A CPA firm’s business continuity plan should identify its critical people, systems, data and workflows; set recovery priorities; assign emergency roles by job title; document primary and backup communication methods; explain how employees will work when the office or technology is unavailable; and establish a schedule for testing and updates. It should also account for filing deadlines, client confidentiality, vendor dependencies, and the financial cost of downtime. I tell firm leaders to keep asking “what if?” until the plan still works after the obvious backup fails.
What Is a Business Continuity Plan?
In plain English, a business continuity plan explains how your firm will keep serving clients when normal operations break down. It covers more than restoring a deleted file or replacing a failed laptop. It prepares the whole organization to continue through a serious disruption, such as a cyberattack, extended internet failure, cloud service outage, power loss, inaccessible office or the sudden absence of a key leader.
I think of the business continuity plan as the answer to the “oh crap” situation. COVID showed us how quickly normal work can change. Firms had to meet with clients remotely, move employees out of the office, and maintain service without the routines they had relied on. A good business continuity plan treats the firm as a living organization that must operate beyond the availability of any one partner, employee, location or technology provider.
Business continuity and disaster recovery support each other, but they solve different problems. Continuity keeps the business operating during disruption. Disaster recovery restores systems, applications and data after a failure. A backup belongs in the recovery strategy, but a backup alone does not tell your team who makes decisions, how employees communicate, or how the firm meets a filing deadline while restoration is underway.
A Business Continuity Plan Built for Accounting Firms
CPA firms need a business continuity plan designed around the reality of tax and audit work. During busy season, one hour of downtime carries more weight because deadlines do not move and the entire team may already be working at capacity. If a server, firewall, internet connection or tax application fails, the disruption can ripple through preparation, review, e-signature, billing and client communication.
Start by listing every system, application, file set, device and cloud service your firm uses. Then rank them by how directly they affect client service and deadlines. Your highest-priority list will often include tax and audit software, document management, email, Microsoft 365, client portals, e-signature, time and billing, identity services, internet connectivity, firewalls, servers and secure remote access.
Next, map the workflows behind those systems. A tax return does not move from intake to filing through one application. It moves through people, approvals, client documents, review steps and outside services. Document what must happen, who can approve it, and what alternative process the team can use if one link breaks.
Do the same exercise with people. List the key decision makers and process owners, then remove them from the scenario one at a time.
- What happens if the managing partner cannot respond?
- Who approves an emergency purchase?
- Who can contact the cyber insurer?
- Who understands the backup environment?
A single in-house IT employee can become a major point of failure if that person quits, gets sick, or cannot access the environment. Every critical responsibility needs a trained alternate and enough documentation for that person to act.
I use a version of the “five whys” that I call the “five ifs.” If Microsoft 365 goes down, what do we do? If the backup is unavailable, what do we do next? If local copies are inaccessible, what is the next option? You may not need five practical layers for every scenario, but go at least two or three levels deep. That exercise exposes assumptions before an emergency does.
What To Do During An Outage
Employees should not have to invent an outage response. The firm should give them a short, accessible playbook that answers four questions:
- How do I report the problem?
- Where do I receive verified instructions?
- What work can I perform safely?
- When and how do I communicate with clients?
Keep a current copy somewhere the affected system cannot lock away.
The incident team should quickly confirm the scope, protect data, activate the right technical or insurance resources, choose the approved work alternative, and set the next update time. For a cloud outage, the team may shift to a separate service or approved local process. For an internet failure, employees may move to a secure alternate connection or work remotely. For an office closure, the team may activate remote work or another location. Your business continuity plan must define these options before people use personal email, unapproved file-sharing tools, or unsecured Wi-Fi under deadline pressure.
In Arizona, that may mean planning for a monsoon-related power or internet outage while employees are spread from downtown Phoenix to Old Town Scottsdale and Tempe. If your firm depends on cloud applications, consider a secondary internet connection and confirm that employees can work securely from home. If you still run a physical server, define how quickly your provider can bring up a virtual image or replacement environment.
