Before the Delugeand After

DISASTER PLANNING/PRACTICE MANAGEMENT

CPAs can help clients prepare to pick up the pieces when Mother Nature hits hard.

Before the Deluge—and After

BY SARAH PHELAN AND MICHAEL HAYES

EXECUTIVE SUMMARY

BEING ABLE TO REACH STAFF IS PARAMOUNT during and directly after a disaster. To communicate while power and telephone lines are down, a firm can use public service radio announcements to give out phone numbers where employees can get information.

ORGANIZE BUSINESS RECOVERY TEAMS AND DETERMINE the resources needed to recover headquarters, computer operations and the disaster site. Reopening quickly helps a business to retain employees because there is no interruption in their earnings.

BESIDES MAKING SURE OPERATIONAL AND project data are backed up at a separate, secure location, one CPA recommends that a business or firm pick out two or three potential replacement spaces and keep up-to-date about their availability.

TO CREATE AN EFFECTIVE CONTINUITY PLAN, a business needs to obtain senior management sponsorship, analyze environmental vulnerability, analyze the business impact of potential equipment and data loss and identify and describe critical business processes.

THE ENTITY MUST PREPARE DETAILED documentation of the steps to take to perform its essential tasks. In theory, an individual can use the recovery manual to find its people, obtain equipment and support, use job-file and system backups and put staff to work in an alternate location.

ESTABLISH DOCUMENT- AND DATA-RECOVERY procedures and test them quarterly. The level of detail for any plan depends on the company’s needs. For some, it doesn’t much matter if they don’t operate for two days, but others can lose billions of dollars in two or three hours.

SARAH E. PHELAN, JD, is a New York-based attorney and writer. Ms. Phelan was formerly a senior manager with Deloitte & Touche and a technical manager in personal financial planning at the AICPA. Her e-mail address is Phelanlaw@prodigy.net. MICHAEL HAYES is a senior editor on the JofA. Ms. Hayes is an employee of the AICPA and her views, as expressed in this article, do not necessarily reflect the views of the Institute. Official positions are determined through certain specific committee procedures, due process and deliberation.

t the eastern edge of North Dakota, the Red River flows north toward Canada, forming the state’s border with Minnesota. The city of Grand Forks sits in the Red River Valley, north of Fargo and south of Winnepeg, on the North Dakota riverside just across from East Grand Forks. Between melting snow and persistent rains, the spring of 1997 was a wet one, and the river rose—and rose. When it finally crested at 54.4 feet, close to double the flood stage of 28 feet, water was flowing at 140,000 cubic feet per second, 178 times the normal rate. By Saturday, April 19, floodwaters covered large areas of Grand Forks and East Grand Forks and 90% of the population had been evacuated. The city went 23 days without drinkable water. Once flooded, downtown Grand Forks burned.

In this article, three CPAs who’ve been on the front lines of devastation share lessons learned the hard way and tell firms how to prepare—and rebound—and help clients do the same.

GOOD PEOPLE AND GOOD BACKUP
Peter Hoisted, CPA and partner at Brady, Martz and Associates, CPAs—a 25-partner, 130-employee firm with headquarters in Grand Forks and three regional offices—has vivid memories of 1997’s rout. “The water came up and the fire came down.” While the floodwaters rose, “everyone was out sandbagging,” Hoisted says. Nobody worried that the flood might reach the laptops in Brady, Martz’s downtown third-floor suite, so 35 of 38 laptops were still in the office when it burned.

Be Careful Out There

More than 40% of all companies that experience a disaster never reopen.

Source: U.S. Department of Labor Statistics.

The firm’s IT and administration functions had been at that location, so its billing, collection and time-inventory records as well as other important management documents and systems “all melted.” Then the firm’s nearby off-site storage and bank burned, too. It would be a month before Hoisted worked downtown again.

