Quick answer: A business continuity plan gives a tax or accounting firm a written order of recovery when people, premises, technology or a key vendor becomes unavailable. It should name the services that cannot wait, the people authorized to make decisions, the systems and third parties each service depends on, the temporary workaround, and the evidence that recovery has actually been tested.
This checklist is designed for U.S. tax preparers, bookkeepers and accounting firms. It is intentionally more practical than a generic continuity template: it accounts for filing deadlines, payroll cycles, EFIN and tax-software dependencies, secure client communications, seasonal staffing, cyber incidents and the possibility that a solo owner becomes unavailable.
Use it as a planning tool, not as a promise of uninterrupted service. Recovery targets must be selected by the firm after considering its workload, contracts, legal duties and resources. Keep credentials and sensitive client data out of the plan; store them only in an approved secure system.
What a business continuity plan does—and does not do
The National Institute of Standards and Technology describes continuity planning as the coordinated plans and procedures used to sustain business processes and supporting systems during and after a disruption. It is broader than restoring a server and different from responding to a data breach.
| Document | Main question | Example for a tax or accounting firm |
|---|---|---|
| Business continuity plan | How will essential services continue or recover? | Prioritize payroll, e-file activity, secure client communications and deadline tracking. |
| Written Information Security Plan (WISP) | How will customer information be protected? | Define safeguards, access controls, service-provider oversight and security responsibilities. |
| Incident response plan | What happens after a suspected security incident? | Contain the event, preserve evidence, notify the right parties and coordinate recovery. |
| Disaster recovery plan | How will technology and data be restored? | Restore tax software, files, identity systems, devices and network access from known-good sources. |
| Emergency or safety plan | How will people be protected during an immediate hazard? | Evacuate, account for personnel and contact emergency services. |
These documents should work together. Your tax-preparer WISP template can cover information security, while this checklist organizes operational recovery. The data-breach response guide addresses the actions that begin when an incident is suspected.
Business continuity plan checklist
1. Define the plan’s scope and activation triggers
- List the offices, remote workers, systems and services covered by the plan.
- Identify who can activate the plan and who serves as the alternate.
- Set clear triggers: building loss, power or internet outage, ransomware, unavailable tax software, failed client portal, key-person absence, severe weather or a critical vendor outage.
- State where the current approved copy is stored and how authorized people can access it when normal systems are down.
- Record the plan owner, approval date, next review date and version number.
2. Identify the services that cannot wait
Start with client and regulatory consequences, not with technology. A business impact analysis asks what happens when a process stops and how that impact changes over time. For a tax or accounting firm, review at least:
- Return preparation, review, authorization and e-filing
- Extension and estimated-tax deadline tracking
- Payroll processing and tax deposits
- Bookkeeping close and management reporting
- Secure client document exchange and identity verification
- Tax notices, representation matters and time-sensitive correspondence
- Billing, collections, banking and staff payroll
- Client support, phone and email communications
For each process, document the deadline or service commitment, the effect of an outage at four hours, one day and several days, and the minimum people, data, systems and vendors needed to operate.
3. Set recovery objectives in plain English
- Maximum tolerable outage: the longest the firm believes a process can be unavailable before the impact becomes unacceptable.
- Recovery time objective (RTO): the firm’s target time to restore a service after disruption.
- Recovery point objective (RPO): the amount of recent data the firm can tolerate recreating after recovery.
These are planning choices, not universal legal deadlines. A payroll service due that afternoon may need a much shorter target than an internal monthly report. Set targets process by process, confirm that the technology and staffing can actually meet them, and revise any target that has never been tested.
4. Name decision-makers and trained alternates
- Assign a continuity lead, technology recovery lead, client-communications lead and insurance/legal contact.
- Name a trained alternate for every essential role and document decision authority.
- Maintain an offline emergency contact list for employees, vendors, insurers and professional advisers.
- For a solo practice, create a professionally advised succession and incapacity arrangement. Do not give informal access to client data, bank accounts or e-file credentials.
- Document how seasonal staff and contractors will receive instructions.
5. Map every critical dependency
A process is only as recoverable as its least visible dependency. Trace each critical service through:
- Tax, accounting, payroll and practice-management software
- Cloud storage, identity provider, multifactor authentication and password manager
- Client portal, e-signature, email, phone and payment services
- Internet, power, devices, printers and scanners
- EFIN-related access and other role-specific authorizations
- Banking, payroll, document storage and shredding providers
- Key employees, outsourced preparers and IT support
For each dependency, record the support channel, account owner, outage-status page, data-export method, contractual recovery commitment and practical alternative. Do not assume a vendor backup is the same as your firm’s tested ability to restore operations.
