Continuity Planning for Small Law, Accounting and Advisory Firms

When the vendor is the outage

Small firms outsource almost everything, which is sensible, so the plan has to cover the day the outage belongs to someone else. Three dependencies deserve their own page.

• Practice-management and docketing software. Check what the contract says about availability and data export, and whether you can pull a full export yourself. Then run one, so you know how long it takes.
• Your managed IT provider. The July 2021 Kaseya VSA attack showed how ransomware can travel through a remote-management tool used by managed service providers into many of their small-business customers at once. Ask how the provider secures its own tools, who helps you while its staff are busy with dozens of other clients, and whether your backups sit beyond the reach of its administrator accounts.
• Email and identity. If the email tenant is down, so are password resets, client portal logins and often the phone system. Keep a short list of client, court and agency contacts with phone numbers somewhere else.

Law and accounting firms hold other people's most sensitive data, which makes them attractive targets. The cost of an attack is mostly lost billing and missed work, not the demand; the briefing on why ransomware downtime costs more than the ransom sets out where the money goes.

The partner who is the practice

In a 25-person firm, one partner may hold the relationships, the signing authority and the working knowledge of a dozen active matters. Illness, an accident and a sudden resignation all raise the same question: who looks after those clients tomorrow?

The plan should name, for each partner or principal, a backup professional who can triage the active matters, has read access to the files, and has met the larger clients before anything goes wrong. It should also cover the money. If one partner is the only signer on the client trust or escrow account, or the only approver in the payment platform, that account stops when they do. Add a second signer, and ask the bank how long a signatory change takes. It is rarely same-day.

Firm agreements deserve a look too. Partnership and shareholder agreements often treat death and disability as financial events and say nothing about who takes operational control of the partner's clients, files and accounts. Solo practitioners and very small law practices should read the succession-planning guidance their bar regulator publishes, because expectations differ from state to state.

Professional duties do not pause

Rules vary by profession and jurisdiction, so have your general counsel or ethics adviser read the finished plan. The obligations that bite during a disruption are consistent enough to plan around.

1. Confidentiality survives the emergency. When the system is down, people improvise with personal email, consumer file-sharing links and home printers. Decide in advance what is allowed. An encrypted loaner laptop beats the family computer.
2. Clients are owed an early explanation. If a disruption may affect a client's matter, deadline or money, tell the client before the deadline, not after. Draft two or three short notices now.
3. Client money needs a second path. Trust, escrow and client-fund accounts carry strict handling rules, and a disruption is no excuse to bend them. Alternate signers and procedures have to exist beforehand.
4. A breach starts several clocks. If an incident involves unauthorized access to client data, notification duties under state breach laws, engagement letters and, for some firms, regulatory rules may begin running. Call your cyber insurer and outside counsel early; most policies expect prompt notice.
5. Retention duties outlive the damage. Water-soaked files and a corrupted archive do not end the obligation to keep records. Know which records are backed up and which exist only on paper.

Losing the office

Hybrid work has made losing a building far less serious for most professional firms; our piece on continuity planning when the office is no longer the recovery site covers the home-working side. What a small firm still loses with its office is physical: signed originals, wills and deeds in the firm's safe, records waiting to be scanned, the production scanner, and the mail.

Three cheap measures cover most of it. Scan on intake, so the paper becomes a copy rather than the record. Keep originals that must be kept in fire-rated storage, with a log of what is held for whom stored somewhere else. And know how to redirect mail and deliveries.

Superstorm Sandy in 2012 left much of lower Manhattan without power for days, and some office buildings stayed closed far longer. Firms whose clients came in to sign learned that the conference room is a dependency too: know where a closing can happen if your space is gone.

A one-day agenda for writing the plan

A firm this size does not need a six-month project. It needs one day with five or six people: the managing partner, the firm administrator, whoever runs IT, a lead from each practice group, and the docket keeper. Block the calendar and work through this agenda.

Put the output into a familiar structure such as our annotated sample business continuity plan. For a firm this size the one-page version at the end of that outline is a sensible target, with the deadline export and system table as appendices. Ready.gov's business continuity planning resources include free templates if you would rather start from a form.

What you should have by 5 p.m.

• A ranked list of client services and how long each can stop.
• A named owner for the weekly offline deadline export.
• Two administrators for every system that holds client data.
• A backup professional for every partner, and a second signer on every client-funds account.
• Notice templates for clients and a phone list that does not depend on email.
• A date for the first test, no more than 60 days out.

If the day produces only the deadline export and the second administrators, it has still paid for itself.