Nevertheless, his downtown team delivered a client’s payroll on time within days after the waters crested. Although the employer’s on-site records had been destroyed, its payroll information was on one of the firm’s hard drives. Fortunately for the client’s staff, Brady, Martz had a system whereby various employees took data backups home on a regular rotation. The person with the crucial backup had had the presence of mind to grab it and carry it to safety when the dike broke as the floodwaters crested, and National Guard trucks rolled down her residential street with soldiers shouting, “You have to get out now!”

Retired partner Ron Lunde, CPA, says providing payroll services helped keep the firm going. In contrast to a tax or audit project, the payroll work was needed right away, which gave them no time to despair about how to go on, he says. The firm couldn’t have rallied so quickly without a combination of a little luck, a lot of foresight and the outstanding effort and dedication of its staff, Hoisted says: “Our people saved our necks.” Here are issues he found crucial to becoming operational again. (For more postdisaster tips, see “Business Recovery Procedures.”)

Communication. Being able to reach staff while local power and telephone lines were down was paramount. The firm used public service announcements over area radio stations to give its people phone numbers to call for information. This also let the firm compile a new record of where to contact each employee.

Business Continuity Resources
Firms that want to develop a plan to be ready in the event of a disaster can learn more about the process from the following resources.

The Association of Contingency Planners, www.acp-international.com.

Business Resumption Planning, by Edward Devlin, Cole Emerson and Leo Wrobel (CRC Press, 1997), www.crcpress.com.

Disaster Recovery Journal, St. Louis, www.drj.com.

Contingency Planning & Management, Witter Publishing Corp., www.contingencyplanning.com.

The Business Survival Newsletter, www.rothstein.com.

Loans from the U.S. Small Business Administration, www.sba.gov.

Federal Emergency Management Agency (FEMA), www.fema.gov.

Source: “Managing Effective Disaster Recovery,” by Stanley Weiner, The CPA Journal, December 2001, www.cpaj.com.

Logistics. For overall business continuity, the firm had the advantage of its other offices, which made it possible to back up some files and provided places for some displaced staff to work as well. There wasn’t room for everyone, however, and temporary office space in Grand Forks was at a premium after the disaster. Only 1,000 square feet was available to replace the 15,000 square feet of the destroyed headquarters, and just 25% of the normal head count could work there.

“If you weren’t one of the first 14 people to arrive, you didn’t get space,” Hoisted says. People would show up to download files or obtain what work materials they could. Then they’d leave to work from their car—as Lunde did, with his laptop and mobile phone—or from their dining room table, as Hoisted did. The interim office didn’t have enough phone capacity to accommodate telecommuting, even for staff members with dedicated Internet lines or fax machines at home. (For more on emergency office space, see “Hot Sites.”)

Systems. The firm’s technology suppliers were able to send replacement equipment and operating systems virtually overnight. Such “quick ship” service is a support option many third-party leasing vendors provide their customers (see “Hot Sites”) .

Even though the firm lost all the data in the office, it had backup disks stored in zip-lock plastic bags in safety-deposit boxes at its bank. The bank’s vault and the surrounding basement had been under the river. As soon as the water ebbed, the firm had to get the disks so it could obtain any recoverable information. Lunde was available, so he put on boots and a hard hat, grabbed a flashlight and, accompanied by his bankers, made his way through the mud and debris in the burned building. As he trudged through glop, he remembers thinking that he hadn’t envisioned the experience as part of an accounting career. The good news: The data on the disks were useable.

Insurance. Insurance paid some of the firm’s rent for temporary quarters, but only because of the fire. (Had the displacement been caused by flood alone, no rent would have been included.) Moral: Know your policy.

Recovery. Because the flood and fire affected the entire city of Grand Forks, many businesses had to lay off their people. In contrast, Hoisted says, “We were able to keep paying our staff.” Reopening quickly helped retain employees because their earnings and their relationship with their employer weren’t interrupted, he says.

It took Brady, Martz two-and-a-half years and two more offices to restore its business to comparable space. Today, it’s back downtown, across the street from where it used to be. As one of the larger downtown employers, the CPA firm’s return has bolstered other area businesses, as has the return of law firms and banks.