6. Protect backups—and prove that restoration works
- Back up the information needed to perform critical services, including configuration and documentation—not only client files.
- Maintain protected copies that are not all exposed to the same account, device or location.
- Restrict backup access and protect recovery credentials and encryption keys.
- Define who can authorize a restore and how the firm will verify that a recovery source is trustworthy.
- Run scheduled restoration tests and record the date, data set, result, elapsed time, problems and corrective owner.
- Verify that the restored data can be opened and used in the applications required for real work.
A successful “backup completed” notification is not a recovery test. The useful evidence is a documented restoration that meets the firm’s selected recovery objectives.
7. Prepare an alternate way to work and communicate
- Identify an alternate workspace and confirm its power, connectivity, privacy and physical-security requirements.
- Keep approved, secured equipment available or document how replacement equipment will be obtained and configured.
- Prepare a secondary communication channel that does not depend on the same email or identity system as the primary channel.
- Draft short templates for employees, clients and vendors. State what is known, what service is affected, the safe communication method and when the next update will be issued.
- Define how the firm will verify client identity before changing bank details, portal access or delivery methods during a disruption.
8. Coordinate continuity, cyber response and insurance
- Put the cyber insurer’s notice instructions, policy number and breach-hotline details in the offline contact pack.
- Before hiring forensic, legal, public-relations or restoration vendors after a suspected cyber event, check whether the policy requires consent or panel providers.
- Preserve logs, notices, invoices, staff time, extra expenses and the timeline of decisions.
- Define how incident response hands work back to continuity and disaster-recovery teams.
- Never restore compromised systems merely to meet a time target; validate the recovery environment with qualified support.
9. Test the plan, train the team and fix what fails
Use more than one type of exercise:
- Tabletop exercise: talk through a realistic event, decisions and communications.
- Contact test: verify that employees, vendors and advisers can be reached through the alternate channel.
- Restore test: recover selected data and confirm it is usable.
- Workaround test: perform a critical process without its normal office, device or vendor.
- After-action review: assign each weakness an owner and due date, then update the plan.
Review the plan at least annually as a sound practice, and sooner after material staffing, system, vendor, location or service changes. Also review it after an incident or exercise. Annual review is a planning recommendation here, not a claim that every firm has the same legal requirement.
Filing-season recovery-priority worksheet
Complete this table before peak season. Do not copy another firm’s recovery times: select targets that reflect your own deadlines, client commitments, staffing and technology.
| Critical process | Owner / alternate | Key dependencies | Maximum tolerable outage | Target RTO / RPO | Temporary workaround | Last test and evidence |
|---|---|---|---|---|---|---|
| Return preparation and e-file | ___ / ___ | Tax software, identity, portal, internet, EFIN access | ___ | ___ / ___ | Deadline register; approved alternate workspace and communications | ___ |
| Payroll processing | ___ / ___ | Payroll platform, bank, client authorization, secure files | ___ | ___ / ___ | Vendor escalation and pre-approved manual procedure | ___ |
| Secure client communications | ___ / ___ | Email, portal, phone, identity verification | ___ | ___ / ___ | Verified alternate channel and prepared notice | ___ |
| Bookkeeping and close | ___ / ___ | Ledger, bank feeds, source documents, staff | ___ | ___ / ___ | Priority-client queue and secure export | ___ |
| Billing and firm payroll | ___ / ___ | Practice management, bank, payroll provider | ___ | ___ / ___ | Authorized alternate and offline contact route | ___ |
Seven-day implementation sprint
| Day | Action | Deliverable |
|---|---|---|
| 1 | Set scope, activation triggers and plan ownership. | Approved purpose, team and version-control section. |
| 2 | List critical services and complete the business impact analysis. | Ranked process inventory with outage consequences. |
| 3 | Map people, systems, data and vendor dependencies. | Dependency map and offline contact pack. |
| 4 | Choose recovery targets and temporary workarounds. | Completed recovery-priority worksheet. |
| 5 | Document communications, cyber escalation and insurance notice steps. | Call tree, message templates and escalation card. |
| 6 | Run one restore test and one tabletop scenario. | Test evidence and problem list. |
| 7 | Correct urgent gaps, approve the plan and schedule the next test. | Current plan, assigned actions and calendar dates. |
Insurance questions to resolve before an outage
Continuity planning reduces confusion; it does not determine whether a loss is insured. Ask a licensed insurance professional to explain the actual policy language, endorsements, exclusions, waiting periods, sublimits and notice requirements. Questions worth documenting include:
- Does business-income coverage require direct physical loss or damage from a covered cause?
