When Hurricane Rita ripped through southwest Louisiana last fall, Kenneth Quirk, co-owner of CPA firm Quirk and Associates, was without power and water for almost two weeks."This area had 500 tornadoes taking place during the hurricane. It devastated 50 miles south of us," said Quirk. "Cameron Parish was wiped off the map! Just down the street, there were buildings with their roofs blown right off and water damage to all their equipment."
Quirk was very lucky that the hurricane and tornadoes, which caused an estimated 119 deaths in five states, blew right passed his offices without scratching his server - which he had wrapped in plastic in hopes of preventing water damage and left sitting on a shelf inside his office.
Quirk joked that the worst damage was done to his taste buds from having to eat MRE (Meals Ready to Eat) for over a week.
However, he said that things could have been very different.
Currently, Quirk is testing QuickBooks Online Edition as his primary accounting package and as a means to keep his back-up data offsite. He guarantees that the next time a hurricane comes around, he is taking his server with him.
Since the September 11 attacks, businesses and CPA firms have been taking a closer look at disaster recovery and business continuity plans. The subject has topped the Top Ten Technology Concerns annual survey compiled by the American Institute of CPAs for the last six years. However, most of the attention and IT dollars being spent on disaster recovery planning, according to a June 2005 Forrester report, are coming from enterprise-level companies.
"Have a plan and test that plan, no matter what size you are," advised IT assurance partner George Fallon with regional CPA and business advisory firm Clifton Gunderson LLP.
It can happen to you
"You've got regular clients and issues, so squeezing in something you know is important but doesn't seem critical while things look good is hard," said Rob Rogers, vice president of The Accounts Payable Network, an online information resource for accounts payable professionals housing service tools, templates and articles regarding disaster recovery issues. "It's harder to get your hands around how quickly that can all change."
While hurricanes like Katrina and Rita gave CPAs plenty of notice to gather their servers, back-up tapes and computers for safekeeping, there are plenty of disasters that strike without warning.
For example, at 4:30 a.m. on Jan. 17, 1994, an earthquake hit the San Fernando Valley with a force of 6.7 on the Richter Scale, killing 51 people, injuring 9,000 others and collapsing freeways around the Los Angeles area.
"It was the worst experience of my life," recounted David Cieslak, CPA, CITP and principal of the Encino, Calif.-based Information Technology Group, who was awakened by the quake. "I literally felt the house being picked up off of its foundation and slammed back down again - all you heard was the sound of smashing glass."
If such a catastrophic event happens during work hours, the first course of action is to locate your employees and help support their needs and the needs of their families, according to a disaster checklist compiled by the AICPA and released last year following the destruction left by Hurricanes Katrina and Rita.
Once the immediate disaster is over, the institute stressed the need to keep communication with key employees, vendors and customers, along with securing the physical location of the office so no looting or further damage is done. The AICPA also suggested some planning tips like maintaining emergency supplies onsite, including food and water, batteries, and flashlights, and also distributing wallet cards with a complete disaster recovery plan to employees.
Take a look at your back-up
"Beyond personnel, the key asset is the data and the documentation for the clients," said Joe Harpaz, vice president of business development for Thomson RIA-GoFileRoom, a document management system provider and a unit of Thomson RIA. "Paper is not resilient in terms of a disaster."
Backing up client data on tapes and taking the tapes off site is not enough, said Scott Jarr, director of digital strategy for Iron Mountain, a provider of records management services. Jarr said that he sees a 30 percent to 50 percent failure rate when accountants in small and midsized firms try to perform their own back-up.
As client data is the primary product for accountants, that data should be guarded as safely as possible. Two back-up locations, preferably in separate geographical regions in case of a widespread disaster, are encouraged, along with constant testing of that back-up system.
"[A] vast majority of accountants have their data on servers. Traditionally, they stick in a tape and then ship that tape offsite. There are lots of problems with that," said Jarr. "There are lots of manual steps. What we do is take those steps and automate the process."
Using an online back-up system or online software system that backs up automatically takes the responsibility of providing accurate and secure back-ups off of the accountant. These online back-up applications and online software systems - anything from a write-up, tax preparation or back-office accounting application - can also be reached after a disaster from any Web browser, making it easier to continue working even if the physical office is unreachable.
"We're taking advantage of [GoFileRoom] features like their geographic location structure," said Joe Gutierrez, technology director at Miami-based CPA firm Berkowitz, Dick, Pollack & Brant LLP, which has been through six hurricanes in the last two years. "They have two IBM facilities, one in Chicago and one in the Northeast."
Last year, Gutierrez's firm installed GoFileRoom. Using that, along with Thomson RIA's GoSystem Tax RS, relieves a burden of responsibility for recovering data should a hurricane hit their offices, he said.
But even with online software, key applications are near impossible to operate a business without, said Clifton Gunderson's Fallon. Word, Excel and e-mail are all needed to continue basic business processes, and this is why keeping all application disks with the licensing numbers in one central location, offsite and in some fireproof container, is also recommended.
"You have to have a disaster pack with the applications and all the licensing numbers so you can grab and go, preferably somewhere separate than the office," said Ken Garen, president of Universal Business Computing Co., a data processing and software development firm located in Taos, N.M.
Helping hands
Tax and business software provider CCH, a Wolters Kluwer business, offers users stricken by a disaster a number of free services.
CCH will replace any CCH software missing or damaged at no charge. If a firm is working in a temporary office, it will ship the new installation software free of charge, and firms can also try CCH's online tax software, ProSystem fx Global fx Tax, free for one year.
If a user does not have print capabilities, CCH will print for them at one of its service centers and ship the information to the firm. CCH also provides new supplies, like envelopes, to help firms get back on their feet. It posted these services on its Web site during Hurricanes Katrina and Rita.
Communication is the key
The biggest obstacle for CPA firm LaPorte Sehrt Romig Hand after Katrina hit their suburban New Orleans office in Metairie, La., was communication. They had duplicated their data files at their Covington, La., office, located about 35 miles across Lake Pontchartrain. The firm also had a core group of managers selected to take back-up tapes out of the office. However, they had no power, no landline or cell phones, and, because they left their servers in the office, they had no interoffice e-mail capabilities.
"Someone set up an 800 number and disseminated the information through a blog page on the Web," explained Ted Mason, president of the firm. "The blog page and 800 number were the only modes of communication we had." He advised paying a few extra dollars a month to sign up as a priority member for the local power company, so the firm's power will be restored on a priority basis.
Redundant communication sources like Voice over Internet Protocol telephones, satellite phones, and wide-area-network Internet cards (computer network cards with a reach up to thousands of miles away) are also recommended to ensure business continuity.
"We were devastated here," said Quirk. "The only communication was the local TV, neighbors' word of mouth and radio. The good thing about hurricanes is that you have plenty of warning. You know what to prepare in order to get out. As my CFO used to say to me, being forewarned is being forearmed."
