Accounting provider disaster recovery: protect the next payroll and close

Review an accounting provider's recovery plan through the work your business cannot leave unattended. List the next payroll approval, supplier payment run, filing deadline, customer billing cycle, and monthly close. Identify the records and people each task depends on. An assurance that the platform has backups does not explain how your team will complete Friday's payroll if the portal is unavailable on Thursday.

NIST's contingency-planning guidance addresses business impact, recovery priorities, strategies, testing, and plan maintenance. It was written for federal information systems, so use its planning concepts as a reference rather than treating every provision as a requirement for your accountant. The buying question is concrete: which finance activities can continue, which pause, and what evidence will establish that recovery is complete?

Ask the provider to explain the recovery time it targets and how much recent data may need to be reconstructed after restoration. Have it translate those measures into an example involving your work. A system can return quickly while missing recent uploads or approvals. Conversely, intact records are not enough if nobody can access them in time to authorize a payment.

Identify dependencies outside the provider's control, such as the ledger platform, payroll service, bank, document store, or identity service. Ask who contacts each party and what alternatives exist. The provider should describe the agreed support for your engagement, including any limits; avoid reading a cloud platform's availability commitment as a promise that the accounting team can recover every connected workflow on the same timetable.

Request a summary of the most recent relevant recovery test, its scope, findings, and corrective actions. You do not need confidential network diagrams to understand whether the provider restored the kinds of records your service relies on. Ask whether the test checked completeness and permissions, or only that an application opened successfully.

For an accounting example, restored documents should still connect to the right entity, period, reconciliation, and approval. Test whether staff can retrieve an approved journal's evidence and distinguish it from an unfinished draft. If the test exposed missing attachments or outdated access, ask what changed and how the correction was verified. Keep the answer tied to the proposed service instead of accepting an unrelated corporate exercise as sufficient evidence.

Agree which records your company keeps independently, who can retrieve them, and how they are protected. A recent approved trial balance, bank statements, payroll register, filing calendar, and open-item list may be useful, depending on the service. Limit copies to what the continuity plan needs. The FTC recommends safeguarding retained information and planning for security incidents; emergency access should preserve those protections.

Define how temporary work returns to the main record. If a payment is approved or a journal is prepared outside the usual portal, retain the evidence and identify who checks it before posting. Record stable references so the same transaction is not entered again when the integration recovers. A fallback that restores speed but loses approvals can create another problem after the outage ends.

Ask how the provider notifies your team, where updates appear, and how to reach a responsible person if its usual support system is unavailable. Agree the company contacts who can approve emergency decisions. Keep urgent payment and filing matters separate from routine reporting questions so the service team can identify the time-sensitive work.

Clarify what the provider will do about an affected deadline and what remains with the company or a specialist. Do not assume an outage changes a tax, payroll, or contractual obligation. The appropriate professional should assess any available relief or revised action. Preserve the incident timeline and actual submissions so a later reviewer can see what happened and which decisions were made with the information available.

Reconcile work completed before, during, and after the interruption. Compare bank movements, payroll results, posted bills, customer invoices, and submitted filings with the activity log. Check for missing items and duplicate retries. Identify the last approved reporting version and decide whether management needs a corrected pack. Restoring access is one milestone; confirming the records is the accounting completion step.

Review the incident with the provider while details are fresh. Record the cause that has been established, unresolved questions, and changes to access, coverage, exports, or procedures. Schedule a targeted retest where a material weakness was found. Renewing a service with a documented limitation can be a deliberate decision, but the person accepting it should understand the affected task and the plan for the next interruption.