Las Vegas (May 12, 2004) -- While it may seem obvious, the most crucial aspects of a disaster recovery plan are to put that plan in writing and to actually test it, according to a leading consultant.
“If it isn’t in writing, it doesn’t exist. If it hasn’t been tested, it doesn’t have value,” Robert H. Spencer of K2 Enterprises told attendees at the American Institute of CPA Information Technology Conference, here.
And even small CPA firms can forget using cost as an excuse to out off disaster recovery planning, says Spencer, who notes that the most often-heard response from firms when asked if they have a disaster recovery plan in place is, “Disaster recovery planning costs money. We can’t do that.”
Not so, according to Spencer. “Disaster recovery planning will improve your business processes and will improve the way you manage technology. That alone will put money in your pocket,” Spencer said.
And all firms must designate a risk management officer. “Somebody has to champion the risk management plan and evaluate the firm’s vulnerabilities,” Spencer said. In addition, the RMO must have the authority to execute their responsibilities.
“Getting your systems back up is the easy part,” Spencer added. “The part of disaster recovery planning that no one thinks about is where will people access the data from? Where will the workers be? What tasks need to be done right now, and what can wait?”
Firms must also ensure that all employees have a copy of the DRP and that they actually know what to do in the event of a disaster.
“Disaster recovery planning is not about being 100 percent, it’s about figuring out where your business will survive during a disaster,” Spencer said.
-- Melissa Klein Aguilar