- Is cyber business interruption included, and what event must trigger it?
- Is an outage at a cloud, tax-software or other dependent provider addressed?
- What waiting period applies before business-interruption coverage begins?
- Are extra expenses for temporary equipment, workspace, data restoration or specialist help covered?
- Which vendors require advance insurer approval?
- How are lost income and continuing expenses documented?
- Are equipment breakdown, utility interruption, crime or social-engineering losses separate coverages?
For coverage context, see our tax-preparer insurance guide and cyber insurance guide for accountants. Use the tax and accounting insurance quote worksheet to organize questions for an agent or broker.
Common continuity-plan mistakes
- Starting with every application instead of critical client outcomes. Prioritize the services that carry the greatest deadline, financial, contractual or trust consequences.
- Treating backups as the whole plan. Recovery also depends on people, authorizations, devices, communications, vendors and a safe place to work.
- Using recovery targets that have never been tested. A written four-hour target has little value if restoration takes two days.
- Keeping the only copy inside the unavailable system. Authorized leaders need a protected, accessible copy and offline contacts.
- Including passwords in a broadly shared plan. Reference the approved credential system instead.
- Ignoring the owner’s absence. Solo and small firms need a secure, legally sound continuity and succession arrangement.
- Sending vague client messages. Prepare short, factual templates and a schedule for updates.
- Failing to close test findings. Every gap needs an owner, priority and due date.
Frequently asked questions
Is every tax or accounting firm legally required to have a business continuity plan?
There is no single federal rule that universally requires every U.S. small tax or accounting firm to maintain a standalone document with that title. Other duties can still matter: tax professionals handling taxpayer information have security obligations, contracts and insurer applications may include continuity requirements, and state or profession-specific rules may apply. Confirm the requirements relevant to your firm rather than treating this checklist as legal advice.
Is a WISP the same as a business continuity plan?
No. A WISP focuses on protecting customer information. A business continuity plan focuses on sustaining and recovering essential operations. They overlap around security incidents, vendors, backups, access and communications, so the two plans should reference each other.
How often should the plan be tested?
A practical baseline is at least one documented exercise each year, with additional testing before peak filing season and after material changes or a real incident. High-risk recovery steps, including backup restoration and emergency communications, may deserve more frequent testing. Choose a schedule proportionate to the firm and record the evidence.
What do RTO and RPO mean?
RTO is the target time to restore a service. RPO is the amount of recent data the firm is prepared to recreate after recovery. For example, a shorter RPO generally requires more frequent or continuous protected copies. Both should follow the business impact analysis.
Is cloud software enough for continuity?
No. Cloud services can improve resilience, but the firm may still lose access through an internet failure, identity-system outage, compromised administrator account, provider incident or contractual problem. Document exports, alternate communications, identity recovery and provider escalation.
What should a solo tax preparer do differently?
Prioritize incapacity and succession planning, deadline visibility, secure access by an authorized alternate, client communications and vendor continuity. Work with qualified legal, insurance and technology professionals so an emergency arrangement protects client confidentiality and does not improperly share credentials or authority.
Bottom line
A useful continuity plan is not measured by page count. It is measured by whether the right people can identify the next decision, reach the right contacts, operate a safe workaround and restore a tested service before the impact becomes unacceptable. Complete the worksheet, test one critical recovery path this week and turn every failed assumption into an assigned improvement.
Primary sources and further reading
- NIST SP 800-34 Rev. 1, Contingency Planning Guide
- NIST SP 800-184, Guide for Cybersecurity Event Recovery
- IRS, Preparing for a Disaster
- IRS Publication 5708, Creating a Written Information Security Plan for Your Tax & Accounting Practice
- FTC, Safeguards Rule guidance
Editorial note: Reviewed November 6, 2026. This educational guide does not provide legal, tax, cybersecurity or insurance advice and does not amend any policy or contract. Requirements and coverage depend on the firm’s facts, jurisdiction and governing documents.
