Working for a construction business through Florida hurricanes has made Jennifer Elder, CPA/CFF, CGMA, an expert in disaster recovery and business continuity. She offers these tips for organizations.
Understand the necessity and the objectives. "It's sort of a false sense of security when people say, 'This will never happen to me,'" Elder said. She said a disaster plan should outline a two-part process. The first part involves boarding up windows, making sure employees are safe, and taking steps to minimize the immediate damage. The second part should describe business continuity. "Now you figure out how to get back to [your] normal level of business," she said.
Consider the most likely scenarios. These may not be natural disasters. "Right now, for every company, the most likely disaster ... is an IT disaster," Elder said. "What happens if you get hit with malware or ransomware? What happens if there's a power outage and you can't access your computer database? ... Everybody should have a plan for that." Forming a team from various parts of your organization can help you brainstorm for possible scenarios and determine the biggest risks.
Assess your operations. Decide what's truly critical and make plans to protect it in various scenarios. "As much as I'd love to say the accounting department in an organization is critical, if you're trying to recover from a disaster, it's probably not your number one focus," Elder said. Your response strategies will differ depending on the nature and likelihood of the risk and the potential threat to critical operations. "We can ignore them," Elder said. "We could defend against them. We can insure them. Or we can just plan for a response. So we need to tailor how we respond."
Put your plan in writing. The plan can be simple. "Disaster planning doesn't have to be a monstrous event," Elder said. "This doesn't require a consultant. This doesn't require a plan that's a hundred pages long." It's natural for people to panic or feel great stress when a disaster strikes, and this can have a negative effect on decision-making. A written plan can help guide a rational response.
Review your plan regularly — and test it, too. A friend of Elder's saw power in a company's building go out shortly after a generator was installed as part of a business continuity plan. The company hadn't had time to test the generator when the building lost power. It turned out that the building was too large for the generator to handle, and it broke under the strain. "Testing your plan and making sure you haven't missed anything is as important as putting it together," she said.
Editor's note: This checklist was adapted from a JofA podcast, "Why You Can't Wait to Prepare for Disaster," May 6, 2019.
Jennifer H. Elder, CPA/CFF, CGMA, is owner and president of The Sustainable CFO consulting firm. She is co-author of the book Faster Disaster Recovery: The Business Owner's Guide to Developing a Business Continuity Plan, available at aicpastore.com (#PMA1901P). To comment on this article or to suggest an idea for another article, contact Ken Tysiac, the JofA's editorial director, at Kenneth.Tysiac@aicpa-cima.com.
