I can know what everyone is doing even if I can't get in touch with them."
Keeping user names and passwords stored offsite in such an application can also serve as a safeguard in case something happens to the principal who normally maintains that type of information.
Trumpet's Day uses her own online workflow management system of sorts, each week sending a calendar of her seven staff members' appointments and contact information for those appointments for the coming week to offsite emails, so at the very least they can still conduct their meetings.
PUTTING PEOPLE FIRST
Finding those staff members is even more important.
"Job No. 1 is locate your employees. Everything else comes second," MacQuarrie says. Keep in mind that cell phone service might be spotty, or not available, if the disaster is more regional in nature and not specific to one office-as was the case in New York City during the Sept. 11 terrorist attacks when people could not get through to mobile phones because so many calls were being made simultaneously.
MacQuarrie suggests firms require employees to provide emergency contact numbers of someone outside the area for such incidents. They should also have staff members' personal email addresses in case just the firm's domain is not accessible.
Registering a backup domain hosted by a third party-at least for partners or managers-allows for still sending out emails even if the primary email system is down. For example, MacQuarrie could send a message from email@example.com instead of firstname.lastname@example.org, and it looks more professional than sending correspondence from a Hotmail or Yahoo account.
He also established a call tree so that he is not responsible for calling everyone. Day's smaller staff has wallet-sized contact cards that they can carry with them at all times and she updates them every three months if numbers changed.
Another option is investing in a text messaging service to alert employees not to come to work, something colleges and universities began evaluating following the Virginia Tech shootings this April, during which the school waited two hours after the 32-person killing spree to notify students of the incident via email.
While university-quality systems could cost thousands of dollars, other less expensive options exist for smaller companies. For example, Mobivity Alert lets users blast messages to employees' cell phones, alerting them to go to an alternative site. Mobivity's alert system comes with an active send-to list for a monthly fee starting at $79 for 500 messages and going as high as $800 per month for 10,000 messages.