The results of an ongoing study of professional accounting firms in the U. S existing research methodology and results included in the 2006 IRMA International Conference reporting the strategic planning by a law firm pertaining to its disaster planning and recovery using information technology.
All professional firms have certain legal and ethical obligations to protect their clients’ interests and records (including electronic ones). Based upon the experiences of this CPA firm in planning for disaster recovery and its successes (and failures) in protecting its developing decision support capabilities a post-disaster study was conducted to ascertain the impact on the CPA firm’s continued viability and growth, and on the impact on the firm’s clients.
INTRODUCTION One professional firm, identified in this research only as the CPA Firm, [CPAF] has undertaken strategic disaster recovery planning efforts that they believe will allow them to recover quickly from a natural disaster. On August 29, 2005 Hurricane Katrina struck the U. S. and the planning for a disaster by the CPAF was put to a test. REVIEW OF LITERATURE A review of the literature related to disaster planning by professional firms in the U. S. esulted in minimal literature that was specific to a professional (legal and CPA) firm. The review was limited to the immediate past three year period to gain insight into current usage of the disaster planning for maintaining existing technology usage in a disaster area. No effort was made to review the literature that would establish a need for the use of technology; rather, the review was directed toward learning how planning in the U. S. for natural disasters has been adopted and if planning efforts were adequate.
The literature review revealed little regarding the impact on the individual accounting firm, but did provide an understanding of potential implications to professional firms in general. CASE DESCRIPTION The CPA firm [CPAF] used as the basis for this case study is considered a specialty firm. The firm has a targeted market segment of small businesses and not-forprofit organizations located in a four state region. The workload of the office is measured 2 n terms of actual clients; rather than attempting to measured the firm in terms of the billing hours or dollars. Two individual clients serviced by the firm illustrate the complexity of coordinating the activities within one local, targeted firm within the region. One client is an independent oil and gas entrepreneur that operates over an expanded region which may involve operations in multi-states when exploration is active. A second client is a construction company that has crews operating in four states on a weekly basis. The required accounting and tax documents (paperwork) and information change exponentially with the addition or deletion of new clients to the existing client list. A concurrent change is that of administering a database to permit the firm to manage the required coordination between separate accountants working independently but for the same client. The firm’s workforce is made up of two partners, one non-partner associate and various other hourly personnel. The firm currently operates offices in two locations within a single state.
The CPA Firm (CPAF) partners recognized within the past several years that a paper intensive environment had resulted in a firm-wide system that was in danger of collapse. One of the two partners, the senior partner, was assigned the specific task of developing policies related to two interrelated purposes involving the use of technology: (1) to improve the management of the processes and work (data) flow within the firm’s system and (2) to undertake strategic planning to insure the firm’s continued growth and success by improving cost efficiencies through better usage of technology.
The research group (authors of the study) used the results of an interview of a partner of a professional law firm (in a parallel study) using the nine milestones recommended by the SEARCH (the National Consortium for Justice Information and Statistics) during the literature review as a guide in determining the strategic planning and implementation for a typical law firm within the justice system in order to compare research results between two different, but similar, professional firms.
The milestones permitted the research group to organize its findings in a manner that is consistent with other efforts within the justice system (law firm) while also providing a similar structure for a CPA that is governed by parallel expectations. However, ince the law firm was a component of the justice system the findings are grouped into fewer categories to allow the research group to structure the intent of the recommendations provided by SEARCH to a specific case study (of the CPAF) regulated by professional, federal and state statutes/regulations to a professional law firm within a specific segment of the overall judicial system yet regulated in a similar manner. Both types of professional firms have legal and ethical obligations to protect their clients’ interests (manual and electronic documents, etc. ). 3
STRATEGIC DISASTER PLANNING The CPAF originally had a self-contained computer-based information system housed internally in one of the two branch offices of the firm. As growth of the client base grew and the firm expanded the firm added a part-time, consulting-in-nature IT support that continues today. Initially IT periodically backed up the firm’s data on an infrequent basis that evolved into a routine practice over time. However, no firm backup policy or procedure existed; rather the IT staff simply implemented common sense and applied what experience had shown them was the service the firm needed.
In short, simple use of backup tapes and disks as determined informally by the IT consultant as his time permitted. However, as the CPAF continued to grow the partners began to informally create a plan for backup; however, the backup was still localized and stored at one of the firm’s office where the primary IT operation was housed. The easy plan established and used was to store duplicate copies of computerized files in the same physical location where the master copies were located.
Experience proved to be a lesson learned. The offices of the firm are located in an area of the U. S. that is prone to hurricanes. While the offices are not located on the coast hurricane damage has occurred within the life of the firm and the original partners learned that offsite storage of backup copies could prove to be a wise course of action in an area that has experienced hurricanes on a frequent basis. Thus a backup of computerized records with offsite storage became the default plan for several years.
The senior partner, upon being charged with the responsibility to improve the management of the processes and work (data) flow within the firm’s system and to undertake strategic planning to insure the firm’s continued growth and success by improving cost efficiencies through better usage of technology initiated planning by developing a firm wide identification of technology needs, policies and procedures that would be necessary for the firm to successfully survive a natural disaster.
This planning effort included charging the IT consultant with the responsibility to recommend changes in the computerized firm-wide system that would permit the daily backup of all databases and other files at remote sites including alternative network capabilities that could be used to resume email and other communication capabilities as quickly as possible if the main office location was down due to a natural disaster. The plan was to have alternatives that would permit the firm to resume and maintain operations from various sites within the U.
