| EXECUTIVE SUMMARY
|  BEING ABLE TO REACH STAFF IS
PARAMOUNT during and directly after a
disaster. To communicate while power and telephone
lines are down, a firm can use public service radio
announcements to give out phone numbers where
employees can get information.
ORGANIZE BUSINESS RECOVERY
TEAMS AND DETERMINE the resources
needed to recover headquarters, computer
operations and the disaster site. Reopening
quickly helps a business to retain employees
because there is no interruption in their
earnings.
BESIDES MAKING SURE
OPERATIONAL AND project data are backed
up at a separate, secure location, one CPA
recommends that a business or firm pick out two or
three potential replacement spaces and keep
up-to-date about their availability.
TO CREATE AN EFFECTIVE
CONTINUITY PLAN, a business needs to
obtain senior management sponsorship, analyze
environmental vulnerability, analyze the business
impact of potential equipment and data loss and
identify and describe critical business processes.
THE ENTITY MUST PREPARE
DETAILED documentation of the steps to
take to perform its essential tasks. In theory, an
individual can use the recovery manual to find its
people, obtain equipment and support, use job-file
and system backups and put staff to work in an
alternate location.
ESTABLISH DOCUMENT- AND
DATA-RECOVERY procedures and test them
quarterly. The level of detail for any plan
depends on the company’s needs. For some, it
doesn’t much matter if they don’t operate for two
days, but others can lose billions of dollars in
two or three hours. | | SARAH E. PHELAN, JD, is a New York-based
attorney and writer. Ms. Phelan was formerly a
senior manager with Deloitte & Touche and a
technical manager in personal financial planning at
the AICPA. Her e-mail address is
Phelanlaw@prodigy.net . MICHAEL HAYES is a
senior editor on the JofA . Ms. Hayes is an
employee of the AICPA and her views, as expressed in
this article, do not necessarily reflect the views
of the Institute. Official positions are determined
through certain specific committee procedures, due
process and deliberation.
|
 t the eastern edge of North Dakota, the Red
River flows north toward Canada, forming the state’s border
with Minnesota. The city of Grand Forks sits in the Red
River Valley, north of Fargo and south of Winnepeg, on the
North Dakota riverside just across from East Grand Forks.
Between melting snow and persistent rains, the spring of
1997 was a wet one, and the river rose—and rose. When it
finally crested at 54.4 feet, close to double the flood
stage of 28 feet, water was flowing at 140,000 cubic feet
per second, 178 times the normal rate. By Saturday, April
19, floodwaters covered large areas of Grand Forks and East
Grand Forks and 90% of the population had been evacuated.
The city went 23 days without drinkable water. Once flooded,
downtown Grand Forks burned. In this article, three
CPAs who’ve been on the front lines of devastation share
lessons learned the hard way and tell firms how to
prepare—and rebound—and help clients do the same.
GOOD PEOPLE AND GOOD BACKUP
Peter Hoisted, CPA and
partner at Brady, Martz and Associates, CPAs—a
25-partner, 130-employee firm with headquarters in
Grand Forks and three regional offices—has vivid
memories of 1997’s rout. “The water came up and the
fire came down.” While the floodwaters rose,
“everyone was out sandbagging,” Hoisted says. Nobody
worried that the flood might reach the laptops in
Brady, Martz’s downtown third-floor suite, so 35 of
38 laptops were still in the office when it burned.
|
| Be Careful Out There
More than 40% of all companies
that experience a disaster never
reopen. Source: U.S.
Department of Labor Statistics.
| |
The firm’s IT and administration functions had been at
that location, so its billing, collection and time-inventory
records as well as other important management documents and
systems “all melted.” Then the firm’s nearby off-site
storage and bank burned, too. It would be a month before
Hoisted worked downtown again. | Nevertheless, his downtown
team delivered a client’s payroll on time within
days after the waters crested. Although the
employer’s on-site records had been destroyed, its
payroll information was on one of the firm’s hard
drives. Fortunately for the client’s staff, Brady,
Martz had a system whereby various employees took
data backups home on a regular rotation. The person
with the crucial backup had had the presence of mind
to grab it and carry it to safety when the dike
broke as the floodwaters crested, and National Guard
trucks rolled down her residential street with
soldiers shouting, “You have to get out now!”
