Category: Helpful Articles

All too often companies move to digitally transform data without a strategic or proactive approach to cybersecurity and data privacy. As a result of the COVID-19 pandemic, there has been a dramatic, sudden, and unexpected increase in people working, learning, teaching, and consulting from home. This largely unplanned transition from office-based and school-based network access to remote/home access has created some unique capacity, operational, and cybersecurity challenges. Many organizations who conduct digital transformations have realized gains in digital productivity, via increased speed and access to data, more rapid data analysis, and related data storage cost savings, especially when cloud-based data storage is included. However, increasingly these same organizations have encountered costly cyber-attacks in the form of socially-engineered spear-phishing attacks, business email compromise (BEC) or spoofing attacks, and/or ransomware attacks, because they did not adequately or proactively begin their digital transformation with cybersecurity in mind.

Frequently, organizations of all sizes, and from every industry, consider cybersecurity to be an afterthought. However, these organizations are learning this leads to costly lessons on cyber fraud and/or data breaches. In 2019, the estimated global damages from cyber fraud and data breaches exceeded $4 trillion, according to the Gartner Group. Rather, cybersecurity should be at the forefront of strategic business planning for all digital projects. IBM Security reported the average cost of a cyber data breach now exceeds $8.2 million.

As both the level of sophistication and the number of cyberattacks increases every year, it has become painfully evident that the benefits of digital information including: speed, easy data access, rapid data analysis, data visualization, and related cost savings, can be completely lost or stolen as a result of damages. The damages can come from many forms such as: cyber-attacks, cyber fraud, cyber data breaches, cyber-related law suits for cybersecurity negligence, federal and/or state regulatory penalties for cybersecurity/data privacy compliance failures, and negative impacts to an organization’s reputation due to inadequate information security. In addition, the global cybersecurity and data privacy regulatory landscape is increasingly complex. This leaves the door open to potential massive class-action lawsuits for cyber data breaches disclosing consumers’ personal identifiable information, such as the new California Consumer Privacy Act (CCPA) enacted in January 2020. The CCPA clearly states an organization cannot ensure data privacy without “reasonable security.”
Begin with Cybersecurity in Mind

So, what exactly does it mean to begin a digital project or digital transformation of an organization with cybersecurity in mind? Simply said, it means to start all digital project planning by asking the right cybersecurity related questions up-front, including the following:

20 Key Cybersecurity Questions To Consider:

1. Will this project and/or the organization require access to any of the following types of data or information, including:
   • Second level Personal Identifiable Information (PII) of employees, partners, or consumers Protected Health Information (PHI)
   • Payment Card Information (PCI)
   • Intellectual Property (IP)
   • Controlled Unclassified Information (CUI)
   • Covered Defense Information (CDI)
   • Classified Information (CI)
   • Company Sensitive Information (CSI)
2. Who will need access to the project and organization data?
3. How will information access be controlled, internally and with vendors/subcontractors/clients?
4. Where will the project and organization information reside/be stored and how will it be secured?
5. Who will develop and manage the organization’s information governance plan, information system security plan, and data resilience or back-up plan?
6. Does the organization have the right people/resources to effectively lead cybersecurity and data privacy strategic planning and implementation?
7. What project and organization data segmentation or compartmentalization (i.e. zero trust data architecture) is needed to protect the information?
8. What identity, access, and data control procedures should be implemented, including: encryption, biometrics, multi-factor authentication, etc.?
9. Does the project or the organization’s data need to be compliant with one or more specific industry cybersecurity or data privacy regulatory or contractual requirements? If so, which specific requirements (i.e. National Institute of Standards & Technology [NIST] Special Procedure 800-171,ISO 27001, Payment Card Industry Data Security Standard [DSS], New York Department of Financial Services [NYDFS] Cybersecurity, Health Insurance Portability & Accountability Act [HIPAA]Cybersecurity, HITRUST – Common Security Framework [CSF], the new U.S. Department of Defense [DOD] Cybersecurity Maturity Model Certification [CMMC], European Union General Data Protection Regulation [GDPR], and/or the California Consumer Privacy Act [CCPA], etc.)?
10. What cybersecurity vulnerabilities currently exist within the organizations email system, network/information system, software applications, and endpoints?
11. Does the organization currently conduct 24/7/365 data monitoring, cyber intrusion detection, and cyber incident response for all information? If not, are these services provided by a highly qualified Managed Security Services Provider (MSSP)?
12. Has the organization developed, documented, implemented, and tested effective cybersecurity policies, plans, and procedures for project information, including:
    • Incident Response Plan (IRP)
    • Business Continuity Plan (BCP)
    • Disaster Recovery Plan (DRP)
13. Which cyber threat actors (nation-state cyber-attack groups, organized criminal cyber-attack groups, and/or hackavists) would be most interested in the information involved with this project, the organization, the leadership, and the supply-chain?
14. What cyber threat vectors would cyber-attackers most likely exploit within the organization in order to gain access to valuable information?
15. How susceptible are the organization’s employees from top to bottom to socially-engineered spear-phishing cyber-attacks and business email compromise (BEC) attacks?
16. Does the organization currently outsource the Information Technology (IT) services to a Managed Services Provider (MSP) or outsource the cybersecurity to a Managed Security Services Provider (MSSP)? Is the C-suite of the organization satisfied with the outsourced IT or cybersecurity services?
17. When did the organization most recently conduct a cyber-attack simulation or tabletop exercise with the C-suite and board of directors?
18. What percent of the organization’s annual IT budget is spent on cybersecurity?
19. Does the organization have adequate cyber liability insurance coverage?
20. How effective is the organization’s cybersecurity education and training program?