Hot Sites
CPAs researching business continuity options should be familiar with the following information.

Hot site: A hot site is an operationally ready business center that provides subscribers with computers, phones, printers, fax machines and everything they need to carry on if there is a catastrophic event. Hot sites can be used for up to eight weeks in disaster mode. Subscriptions average 52 months in length, and costs range from $250 to $120,000 a month. A number of reputable companies offer this service.

Cold site: An empty, environmentally conditioned computer room where staff can work. A hot site subscriber that uses up its occupancy time moves to a cold site.

Electronic vaulting: Transmission of data from the subscriber office to the hot site using a dedicated line.

Mobile/porta-site: A mobile site is a standalone computer/office environment unit on a trailer; a porta-site is transported to the subscriber’s site and constructed after delivery. These business continuity options serve the same function as cold sites.

Original equipment manufacturer (OEM) insurance: In the event of a disaster, some computer companies will replace damaged computer equipment on a priority basis and guarantee another system of equal or greater processing capacity within a specified period of time. Costs are usually in the range of 6% to 8% of the monthly maintenance bill.

PC-based planning tools: As an incentive to subscribe, many hot-site vendors offer a PC-based disaster recovery program that the client can use.

Quick ship: Most third-party leasing vendors provide recovering customers quick shipment of computer equipment. Customers are charged a priority equipment search fee.

Most important tips. Besides making sure operational and project data are backed up at a separate, secure location, Hoisted strongly recommends that any business

Keep up-to-date about the availability of two or three potential replacement spaces.

Get in touch with everyone important to the business. Contact clients and discuss files, records, deadlines and the status of work in progress.

If there is a lease agreement, contact the landlord to discuss the recovery efforts and determine obligations during the period in which space cannot be accessed.

SHAKE, RATTLE AND ROLL
California’s Northridge earthquake of January 17, 1994, measured 6.7 on the Richter scale and left widespread destruction. Many houses, office buildings, parking structures and sections of major freeways collapsed or suffered irreparable damage. Mitchell Freedman, CPA/PFS, was at home, less than five miles from the epicenter of the quake, when it struck at 4:30 a.m. The sensation was “as if a huge speeding locomotive was coming through the house,” he says. With an earthquake, “you never know if the first shock is just the beginning.”

Damage was uneven and quirky. For example, Freedman’s home sustained six-figure damage, but the house next door was a total loss. At his nine-person firm, located in a high-rise in the San Fernando Valley, just a few computer monitors toppled onto chairs, but the office building across the street was red-tagged by authorities as uninhabitable. Here are some changes he made after the event.

Important Family Documents
The Federal Emergency Management Agency (FEMA) recommends keeping these important family documents in a waterproof, portable container:

Will, insurance policies, contracts, deeds, stocks and bonds.

Passports, Social Security cards, immunization records.

Bank account numbers.

Credit card account numbers and company contact information.

Inventory of valuable household goods and important telephone numbers.

Family records (birth, marriage and death certificates).

For more on disaster preparedness, see www.fema.gov/about/drc.shtm.

Preparedness plans. Most people were unprepared, Freedman says, so after the quake he instituted personal and business preparedness plans and helped his clients do the same.

Personally, Freedman now follows standard emergency readiness advice, keeping sturdy shoes by the bed (he cut his feet on broken glass in the quake) and a flashlight in the nightstand drawer. “I don’t just check the batteries,” he says, “I change them.” He makes sure he has athletic shoes, drinking water and a first-aid kit in the trunk of his car. His family has designated an emergency contact person in Florida, far away from potential temblors (see “Important Family Documents.”).

From a business standpoint, he says, the crucial factors are to be able to contact people—including employees, clients and vendors—and to get the business operating as quickly as possible. His employees now have an agreed-upon place to meet after an event, and they all keep an earthquake kit under their desks, which consists of a backpack containing a phone list, flashlight, blanket, water, nutrition bars, canned food and athletic shoes. (For more information about what to do in an emergency, see “Medical Emergency Information.”) The firm protects its data with daily downloads, and staff take home the previous day’s job files. The firm backs up other system information to its tech vendor 11 miles away.