Retired partner Ron Lunde, CPA, says providing
payroll services helped keep the firm going. In
contrast to a tax or audit project, the payroll
work was needed right away, which gave them no
time to despair about how to go on, he says. The
firm couldn’t have rallied so quickly without a
combination of a little luck, a lot of foresight
and the outstanding effort and dedication of its
staff, Hoisted says: “Our people saved our necks.”
Here are issues he found crucial to becoming
operational again. (For more postdisaster tips,
see “ Business Recovery Procedures. ”)
 Communication.
Being able to reach staff while
local power and telephone lines were down was
paramount. The firm used public service
announcements over area radio stations to give its
people phone numbers to call for information. This
also let the firm compile a new record of where to
contact each employee. |
Business Continuity
Resources
Firms that want
to develop a plan to be ready in the event
of a disaster can learn more about the
process from the following resources.
The Association of
Contingency Planners,
www.acp-international.com .
Business Resumption
Planning, by Edward Devlin, Cole
Emerson and Leo Wrobel (CRC Press,
1997),
www.crcpress.com .
Disaster Recovery
Journal, St. Louis,
www.drj.com .
Contingency Planning
& Management, Witter
Publishing Corp.,
www.contingencyplanning.com .
The Business Survival
Newsletter,
www.rothstein.com .
Loans from the U.S. Small
Business Administration,
www.sba.gov .
Federal Emergency
Management Agency (FEMA),
www.fema.gov . Source:
“Managing Effective Disaster Recovery,”
by Stanley Weiner, The CPA Journal,
December 2001,
www.cpaj.com .
| |
Logistics. For overall
business continuity, the firm had the advantage of its other
offices, which made it possible to back up some files and
provided places for some displaced staff to work as well.
There wasn’t room for everyone, however, and temporary
office space in Grand Forks was at a premium after the
disaster. Only 1,000 square feet was available to replace
the 15,000 square feet of the destroyed headquarters, and
just 25% of the normal head count could work there.
| “If you weren’t
one of the first 14 people to arrive, you didn’t get
space,” Hoisted says. People would show up to
download files or obtain what work materials they
could. Then they’d leave to work from their car—as
Lunde did, with his laptop and mobile phone—or from
their dining room table, as Hoisted did. The interim
office didn’t have enough phone capacity to
accommodate telecommuting, even for staff members
with dedicated Internet lines or fax machines at
home. (For more on emergency office space, see “ Hot Sites. ”)
Systems. The firm’s
technology suppliers were able to send replacement
equipment and operating systems virtually
overnight. Such “quick ship” service is a support
option many third-party leasing vendors provide
their customers (see “ Hot Sites
”) . Even though the firm lost all the
data in the office, it had backup disks stored in
zip-lock plastic bags in safety-deposit boxes at
its bank. The bank’s vault and the surrounding
basement had been under the river. As soon as the
water ebbed, the firm had to get the disks so it
could obtain any recoverable information. Lunde
was available, so he put on boots and a hard hat,
grabbed a flashlight and, accompanied by his
bankers, made his way through the mud and debris
in the burned building. As he trudged through
glop, he remembers thinking that he hadn’t
envisioned the experience as part of an accounting
career. The good news: The data on the disks were
useable.
Insurance.
Insurance paid some of the firm’s
rent for temporary quarters, but only because of
the fire. (Had the displacement been caused by
flood alone, no rent would have been included.)
Moral: Know your policy.
Recovery. Because
the flood and fire affected the entire city of
Grand Forks, many businesses had to lay off their
people. In contrast, Hoisted says, “We were able
to keep paying our staff.” Reopening quickly
helped retain employees because their earnings and
their relationship with their employer weren’t
interrupted, he says. It took Brady, Martz
two-and-a-half years and two more offices to
restore its business to comparable space. Today,
it’s back downtown, across the street from where
it used to be. As one of the larger downtown
employers, the CPA firm’s return has bolstered
other area businesses, as has the return of law
firms and banks. |
Hot Sites
CPAs researching business
continuity options should be familiar with
the following information.