The twenty (20) key cybersecurity questions to consider are just a starting point for a deeper discussion about developing and implementing a strategic, proactive, and comprehensive cybersecurity program. An organization’s responses to the above stated questions will certainly help paint a picture of their current level of cyber defense, potential cyber threats, and known cyber vulnerabilities, which will help cybersecurity experts to build a customized road-map for enhanced cybersecurity and data privacy.
Summary

Too many organizations make critical mistakes when embarking on large-scale digital transformation for their organization. Many fail to develop a strategic, proactive, and threat-based cybersecurity program and under-investing in the following five (5) key elements of cybersecurity:

• Provide cybersecurity education/training for all members of the organization from the top to the bottom.
• Hire the right people to lead the organization’s cybersecurity and data privacy strategic planning and implementation from the start.
• Engage independent firms to conduct periodic cybersecurity diagnostic testing, including: computer vulnerability scanning, penetration testing, email system cyber-attack assessments, spear-phishing campaigns, and dark web analysis, to understand the organization’s cyber vulnerabilities and threats.
• Ensure continuous 24/7/365 information monitoring, intrusion detection, and rapid cyber incident response services either internally or via outsourced Managed Security Services Providers (MSSP).
• Implement and test appropriate information resilience plans and procedures via cyber incident response plans, cyber business continuity plans, and disaster recovery plans.

The key to success is to begin all digital transformation projects with cybersecurity in mind. By engaging with cybersecurity experts from the start of a project, or new business venture, an organization can ask the right questions then develop a proactive and threat-based cybersecurity program. Remember, in the digital age an organization can only achieve information integrity and data privacy through effective cybersecurity.

By now, some businesses have completed their 2021 budgets while others are still crunching numbers and scrutinizing line items. As you put the finishing touches on your company’s spending plan for next year, be sure to cover the finer points of the process. This means not just creating a budget for the sake of doing so but ensuring that it’s a useful and well-understood plan for everyone. 

Obtain buy-in 

Management teams are often frustrated by the budgeting process. There are so many details and so much uncertainty. All too often, the stated objective is to create a budget with or without everyone’s vision for how to get there. To put a budget in the best position for success, every member of the leadership team needs to agree on common forecasting goals. Ideally, before sitting down to review a budget in process, you and your managers should establish some basic ground rules and reasonable expectations. If you are already down the road in creating a budget, it may not be too late. Call a meeting and get everyone on the same page before you issue the final product. 

Account for variances 

Many budgets fail because they rely on purely accounting-driven, historically minded budgeting techniques. To increase the likelihood of success, you need to actively anticipate “variances.” These are major risks that could leave your business vulnerable to high-impact financial hits if the threats materialize.

 One type of risk to consider is the competition. The COVID-19 pandemic and its economic impact have reengineered the competitive landscape in some markets. Unfortunately, many smaller businesses have closed, while larger, more financially stable companies have asserted their dominance. Be sure the budget accounts for your place in this hierarchy. 

