When a wildfire was sparked in Lytton, BC, on a sweltering summer day in 2021, few residents knew that their lives and businesses would be forever altered within mere minutes.
The devastation experienced in Lytton underscores the importance of emergency preparedness planning—both for individuals and businesses. But how can business owners plan for the unforeseeable? The solution lies in setting up resilient plans that encompass both business continuity and disaster recovery strategies.
Business continuity versus disaster recovery
Although these terms are often used interchangeably, there is a subtle distinction between them.1 Business continuity planning is proactive—it focuses on developing plans and strategies to ensure that essential services remain uninterrupted during crises. Disaster recovery, as the name implies, is reactive—it focuses on restoring systems and data following catastrophic events.
CPAs who manage emergency preparedness for their organizations and/or clients will need to consider both proactive and reactive planning.
The components of emergency preparedness planning
Most preparedness planning initiatives start by focusing on threats in the following broad categories:
- Natural threats, such as floods, earthquakes, fires, the death of key individuals, and pandemics;
- Human-caused threats, such as arson, employee sabotage, workplace accidents, and violence; and
- Technology-based threats, such as system failures and cybercrime.
Successful emergency preparedness plans typically emphasize implementing multiple safeguards and preventing single points of failure. It’s worth noting that single points of failure can take many forms.2 For instance, members have reported situations to CPABC in which their operations temporarily shut down because no one on hand knew the passwords to specific components of their computer system or to the accounts of online bookkeeping systems.
What emergency preparedness plans should contain
There are three helpful resources that offer high-level guidance for creating emergency preparedness plans. The Province of British Columbia provides an informative emergency preparedness education program called PreparedBC to help the general public, local governments, Indigenous communities, and schools prepare for and recover from disasters. Although the program focuses on family and personal planning, it also provides useful information for businesses looking to get started, especially smaller businesses.3
The Canadian Federation of Independent Business provides useful resources for business owners, including the following five-step guide to emergency preparedness planning:
- Assign responsibility for managing a crisis;
- Identify threats to your business, factoring in your location, the nature of your business, and your exposure to catastrophic events triggered by human error;
- Reduce identified risks where possible;
- Prepare and document an emergency plan that includes evacuation procedures and a prioritized recovery list; and
- Practice and test your plan at least once a year.4
And in “The CPA’s Guide to Business Continuity and Disaster Recovery Planning,” author Peter Pepperell provides guidance for CPAs in particular. He says CPAs should take the following steps to create a comprehensive plan:5
- Perform a risk assessment – Identify vulnerabilities in the current system;
- Conduct a business impact analysis – Gauge the potential effects of disruptions;
- Develop strategies – Create actionable steps to counter identified risks;
- Conduct training and testing – Regularly update your team and test the efficacy of the plan; and
- Review and revise – Continually update the plan to adapt to new challenges.
One commonly identified risk is the potential failure of automated systems. Planning for this possibility should include determining a realistic recovery time and figuring out whether manual processes could be used as temporary substitutes.
Considerations for CPA firms and practitioners
CPABC’s Public Practice Knowledge Base includes two articles that provide guidance on emergency preparedness:
Preparing Your Practice for an Emergency
This article features a practitioner emergency planning checklist compiled by CPA Alberta, which includes guidance on:
- Wills and powers of attorney;
- Client transitions in the event of a long-term or permanent situation;
- Client communications; and
- The collection of accounts receivable and the payment of expenses.
Supplementary guidance: CPABC also recommends that sole practitioners keep a copy of their emergency preparedness and business continuity plans at home. We also recommend that you review the details with your family so they will know what to do in the event that you cannot act on your own behalf.
Business Continuity Planning and Practice Continuation Agreements
As noted in this article, the purpose of a business continuity plan/practice continuation agreement is to ensure a smooth transition in the event of a practitioner’s incapacity or death and to provide uninterrupted service to clients during temporary or long-term disability. Having a plan in place means that your estate will receive the full economic value of the practice you’ve spent years building, and your clients will have the assurance that a qualified business advisor will always be available to meet their needs.
