CFO & Vital Records Protection

The CFO and Financial Executive's Role in Disaster Recovery
A Business Continuity/Disaster Recovery (BC/DR) plan has three purposes. It serves as the main resource an organization can use in the event a disaster strikes and affects any number of crucial functions. This plan also provides a framework for the decisions made, and actions to be taken, by company officials to ensure that operations can continue while the disaster is occurring. Lastly, the BC/DR plan helps ensure that companies will be able to recover and return business activity (hopefully) to pre-disaster levels.

Preserving Vital Records is Paramount
The foundation for developing a BC/DR plan lies in developing a method for protecting and preserving vital records. All businesses should take a proactive rather than a reactive approach to disaster preparation, especially with respect to vital records.

The most essential component of the plan is identifying and protecting vital records. If a vital record is lost, damaged, destroyed or otherwise rendered unavailable, that loss becomes a disaster-within-a-disaster, affecting the critical operations needed to recover from the first disaster. Therefore, protecting vital records should be the main priority (after the protection of human life of course) for contingency and recovery efforts when a disaster occurs.

In the past several years, incidents like 9/11 and dramatic natural disasters, such as the Western wildfires or the hurricanes that periodically threaten the American east coast, illustrate the importance of Vital Records Protection (VRP) for business. In addition to a general crisis management plan designed to preserve and protect human life, companies need to develop contingency plans to protect critical information from destruction.

The role of the CFO in this crucial aspect of risk management is ever-evolving, since a comprehensive risk analysis will illuminate the impact and cost of major disasters to a company’s bottom line.

CFOs as VRP Advocates
Some estimate that 85 percent of the CEOs running companies today rose from the sales force. What this means for VRP is that often, the CEO and his/her senior management team will profess they consider document protection important, but then become reluctant to devote funding and staffing to VRP efforts. Instead, they may focus on devoting resources to sales and marketing initiatives.

By quantifiying the risk in a way that makes sense (i.e., financially) for the decision makers, the CFO can significantly affect how senior management views VRP. The CFO can advocate that management should not view BC/DR and VRP as a one-off project.

Instead, the company will thrive, they should say, when management makes a long-term commitment to VRP and supports it as a line-item in the overall corporate budget on an ongoing basis.

CFOs Can Commandeer a Recovery
No matter how much a company heeds the CFO and initiates a well-funded VRP strategy, a company can still encounter a worst-case scenario in which a disaster causes vital records to be lost or destroyed. This is where a CFO can play an active role in the recovery process.

The first issues often concern cash flow. CFOs need to figure out how to pay immediate bills, such as those funding payroll and/or interim facilities, computers, and phone equipment. This cannot occur without ready access to:

• vital financial records (contracts/agreements that prove ownership of property, equipment, vehicles and products);
• operational records (current or unaudited accounting and tax records, current personnel and payroll records, client-account histories, and shipping delivery records); and
• current client files.

The CFO should direct these efforts because there really is no one on the senior management team better qualified to manage the use of these records during the recovery process.

Options for Protecting Vital Records
If you have analyzed, reviewed and audited your company's VRP needs and laid out in great detail a viable and cost-effective VRP strategic plan, some potential approaches for protecting vital records include an on-site fire-rated vault, safe or file cabinet, off-site storage at another location of the organization, and storage at a vendor who specializes in off-site vital records storage.

Most companies employ various combinations of these options. The key for a CFO is to lead and to plan and develop a VRP strategy before a disaster strikes, because once you are in the middle of a disaster, it's far too late.

AICPA’s Top Ten Technologies 2005 is a project of the AICPA’s Information Technology (IT) Membership Section and led by the Top Ten Technologies Task Force. This article is designed to show how “Disaster Recovery,” ranked #5 in the 2005 list, has an impact on CPAs in business & industry. For more information on the AICPA’s technology initiatives, including the Top Technologies, the CITP credential and the IT Membership Section, visit www.aicpa.org/infotech.

About Doug Voet
Doug Voet, CPA, is CFO of Fire King Security Group, a New Albany, Ind.-based provider of security products and solutions. He has held that position since 1995. Mr. Voet, a CPA since 1980, is a member of the Kentucky Society of CPAs and a member of the AICPA. E-mail him at dougv@fireking.com.