Freedman recommends that clients keep some cash at home and in nearby banks. (His PFP clients who do this had access to money when a money-market mutual fund couldn’t do business during the four days the financial markets shut down after the September 11 World Trade Center attacks.)

Insurance and emergency help. A valuable service CPA financial planners can provide clients is dealing with insurance companies and the Federal Emergency Management Agency (FEMA). Policies vary, and some cover both structure and contents with one deductible, while others require separate deductibles. A few of Freedman’s clients had one policy for the structure and another for contents, with each carrying a deductible of up to 15%. Unraveling the types of losses they reimbursed was complex.

Some houses in the Northridge, California, area burned when the quake ruptured a gas line, so several clients who lacked earthquake insurance were helped by fire insurance, Freedman says. Besides knowing what the fine print does and doesn’t cover, be aware that the insurer’s first response to a claim inquiry may not be final. For example, if too much glass breaks into a carpet, it can’t be cleaned and must be replaced. Freedman negotiated a replacement from an insurer that initially told its customers to vacuum the broken glass.

CPAs can help clients apply for low-interest Small Business Administration loans. Although easier to obtain after a catastrophe, an SBA emergency loan request for operating cash requires a massive amount of highly detailed, well-documented paperwork (see “Business Continuity Resources.”).

Most important tips. Freedman says that besides an earthquake kit, clients should

Keep cash, “in the hundreds,” in a part of the house that’s both accessible and unlikely to collapse. (ATMs don’t work when power lines are down.)

Document items for legal and insurance purposes. Take snapshots of destroyed property.

Medical Emergency Information
In case of a medical emergency, follow these procedures:

Call an ambulance.

Find the nearest person trained in cardiopulmonary resuscitation (CPR) or first aid.

Send someone to the parking lot to meet the ambulance.

Do not move the patient unless failure to do so would be life threatening.

Have the firm spokesperson notify family members of the injured person.

Keep medical emergency kits and medical-help information handy:

Post diagrams of where to find stored medical supplies such as first-aid kits and blankets.

List medications and include instructions about use.

Conduct quarterly inventory of medical supplies; check freshness and restock at least quarterly.

List the names and telephone numbers of all employees trained in CPR and first aid.

Post the names and addresses of local hospitals and walk-in clinics, and include street maps and driving directions.

Source: Management of an Accounting Practice Handbook, AICPA, www.aicpa.org and www.cpa2biz.com.

Don’t reenter a building if dangerous conditions exist.

BE PREPARED
“There is nothing we can do to prevent disasters. But if one happens, we offer our clients recoverable information and a place to work,” says Andrew Rudin, a New York-based CPA, who has provided business continuity planning and technology consulting for more than a dozen years. “We have master lists of clients’ employees so we can contact them, make sure they’re OK and tell them where to show up to work.”

An early and essential step in developing a business recovery plan is a risk analysis to identify physical and operational weaknesses, sources say. Next, the entity must determine the basic processes and assets it needs to function. That information is the basis for preparing detailed documentation of what to do in an emergency and how to do it for that organization. In theory, an individual having the resulting recovery manual can find the firm’s people, obtain equipment and support, use job-file and system backups and put staff to work in an alternate location.

To create a comprehensive continuity plan, a business needs to

Obtain senior management sponsorship.
Analyze environmental vulnerability.
Analyze the business impact of potential equipment and data loss.
Identify and document critical business processes.
Organize business recovery teams and determine the resource requirements to recover

• Headquarters.
• Computer operations.
• The disaster site.

Develop procedures to reinstate voice communications and business operations equipment.
Establish document- and data-recovery policies and procedures and test them every three months.

Rudin helps his clients implement planning procedures and find and learn to use off-site data storage, redundant computer systems in another secure facility and ways to transfer data on dedicated lines or the Internet. The level of detail for any plan depends on the client company. For some, it doesn’t make much difference if they don’t operate for two days, but others can lose billions of dollars in two or three hours and need to get back up immediately, he says. Here are the areas he pays particular attention to.

