Contingency and Disaster Preparedness Plans for Your Accounting Firm
Practical tips for planning for the day after.
September 22, 2011
In January 2011, major snowstorms pummeled the northeast; in February, President Obama declared Cook County and much of Illinois a federal disaster area because of a blizzard. In March, an earthquake and a tsunami ravaged Japan, causing unforeseeable reactor explosions, high radiation levels and mass evacuations. On August 28, Hurricane Irene ravaged Vermont and Upstate New York, regions not considered prone to hurricanes. This month, on the 10th anniversary of September 11th, soldiers armed with assault rifles guarded New York City's Port Authority and other arteries, while the NYPD monitored suspicious activity.
What to Do
Although thinking about improbable disasters is unpleasant, this year's pattern may hint that it is time to review your firm's contingency and disaster preparedness plan. A review might include:
Developing a Disaster Recovery Plan
Writing for the Computer Security Division of the Information Technology Laboratory of the US Department of Commerce (Shirley Radack, editor, "Contingency Planning for Information Systems: Updated Guide for Federal Organizations" (PDF)), Shirley Radack emphasizes the need for a contingency planning policy statement that defines the organization's planning objectives and a business impact analysis that identifies priorities and consequences of disruption.
In taking the above steps, accounting firms' HR departments, firm administrators or firm designees need to work with facilities management, management information systems, customer relations and top management to cross-train employees to cover for each other in case of personnel losses. HR also needs to develop backup procedures for personnel data. Most importantly, HR needs to identify what human capital is critical to the firm's survival. It is easier to replace a computer or an office than to replace a key employee. Developing procedures manuals and cross training can help re-create human capital in times of crisis.
State of the art management practices such as flexibility with respect to job assignments, cross-functional training, broad, competency-based job descriptions and employee empowerment, are consistent with best practice contingency planning. The best armies are those in which soldiers are well-trained, empowered, flexible and used to taking initiatives, so the firms that have created flexible workforces in which employees can cover for each other are best able to adapt to adverse circumstances, including disasters.
The new generation of portable memory devices, such as computer back-up solution provider, Clickfree, has made records recovery easy. Every employee who uses a PC should perform a full back-up each evening and take the device home. It only takes a minute to create additional back-up media that can be stored in various locations. Desks should be cleared each day and data secured. Accounting firms should utilize cloud- or Internet-based backup and use a third-party server for large data requirements. But it is important to remember that if your power goes out it may not be possible to access or recover Internet-based or third party data. If your firm uses a great deal of bandwidth, recovery may be difficult. Ranking which data are most important might be a useful step. The Continuity Council recommends that you understand your recovery time objective (maximum allowable time) and your recovery point objective (maximum allowable data and personnel loss) in analyzing data recovery.
Contingency Planning.com adds that firms should have up-to-date and clear evacuation plans. Your plan should be simple enough to understand, but robust enough to anticipate complex variations, to include employee panic, shifting building infrastructure and blocked exits. Writing in National Underwriter Property and Casualty (Caroline McDonald, "How Sound Is Your Firm's Disaster Contingency Plan?" National Underwriter Property and Casualty 23-25. July 5-12, 2010), Caroline McDonald emphasizes that senior management needs to be involved in developing such plans, in protecting employees' health and safety and in anticipating supply-chain threats. Accounting firms that utilize computer service providers or other outsourced services need to verify that the supplier firms have robust contingency plans in place.
Writing in Practice Management Solutions, Kirk Hulett (Kirk Hulett, "Time for a Contingency Communication Plan," Practice Management Solutions, January/February 2009.) emphasizes the importance of client management during a crisis. It is important to prioritize which clients to call. Mass e-mails, conference calls, and podcasts can be used to maintain client relationships. The same is true of employee relations. E-mail and Internet communication such as a firm Website may be useful in keeping in touch with employees. As well, your firm should consider contracting for a relocation site. Relocation sites can be hot or cold. Hot sites have currently-maintained computers and are ready to use. Cold sites are bare; computers and other equipment need to be installed. Jonathan King points out in Information Systems Management (Jonathan R. King, "Contingency Plans and Business Recovery," Information Systems Management, fall 1993, 10:4)that once your firm has contracted for a relocation site it is important to verify that your employees can indeed work at the alternate site and that the site has enough workstations.
The contingency plan should be a living document; employees should be involved in developing it, and HR should support it with cross training. Management should also identify how to overcome interruptions in the supply chain, identify employees with medical conditions and mandate disaster training and simulation practice of the plan. A step that might reap benefits is to meet with emergency personnel in your locality, to include fire, police and elected government officials.
Michael Seese has written an excellent book about contingency planning: Scrappy Business Contingency Planning (Jonathan R. King, "Contingency Plans and Business Recovery," Information Systems Management, fall 1993, 10:4). Seese argues that the key to a good plan is to focus on possible losses rather than events. It is impossible to predict how losses will occur, but the main challenge is to develop a plan on how to react to particular kinds of losses when they occur. In contingency planning, Seese advises us to be creative with negative thinking: It is the unexpected that will threaten your firm. Small disasters should be considered as well as large. At the same time, plans should not be too complicated. Consider that your plan will be put into use at a time of considerable stress.
Accounting firms of 100 employees or fewer can probably just have one plan, but as firms become larger and have multiple locations then they will need to develop and practice multiple plans.
It is important to test contingency plans. Seese recommends a range of exercises such as a checklist test, a thought experiment whereby you go through a disaster scenario and then describe a step-by-step process, a structured walk-through and a full simulation in which employees not only practice evacuation, phone-tree calling and recovery of data, but also work at an alternative site.
Like the claims of survivalists, contingency planning may seem farfetched. But anticipation of the unthinkable is part of coherent human resource strategy. Perhaps due to global warming, one hundred year storms seem to be occurring too often. Prudence dictates the need for a viable plan.
Rate this article 5 (excellent) to 1 (poor). Send your responses here.
Mitchell Langbert, PhD, is an associate professor at Brooklyn College. Widely published on the subject of human resource management, Langbert has consulted and served as an expert witness.