Establishing a Disaster Recovery Plan for an Employee Benefit Plan
David Dorsey, CPA
Employee benefit plans are designed to try to juggle the pressures of day-to-day benefit processing, adjusting for constant changes from federal and state regulators and ensuring that the Plan is fiscally fit. It is therefore easy to understand why so many Plans overlook some of the most obvious risk exposures that could cause a catastrophic problem for the Plan participants and the fiduciaries charged with the responsibility of running the Plan. Disasters come in many different forms and from many different directions. How well prepared is your Plan prepared to handle a real disaster?
How would your Plan deal with a situation where local construction crews accidently severed a power line and the repair is anticipated to take a week? How about a situation where the water supply is damaged coming into your offices and the health department closes your building until the problems are identified, repaired and inspected? Or, how would your Plan deal with a situation where a tornado, hurricane or other act of nature damages the Plan’s facilities or causes so much collateral damage that entry into the building is denied for weeks? The tragic events that crippled New Orleans from flooding or New York from terrorist attacks caused complete shut downs of nearby commercial buildings for months. How would health claims get paid? How would monthly pensioner checks get processed? Is your Plan prepared to deal with these kinds of issues?
Fiduciaries must consider how the Plan would continue to operate in the event of such disasters. I believe that a prudent person would expect that Plan trustees would have considered such plans and implemented reasonable measures to provide for alternative operations if disaster strikes. Here are a just three ideas to help your Plan prepare for the worst:
Strategies to Protect Plan Data to Function in Case of Emergency
Contact an employee benefit plan in another part of the country and establish a bilateral agreement whereby each Plan acts as a remote operational computer site for the other. Perhaps you could limit your search to those plans that use the same software/processing system as your Plan to allow the smoothest transition, or search for Plans that represent a similar demographic as the participants in your Plan. This arrangement may require the acquisition of some additional hardware/software so each site can handle the additional “load” placed by having both Plans operate from the same site. Outside consultants might be the best way to successfully evaluate and implement this solution.
Your Plan should adopt an electronic backup process for data such that you could re-establish your existing electronic workspace from an alternative site. Many Plans have established best-of-breed backup solutions, some of which use cloud-based solutions via the Internet to remotely store electronic data. The problem I see in practice, whether the process is performed on-site or remotely, is that few Plans actually test the backup system on a recurring basis to ensure it works as expected. Imagine the disappointment when you have a disaster and your system fails.
In addition to the more common use of electronic technology, many Plan documents are still in paper form. The second biggest problem I observe is that there is no process in place to protect the hardcopy files. Plans should consider bulk scanning/imaging of hardcopy documents to ensure that, if a fire occurs, the Plan can continue to operate. A process of quality control should be deployed when scanning bulk documents to ensure that scan quality and file organization is maintained at all times. Don’t set yourself up to be disappointed when you try to open a document six months from now and learn that the scanned image is not legible.
For more information on this and other topics related to employee benefit plans, please visit our new blog on a regular basis.