Another risk is compliance. Although regulatory oversight has diminished in many industries under the current presidential administration, this may change next year. Be it health care benefits, hiring and independent contractor policies, or waste disposal, factor compliance risk into your budget. 

A third type of variance to consider is internal. If your business laid off employees this year, will you likely need to rehire some of them in 2021 as, one hopes, the economy rebounds from the pandemic? Also, investigate whether fraud affected this year’s budget and how next year’s edition may need more investment in internal controls to prevent losses. 

Eyes on the prize 

Above all, stay focused on the objective of creating a feasible, flexible budget. Many companies get caught up in trying to tie business improvement and strategic planning initiatives into the budgeting process. Doing so can lead to confusion and unexpectedly high demands of time and energy. You’re looking to set a budget — not fix every minute aspect of the company. 

Our firm can help review your budget-setting process and recommend improvements that will enable you to avoid common mistakes and get optimal use out of a well-constructed budget for next year. Contact ATA for more information.  © 2020

ATA Partner, David Hart, CPA, CGMA, CVA, CFF  gives a timely overview for business owners on 2020 tax planning.  Watch the video to learn more key information on business depreciation and for an update on Section 199A Deductions.

Depreciation

For business owners who own equipment and heavy-duty vehicles, please keep in mind that up to $1,040,000 of qualified fixed asset additions can be expensed in 2020 under Section 179. This includes equipment, furniture, roofs, HVAC equipment, and security systems. Also, the first $18,000 of vehicles with a towing capacity of 6,000 pounds or less and the first $25,000 of vehicles with a towing capacity exceeding 6,000 pounds are eligible to be expensed under Section 179.

Bonus depreciation of up to 100% will also be allowed on equipment, furniture, and software placed in service during 2020. In addition, up to $18,000 of bonus depreciation is allowed on new passenger vehicles purchased in 2020.

Section 199A Deduction

Owners of partnerships, LLCs, S-Corporations, and sole proprietorships could be eligible for a deduction of up to 20% of qualified business income.  It reduces taxable income whether or not you itemize deductions.  Anyone with taxable income of $326,600 or less ($163,300 if single) is entitled to the full 20% deduction, and those with taxable income of up to $426,600 ($213,300 if single) are entitled to the deduction, subject to limitations.

Careful tax planning can help you maximize your depreciation deductions in 2020.  Contact your ATA tax professional to assist you in maximizing these tax benefits.

What’s happening with deductions in 2020?

The standard deduction has once again been increased for inflation. The 2020 amounts for separate filers is $12,400 and for joint filers is $24,800. Itemized deductions are more beneficial if taxpayers ‘bunch’ deductions into one year.  The itemized deductions that may be able to be shifted from year-to-year are real estate taxes, state income tax estimates, and charitable contributions. An example of this would be paying your 2020 and 2021 real estate taxes in the same year. This bunching strategy needs to be discussed with your tax advisor to be most beneficial. Also need to remember there is a $10,000 cap on the amount of property and income taxes you deduct. 

If you don’t itemize deductions, normally you can’t deduct charitable donations. But, the CARES Act allows taxpayers who claim the standard deduction to deduct up to $300 of cash donations to qualified charities in 2020. 

Here’s a Tip: If you know you’re not going to have more than the standard deduction, then don’t worry about gathering the itemized deduction documentation and turning them into your CPA. 

As a reminder, Itemized deductions consist of the following: medical expenses, sales and real estate taxes, mortgage interest, charitable contributions. Talk to your CPA if you have any questions on what may qualify. 

-Single Standard Deduction $12,400

-Married Filing Jointly Deduction $24,800

Tax expert, Abby Norville, CPA, gives a timely overview on year-end tax planning for deductions. Watch the video to learn more on key information for itemized deductions.

Cash flow is a top concern for most businesses today. Cash flow forecasts can help you predict potential shortfalls and proactively address working capital gaps. They can also help avoid late payments, identify late-paying customers and find alternative sources of funding when cash is tight. To keep your company’s cash flow positive, consider applying these four best practices. 

