Preparing for disaster

One CPA firm is still recovering from a “superstorm” that damaged nine of its 14 offices. Another has constructed a safe room in its new office, which was built after a tornado destroyed its previous office. A third firm is adjusting to the “new normal” in a city forever changed by widespread flooding.

For these firms, disaster-response planning has taken on a whole new meaning. It no longer refers to a compilation of phone trees and process recovery checklists. Instead, it refers to the sober realization that disasters can happen to anyone at any time and that the most important preparation is to understand that even the best disaster-recovery plans won’t work exactly as envisioned.

The firms featured in this article survived three of the worst weather-related natural disasters in U.S. history, but what they learned can apply to situations as common as an office fire. This article addresses issues CPA firms should be prepared to face if they are hit with a disaster that disrupts their business (see the sidebar, “Areas to Address in Disaster-Recovery Plans,” below for detailed suggestions on what to include in a disaster plan).

IT ALL STARTS WITH COMMUNICATION

At first glance, WithumSmith+Brown; Bourgeois Bennett LLC; and Hardy, Wrestler and Associates would appear to have little in common, aside from being accounting firms. WSB is a New Jersey-based firm with 14 offices and 500 employees. Bourgeois Bennett is a regional firm with 100 or so employees in the New Orleans area. Hardy, Wrestler and Associates is a 20-employee firm in Joplin, Mo.

But each survived a major weather-related disaster, and each ran into many of the same problems in the aftermath of those disasters.

One of those problems was communicating with staff. WSB, for example, operates in a region devastated by Hurricane Sandy, also known as Superstorm Sandy, in October 2012. Sandy, whose storm surge wiped out many homes along the coast and whose winds and rain caused more than 100 deaths in the Northeast, damaged nine of WSB’s 14 offices.

In addition, the storm knocked out 25% of the cellphone towers in a 10-state region. This wreaked havoc on WSB’s post-disaster communication strategy, which relied on phone trees in which employees would call other employees via their cellphones. The loss of cell towers resulted in that plan failing.

Jim Bourke, CPA/CITP/CFF, CGMA, a partner in charge of information technology with WSB, responded to the cellphone disruption with a two-pronged approach:

1. His IT team converted the firm’s internal website into the centralized location where employees could learn which offices were open, which technologies were accessible, and how to reach critical contacts and services.

2. His staff relied on texting to communicate with one another. Because texting uses far less bandwidth than voice calls, some texts were able to get through. That allowed WSB to spread the word about the internal website.

Bourgeois Bennett is located more than 1,000 miles southwest of WSB’s New Jersey home, but the New Orleans firm also ran into communication challenges when the city’s levee system failed after Hurricane Katrina hit in 2005. Floodwaters reached to the rooftops in 80% of the city, resulting in more than 1,800 deaths. With employees displaced and cellphone towers in the flood zone inoperable, Bourgeois Bennett turned to an externally hosted bulletin board system, UltraBB (ultrabb.com), as a means of communication, said Les Nettleton, the firm’s director of information technology. Employees could access essential information from anywhere they could get an internet connection.

For Jim Hardy, CPA/ABV/CFF, founder of Hardy, Wrestler and Associates, texting also was the best way to communicate in the wake of an EF5 tornado, the strongest possible on the Enhanced Fujita scale for measuring tornado wind speed and damage. The tornado tore through the middle of Joplin in May 2011, killing more than 155 people and destroying many of the town’s structures, including the office building in which Hardy’s firm was located.

“We had a meeting place, which happened to be my house, where we told [the employees] to come and bring their laptops, if they had them at home,” Hardy said. “And that’s how we got started the next day—at least we had some computer equipment.”

The firm also had a temporary home, thanks to a client contact and some good fortune. A client who happened to be in Tampa, Fla., when the tornado hit called Hardy and, once he confirmed that Hardy’s office had been destroyed, offered him the use of an empty building owned by the client’s father. By 9 p.m. the night of the tornado, Hardy, Wrestler and Associates had secured a place to go. “That was a real blessing,” Hardy said.

