In 2017, in a span of fewer than 30 days, Hurricanes Harvey, Irma, and Maria claimed 282 lives, left approximately 25 million people without power, and made several hundred thousand more people homeless. Hurricane Harvey dropped massive amounts of rain in areas across Southeast Texas and left half of the city of Houston under water. Hurricane Irma set a new record for being the most powerful storm in history, destroying more than 65% of the homes in the Florida Keys and leaving more than 1.9 million people in Florida without power a week afterwards. Then came Hurricane Maria, which devastated Puerto Rico, leaving 80% of its inhabitants without power a month following the storm.
What does this have to do with payroll? Everything! The sheer magnitude of the number of people and businesses affected by these storms should make all of us stop and think—how would an event like this affect my ability to do my job? Would you be able to pay your employees if you were without power for three weeks? How about six months? Does your company have a business continuity plan (BCP)? If so, are you familiar with it and, most importantly, does it address payroll?
Unfortunately, for the majority of us the answer to these questions is “I don’t know.” Even the best plan is virtually useless if the employees are unaware of it or don’t know how to implement it. And if the payroll department isn’t aware of the plan, payroll employees probably weren’t consulted when the plan was written. Maybe you have faith that your senior management understands what payroll needs in order to function in the face of an unexpected or catastrophic event, but that doesn’t mean you shouldn’t be prepared.
Plan Now
So what can you do to prepare for the worst? Start by brainstorming. Sit down and make a list of “what if” scenarios. What are some of the worst-case scenarios you can imagine, and what can you do to mitigate the consequences of these situations? Let your imagination run wild. Even if an event is unlikely in your area, many times the solution you come up with can be applied to other, more probable events. You will not have wasted time considering an unlikely event—just ask Ireland. The people in Ireland hardly expected to be hit by a tropical storm, but that didn’t stop Hurricane Ophelia from pounding through and wreaking havoc on the island last October.
Likewise, Citibank didn’t expect one of its computer engineers, after receiving a poor performance review in 2013, to transmit a code and command, erasing the running configuration files and shutting down its routers. Nor did the city of San Francisco expect one of its IT employees to go rogue in 2008 and lock everyone but himself out of the city’s network, causing the city to lose control over the system that housed all emails, law enforcement records, personnel files, and payroll files.
You don’t want the occurrence of an emergency to be the first time you have ever even considered the potential of such a threat. By allowing your imagination to concoct even the most outlandish worst-case scenarios, you will discover your weak spots. You don’t necessarily want to plan a step-by-step response to all the unconventional scenarios you come up with, but you do want to consider them enough to identify why this scenario would prevent you from processing payroll. By doing so you will probably start to see a pattern, and that pattern will point you to a common problem. If you can resolve that problem, you will likely ease the challenges you face in the more likely emergency scenarios.
What If
What if you are facing a direct hit by a category 5 hurricane? The potential damage could include extended bank closures, extended power outages, flooding and debris blocking access to and from your home and office, and limited or no access to computerized payroll data.
What if there is a large-scale terrorist attack? Look at New York on 9/11 to imagine the potential issues you could face in such a disaster. If you went home as usual tonight, and your office building was destroyed before you returned in the morning, what aspects of your job would you be able to continue from a different location and what aspects would be brought to a grinding halt?
What if there is a fire at the office and it (or the sprinkler system it activates) destroys your computer and everything in your office, or there is a tornado or an earthquake? These are different scenarios than a terrorist attack, but the resulting circumstances are the same—what aspects of your job would come to a halt if you lost everything in your office?
What if a disgruntled IT employee wants to undermine or damage the employer? A rogue employee who possesses IT knowledge and access could potentially destroy all computerized data. If someone were to wipe out all of the payroll data from the system, how would you process payroll?
So what do you do? The first and most important step is simply to have a plan. Don’t wait until the last minute to decide what to do. Hurricane Harvey went from a tropical depression to making landfall as a category 4 hurricane in 56 hours, giving Texans two days to prepare for a record-breaking, catastrophic storm. You need to already be familiar with your BCP so you can use that time to activate it. As for devising that plan, every business is different, and every payroll department has its own unique environment. The potential threats we face vary and are influenced by the size, location, and industry of our company. No single plan will work for all payroll departments, or for all types of emergencies. You must customize it according to your company’s environment. Nevertheless, everyone can take some basic steps to be prepared.
