By Randy Johnston, Network Management Group, Inc.; William Thompson, CPA, RPLU, President, CPA Mutual
The COVID-19 pandemic forced many CPA firms and businesses to work at home unexpectedly. It emphasized the need for firms to have both a business continuity and disaster recovery (BC/DR) plan as well as a pandemic plan in place. Now would be an excellent time to consider updates to these plans as well as other business plans and policies.
Will increased work-at-home become the New Normal? Or will we return to business and life as usual? While it is hard to be sure of the long-term outcome, firms learned several things about their operations during the COVID-19 pandemic. Some were ready for remote work, and some were not. Some found a few technological things that did not work like phones or virtual private networks. Others found that they were not as paperless as they thought or that they were not able to share and control work with workflow tools. Let us consider a few items that should be updated considering our recent COVID-19 stay-at-home experience.
Does Disaster Need a New Name?
Disasters have come in many forms through the years, including fires, hurricanes, earthquakes, floods, and more. Standard BC/DR plans define periods of outage and recovery times in levels. The Event-Driven approach in BC/DR defines four levels:
- Level I – 4 hours or less
- Level 2 – 24 hours or less
- Level 3 – 72 hours or less
- Level 4 – Catastrophic failure
- Level 4 is typically where the BC/DR plan is activated, and your Emergency Response Team (ERT) goes into action.
Let us consider the difference between business continuity and disaster recovery. Business continuity is the need for an organization to continue to function at some minimal level, even after a disastrous event. Minimal functions include doing the right things to survive and leaving the unimportant for later. Disaster recovery can respond to an unplanned interruption, implementing a technology and communications recovery plan, and successfully restoring an organization's critical operational functions.
Regardless, both plans include Awareness, Prevention, Recovery, and Continuation.
- What could happen?
- What would you do?
- How would you respond?
Business continuity planning is about the survival of your business! Where would you go to get the resources you need in a catastrophic event? During the COVID-19 pandemic, there were apparent shortages of things in the supply chain, ranging from computer webcams and large monitors to some food like meat and vegetables to cleaners and toilet paper. However, some of these shortages were from panic buying like we frequently see before hurricanes. On the other hand, the shortage of PPE for the medical community and mask shortages for everyone showed how quickly items can disappear — when supply chains fail during unexpected demands. The COVID-19 pandemic experience suggests we should update our BC/DR and pandemic policies.
What Should be Updated?
First, you should have a BC/DR plan in place. If you do not have one, now is the time to start with a FEMA standard plan and modify it to fit your circumstances. BC/DR plans vary in length and detail from a few dozen pages to hundreds of pages or more. Especially consider these areas, which needed attention from most firms during the COVID-19 pandemic:
- Work policies
- Service standards
- Communications and reputation management
- Health and safety protocols
- Meetings and interaction between employees and clients
- Revising processes
- Professional Appearance
While our 10 things to update in your disaster plan are simply a starting point to get you thinking, do not stop with these 10 items. Remember that you should put employee safety first, client, or customer contact second. Whether our COVID-19 pandemic experience is temporary, or the New Normal, these ideas can apply in any disaster situation.
You will be amazed how much easier it is to stay calm and think clearly when you have planned for a disaster, regardless of the cause.
Randy Johnston is a shareholder in K2 Enterprises LLC and owner of Network Management Group Inc. Concepts for this article came from the all-day K2's Business Continuity: Best Practices for Managing the Risks and from Johnston's own experience. Contact him at 620-664-6000 or firstname.lastname@example.org.