Benefit Plan Policies: Disaster RecoveryBondBeebe
Larry Beebe, CPA
In this series, we are reviewing the written plan policies needed to help your benefit plan stay compliant and operate most effectively. For a full list of the necessary policies and why your plan should implement them, click here.
A great majority of plans acknowledge that they should have a disaster recovery policy and have taken the steps to put this policy in place. However, having such a policy and implementing the policy are often two different things. A plan may have a disaster recovery policy on paper, but has done nothing to implement or test the policy.
When we think of disasters we tend to think of environmental events such as fire, floods, hurricanes, tornadoes, and earthquakes. Disasters can also occur in the form of a loss of information stored on computers, failures of computer software and hardware, network crashes, cybercrime, and terrorist activity that prevents access to the workplace for a prolonged period of time.
In order to protect and prepare your plan for these events, your disaster recovery policy should address the following issues:
- Definitions. Your policy should define what constitutes a disaster and who will need to respond and how.
- Applicable Regulatory Requirements. For example, the Health Insurance Portability and Accountability Act (HIPAA) requires health & welfare plans to adopt a contingency plan for emergencies.
- Records. Your disaster recovery policy should specify how plan records will be safe guarded.
- Instructions. Provide clear instructions for all plan personnel regarding how to plan for and react to any situation and the resulting recovery process.
- Testing. Not only should your recovery procedures be tested, the tests themselves should be required by the policy.
- Restoration. Your policy should include details as to how plan operations will be restored as well as recovery objectives.
- Priorities. The policy should set out priorities for when the disaster occurs.
No organization can possibly anticipate and plan for every type of disaster that could occur. Having a good plan, updating it regularly and regularly testing your plan are all essential steps for proper disaster preparedness and recovery.
For more details on this type of plan, please see the Trustee Handbook published by the International Foundation of Employee Benefit Plans.