Planning for the unthinkable: what's your plan to ensure people are ok, business isn't lost?

At 11:15 a.m. on a mild Monday in December, Rusty Roy headed out of his office to get a muffin from the local bakery, a mid-day routine. But as the Paso Robles-based CPA made his way out the door, he noticed his phone's blinking message light and decided--fortuitously--to check his messages.

As Roy returned the call, a 6.5 earthquake rocked Paso Robles, burying two victims, who were along the same path Roy would've taken to the bakery, under rubble.

"It was like a giant pounding on our roof," Roy says. "It was sickening."

In the ensuing weeks, Roy and his firm, Roy & O'Conner, CPAs, Inc. received a lesson in disaster planning and recovery they will never forget.

"There were so many variables along the way that we were constantly adjusting our plan," says Roy, whose firm suffered a few broken windows, a few days of down time and a few hundred dollars worth of damage. "We're very diligent about our backup procedures and we try to keep our technology fairly current.

"But even as well-prepared as we were, there's always something you forget," says Roy, chair of the CalCPA Management of an Accounting Practice Committee.

WHO'S PREPARED?

Short of tea leaves or a crystal ball, predicting if, or when, a natural disaster will strike is impossible. Still, that doesn't mean you should just sit idly by. How long can your business afford to be out of commission? Where will you work if your office is inaccessible? How many employees can work from home? Who's in charge if something happens to your key management? Who has what data and where is it located?

These are all tough questions and no one particularly likes to think the worst. But a disaster plan for a business is as important as its financial plan. Unfortunately, many businesses don't understand the importance of a disaster plan until it's too late.

[ILLUSTRATION OMITTED]

According to a recent Robert Half survey, 37 percent of 1,400 CFOs believe their firms are most vulnerable when it comes to disaster recovery, followed by security of information systems, at 24 percent.

Additionally, a recent American Red Cross poll reveals that 62 percent of corporate employees were either "not confident," "didn't know" or were "neutral" when asked if they were prepared for a disaster at work. And the Federal Emergency Management Agency estimates that 40 percent of all businesses hit with a natural disaster fail to reopen.

But just having a plan isn't enough. An oft-overlooked aspect of disaster recovery planning is simply keeping the plan updated. "You have to practice it and you have to keep it up to date," says George Paulsen, Menlo Park-based partner with Hood and Strong and the author of the MAP Committee's Disaster Recovery Planning Guide.

"I think that's where most businesses fail in their planning," Paulsen says. "A company might say, 'OK, we've got a plan,' but will they remember where or what it is while they're running out the door?"

TAILOR MADE

No one disaster plan fits all companies. Plans must be tailored to your business' goals, management style, size, resources and location. "Just as your business is an ever-changing entity," your plan should be a dynamic document, says Larry Kalmis, chair of the Business Continuity Institute, an international organization for business continuity professionals.

Kalmis, who began his career in business continuity as a consultant at Peat Marwick 30 years ago, believes you first need to recognize the risks when developing a plan.

"Look at what risks you might possibly face, what the risks of your environment are," Kalmis says. While most businesses have liability insurance for fire, as well as local fire codes that mandate certain preparedness and preventative measures, many other potential disasters, such as earthquakes, are often overlooked.

"Then prioritize what you need to protect," Kalmis says. "And decide that which you're not going to waste your time on. Remember, you don't have to recover everything."

The first action of disaster planning is the same for every organization: "Designate somebody in the company to take a leadership role and be the champion for disaster planning," says Rocky Lopes, manager of community disaster education for the Red Cross.

This "disaster coordinator" will gather essential information, such as an emergency phone list with contact info for every employee; police, fire and emergency medical providers; and major utility providers, to name a few. It's also a good idea to have some employees take first aid and CPR courses, the Red Cross says.

The disaster coordinator also would be responsible for identifying alternate work locations in the event of a disaster. "Just simply ask the questions, 'What would we do if we can't do it here and how would we do that somewhere else?'" Lopes says.