S. if necessary. On no single date was the system to be backed up at only the main location by having the master and backup files physically located at the same system. The IT consultant recommendations were used by the senior partner to subsequently develop plans for the CPAF which addressed the backup, relocation, security, and recovery in the areas of hardware, software, databases, and physical 4 structure or operational areas, and telecommunications-network links internal and external to the CPAF.
The IT staff was requested to provide the senior partner with suggested scenarios that would describe the cause and effect of actions (procedures) that the CPAF should implement. Examples provided by the senior partner included the following: ? Hardware – laptop computers were to be taken home (and subsequently to evacuation locations) by individuals the laptop was assigned to by the firm. All non-removable computers, etc. were wrapped in heavy plastic for protection from wind and water damage (anything short of a direct destructive hit).
The CPAF buildings were to be secured to minimize the effect of wind and water debris and structural damage. ? Software – All software programs, systems and applications, backed up and sent to offsite locations in second firm office located another geographical region of the country. ? Databases – all data backed up and copies moved to local and distant locations electronically and hardcopy. Two sets prepared and kept at two different locations locally and one set sent to an off-site location in Tennessee (and not in line for hurricane damage). Telecommunications-network – reviewed the backup contingency plans with vendor that was located in another geographic region to initial recovery efforts once the CPAF and vendor could resume contact and after power and other utilities were restored. Partners of the CPAF were obviously kept in the loop and were advised to carry identified hardware, software, and paper files to other locations (homes and perhaps subsequently to evacuation location areas outside of the disaster area).
The partners supervised the transfer of items to the second CPAF location (from one gulf coast state to an inland state overnight). DISASTER PLAN IMPLEMENTATION On August 26, 2005 the path of Hurricane Katrina continued to indicate that the CPAF likely would be within the projected landfall area and subsequent inland path of destruction. The increasing magnitude of the hurricane became obvious to the firm personnel and the disaster plan was set in motion.
The plan identified those responsible for each of the planned areas of responsibility. When the decision was made by the partners-owners of the firm to implement the disaster plan there was approximately four hours remaining in the work week. CPAF employees were already concerned for family and personal property and the firm began to allow employees to leave work early to tend to those needs. However, a core of employees – partners and one staff person remained to oversee the completion of disaster procedures.
Who did what? When asked this question the senior partner stated that the partners did the activities related to insuring the hardware, software, databases, 5 telecommunication-network and structural preparations were completed as quickly as possible. He commented that what most have to remember is that Hurricane Katrina grew from a category 1 to a category 4 or 5 within a very short timeframe. All disaster planning had been based on what disaster experiences in the past had shown would be probably.
The IT consultant worked non-stop until the last items were relocated, secure, backed up and ended their efforts on Sunday, August 28th. The CPAF partners at both locations dealt with the business end of the disaster plan implementation. Those tasks included: ? Notifying clients and carriers the CPAF was “battening down” and would be back in touch as soon as possible, ? Arranging to have any imminent incoming checks re-routed to the off-site inland state location (for safety and operational banks), ? Updating voice messages for the office, ?
Making final decisions about which paper (hard) copy file needed which level of protection (covered, uncovered, removed to another location, etc. ), ? Reviewing that all electronic (soft) copy were backed up according to the plans to insure that copies were located in several locations locally and remote and the person responsible for each copy, ? Providing phone contact lists for all employees and giving out partner information to all employees (who had already been sent home to deal with personal and family disaster preparations), and ?
Checking insurance policy coverage (and later following through [for example, business interruption insurance has been troublesome]). EVALUATION OF PLANS & FUTURE CONSIDERATIONS Since Hurricane Katrina the CPAF has had approximately three years to recover from the disaster. There continued to be ongoing issues related to utility disruptions as recovery crews from the basic restoring of minimal services to the existing service area (October 2006) to finalizing restoration of normal services to the area in two years (November 2007).
Once this was completed the utility crews began upgrading the service to anticipate further disasters. The business community that was disrupted has gradually become more “normal” as moving beyond recovery is progressing and business activities are ongoing. As the firm moved into and past an initial resumption of normal daily activities at levels that approached pre-Katrina levels the CPAF began to review and update its disaster recovery plans based upon this recent experience.
The senior partner stated that the firm simply has not had enough time yet to fully review the success and failure of the plan that was followed but a general assessment by the partners (and based upon initial but limited feedback from clients and others in the business community) the policies and procedures appeared to be more successful than not. CONCLUSIONS The research presents the results of an unanticipated opportunity to study disaster recovery planning and collect data about a CPA firm’s successes (and failures) when the plan had to be implemented as Hurricane Katrina passed over the CPAF with sustained winds of 100 miles per hour. The researchers are engaged in an ongoing study of professional firms in the U. S. The experiences of this firm in planning for disaster recovery and its successes (and failures) in protecting its developing decision support capabilities permit a post-disaster study to be conducted that will aid in the ongoing research of the changing usage of technology in the U.
S. 7 REFERENCES Harris, Blake, “Building Blocks,” Government Technology, Vol. 17, Issue 5, May 2004, 27-28. Lewis, Stan; King, Ernest W. ; and Burks, Eddy J. ; “Impact of Technology on the Legal System – A Study of a Law Firm’s Disaster Recovery Planning;” 2006 Information Resources Management Association International Conference Proceedings; Washington, D. C. , May 19-21, 2006, pages 127-129.