Hot site: A hot
site is an operationally ready business
center that provides subscribers with
computers, phones, printers, fax
machines and everything they need to
carry on if there is a catastrophic
event. Hot sites can be used for up to
eight weeks in disaster mode.
Subscriptions average 52 months in
length, and costs range from $250 to
$120,000 a month. A number of reputable
companies offer this service.
Cold site: An
empty, environmentally conditioned
computer room where staff can work. A
hot site subscriber that uses up its
occupancy time moves to a cold site.
Electronic vaulting:
Transmission of data from
the subscriber office to the hot site
using a dedicated line.
Mobile/porta-site:
A mobile site is a
standalone computer/office environment
unit on a trailer; a porta-site is
transported to the subscriber’s site and
constructed after delivery. These
business continuity options serve the
same function as cold sites.
Original equipment
manufacturer (OEM) insurance:
In the event of a
disaster, some computer companies will
replace damaged computer equipment on a
priority basis and guarantee another
system of equal or greater processing
capacity within a specified period of
time. Costs are usually in the range of
6% to 8% of the monthly maintenance
bill.
PC-based planning tools:
As an incentive to
subscribe, many hot-site vendors offer a
PC-based disaster recovery program that
the client can use.
Quick ship: Most
third-party leasing vendors provide
recovering customers quick shipment of
computer equipment. Customers are
charged a priority equipment search fee.
| |
Most important tips. Besides
making sure operational and project data are backed up at a
separate, secure location, Hoisted strongly recommends that
any business
 Keep up-to-date about the availability of two
or three potential replacement spaces. | Get in touch with everyone important to
the business. Contact clients and discuss files,
records, deadlines and the status of work in
progress.
If there is a lease agreement,
contact the landlord to discuss the recovery
efforts and determine obligations during the
period in which space cannot be accessed.
SHAKE, RATTLE AND ROLL
California’s Northridge earthquake of
January 17, 1994, measured 6.7 on the Richter
scale and left widespread destruction. Many
houses, office buildings, parking structures and
sections of major freeways collapsed or suffered
irreparable damage. Mitchell Freedman, CPA/PFS,
was at home, less than five miles from the
epicenter of the quake, when it struck at 4:30
a.m. The sensation was “as if a huge speeding
locomotive was coming through the house,” he says.
With an earthquake, “you never know if the first
shock is just the beginning.” Damage was
uneven and quirky. For example, Freedman’s home
sustained six-figure damage, but the house next
door was a total loss. At his nine-person firm,
located in a high-rise in the San Fernando Valley,
just a few computer monitors toppled onto chairs,
but the office building across the street was
red-tagged by authorities as uninhabitable. Here
are some changes he made after the event.
|
Important Family
Documents
The Federal
Emergency Management Agency (FEMA)
recommends keeping these important family
documents in a waterproof, portable
container:
Will, insurance policies,
contracts, deeds, stocks and bonds.
Passports, Social Security
cards, immunization records.
Bank account numbers.
Credit card account numbers
and company contact information.
Inventory of valuable
household goods and important telephone
numbers.
Family records (birth,
marriage and death certificates).
For more on disaster preparedness,
see
www.fema.gov/about/drc.shtm .
| |
Preparedness plans. Most
people were unprepared, Freedman says, so after the quake he
instituted personal and business preparedness plans and
helped his clients do the same. Personally, Freedman
now follows standard emergency readiness advice, keeping
sturdy shoes by the bed (he cut his feet on broken glass in
the quake) and a flashlight in the nightstand drawer. “I
don’t just check the batteries,” he says, “I change them.”
He makes sure he has athletic shoes, drinking water and a
first-aid kit in the trunk of his car. His family has
designated an emergency contact person in Florida, far away
from potential temblors (see “
Important Family Documents. ”). From a
business standpoint, he says, the crucial factors are to be
able to contact people—including employees, clients and
vendors—and to get the business operating as quickly as
possible. His employees now have an agreed-upon place to
meet after an event, and they all keep an earthquake kit
under their desks, which consists of a backpack containing a
phone list, flashlight, blanket, water, nutrition bars,
canned food and athletic shoes. (For more information about
what to do in an emergency, see “
Medical Emergency Information. ”) The firm protects
its data with daily downloads, and staff take home the
previous day’s job files. The firm backs up other system
information to its tech vendor 11 miles away.
| Freedman recommends
that clients keep some cash at home and in nearby
banks. (His PFP clients who do this had access to
money when a money-market mutual fund couldn’t do
business during the four days the financial markets
shut down after the September 11 World Trade Center
attacks.)