ALTERNATE LOCATIONS

According to Lopes, identifying alternate locations may be the most overlooked aspect of disaster planning. "That's why a number of small businesses fail to reopen after a disaster," Lopes says. "They haven't made plans to operate temporarily elsewhere."

For small businesses, that alternate location is often the owner's home. "Having backup documents or backup disks or a tape of what's kept on your office server is essential. And make sure you have the equipment at your alternate location to read that disk or tape," Lopes says.

After Roy & O'Conner's building had been red-tagged by the fire department in the days following the Paso Robles quake, Roy had a quick, though unforeseen, commute. "We set up shop in my house," he says. "We had our tech guy come and get our LAN running; the paper files we were able to recover were in the garage. We worked there for a week."

After much frenzied searching in the days after the quake, Roy found some temporary office space, but it was small and ill-equipped to deal with the upcoming tax season. Roy then drafted plans for the next alternate location--trailers parked on a client's property.

But two of the most troubling aspects of business continuity, Roy says, were some of the easiest things to take for granted: paper and telephones.

A LESS PAPER OFFICE

"The biggest problem we had was paper," Roy says. "Some vital pieces of paper were trapped in the building, which was red-tagged."

During supervised visits, Roy removed about 35 percent of his office's business files. "We prioritized it, but inevitably there was stuff we needed that didn't get out."

Having made a commitment to go paperless last year, Roy found that his electronic filing system--scanning all documents and converting them to a portable document file, or PDF--suited his business continuity issues. "That was enormous for us, it really helped. We lost probably only two or three days of productivity, mainly because most of our files were easily recoverable."

The Red Cross recommends duplication efforts for both electronic and print documents. "After the federal building bombing in Oklahoma City, there were some businesses that lost essential records they couldn't replace, and it caused some major problems," says Lopes. "So duplication works for both electronic and print records."

Make hard copies of files or records that are unique or irreplaceable, Lopes says, and protect them in an offsite, fire-resistant storage location.

COMMUNICATIONS

An essential part of business continuity planning is having an appropriate communications system. "Since the service sector depends a great deal on customer contact via e-mail, websites and telephone, having backups for those systems is important--whether it's programmable call forwarding or being able to remotely access voice mail or a website," Lopes says.

Roy wasn't so lucky. Only after the disaster, during a supervised visit into his red-tagged office, did he update his phone system to include call forwarding. "We snuck in one of our phone guys and were able to upgrade our system on the fly so that we could just press a button on our handset and it forwards to our cell phones," Roy says.

But relying on cell phones is also shaky. In the hours following the quake, "the cell system was completely overloaded," Roy says. "There was no way to complete calls for two hours." What's more, Roy quickly used up his cell phone minutes in the days following the disaster and was hit with a $600 phone bill.

The Red Cross advocates building a "phone tree," a network of contacts out of the area, for communicating after a disaster. "We recommend having an out of town contact because it may be easier to make a long distance call than a local call," Lopes says.

When the majority of long distance lines were installed in the 1950s and '60s, they were hardened for a potential nuclear attack, making them more robust than many local lines. "We recommend you have multiple communications methods. We've found that after disasters, cell phones are not that reliable," Lopes says.

After the Aug. 14 Northeast blackouts, tens of thousands of people were bewildered because they couldn't make a phone call. "The telephone instruments in their businesses and homes were often electronic; they had to be plugged into the wall," Lopes says. "But regular, hard wired landline telephones often work even if the electrical power is off."

Building redundancy into your communication plan and providing alternate paths are key, Kalmis says. He even suggests setting up a hotline for quick access. "Look at having multiple lines, and provide alternate mechanisms, like an 800 number, so your staff can call and communicate that they're OK," he says.

IT DISASTER PLANNING

When preparing a disaster plan, a vital component involves technology and the electronic storage of documents. The importance of a firm's ability to rapidly reconstruct essential information after a disaster can't be overstated.

Large companies often cover their bases when it comes to risk management, data protection and information security. But small and midsize businesses face the same risks, albeit with fewer resources.

