Investors, lenders and other stakeholders have been vocal in recent years about pushing companies to provide more information in their financial reports about cybersecurity. Could your company do a better job disclosing cyberrisks and recent hacks?
Most public companies could do better, according to recent testimony during congressional hearings by Jay Clayton, Chairman of the Securities and Exchange Commission (SEC). Here are ways his agency is attempting to “refresh” the disclosure guidance.
Updating the guidance
The SEC doesn’t expect to overhaul its Disclosure Guidance: Topic No. 2, Cybersecurity. Rather, it plans to consider whether important information about cybersecurity should be disclosed to stakeholders within the context of the existing rules. For example, companies may need to beef up their management’s discussion and analysis (MD&A) and footnote disclosures to reflect potential cyberrisks and material financial implications of data breaches.
The current guidance on cybersecurity, which was published in 2011, doesn’t include a specific requirement for companies to disclose computer system intrusions. The SEC’s effort to update the guidance comes amid concerns that more public companies have been experiencing attacks to their computer systems, but their disclosures haven’t been timely or informative enough.
Changes in the works
Regulators in the SEC don’t know whether the update will be issued in the form of staff-level guidance or a regulatory release approved by the SEC’s commissioners. But they’ve decided to address two key areas in the update:
- Financial reporting controls and procedures that identify and disclose cybersecurity threats in a timely manner, and
- Corporate strategies and policies regarding cybersecurity prevention, detection and breach response.
On the one hand, companies feel a responsibility to share relevant information openly and honestly with stakeholders. On the other, they don’t want to prematurely disclose information about a breach before they know the extent of the damage or to release inaccurate information that later needs to be revised. Company insiders may also be working with law enforcement, in which case they don’t want to disclose information that could compromise the investigation.
Regardless of whether your business is public or private, it’s important to assemble a team of professional advisors — including legal, insurance and financial experts — to identify risk factors and to handle breach response, measure the impact and mitigate potential losses. We can help you provide transparent and timely information to your stakeholders.
Private companies that follow U.S. Generally Accepted Accounting Principles (GAAP) must comply with the landmark new revenue recognition standard in 2019. Many private company CFOs and controllers report that they still have significant work to do to meet the demands of the sweeping rules. If you haven’t started the implementation process, it’s time to get the ball rolling.
Lessons from public company peers
Affected private companies must start following Accounting Standards Update (ASU) No. 2014-09, Revenue from Contracts with Customers (Accounting Standards Codification Topic 606), the first time they issue financial statements in 2019. For private companies with a fiscal year end or issuing quarterly statements under U.S. GAAP, that could be within the next few months. Other private companies have until the end of the year or even early 2020. No matter what, it’s crunch time.
Public companies, which had to begin following the standard in 2018, reported that, even if the new accounting didn’t radically change the number they reported in the top line of their income statements, it changed the method by which they had to calculate it. They had to comb through contracts and offer paper trails to back up their estimates to auditors. Public companies largely reported that the standard was more work than they anticipated. Private companies can expect the same challenges.
The revenue recognition standard erases reams of industry-specific revenue guidance in U.S. GAAP and attempts to come up with the following five-step revenue recognition model for most businesses worldwide:
1. Identify the contracts with a customer.2. Identify the performance obligations in the contract.3. Determine the transaction price.4. Allocate the transaction price to the performance obligations.5. Recognize revenue as the entity satisfies a performance obligation.
In many cases, the revenue a company reports under the new guidance won’t differ much from what it reported under old rules. But the timing of when a company can record revenues may be affected, particularly for long-term, multi-part arrangements. Companies also must assess:
- The extent by which payments could vary due to such terms as bonuses, discounts, rebates and refunds,
- The extent that collected payments from customers is “probable” and won’t result in a significant reversal in the future, and
- The time value of money to determine the transaction price.
We can help
Our accounting experts can help you avoid a “fire drill” right before your implementation deadline and employ best practices learned from public companies that made the switch in 2018. Contact us for help getting your revenue reporting systems, processes and policies up to speed.
A technician at a mobility equipment supplier was servicing the motorized wheelchair of a long-time customer and noticed it was a brand-new model. “Where did you buy the chair?” he asked the customer. “At the health care supply store on the other side of town,” the customer replied. The technician paused and then asked, “Well, why didn’t you buy the chair from us?” The customer replied, “I didn’t know you sold wheelchairs.”
Most business owners would likely agree that selling to existing customers is much easier than finding new ones. Yet many companies continue to squander potential sales to long-term, satisfied customers simply because they don’t create awareness of all their products and services.
It seems puzzling that the long-time customer in our example wouldn’t know that his wheelchair service provider also sold wheelchairs. But when you look a little deeper, it’s easy to understand why.