Vital documents and contracts. Rudin reviews clients’ important contracts, locates all copies of trademarks and licensure agreements and helps clients with document control and warehousing. Clients can store duplicates or originals off-site in a safety-deposit box, in a bank or a secure storage facility. He recommends clients move toward data imaging, so they scan and store documents electronically. Clients should keep the originals secure, but a facsimile or a reproduction of a scanned image is legal and flexible backup, he says.

Scope of services. The service ranges from quick advice through writing detailed in-house manuals on how to handle a worst-case scenario. Rudin helps larger companies select a “hot site,” a facility that provides subscribers with computers, phones, printers, fax machines and everything they need to do business (see “Hot Sites”).

AICPA Resources

Chapter 215 of the MAP handbook covers coping with a disaster. Section 215.03 takes CPAs through steps to create an IT recovery plan. “Coping With Disaster” was written by Philip Rothstein, FBCI. To order the Management of an Accounting Practice Handbook (090407), call 1-888-777-7077 or go to www.cpa2biz.com. To order the electronic edition (e-MAP), search the cpa2biz Web site under keyword emap.

Disaster Recovery: A Guide to Financial Issues, a publication jointly prepared by the AICPA and National Endowment for Financial Education (NEFE), will be released in early 2003. It will be available from the AICPA and state societies.

This guide aims to provide comprehensive information for survivors of a disaster by offering suggestions on steps to take immediately, in the initial weeks and months, as well as how to begin planning the future. It covers all aspects of recovery, including financial issues surrounding the death of a loved one, personal injury and disability and property loss that results from a disaster.

One client installed a fully redundant data system: What’s written to the office server is duplicated at a location 25 miles away, a distance partly determined by the efficacy of the T-1 line between the two. (Backup systems several hundred miles away may be even more secure, sources say.) If the company’s building floods, burns or worse, its employees can drive to the other location, access their data, and everyone theoretically can work from home. “There are 72 people in the client’s company,” says Rudin.

Marketing. The firm asks clients if they have a disaster recovery plan. If so, Rudin reviews it and suggests improvements. Jobs for small businesses have entailed fees of less than $5,000, but the more important immediate business reactivation is to the client, the more it needs to spend.

A living document. A client needs to update its business continuity plan every time something changes. Every two months the continuity provider should ensure that clients’ phone lists and contracts are current, says Rudin. Remind clients to keep up payments on alternate work sites and services to make sure they’re available if they’re needed.

LAST WORDS
All firms and companies should assess their risk, determine the basic processes and assets they need in order to function and prepare a backup plan. The crucial continuity factors to get a business going again after a disaster are to be able to contact the people important to the business—including employees, clients and vendors—and to have a place and the equipment to work. Give employees an agreed-on place to meet, store important duplicate data off-site and start scanning and storing documents electronically. Lease a hot site or keep track of the availability of a couple of potential replacement offices.

A dozen years ago, a large Park Avenue law firm in New York City had a fire in the building that housed its main office. All its information was stored on-site. “We needed to get the client up and running at another location, so someone had to retrieve the firm’s backup, which we couldn’t get to because there was asbestos all over,” says Rudin. “The fire department gave one of my associates a physical, then sealed him in a yellow ‘spacesuit’ with an air pack so he could go into the office to get the firm’s data. That situation worked out fine, but we have to be so careful. If you’re wrong, the company dies—that’s the reality.”

Business Recovery Procedures

A company or firm with a continuity plan, backup data, backup equipment, alternate workspace and personnel trained to implement a recovery is better positioned to deal with a catastrophe than one that isn’t. All businesses will need to organize quickly.

In the damage assessment phase, line up help.

Contact the local emergency operations center to register a claim for relief.

Get in touch with the business’s property/casualty insurer. Review the policy, talk with a representative about the loss and discuss business interruption coverage for loss of income as well as reimbursement for expenses such as temporary office space and equipment.