"There are many methodologies, but all basically center on some form of backup," Kalmis says, "One of the key factors is how quickly you are going to need this data."

When Kalmis consults businesses on continuity issues, he first draws up a business impact analysis--"or how long can I go without having a certain business function active? And that becomes your recovery time objective and, to some extent, will determine the methodology you use to back up or protect your data," he says.

Instituting a diligent server backup procedure is the first action of IT disaster planning. "The main thing I learned from this disaster is to keep your technology and your backup current," Roy says. "We keep a copy on site in a fireproof strong box and we keep the most recent copy and the preceding day's copy offsite."

First, remember to keep your backup data current. If you back up data nightly, you ensure that you'll only lose one day of data. Second, make copies of the backup data, and keep one copy offsite. Offsite storage can be located anywhere--your house, a branch office or a safety deposit box.

And its not just backup data that needs to be stored. Off-site storage of information, such as client lists and supplier phone numbers, also help your firm get up and running.

BACK UP THE BACKUPS

But sometimes a blind allegiance to technology can be a problem. "One of the fallacies about backup tapes is that they are infallible," Paulsen says. "But they aren't 100 percent reliable; data gets lost."

Seven years ago, and in the middle of tax season, Paulsen's former firm of Johnson, Robertson & Paulsen had some maintenance done, and a worker looking for a socket to plug his drill into mistakenly unplugged the server.

"I was amazed at the cost of what we lost, even though we had a backup from the night before," he says. "When we went to see what was restored, we were surprised to find that some of the tax return files just didn't make it."

Paulsen suggests rotating backup tapes to ensure minimal wear and tear, and to perform routine tests, such as reformatting and retensioning. Tapes that haven't been used in days or weeks can get loose, and might need to be tightened, or tensioned.

You also can use a data hosting company, where your documents may be on a server 3,000 miles away. "Why can't you put your data on a web server in Illinois? Why does it have to be in your machine here?" Paulsen says. "It's much more economical to do that now than it was just five years ago."

But Kalmis warns against the seduction of new technology vs. an economically feasible solution. "Don't get too entranced by new technology," he says "Business continuity is a business issue and has to be approached in a realistic business framework."

PEOPLE FIRST

Almost a month after the earthquake, Roy & O'Conner was able to return to its renovated office building. "I didn't realize how much I had riding on (returning to the office) until we got the red tag off," Roy says. "And I just about broke down."

Indeed, Roy admits that the emotional component of the disaster was something he underestimated. "Sometimes the damage is more significant emotionally than physically," he says.

The Red Cross recommends distributing personal workplace disaster supply kits to your employees. Such kits typically include a flashlight and batteries; a battery-powered radio; enough food and water to sustain one for 72 hours; medications; first aid supplies and other tools and supplies.

"Not enough attention is paid to life safety issues," Kalmis says. "The most vital aspect of a smaller organization is its people. But if you walk into any organization holding a fire drill, nobody takes them seriously."

EXPECT THE UNEXPECTED

While the best-laid plans can go astray, preparing your business for the unthinkable is an essential act. "Disasters happen," Paulsen says. "It may never happen to you, but it's a real risk not to have a plan."

Beyond electronic document storage, phone trees and alternate locations, there are bigger eventualities to consider. Some firms have a mutual aid agreement with other practitioners for the transfer of their businesses upon death or disability, says Paulsen.

No matter how well-prepared you are, "it's always that which is not obvious that rises up to bite you," Kalmis says.

RELATED ARTICLE: Where to Go

Filled with sample disaster recovery plans for organizations of all sizes, the MAP Committee's Disaster Recovery Planning Guide can be downloaded at www.calcpa.org/MAP/disaster.pdf.

The Red Cross' Guide for Business Continuity Planning CD-ROM offers step-by-step instructions on minimizing interruptions, transitioning back to normal operations, working with public and private agencies and formalizing a disaster plan, and can be found at www.redcross.org/prepare/workplace/index.asp

Jerry Ascierto is CalCPA's associate editor. You can reach him at [e-mail].