This is the third article of a risk management series and focuses on business continuity planning and risk mitigation strategies. The first article Eight Steps to Establish a Firm Risk Management Program covered the benefits and steps of establishing risk management program and the second Ten Steps to Successful Firm Risk Management highlighted 10 key steps for successful risk management.

The articles are a result of discussions at recent IFAC’s SMP Committee meetings, which involves practitioners from around the world sharing their perspectives and insights. In February 2019 SMPC meeting featured a session about the Japanese accountancy professions involvement in disaster recovery support and reconstruction activities following the earthquake in 2011.

Japan is one of the few nations that has an active disaster recovery support for small- and medium-sized entities (SMEs). It is well recognized that SMEs are critical to every countries economy, for innovation, employment and contribution to GDP. Hence, the continuation and sustainability of SMEs during and after any natural disaster is vital.

The Guide to Practice Management for Small- and Medium-Sized Practices (the PM Guide) includes a whole module on risk management including: professionalism and ethics, client engagement, quality control and business continuity planning and disaster recovery. In addition, practitioners are encouraged to use a Good Practice Checklist for Small Business as a marketing or diagnostic tool to help them determine the advice a small business client may need, and also help them in managing their own business. It includes a section on Environmental Management Tasks highlighting the necessity for SMEs to have a contingency plan for an emergency or disaster and contains a checklist on “how to respond to emergencies”. 

Developing a Business Continuity Plan

The key to business continuity planning and disaster recovery is to look at it as an entire function as whole and complete in itself. The most effective way to coordinate planning in this area is to include the various components required in one central document. This is called a Business Continuity Plan. The purpose of developing a Business Continuity Plan is to ensure the continuation of the firm during and following any critical incident that results in disruption to the normal operational capability of the firm.

The Business Continuity Plan is based on the Prevention, Preparedness, Response and Recovery (PPRR) framework:


Prevention is all about risk management planning (please see Eight Steps to Establish a Firm Risk Management Program). This is where the likelihood and/or effects of risk associated with an incident are identified and managed. The key elements of the risk management processes are implemented at this stage, with threats identified and dealt with, or reduced to an acceptable level. 

The key tool for the Preparedness element is the Business Impact Analysis. This is where the key activities of the firm that may be adversely affected by any disruptions are identified and prioritized.

The key function of the Response element is Incident Response Planning. This plan outlines the immediate actions to be taken to respond to an incident in terms of containment, control and minimizing of impacts.

The Recovery section focuses on recovery planning. The purpose is to outline the actions that are to be taken to recover from an incident in order to minimize disruption and recovery times.

Another important element of the Business Continuity Plan is the concept of regular updates and review. It is hoped that the firm will never need to use the plan, but if the need ever arises, staff should know the plan is up to date with current details, information and resources. This is important, as it should reflect the changing needs of the firm.

Key items the plan should include:

  • Distribution list: An up-to-date list should be maintained of the people who have been supplied with a copy of the plan and their contact details. Remember to keep a copy of the plan in a safe off-site location.
  • References and related documents: Make a list of all the documents that have a bearing on the Business Continuity Plan.
  • Objectives of the plan: Objectives clarify the purpose of the plan and should describe the intended result. An example includes:
    • Undertake a risk management assessment of the firm;
    • Define and prioritize the firm’s critical practice functions;
    • Detail the immediate response to a critical incident;
    • Detail strategies and actions to be taken to enable the firm to continue operating; and
    • Review and update this plan on a regular basis.

Ten Risk Mitigation Strategies

Each firm should have risk mitigation strategies to prepare in case of death, loss or injury of a partner.

1. Document Sensitive Information

It is important to document and keep in a safe place critical information that is necessary for the effective running and operation of the firm. This information may include:

  • Client agreements and arrangements;
  • Employee agreements and arrangements;
  • Supplier agreements and arrangements;
  • Personal guarantees provided and to whom;
  • Bank and finance arrangements;
  • Lawyer’s name and contact details;
  • Intellectual property residing within or developed by the firm; and
  • Recommendations for ongoing management of the firm.

2. Maintain Adequate Insurance

It is important to maintain adequate insurance to cover the firm. It is prudent to ensure that the firm has adequate insurance to cover each partner and to provide the funds to pay out the estate for the partner’s share of the firm in the event of their death. The prudent firm will insure their key human assets just as they do their physical assets.   