Know Your Company Policies
Know your company policies. Or create new ones. If you are just starting to create a payroll continuity plan, there is a good chance the current policies don’t address emergency situations. From your brainstorming session, you will have identified possible solutions for various circumstances. Now you need to select the best options and write them into policy. Make your payroll continuity plan part of the company’s written BCP.
If a hurricane is barreling down on you, do you wait until payroll is due and hope that you will still have the ability to process it, or does your company allow for you to process and issue the upcoming payroll early due to the circumstances? Running an early payroll comes with its own set of issues because you will not know what overtime pay and additional wages are due to your employees, but that can be addressed when business returns to normal. What matters at the moment is that your employees don’t have to survive the storm (and its aftermath) without any money. If you know a major storm is coming, you need to at least be able to run a vanilla payroll—pay your employees their base salaries for the pay period before the storm hits, while the banks are still open and ATMs are still working. Explain to them that you will run a special payroll at a later date to pay any overtime or additional wages due to them. They will appreciate that you made sure they had access to at least their base wages just in case.
What if you are still without power a month later? Does your policy address if and how you will continue to pay your employees if the situation persists for an extended period of time? If you have salaried employees, they are expecting to be paid whether they worked or not. The same goes for any employees who have accrued leave. They will expect to be paid at least until they run out of leave. Additionally, depending on your industry, you may have employees who are expected to continue working through the emergency. They will definitely expect to be paid. Your policy needs to address this possibility. Do you have the ability to write paper checks to all your employees? If so, with banks closed due to widespread power outages or flooding, would your employees be able to cash or deposit those checks? Having enough cash on hand to cover one or two payroll cycles might be a better idea if your company has a secure vault or safe to store it in.
Have Basic Items on Hand
While there is no single plan that covers all possible emergencies, there are a handful of items you can keep on the ready that will help ease the burden under most circumstances, such as:
- A fully charged laptop with access to your payroll data files and, if possible, your company network and your payroll system. Keep a fully charged spare battery as well. In the computerized world we live in, most of us would be lost without access to our computer files. Having a spare laptop will give you access to these files in the event your primary computer is out of commission. If the laptop has network access, you may also be able to use it to process payroll remotely.
- Hard copies of your payroll files. If everything is down and you have to calculate paychecks manually, you will need basic information for each employee in order to do so. Keep a paper file containing each employee’s basic payroll and deduction information. Add new employees as they are hired and update your file annually. Some of their deductions may have changed throughout the year, but most of those changes will be relatively minor and can be adjusted for after the emergency has subsided.
- A thumb drive containing copies of your payroll files. Following the same concepts of the first two bullet points, having this information on a thumb drive will allow you to process a relatively accurate payroll from anywhere.
There are some security risks involved, however, and you will need to establish a policy that protects against those risks. For example, the main idea of keeping the information on a thumb drive is that it is portable—if your office is destroyed or inaccessible, the hard copies you’ve filed away won’t do you any good. Neither will the thumb drive if you store it in your office. You need to establish a remote, yet safe, place to securely store this data.
Create an Effective Plan
Creating an effective continuity plan for the payroll department involves a comprehensive review and analysis of a variety of worst-case disaster scenarios. The plan should identify functions that are critical and essential and analyze which of those functions are most likely to be disrupted during various emergencies. It should then provide the approved procedures to mitigate these disruptions. It should consider both immediate needs and long-term needs, should the situation become prolonged. It should address, first and foremost, the operational difficulties, but also the financial and logistical concerns. It should outline step-by-step procedures that will guide you or your staff through processing payroll under the emergency conditions. An effective plan will minimize your reliance on technological resources. It should allow you to process payroll without the use of a computer and with minimal to no assistance from other employees. And finally, one of the most valuable assets it can provide is to establish a remote location to store backup files for essential information.
If you need help getting started, there are templates available online at www.ready.gov and a free analysis of your plan at www.readyrating.org. You can also reach out to your colleagues at the APA, who are always willing to help.
Mary Brown, FPC, is the Payroll Specialist at Leon County Sheriff’s Office. She is also the Tallahassee Chapter Treasurer and a new member of the Board of Contributing Writers for PAYTECH.