The business continuity plan should include:
- The names of employees and the location of their HR files;
- The location of financial and accounting records;
- Client listings, contracts, and deadlines;
- The location of working papers;
- Manuals for office procedures, computer systems, and collections policies; and
- Passwords and access codes for every component of the practice.
The applicable rules from the CPABC Code of Professional Conduct
The rules in the CPABC Code of Professional Conduct (CPA Code) apply in the context of business continuity, disaster planning, and response.
|
Rule 201 – Maintenance of the good reputation of the profession Registrants must “maintain the good reputation of the profession and serve the public interest.” |
The public expects that CPAs will plan ahead and be prepared for any challenges they may face. Not making a proper preparedness plan may damage the profession’s reputation. |
|
Rule 206 – Compliance with professional standards “A registrant shall perform professional services in accordance with generally accepted standards of practice of the profession.” |
Although each situation will have its own context, it is safe to assume that sufficient disaster planning is required to meet professional standards. This is especially true given the specific requirements of rules 212.2 and 218. |
|
Rule 212.2 – Handling property of others “A registrant, in the course of providing professional services, shall handle with due care any entrusted property.” |
In the case of a disaster, the property of others must be handled and preserved with sufficient care. Client records and property must be preserved from destruction. |
|
Rule 218 – Retention of documentation and working papers “A registrant shall take reasonable steps to maintain information for which the registrant is responsible.” |
As with client property above, documentation and working papers must also be managed and preserved with sufficient care. |
|
Rule 502 – Policies and procedures for the conduct of a practice “A registered firm shall establish, maintain and uphold appropriate policies and procedures … and in particular: (a) conduct themselves in a manner which will maintain the good reputation of the profession and serve the public interest; (b) perform their professional services with integrity and due care.” |
Firms should have robust preparedness plans to meet the expectations of the public. |
|
Bylaw Regulation 704/4 – Appointment of Assisting Accountant The “renewal of a public practice licence must be accompanied by … (a) written confirmation of the appointment of an assisting accountant to be responsible for returning client records in the event of … death or incapacity; (b) written authorization for CPABC to appoint a member in good standing holding a public practice licence as an assisting accountant…; (c) the applicant’s certification that they will only be engaged in public practice at or in association with a registered firm in which two or more members have a proprietary interest.” |
The role of assisting accountant is to return client records on the death or incapacity of a practitioner, after which the role of the assisting accountant ends. The assisting accountant’s responsibilities do not include completing any unfinished work. See: “Death of a Practitioner - FAQs” in CPABC’s Public Practice Knowledge Base at bccpa.ca/kbase. |
CPABC has disciplined members for failing to handle their business properly after a disaster. For example, a practitioner was disciplined in 2018 for failing to take adequate responsibility when their business partner became permanently incapacitated.
Free PD webinar available
CPABC offers a free webinar for members entitled “Be Prepared: Disaster Prevention, Preparation, and Recovery,” presented by Mark Ostry, CPA, CGA. The course is eligible for 1.5 CPD hours and is available on demand until December 31, 2024.
Do you need guidance?
The guidance in the CPA Code is designed to help you understand how the rules should be applied. CPABC’s professional standards advisors are also here to help. You can consult them for confidential guidance to ensure that you stay compliant with the CPA Code and the CPABC Bylaws when navigating difficult situations. Contact our advisors by email at professionaladvisory@bccpa.ca
This article was originally published in the July/August 2024 issue of CPABC in Focus.
Footnotes
1 Peter Pepperell, “The CPA’s Guide to Business Continuity and Disaster Recovery Planning,” CPA Practice Advisor, August 21, 2023.
2 Elad Schaffer, “Founders: Here’s How to Escape Your Company’s Single Points of Failure,” forbes.com, April 28, 2023.
4 CFIB, “Emergency Preparedness: The Five Things You Need to Do,” cfib-fcei.ca, accessed May 24, 2024.
5 See footnote 1.