Insurance and emergency help.
A valuable service CPA financial
planners can provide clients is dealing with
insurance companies and the Federal Emergency
Management Agency (FEMA). Policies vary, and some
cover both structure and contents with one
deductible, while others require separate
deductibles. A few of Freedman’s clients had one
policy for the structure and another for contents,
with each carrying a deductible of up to 15%.
Unraveling the types of losses they reimbursed was
complex. Some houses in the Northridge,
California, area burned when the quake ruptured a
gas line, so several clients who lacked earthquake
insurance were helped by fire insurance, Freedman
says. Besides knowing what the fine print does and
doesn’t cover, be aware that the insurer’s first
response to a claim inquiry may not be final. For
example, if too much glass breaks into a carpet,
it can’t be cleaned and must be replaced. Freedman
negotiated a replacement from an insurer that
initially told its customers to vacuum the broken
glass. CPAs can help clients apply for
low-interest Small Business Administration loans.
Although easier to obtain after a catastrophe, an
SBA emergency loan request for operating cash
requires a massive amount of highly detailed,
well-documented paperwork (see “ Business Continuity Resources.
”).
Most important tips.
Freedman says that besides an
earthquake kit, clients should
Keep cash, “in the hundreds,” in a
part of the house that’s both accessible and
unlikely to collapse. (ATMs don’t work when power
lines are down.)
Document items for legal and
insurance purposes. Take snapshots of destroyed
property. |
Medical Emergency
Information
In case of a medical emergency,
follow these procedures:
Call an ambulance.
Find the nearest person
trained in cardiopulmonary resuscitation
(CPR) or first aid.
Send someone to the parking
lot to meet the ambulance.
Do not move the patient
unless failure to do so would be life
threatening.
Have the firm spokesperson
notify family members of the injured
person.
Keep medical emergency kits
and medical-help information handy:
Post diagrams of where to
find stored medical supplies such as
first-aid kits and blankets.
List medications and
include instructions about use.
Conduct quarterly inventory
of medical supplies; check freshness and
restock at least quarterly.
List the names and
telephone numbers of all employees
trained in CPR and first aid.
Post the names and
addresses of local hospitals and walk-in
clinics, and include street maps and
driving directions. Source:
Management of an Accounting
Practice Handbook, AICPA,
www.aicpa.org and www.cpa2biz.com
.
| |
Don’t reenter a building if dangerous
conditions exist.
BE PREPARED
“There is nothing we can do to prevent disasters. But
if one happens, we offer our clients recoverable information
and a place to work,” says Andrew Rudin, a New York-based
CPA, who has provided business continuity planning and
technology consulting for more than a dozen years. “We have
master lists of clients’ employees so we can contact them,
make sure they’re OK and tell them where to show up to
work.” An early and essential step in developing a
business recovery plan is a risk analysis to identify
physical and operational weaknesses, sources say. Next, the
entity must determine the basic processes and assets it
needs to function. That information is the basis for
preparing detailed documentation of what to do in an
emergency and how to do it for that organization. In theory,
an individual having the resulting recovery manual can find
the firm’s people, obtain equipment and support, use
job-file and system backups and put staff to work in an
alternate location. To create a comprehensive
continuity plan, a business needs to
Obtain senior management sponsorship.
Analyze environmental vulnerability.
Analyze the business impact of potential
equipment and data loss.
Identify and document critical business
processes.
Organize business recovery teams and determine
the resource requirements to recover • Headquarters.
• Computer operations.
• The disaster site.
Develop procedures to reinstate voice
communications and business operations equipment.
Establish document- and data-recovery policies
and procedures and test them every three months.
| Rudin helps his
clients implement planning procedures and find and
learn to use off-site data storage, redundant
computer systems in another secure facility and ways
to transfer data on dedicated lines or the Internet.
The level of detail for any plan depends on the
client company. For some, it doesn’t make much
difference if they don’t operate for two days, but
others can lose billions of dollars in two or three
hours and need to get back up immediately, he says.