1. Identify peak needs. Many businesses are cyclical, and their cash flow needs may vary by month or season. Trouble can arise when an annual budget doesn’t reflect, for example, three months of peak production in the summer to fill holiday orders followed by a return to normal production in the fall. For seasonal operations — such as homebuilders, farms, landscaping companies, recreational facilities and many nonprofits — using a one-size-fits-all approach can throw budgets off, sometimes dramatically. It’s critical to identify peak sales and production times, forecast your cash flow needs and plan accordingly. 
2. Account for everything. Effective cash flow management requires anticipating and capturing every expense and incoming payment, as well as — to the greatest extent possible — the exact timing of each payable and receivable. But pinpointing exact costs and expenditures for every day of the week can be challenging. Companies can face an array of additional costs, overruns and payment delays. Although inventorying all possible expenses can be a tedious and time-consuming exercise, it can help avoid problems down the road. 
3. Seek sources of contingency funding. As your business expands or contracts, a dedicated line of credit with a bank can help meet your cash flow needs, including any periodic cash shortages. Interest rates on these credit lines can be comparatively high compared to other types of loans. So, lines of credit typically are used to cover only short-term operational costs, such as payroll and supplies. They also may require significant collateral and personal guarantees from the company’s owners. 
4. Identify potential obstacles. For most companies, the biggest cash flow obstacle is slow collections from customers. Your business should invoice customers in a timely manner and offer easy, convenient ways for customers to pay (such as online bill pay). For new customers, it’s important to perform a thorough credit check to avoid delayed payments and write-offs. Another common obstacle is poor resource management. Redundant machinery, misguided investments and oversize offices are just a few examples of poorly managed expenses and overhead that can negatively affect cash flow. 

Adjusting as you grow and adapt your company’s cash flow needs today likely aren’t what they were three years ago — or even six months ago. And they’ll probably change as you continue to adjust to the new normal. That’s why it’s important to make cash flow forecasting an integral part of your overall business planning. We can help. Contact us at www.atacpa.net.

If you invest in mutual funds, be aware of some potential pitfalls involved in buying and selling shares.

Surprise sales

You may already have made taxable “sales” of part of your mutual fund investment without knowing it. One way this can happen is if your mutual fund allows you to write checks against your fund investment. Every time you write a check against your mutual fund account, you’ve made a partial sale of your interest in the fund. Thus, except for funds such as money market funds, for which share value remains constant, you may have taxable gain (or a deductible loss) when you write a check. And each such sale is a separate transaction that must be reported on your tax return. Here’s another way you may unexpectedly make a taxable sale. If your mutual fund sponsor allows you to make changes in the way your money is invested — for instance, lets you switch from one fund to another fund — making that switch is treated as a taxable sale of your shares in the first fund.

Recordkeeping carefully

Save all the statements that the fund sends you — not only official tax statements, such as Forms 1099-DIV, but the confirmations the fund sends you when you buy or sell shares or when dividends are reinvested in new shares. Unless you keep these records, it may be difficult to prove how much you paid for the shares, and thus, you won’t be able to establish the amount of gain that’s subject to tax (or the amount of loss you can deduct) when you sell. You also need to keep these records to prove how long you’ve held your shares if you want to take advantage of favorable long-term capital gain tax rates. (If you get a year-end statement that lists all your transactions for the year, you can just keep that and discard quarterly or other interim statements. But save anything that specifically says it contains tax information.) Recordkeeping is simplified by rules that require funds to report the customer’s basis in shares sold and whether any gain or loss is short-term or long-term. This is mandatory for mutual fund shares acquired after 2011, and some funds will provide this to shareholders for shares they acquired earlier, if the fund has the information.

Timing purchases and sales

If you’re planning to invest in a mutual fund, there are some important tax consequences to take into account in timing the investment. For instance, an investment shortly before payment of a dividend is something you should generally try to avoid. Your receipt of the dividend (even if reinvested in additional shares) will be treated as income and increase your tax liability. If you’re planning a sale of any of your mutual fund shares near year-end, you should weigh the tax and the non-tax consequences in the current year versus a sale in the next year. Identify shares you sell If you sell fewer than all of the shares that you hold in the same mutual fund, there are complicated rules for identifying which shares you’ve sold. The proper application of these rules can reduce the amount of your taxable gain or qualify the gain for favorable long-term capital gain treatment.

Contact us if you’d like to find out more about tax planning for buying and selling mutual fund shares. Visit our locations page to find your ATA office.  © 2020