Contact the errors and omissions (E&O) insurer to inform it of the disaster and obtain guidance about how to avoid malpractice liability if the firm will miss client deadlines.

Assess damage to determine what, if anything, is salvageable and how long recovery efforts will take.

Communicate with everyone important to the business.

Contact all firm members and employees to inform them of the status of the situation and to establish communication procedures (telephone trees, emergency information hot line) until office space is acquired and everyone can get under one roof again.

Contact vendors to let them know where the temporary location is.

Advise the post office and other delivery services to stop shipments to the damaged location and reroute services to the temporary site.

Contact banks for replacement checks.

Stay in touch with the payroll service if necessary.

Contact the phone company to reinstate telephone service.

Arrange for an answering service with an appropriate message until a new system is in place.

Arrange temporary service with the local telephone company at the interim location for phones, fax, modem and Internet use.

Have phone calls forwarded to the new number.

Get cellular phones.

Obtain work space, furnishings and equipment for staff.

Identify alternative work locations.

Call local realtors to find office space.

Arrange for temporary space—share with other firms, law firms or rent a hotel suite.

Rent, borrow or purchase desks, chairs, lamps, filing cabinets and bookshelves.

Obtain computers and operating systems. Equipment needed may include computers, computer networks, printers, fax machines, copiers, word processors and calculators. (If staff members have laptops and home computers, find out if they can they be used for the business during the recovery period.)

Contact equipment vendors.

Discuss existing leases, contracts and performance obligations under the terms of the lease or contract.

Get a vendor to assist with the recovery of computer hardware and peripherals.

Obtain office supplies.

Contact the supply vendor to obtain whatever supplies are necessary.

Hire a printer to print stationery and business cards.

Obtain billing and other forms from a forms vendor.

Recover records.

Begin assessing damage once the workplace is accessible. If fire was involved, make sure all file cabinets or other containers are cold to the touch. Flash fires may occur upon opening a warm cabinet. If water damage is the problem, obtain the following supplies:

Freezer or waxed paper.

New boxes, file pockets and folders.

Plastic milk containers.

Refrigerated facilities or trucks.

Plastic garbage cans or pails.

Sawhorses, plywood and plastic sheeting to wrap wet records for removal.

Fans and dehumidifiers; pumps, if necessary.

Mops, buckets, sponges and rubber gloves.

Irons, plastic clips and clothesline or nylon fish line (to dry a small volume of records).

Assess damaged property and documents.

Assign priority to damaged documents. Separate records that are of critical importance from those that can wait. Protect the most critical documents from further damage as you organize them to be restored. If documents are waterlogged, you can freeze them and have a commercial restorer salvage them. Freezing will preserve paper documents up to six years. If backup records are available, the originals aren’t necessary.

Identify the documents’ physical status with colored tape or markers:
Black—beyond hope and cannot be recovered.

Red—to be recovered first, of the greatest importance.

Yellow—to be frozen and recovered only when needed. Long-term storage is possible.

Green—not damaged and can be used immediately.

Document all losses.

Destruction of items should be documented for legal and insurance purposes. Use a disposal certificate to indicate what is beyond recovery and why. The form should describe what was destroyed, how it was destroyed, how it was pertinent to a client if it was and it should be signed and dated.

Techniques to recover water-damaged documents.

Separate sheets of paper by hanging them on a clothesline, or interleaving them with absorbent paper. Dry individual sheets by ironing them using low heat.

Protect a damaged document with clear Mylar as you photocopy it. Discard the original and use the photocopy.

Create new file folders, pockets or boxes to organize the documents as you restore them.

Pack wet documents for freeze-drying into cut-off plastic milk containers. Stand them upright and pack two-thirds full.

Techniques to recover fire-damaged documents.

Look at charred records that are not wet to see if they are completely obliterated or just have burned edges. If the information is recoverable, photocopy the document. Handle the records as little as possible.

Source: Tennessee Bar Association with the Association of Contingency Planners, www.acp-international.com.