I&U CPA LLC (we, us, the firm, I&U CPA hereafter) views recovery of its business operations and supporting technology, Business Continuity (“BC”) and technology Disaster Recovery (”DR”) respectively, as a critical and fundamental part of its ability to fulfill its fiduciary responsibilities to clients. As such, significant resources and effort are dedicated to these programs.

We maintain business continuity and crisis response plans to facilitate the continuity of business in the event of a business disruption. I&U CPA’s executive management is responsible for oversight and governance of the firm’s BC program.

In order to maintain a resilient technology environment, the DR program has implemented strategies for near zero downtime and near zero data loss for all applications that support critical business processes as defined by the BC Program.

I&U CPA’s BC/DR programs have several key elements, including:

  • Planning
  • Exercises and Testing
  • Third Party Resiliency

Planning

There are three main areas of focus that comprise the BC/DR planning that we perform:

1. Business Continuity Plans: We maintain Business Continuity Plans (BCPs) for each business function. The BCPs have the following two components:

  • Business Impact Analysis: The Business Impact Analysis (BIA) methodology is designed to assess both financial and non-financial impacts of the loss of a critical process. Each department periodically reviews and updates their business continuity needs through a formal Business Impact Analysis template. The results of this process are used to perform a “gap analysis” to identify potential areas of improvement within Business Recovery Plans (BRPs). The appropriate groups address any significant gaps and revise BRPs as appropriate.
  • Business Recovery Plan: Business Recovery Plans (BRPs) are procedures designed to recover specific critical processes in support of continuity of operations in the event of a business disruption. These include recovery strategies for personnel, data, communications, information processing and facilities. Recovery Time Objectives (RTOs) are created for all critical business functions and services, and are validated through annual exercise requirements.

2. Disaster Recovery Plans: Disaster Recovery Plans (DRPs) incorporate fail over strategies and are comprehensive enough to recover from a disruptive event affecting a data center yet modular enough to recover from the loss of a single server. The key elements of the DRPs include:

  • Communication Plan that identifies how personnel will be engaged when an event occurs as well as the frequency and method of communicating information and progress throughout the event
  • Incident Management Plan that includes information for establishing and maintaining a command center, responsibilities of the management team as well as a recommended methodology for decision making and escalation
  • Recovery Plans for each team that includes requirements, configuration and execution procedures for failing over each application to a secondary data center

3. Crisis Management:  We have a program devoted to response planning which includes a full-featured Crisis Management framework that includes the following tools:

  • Crisis Management Call Lists that include key business heads
  • An automated crisis notification system that can broadcast messages to designated staff in the event of a crisis. Notifications are sent via email, work and personal phones, and text message
  • Employee emergency pocket cards that contain procedures for employee evacuation, assembly, check-in and communication

Exercises & Testing

We exercise BCPs to ensure the procedures for recovering business operations are appropriate, and that key personnel are familiar with documented procedures. Broadly, the firm utilizes the following recovery strategies in its BCPs:

  • Remote Access exercises (e.g., work from home)
  • Alternative location exercises (e.g., work area recovery or alternate I&U CPA office)
  • Critical process transfer (e.g., transferring workload to another unaffected office and team)
  • System fail-over testing, including external vendors where appropriate

BCM exercise results are documented and reviewed with all involved participants following each exercise. Recommendations for improvements to the recovery process are identified and any corrective actions clearly defined.

We conduct an annual technology DR test. Following each test the report identifies:

  • The recovery time for all applications
  • The pass / fail assessment of each application
  • A plan to resolve any remaining open issues
  • Any lessons learned along with a plan to enhance the recovery program

Third-Party Resiliency

One of the key components of the BCM planning process is our supplier management framework, which includes periodic reviews of the business continuity programs for key service providers. Risk assessments are used to determine the criticality of each service provider. For the most critical service providers, we conduct targeted reviews and evaluations of BCM plans and, where appropriate, on-site visits.