As the most devastating hurricane season on record comes to an end, we move into a new season - one of snow and ice with power outages and broken overhead water pipes. Next up?  Spring flooding and tornados.  After that?  The forecast for 2006 hurricane season doesn’t look very good (usatoday.com).  And, we focus mostly on the acts of God. Man also has a hand in all kinds of disasters like theft, fire and sabotage. Recovering from disaster can be the defining moment for a business.

Disaster Recovery (DR) is nothing new to the industry. DR has been on the AICPA Top Technologies list for seven years and has been a major topic of discussion in countless industry and technology forums.  However, CPA firms have still not embraced DR as a critical requirement and have no working plan for recovery in their business continuity strategy.

DR is strategic, but firms often approach DR strictly from the technology side. Partners initiate projects in a similar light as buying any other technology. Firm administrators and IT personnel often call to ask for direction to implement “some” measures to insure their systems will survive a disaster without understanding what the strategic mission looks like.  They want to know where to start and how to justify the cost to senior management with no end goal defined.

To that end, this article hopes to help your firm establish a good starting point and introduce strategies and technologies to consider in the DR planning process.

Where to start?
The starting point is a Business Impact Analysis (The CPA Journal).  Senior management must assess potential threats and quantify the risks if disaster were to strike.  It is not as simple as calculating billable hours lost. And, while it may be possible to “make up” work, receive extensions from traditional and regulatory deadlines, or to gain other forms of relief due to a natural disaster, your clients are still counting on you to meet payroll on Friday or deliver financial reports to a banker or potential buyer tomorrow.

Considerations should be discussed at length to determine the business risk, budget appropriately, and define key parameters such as the mission-critical applications, as well, as:

• Recovery Point Objective (RPO) - acceptable data loss (last acceptable backup)
• Recovery Time Objective (RTO) – downtime allowed before application is available

Only after IT has this information can they research and plan an adequate technology solution.

IT Strategies
With a solid perspective on the impact that different disasters might have on the business as well as a tight definition on priority for recovery, the firm can more readily evaluate the various strategies and technologies that are available.  The following is a sample range of IT strategies:

Tape Backup with offsite storage can be an effective strategy for some businesses.

o        RPO - 24 hours or last available backup

o        RTO - weeks or more unless some applications, hardware, facilities, and staff are available

o        Cost – Plan development/maintenance.  Arrangement/retainer for facility & IT support

o        Advantage:  Least expensive to maintain

o        Disadvantage:  Can prove most costly to execute.  Many potential barriers to successful recovery, such as, ability to access tapes and/or transport to alternate site, tape failure, etc.

Disaster Avoidance is the other end of the spectrum from Tape Backup.  It utilizes a remote site with fully redundant systems and data. Your infrastructure is duplicated in a physically separate location with data synchronization in real time.

o        RPO - zero to minutes.

o        RTO - zero to seconds for automatic failover or slightly longer for manual failover.

o        Cost - Plan development and maintenance plus cost of 2^nd facility and replication circuits, equipment, facilities, staff, etc. plus additional staff to maintain both environments.

o        Advantages – Greatest potential for survival.  Necessary for life support, highly transactional systems (online), etc.

o        Disadvantage - complex and costly

Hybrid-1 replicates mission-critical data to a storage system in a remote facility and requires installation of some applications following disaster.  The primary goal is to make mission-critical applications available to targeted employees immediately following a disaster.

o        RPO -  minutes to hours for mission-critical data

o        RTO - hours to days for mission-critical applications

o        Cost – In between first two strategies plus IT staffing and Warm Site costs

o        Advantage – Economical approach with greater control for firms with large IT staffs

o        Disadvantage – requires IT staff with DR and advanced networking expertise

Hybrid-2 utilizes a remote facility as the primary data center and replicates data back to the firm’s office (or other facility), near the IT staff or local integrator. This answers the concern of IT staffing availability following a disaster.

o        RPO -  minutes to hours for mission-critical data

o        RTO - hours to days for mission-critical applications and data

o        Cost – In between the first two strategies

o        Advantage – cost, redundancy and personnel access that is just not available or cost effective for most firms

o        Disadvantage – can reduce control and flexibility that the largest firms may want.

While Hybrid-2 may be a drastic departure from traditional network design, co-location is gaining in popularity because it addresses the high risk (and cost) associated with data center facilities (air, power, fire, etc.).  Additionally, combined with “managed services” this may offer the most solid and cost effective approach to a total network design with Disaster Recovery.

For any of the strategies listed above, a major consideration that will significantly impact effectiveness and cost is the “level of operational readiness” of the alternate facility. Make certain that your chosen provider is capable of handling the load placed upon him when disaster strikes. If they serve 50 businesses in the area, when would you be up?

Get Started
Disaster Recovery is critical to any business’ success, especially in today’s age. We should be careful not to look at DR as a technology in competition for our IT dollars. If we do, DR will continue to get pushed to the bottom. More “spotlighted” technologies like Intranets, Document Management, life-cycle replacements, wireless and remote access will win. These projects offer “Return on Investments” or serve as “enablers” for efficiency and improved client service, and we all tend to naturally gravitate in that direction. 

DR must be seen as an additional investment required to insure survivability of the firm. DR helps to mitigate the risk due to interruption of the business. It is an important business requirement, and executive management must lead and provide direction before IT can develop a strategy.

Sit down with your partners. Spend time contemplating different scenarios and the impact on the business if each scenario were to occur. If you get a sinking feeling in your stomach, perhaps you will want to take a next step and formally plan for recovery in the event of a disaster. It might prove to be the single most important decision you make as a business.

Web Resources
Disaster Reovery Journal     Business Continuity Glossary
The CPA Journal     Planning for Disaster
Disaster Recovery Journal     Samples for developing a Plan
The Hartford     Why do you need a Disaster Recovery Plan?
Veritas   The Technology of Disaster Recovery
Searchsttorage    New Backup Strategies
Computer Technology Review     The Difference between Snapshop and CDP

Robert Frazier is a Business Development Manager at Xcentric, LLC, a technology consulting group that provides “Certified Networks for CPAs”.  With offices in Oklahoma, Alabama, and headquarters in Atlanta, Georgia, Xcentric specializes in the accounting industry. You can reach this author or any member of Xcentric by calling 866-XCENTRIC or via email at info@xcentricgroup.com.

We’re online at www.xcentricgroup.com.