Here are the areas he pays particular attention to.
Vital documents and contracts.
Rudin reviews clients’ important
contracts, locates all copies of trademarks and
licensure agreements and helps clients with
document control and warehousing. Clients can
store duplicates or originals off-site in a
safety-deposit box, in a bank or a secure storage
facility. He recommends clients move toward data
imaging, so they scan and store documents
electronically. Clients should keep the originals
secure, but a facsimile or a reproduction of a
scanned image is legal and flexible backup, he
says.
Scope of services.
The service ranges from quick advice
through writing detailed in-house manuals on how
to handle a worst-case scenario. Rudin helps
larger companies select a “hot site,” a facility
that provides subscribers with computers, phones,
printers, fax machines and everything they need to
do business (see “ Hot Sites
”). |
AICPA Resources
Chapter 215 of the MAP
handbook covers coping with a disaster.
Section 215.03 takes CPAs through steps to
create an IT recovery plan. “Coping With
Disaster” was written by Philip Rothstein,
FBCI. To order the Management of an
Accounting Practice Handbook
(090407), call 1-888-777-7077 or go
to
www.cpa2biz.com . To order the
electronic edition (e-MAP), search the
cpa2biz Web site under keyword emap.
Disaster Recovery: A
Guide to Financial Issues, a
publication jointly prepared by the
AICPA and National Endowment for
Financial Education (NEFE), will be
released in early 2003. It will be
available from the AICPA and state
societies. This guide aims to
provide comprehensive information for
survivors of a disaster by offering
suggestions on steps to take
immediately, in the initial weeks and
months, as well as how to begin planning
the future. It covers all aspects of
recovery, including financial issues
surrounding the death of a loved one,
personal injury and disability and
property loss that results from a
disaster.
| |
One client installed a fully redundant data system:
What’s written to the office server is duplicated at a
location 25 miles away, a distance partly determined by the
efficacy of the T-1 line between the two. (Backup systems
several hundred miles away may be even more secure, sources
say.) If the company’s building floods, burns or worse, its
employees can drive to the other location, access their
data, and everyone theoretically can work from home. “There
are 72 people in the client’s company,” says Rudin.
Marketing. The firm asks
clients if they have a disaster recovery plan. If so, Rudin
reviews it and suggests improvements. Jobs for small
businesses have entailed fees of less than $5,000, but the
more important immediate business reactivation is to the
client, the more it needs to spend.
A living document. A client
needs to update its business continuity plan every time
something changes. Every two months the continuity provider
should ensure that clients’ phone lists and contracts are
current, says Rudin. Remind clients to keep up payments on
alternate work sites and services to make sure they’re
available if they’re needed.
LAST WORDS
All firms and companies should assess their risk,
determine the basic processes and assets they need in order
to function and prepare a backup plan. The crucial
continuity factors to get a business going again after a
disaster are to be able to contact the people important to
the business—including employees, clients and vendors—and to
have a place and the equipment to work. Give employees an
agreed-on place to meet, store important duplicate data
off-site and start scanning and storing documents
electronically. Lease a hot site or keep track of the
availability of a couple of potential replacement offices.
A dozen years ago, a large Park Avenue law firm in New
York City had a fire in the building that housed its main
office. All its information was stored on-site. “We needed
to get the client up and running at another location, so
someone had to retrieve the firm’s backup, which we couldn’t
get to because there was asbestos all over,” says Rudin.
“The fire department gave one of my associates a physical,
then sealed him in a yellow ‘spacesuit’ with an air pack so
he could go into the office to get the firm’s data. That
situation worked out fine, but we have to be so careful. If
you’re wrong, the company dies—that’s the reality.”
| Business
Recovery Procedures A company or firm
with a continuity plan, backup data, backup
equipment, alternate workspace and personnel
trained to implement a recovery is better
positioned to deal with a catastrophe than one
that isn’t. All businesses will need to organize
quickly.
In the damage assessment phase, line up
help.
Contact the local emergency
operations center to register a claim for relief.
Get in touch with the business’s
property/casualty insurer. Review the policy, talk
with a representative about the loss and discuss
business interruption coverage for loss of income
as well as reimbursement for expenses such as
temporary office space and equipment.