Bourgeois Bennett’s offices, located on the 17th floor of an 18-story New Orleans building, were not damaged in the Katrina floods, but water that seeped into the building on the bottom floors caused a mold problem that forced the firm to vacate the building for 76 days. This led to the firm temporarily relocating to Houma, La., about an hour southwest of New Orleans.

THE HUMAN ASPECT

In the event of a disaster that impacts day-to-day life for employees and the communities where they live, firms should focus on addressing the human needs of their people. Large-scale destruction and suffering can lead to mental health and other issues for employees.

“It’s a huge psychological issue,” said Bourke, who pointed out that all WSB employees either were impacted directly by Sandy or knew someone dealing with damage inflicted by the storm. “When our people came back to work physically, they didn’t come back to work mentally,” he said. “There were so many relief efforts going on in so many of our communities. We gave [employees] the flexibility to go and help in their communities.”

In a similar vein, Bourgeois Bennett gave all employees three weeks off with pay after Katrina. “The firm decided to stay closed because the rest of the city was closed and there wasn’t really anything we could do for our clients at that time,” Nettleton said. The firm prioritized getting its payroll process up and running so it could get money into its employees’ bank accounts. By focusing first on the employees—rather than on work that had become inconsequential for clients whose businesses literally were underwater—the firm managed to carry on, Nettleton said.

For Hardy, the most evident psychological impact was heightened employee fear of high winds and storm systems that could produce tornadoes. “We made sure to build a tornado shelter as part of the new building,” Hardy said. The firm’s rebuilt office is equipped with a concrete-walled “safe room” that is 31 feet long, 15 feet wide, and 10 feet tall. Emergency supplies such as water, flashlights, and a first-aid kit are kept inside.

Clients also stop by to take shelter in Hardy’s building when tornado warnings are issued for Joplin.

Even after life at the office begins to resemble normalcy, it doesn’t mean that everything is back to normal for every employee. In the first few months after Katrina, the suicide rate in New Orleans tripled. That prompted Bourgeois Bennett to introduce additional mental health initiatives for its staff, 16 of whom lost everything in the storm. “You need staff to know that you care,” Nettleton said.

THE BUSINESS IMPACT

While the human aspect comes first in the recovery process, firms also must find a way to stay viable as businesses in the wake of a disaster. Firms are well-advised to have business interruption insurance, which is structured to compensate businesses for periods when they are unable to operate because of disaster (see the sidebar, “Insurance Matters”). Hardy, Wrestler and Associates had business interruption insurance when the Joplin tornado hit, but the firm’s business actually grew in the wake of the disaster. Part of the increase came from extra work helping business clients make adjustments, such as modifying loan agreements with banks, that would allow them to survive. “Probably within three months of the tornado, we were into that type of planning with our clients,” Hardy said.

Bourgeois Bennett also experienced an increase in billings despite the fact that about 25% of the population of New Orleans left the city and never returned. While many small businesses, the firms’ core client base, left the area, so did many CPA firms, opening up a larger share of the market to Bourgeois Bennett.

WithumSmith+Brown helped its clients navigate the process of securing aid through the Federal Emergency Management Agency (FEMA). The firm was not experienced in this area but had to learn on the go, Bourke said. WSB’s clients also learned that flood insurance doesn’t cover everything, he said.

WSB leveraged its cloud-based document file room to provide some good news to clients who lost financial records to the storm. After sending its first post-Sandy email to staff, the firm emailed clients and let them know that all their mission-critical documents, including all tax returns filed through WSB, were safe and secure in the cloud. Bourgeois Bennett was able to pass along a similar message to its clients.

Hardy, meanwhile, had to deliver some bad news in his email to clients four days after the tornado. While the firm has kept all completed work in digital format since 2007, the scanning of the documents doesn’t take place until the work is finished. As a result, the firm’s work-in-process (WIP) documents are in paper format. In addition, the firm keeps paper copies of finished work items on-site until they are picked up by clients. When the tornado hit, some confidential documents in the office were strewn all over central Missouri. Hardy had to tell clients that those documents were lost.

