So far, 2015 has brought terrible flooding and tornadoes to Texas and Oklahoma. Other parts of the country are prone to hurricanes and wildfires. Remember Hurricane Sandy? Or Hurricane Katrina? The H1N1 virus outbreak? And disasters don’t have to be major events. It could be as simple as burst pipe on the floor above your offices.
No matter the cause, a disaster could threaten the very existence of a business. The Institute for Business and Home Safety estimates that 25 percent of businesses do not re-open after a major disaster — and a TechTarget article notes that about half of businesses do not have a disaster recovery plan, and of those that do have plans, almost half have never tested it.
Does your firm have a disaster recovery plan in place? If it already has one in place, now is a good time to review it and hold a disaster recovery drill. If your firm does not have a plan, now is the time to develop one.
In short, a disaster recovery plan is a comprehensive written plan that lays out how your firm will recover from a disaster. They typically address:
- Protecting and restoring critical business data and your firm’s information technology infrastructure.
- Communicating with and ensuring the safety of your employees.
- Communicating with clients and vendors and assessing the impact on the firm’s business and clients.
- Providing alternative work arrangements to restore productivity until the disruption is resolved.
- Developing a long-range vision for risk assessment and business continuity.
DEVELOPING A PLAN
Feeling overwhelmed and don’t know where to begin? Start with a “business impact assessment” that identifies your firm’s most critical business systems and processes and the impact that an outage of any duration would have. An outage of one day may not seem important — unless it is April 15 and you have 50 extensions to e-file. If you have ever suffered a technology disruption, data loss, or inability to reach key employees at critical times, you have probably crafted some type of solution.
The key is to expand the scope and develop a written roadmap for response and recovery. It is critical to share such a plan with the entire firm so that everyone understands their roles and responsibilities should a disaster strike.
There is no one-size-fits-all approach to a disaster recovery plan, but the following are key elements of a basic plan:
1. Write out each step of the plan and assign and train employees to serve as crisis managers and key points of contact for employees and clients. The employees you count on to lead in an emergency will not always be available.
2. Make a list of important phone numbers, addresses, and e-mail addresses. In addition to employees, the list should include local and state emergency management agencies, clients, suppliers and contractors, your financial institutions, and insurance agents and claims representatives.
3. Protect and harden your infrastructure — consider building a safe room if your firm is in Tornado Alley. Keep important records and IT systems on upper floors to prevent flooding. Consider a back-up power supply.
4. Have a process for communicating with clients to let them know how you will protect and preserve their important data and how you will meet their critical deadlines and business needs. Appoint a key firm executive to serve as the single source of information so that an accurate and unified message is communicated to employees, clients, the media and the community.
5. Determine off-site crisis meeting places and interim workspace solutions. Think in terms of being displaced for a week or several months. Consider a reciprocity agreement with another business. Get an advance commitment from one or more contractors in case you suffer damage.
6. Test your continuity plan regularly to reveal and accommodate changes. Technology, personnel and facilities are in a constant state of flux at any company.
REFUGE IN THE CLOUD
Ready.gov notes that data backup and recovery is an essential component of a disaster recovery plan. To the greatest extent possible, store client files, workflows, tax projections, and tax preparation in the cloud. Identify hard-copy records and information and data on network servers, desktops, laptops and even wireless devices that need to be backed up, and schedule regular backups to a network server. Then back the server up to the cloud using an online data backup service. Recovery data should be kept in multiple physical locations separated by distance.
Also consider storing recovery data on physical media such as external hard drives that are not Internet-dependent, as you may not always have access.
In a similar vein, bear in mind that text messaging may be more effective than voice calls when multiple cell towers go down, because text messages use less data. Make sure your firm knows how to keep in touch with employees, data infrastructure providers, and clients, some or all of whom may or may not have been affected by the disaster. Utilize your firm’s internal Web site portal to communicate status updates to employees and keep them informed.
PRACTICE THE PLAN
Hold practice drills so that your managers and staff know what to do before a disaster strikes. Ensure that your firm knows where critical firm and client data is located and how to retrieve it. Know which data and systems must be recovered first to stay in business and service clients.
Make sure that all employees and executives are involved in the exercises so that they get practice in responding to an emergency. Make business continuity exercises realistic enough to tap into employees’ emotions so that you can see how they will react when the situation gets stressful.
Evaluate your company’s performance during each test, and work toward constant improvement. Continuity exercises should reveal weaknesses.
Hurricane Sandy caused widespread destruction. Your business may have emerged unscathed, but your employees and clients may have been affected. Assess your employees’ needs and those of your clients and how to best help them recover.
If the disaster was widespread, become a trusted resource for non-traditional services for your clients by helping them navigate the complexities of insurance claims and FEMA and other governmental assistance programs, such as those offered by the Small Business Administration.
Also, your firm’s portal and cloud-based systems may provide disrupted clients with a “virtual office” to allow them to continue their business operations.
While recovery of data and equipment are essential in the short-term, longer-term issues also need attention, such as focusing on what clients need to remain assured of your firm’s stability, planning for succession, and planning for the loss of key talent and staff turnover.
No matter where in the U.S. your office is located, you are not immune to disasters. If you take the necessary precautions to mitigate against these unplanned occurrences, you will be safeguarding your business — and your clients — and you’ll be grateful for your productivity.
Kenneth S. Savell, J.D., L.L.M., is tax law editor at Bloomberg BNA.
Register or login for access to this item and much more
All Accounting Today content is archived after seven days.
Community members receive:
- All recent and archived articles
- Conference offers and updates
- A full menu of enewsletter options
- Web seminars, white papers, ebooks
Already have an account? Log In
Don't have an account? Register for Free Unlimited Access