Contact the errors and omissions
(E&O) insurer to inform it of the disaster and
obtain guidance about how to avoid malpractice
liability if the firm will miss client deadlines.
Assess damage to determine what, if
anything, is salvageable and how long recovery
efforts will take.
Communicate with everyone important to
the business.
Contact all firm members and
employees to inform them of the status of the
situation and to establish communication
procedures (telephone trees, emergency information
hot line) until office space is acquired and
everyone can get under one roof again.
Contact vendors to let them know
where the temporary location is.
Advise the post office and other
delivery services to stop shipments to the damaged
location and reroute services to the temporary
site.
Contact banks for replacement checks.
Stay in touch with the payroll
service if necessary.
Contact the phone company to reinstate
telephone service.
Arrange for an answering service with
an appropriate message until a new system is in
place.
Arrange temporary service with the
local telephone company at the interim location
for phones, fax, modem and Internet use.
Have phone calls forwarded to the new
number.
Get cellular phones. |
Obtain work space, furnishings and
equipment for staff.
Identify alternative work locations.
Call local realtors to find office
space.
Arrange for temporary space—share
with other firms, law firms or rent a hotel suite.
Rent, borrow or purchase desks,
chairs, lamps, filing cabinets and bookshelves.
Obtain computers and operating
systems. Equipment needed may include computers,
computer networks, printers, fax machines,
copiers, word processors and calculators. (If
staff members have laptops and home computers,
find out if they can they be used for the business
during the recovery period.)
Contact equipment vendors.
Discuss existing leases, contracts
and performance obligations under the terms of the
lease or contract.
Get a vendor to assist with the
recovery of computer hardware and peripherals.
Obtain office supplies.
Contact the supply vendor to obtain
whatever supplies are necessary.
Hire a printer to print stationery
and business cards.
Obtain billing and other forms from a
forms vendor.
Recover records.
Begin assessing damage once the workplace is
accessible. If fire was involved, make sure all
file cabinets or other containers are cold to the
touch. Flash fires may occur upon opening a warm
cabinet. If water damage is the problem, obtain
the following supplies:
Freezer or waxed paper.
New boxes, file pockets and folders.
Plastic milk containers.
Refrigerated facilities or trucks.
Plastic garbage cans or pails.
Sawhorses, plywood and plastic
sheeting to wrap wet records for removal.
Fans and dehumidifiers; pumps, if
necessary.
Mops, buckets, sponges and rubber
gloves.
Irons, plastic clips and clothesline
or nylon fish line (to dry a small volume of
records). |
Assess damaged property and documents.
Assign priority to damaged
documents. Separate records that are of critical
importance from those that can wait. Protect the
most critical documents from further damage as you
organize them to be restored. If documents are
waterlogged, you can freeze them and have a
commercial restorer salvage them. Freezing will
preserve paper documents up to six years. If
backup records are available, the originals aren’t
necessary. Identify the documents’
physical status with colored tape or markers:
Black—beyond hope and cannot be recovered.
Red—to be recovered first, of the greatest
importance. Yellow—to be frozen and
recovered only when needed. Long-term storage is
possible. Green—not damaged and can be
used immediately.
Document all losses.
Destruction of items should be documented for
legal and insurance purposes. Use a disposal
certificate to indicate what is beyond recovery
and why. The form should describe what was
destroyed, how it was destroyed, how it was
pertinent to a client if it was and it should be
signed and dated.
Techniques to recover water-damaged
documents.
Separate sheets of paper by hanging
them on a clothesline, or interleaving them with
absorbent paper. Dry individual sheets by ironing
them using low heat.
Protect a damaged document with clear
Mylar as you photocopy it. Discard the original
and use the photocopy.
Create new file folders, pockets or
boxes to organize the documents as you restore
them.
Pack wet documents for freeze-drying
into cut-off plastic milk containers. Stand them
upright and pack two-thirds full.
Techniques to recover fire-damaged
documents. Look at
charred records that are not wet to see if they
are completely obliterated or just have burned
edges. If the information is recoverable,
photocopy the document. Handle the records as
little as possible. | | Source: Tennessee Bar Association with
the Association of Contingency Planners,
www.acp-international.com . | |