Important insurance coverage to hold includes:

  • “Key person” insurance;
  • Partnership/shareholder insurance (this provides for payment to the survivors of the partner); and
  • Business equity insurance (it is important that the business equity insurance policy is supported by a “buy/sell agreement,” as discussed below).

3. Ensure there is a Valid “Buy/Sell Agreement”

If there are partners in the firm, it is important to ensure there is a legally drawn and valid “buy/sell agreement.” This outlines the terms and conditions agreed upon between the partners for the purchase or sale of their share in the firm. It should be confirmed that it has been reconciled with the partnership/shareholder insurance coverage to ensure there is no shortfall.

4. Inform Bankers and Suppliers

It is important to consider beforehand what might be the reaction of bankers, other lenders and suppliers to the death or incapacitation of a partner of the firm. For instance, would they be prepared to continue with their financial arrangements, or would they call up their debt? Consideration would need to be given to whether the firm has sufficient financial reserves to cover such a situation.

5. Ensure Adequate Training of Staff

Appropriate training should be provided to staff in the key areas of management and the operation of the firm so that it is not totally dependent on one partner. The PM Guide includes a whole module ‘People Power: Developing a People Strategy’, which covers leadership, managing and retaining employees, recognition, training and development.

6. Ensure Procedures Manual Written and Maintained

It is vital to the ongoing operation of the firm that a procedures manual has been prepared which fully documents the procedures, processes and operations of the practice. It needs to be maintained and kept current. This means the firm is able to continue to operate during the death or incapacitation of the practitioner until certainty as to its future is known. The procedures manual also becomes a key document in any valuation process which is undertaken, as it tends to add value to the firm by reducing reliance on one partner.

7. Ensure Job Descriptions are Completed

It is important that job descriptions have been completed for all roles within the firm and that each staff member is clear on the tasks they are to perform.

8. Undertake Regular Staff Appraisals

Regular staff appraisals allow staff to stay informed of their progress and development within the firm and provides the opportunity to provide feedback on their performance. It also provides the opportunity to advise the staff member of the steps that should be taken if a partner were to die or become incapacitated.

9. Partnership Issues

If there are partners within the firm, it is important they clarify what will happen in the event of either their death or their incapacitation.

10. Other Business Relationships

It is important to understand whether the untimely death or incapacitation of a partner would unduly affect any other business relationship that the firm has. There should be a documented succession and continuity plan in place.

Monica Foerster

Chair

Partner at Confidor, Chair of IFAC's SMP Advisory Group

Monica Foerster became Chair of the IFAC SMP Advisory Group (SMPAG) in 2017, after serving as its Deputy Chair. A SMPAG member since 2014, she was nominated by Conselho Federal de Contabilidade (CFC) and Instituto dos Auditores Independentes do Brasil (IBRACON). With 20 years of experience in the accountancy profession, Ms. Foerster is a partner at Confidor, an accounting, tax, and law firm with offices in Porto Alegre and São Paulo, Brazil.

Monica is currently a member of the Board of Directors of Ibracon Brazil (where she was the SMP Director and coordinator of the SMP Working Group for 6 years), and a board member at the Accounting Council (where she was also the coordinator of the Committee of Audit Studies (CRCRS) for 4 years. 

Monica holds an MBA in financial management, controllership and audit from the FGV – Fundação Getúlio Vargas, Brazil, and a degree in accounting from the Universidade Federal do Rio Grande do Sul – UFRGS, Brazil. 

Christopher Arnold

Director

Christopher Arnold is a Director at the International Federation of Accountants (IFAC). He leads activities on contributing to and promoting the development, adoption and implementation of high-quality international standards, including the Member Compliance Program, Intellectual Property and Translations. Christopher is also responsible for IFAC’s SME (small- and medium-sized entities), SMP (small- and medium-sized practices) and research initiatives, which include developing thought leadership, public policy and advocacy. He was previously an Audit Manager for Deloitte and qualified as a professional accountant in a mid-tier accountancy practice in London (now called PKF-Littlejohn LLP). Christopher started his career as a Small Business Policy Adviser at the Association of Chartered Certified Accountants (ACCA).