In the wake of the tornado, the firm now stores WIP documents overnight in airtight, watertight plastic containers in the safe room.

Completed work yet to be picked up by clients is stored on a cart located a few feet outside the safe room during business hours. In the event of a tornado, the disaster plan assigns an employee to pull the cart into the safe room while entering. The building’s alarm system has different sounds to indicate a fire or a tornado, so that employees are not confused about whether they should exit the building or enter the safe room when the alarm sounds.

And firm policy requires employees to have paperwork from just one job on their desk at any one time, so they can immediately hustle to the safe room or out of the building without feeling pressure to save their work.

These are aggressive measures, but after seeing his office reduced to rubble, Hardy wants to be thoroughly prepared.

“The biggest thing I can’t stress enough,” Hardy said, “and I have done it with a number of our clients, is to have a disaster plan so you know what your steps are immediately following the disaster, so you can start putting those steps in place” (see the Hardy disaster plan in Exhibit 1).

CLOUD COVERAGE

Bourke agrees that disaster recovery plans are important, and he emphasizes the need for firms to update and test those plans. He also places great value in migrating as many IT functions, applications, and processes as possible to cloud data centers that have been vetted with a Service Organization Control (SOC) audit.

“All I have to say to CPAs who are not in the cloud, who are not advising their clients to be in the cloud, this has to be an eye-opener,” said Bourke, a member of the AICPA board of directors. “It’s all about making sure you have up time, protecting those records and mission-critical information.”

Nettleton agrees that digitization can be a significant help for businesses in case of disaster. But he also said there is no perfect answer that would render any business immune to problems.

Should an act of terrorism paralyze internet-based technology, Nettleton said, firms that rely on it could face problems. “That would be as catastrophic as a hurricane coming through,” he said.

One way to mitigate that risk is to ask cloud providers the physical location of the servers they and their subcontractors would use to house and process data. Firms must know where their data would reside and ensure that any service agreements with a cloud provider clearly state who has rights to the data; how the data would be returned to the CPA firm when the contract ends, whether by term or by cause; and where the data physically can be moved, because some state and other regulations require CPA firms to keep certain client information in the United States.

Finding out the physical location of the server that stores the data is just one step to prepare for natural or manmade disasters that can disable a business’s IT system, said Marios Damianides, a partner at Ernst & Young and a former president of the Information Systems Audit and Control Association (ISACA).

To avoid surprises that force a firm into a “just-in-time recovery,” Damianides recommended preparing for disasters in a way that keeps IT recovery plans up to date. “Have [disaster recovery] built into risk management processes. Then it becomes part of a cycle of reviews.”

CONCLUSION

In the end, firm leaders must prepare as much as possible for disaster while preparing their employees for the reality that not everything will go according to plan. As Nettleton puts it, “How do you prepare for and subsequently recover from a disaster that destroys the entire city in which you do business?”

(JofA senior editor Sabine Vollmer contributed to this article.)

EXECUTIVE SUMMARY

CPA firms and other businesses should have disaster-response plans. Employees should be trained on what to do before, during, and after a major event that disrupts business.

Disaster-response plans should cover areas essential to employee safety and the business’s survival. The plan should establish how the business will communicate to ensure employees are safe and to provide post-disaster instructions. Other topics of importance include document storage and recovery; insurance coverage; communication with clients; finding an alternative location for business in the event offices are destroyed; and restoration of business operations, starting with payroll.

Businesses and their employees must be prepared for the unexpected during disasters. CPA firms that have survived major weather-related catastrophes emphasize the importance of adjusting on the fly.

Texting emerged as the most reliable way to communicate with employees in the wake of the Joplin, Mo., tornado, and hurricanes Katrina and Sandy. High winds, flooding, and earthquakes can disable cellphone towers, disrupting voice and other high-bandwidth communications over mobile devices.