Assign emergency responsibilities to job titles, not names. People change, but the role remains. Build a small committee with a decision leader, technical lead, operations coordinator and communications lead. Add alternates for each role. Match responsibilities to strengths, especially when the situation requires someone who can stay calm, organize facts and communicate clearly.
Communication Procedures
Use the firm’s normal communication channel first, then choose a secondary method that does not depend on the same platform. If everyone relies on Outlook and Teams, a Microsoft outage can disable both. A maintained group text, phone tree, or approved messaging group can give employees a separate path to verified instructions.
Prepare short templates for employees, clients and vendors. Employee updates should state what is unavailable, what employees should do, what they must avoid, and when the next update will arrive. Client messages should explain the service impact without speculating or exposing security details. Vendor messages should identify the affected service, support ticket, escalation contact, and requested recovery time.
For a cyber incident, the response team should know when to involve the cyber insurer, attorney, forensic specialists, and any required reporting contacts.
Review and Test The Business Continuity Plan
Do not create the document, save it in a folder and forget it. Review it at least annually and whenever your firm changes a major application, provider, office, leader, insurance policy or workflow. Busy-season preparation should begin as soon as the current season ends. Hold a postmortem while the pain points remain fresh:
- Where did we lose time?
- Which systems slowed the team down?
- Which escalation path failed?
- What should change before the next deadline cycle?
Test the plan, too. A tabletop discussion can walk the committee through a scenario, but a controlled technical exercise reveals more. Temporarily remove access to a nonproduction resource or simulate an Office 365, internet, or tax software outage. Then follow the playbook exactly. If the response says “message everyone in Teams” during a Microsoft outage, you have found a gap.
Test data restoration at least quarterly. The test should confirm that the restored data opens, matches the expected point in time, and supports the required workflow. Track two business decisions: the recovery time objective, or how quickly a system must return, and the recovery point objective, or how much recent data the firm can afford to lose. Your IT provider should proactively report test results, exceptions, and corrective actions instead of waiting for you to ask whether backups worked.
Business Continuity Plan Checklist for a CPA Firm
Use this checklist as the one-page visual inside your plan. Add the owner, alternate, location, and last-tested date for every item.
CPA Firm Continuity Readiness
- – List critical client services, filing deadlines, and minimum staffing needs.
- – Inventory applications, data, devices, cloud services, servers and internet dependencies.
- – Rank systems and workflows in recovery order.
- – Set recovery time and recovery point objectives for each critical system.
- – Name emergency roles by job title and assign trained alternates.
- – Document primary and backup communication channels outside the same platform.
- – Define secure work alternatives for internet, office, server and cloud outages.
- – Maintain independent backups and confirm vendor responsibilities and retention limits.
- – Record contacts for IT, software vendors, cyber insurance, legal counsel and key clients.
- – Write employee, client, and vendor message templates.
- – Apply the “five ifs” to people, systems, backups and communication paths.
- – Run an annual continuity exercise and quarterly restoration tests.
- – Review the plan after each test, incident, major change and busy-season postmortem.
Turn Downtime Risk Into a Business Decision
The strongest business continuity plan connects technical choices to financial consequences. Lost billable time matters, but it is only the beginning. A ransomware event can also bring legal fees, insurance involvement, higher premiums, public-relations costs and lost client trust. Slow computers and intermittent application problems create a smaller but constant productivity drain that adds up across the firm.
Before you decide whether backup internet, faster recovery or stronger security costs too much, calculate what an outage already puts at risk. Use Ma’atIT’s downtime calculator to estimate your firm’s exposure, then compare that number with the investments required to reduce it. The result gives your leadership team a practical starting point for recovery priorities, provider expectations and budget decisions.
Calculate the financial exposure your continuity plan must address with the Ma’atIT Downtime Calculator.
Fady Salama, President
Fady Salama is the Founder and CEO of Ma’atIT, where he helps businesses align technology with profitability and growth. With a strategic, numbers-driven approach, Fady works as a fractional CIO for his clients, going beyond IT support to build smarter roadmaps, reduce waste, and drive measurable business results.