Companies should concentrate on addressing the human aspect of disaster recovery. It is essential to ensure that employees have access to money, insurance, mental health care, and other support programs.

Jeff Drew and Ken Tysiac are JofA senior editors. To comment on this article or to suggest an idea for another article, contact Drew at jdrew@aicpa.org or 919-402-4056 or Tysiac at ktysiac@aicpa.org or 919-402-2112.

AICPA RESOURCES

JofA article

“Most U.S. Small Businesses Lack Disaster-Recovery Plans,” Aug. 2, 2012

Publications

• 10 Steps to a Digital Practice in the Cloud: New Levels of CPA Firm Workflow Efficiency (#PTX1204P, paperback; and #PTX1204E, ebook)
• Principles and Practices of Business Continuity: Tools and Techniques (#991012)
• Quick and Easy Business Continuity Plan for Your Small Business: Step-by-Step Template and Sample Plan (#991011, CD-ROM)
• Risk Management—A CPAs Toolkit for a Changing Environment—Disaster Recovery and Business Continuity (#056503PDF3, on-demand)

Conference

Practitioners Symposium and Tech+ Conference in partnership with the Association for Accounting Marketing Summit, June 10–12, Las Vegas

For more information or to make a purchase or register, go to cpa2biz.com or call the Institute at 888-777-7077.

Private Companies Practice Section and Succession Planning Resource Center

The Private Companies Practice Section (PCPS) is a voluntary firm membership section for CPAs that provides member firms with targeted practice management tools and resources, including the Succession Planning Resource Center, as well as a strong, collective voice within the CPA profession. Visit the PCPS Firm Practice Center at aicpa.org/PCPS.

Areas to Address in Disaster-Recovery Plans

1. How are you going to communicate with staff? A phone tree, where employees call one another and report back to a supervisor, can aid in quick verification if a disaster occurs outside business hours. What is your backup plan if Plan A won’t work because of cellphone tower damage, power loss, or another unforeseen event?

2. Where are you going to set up operations if your physical office is destroyed?

3. How will you access crucial documents? Back up your computer files off-site and go paperless. Paper can be destroyed by wind, water, or fire. If you have client documents hosted on the cloud, are your clients aware that you have copies of those?

4. How will you communicate with clients? Following the Joplin tornado, Jim Hardy had a business phone line routed to his home. He sent a letter explaining the situation to all Hardy, Wrestler and Associates clients just days after the storm.

5. Do your employees know what to do in the event of an emergency? Conduct drills. Make sure employees know where to go and what to do in case of a fire or storm during business hours.

6. How will you meet the human needs of your staff? Will you have mental health services available? Will you have payroll up quickly to get money into employees’ hands? Will you give employees time to deal with damage to personal property or to the communities in which they live? Don’t underestimate the personal impact a disaster can have on your people.

7. Aside from human resources and payroll, what work processes will you be able to restore first? What services will your clients require in the immediate aftermath, and how will you provide those services?

8. Do you have business-continuation, flooding, and other types of insurance in place? Is the coverage appropriate for your business given your size and the likelihood of certain events (floods, hurricanes, tornadoes, etc.) in your part of the country?

Insurance Matters

Business interruption insurance, which is structured to compensate businesses for periods when they are unable to operate because of disaster, can help companies recover. Individuals interviewed for this article offered the following tips related to business interruption insurance:

• Keep a record of your office contents. This will make it easier to substantiate claims for items such as office supplies whose costs quickly escalate when an office is destroyed.
• Carry insurance on any materials at the work site that belong to customers or are on consignment from customers or suppliers.
• If disaster strikes, do what you can to get back to work quickly when it’s safe to do so. “Your insurance company is going to be looking for you to do that if you have business interruption insurance,” said Theodore Sarenski, CPA/PFS, a financial planner in Syracuse, N.Y., and a member of the National CPA Financial Literacy Commission. “They’re going to want you to get back up on your feet as soon as you can.”
• Jim Hardy of Hardy, Wrestler and Associates said it’s a good idea for business owners to thoroughly review their insurance with financial professionals.