The repair customer always visited the repair shop, which had a separate entrance. While the customer’s chair was being repaired, he sat in the waiting area, which provided a variety of magazines but no product brochures or other promotional materials. The customer had no idea that a new sales facility was on the other side of the building until the technician asked about the new wheelchair.
Are you losing business from long-term customers because of a similar disconnect? To find out, ask yourself two fundamental questions:
1. Are your customers buying everything they need from you? To find the answer, you must thoroughly understand your customers’ needs. Identify your top tier of customers — say, the 20% who provide 80% of your revenue. What do they buy from you? What else might they need? Don’t just take orders from them; learn everything you can about their missions, strategic plans and operations.
2. Are your customers aware of everything you offer? The quickest way to learn this is, simply, to ask. Instruct your salespeople to regularly inquire about whether customers would be interested in products or services they’ve never bought. Also, add flyers, brochures or catalogs to orders when you fulfill them. Consider building greater awareness by hosting free lunches or festive corporate events to educate your customers on the existence and value of your products and services.
If you have long-term customers, you must be doing something right — and that’s to your company’s credit. But, remember, it’s not out of the question that you could lose any one of those customers if they’re unaware of your full spectrum of products and services. That’s an open opportunity for a competitor.
By taking steps to raise awareness of your products and services, you’ll put yourself in a better position to increase sales and profitability. Our firm can help you identify your strongest revenue sources and provide further ideas for enhancing them.
Ask many entrepreneurs and small business owners to show you their financial statements and they’ll likely open a laptop and show you their bookkeeping software. Although tracking financial transactions is critical, spreadsheets aren’t financial statements.
In short, financial statements are detailed and carefully organized reports about the financial activities and overall position of a business. As any company evolves, it will likely encounter an increasing need to properly generate these reports to build credibility with outside parties, such as investors and lenders, and to make well-informed strategic decisions.
These are the typical components of financial statements:
Income statement. Also known as a profit and loss statement, the income statement shows revenues and expenses for a specified period. To help show which parts of the business are profitable (or not), it should carefully match revenues and expenses.
Balance sheet. This provides a snapshot of a company’s assets and liabilities. Assets are items of value, such as cash, accounts receivable, equipment and intellectual property. Liabilities are debts, such as accounts payable, payroll and lines of credit. The balance sheet also states the company’s net worth, which is calculated by subtracting total liabilities from total assets.
Cash flow statement. This shows how much cash a company generates for a particular period, which is a good indicator of how easily it can pay its bills. The statement details the net increase or decrease in cash as a result of operations, investment activities (such as property or equipment sales or purchases) and financing activities (such as taking out or repaying a loan).
Retained earnings/equity statement. Not always included, this statement shows how much a company’s net worth grew during a specified period. If the business is a corporation, the statement details what percentage of profits for that period the company distributed as dividends to its shareholders and what percentage it retained internally.
Notes to financial statements. Many if not most financial statements contain a supplementary report to provide additional details about the other sections. Some of these notes may take the form of disclosures that are required under Generally Accepted Accounting Principles — the most widely used set of accounting rules and standards. Others might include supporting calculations or written clarifications.
Financial statements tell the ongoing narrative of your company’s finances and profitability. Without them, you really can’t tell anyone — including yourself — precisely how well you’re doing. We can help you generate these reports to the highest standards and then use them to your best advantage.
For many companies, revenue is one of the largest financial statement accounts. It’s also highly susceptible to financial misstatement.
When it comes to revenue, auditors customarily watch for fictitious transactions and premature recognition ploys. Here’s a look at some examples of critical issues that auditors may target to prevent and detect improper revenue recognition tactics.
Auditors aim to understand the company, its environment and its internal controls. This includes becoming familiar with key products and services and the contractual terms of the company’s sales transactions. With this knowledge, the auditor can identify key terms of standardized contracts and evaluate the effects of nonstandard terms. Such information helps the auditor determine the procedures necessary to test whether revenue was properly reported.
For example, in construction-type or production-type contracts, audit procedures may be designed to 1) test management’s estimated costs to complete projects, 2) test the progress of contracts, and 3) evaluate the reasonableness of the company’s application of the percentage-of-completion method of accounting.
Gross vs. net revenue
Auditors evaluate whether the company is the principal or agent in a given transaction. This information is needed to evaluate whether the company’s presentation of revenue on a gross basis (as a principal) vs. a net basis (as an agent) complies with applicable standards.
Revenue must be reported in the correct accounting period (generally the period in which it’s earned). Cutoff testing procedures should be designed to detect potential misstatements related to timing issues, as well as to obtain sufficient relevant and reliable evidence regarding whether revenue is recorded in the appropriate period.
If the risk of improper accounting cutoffs is related to overstatement or understatement of revenue, the procedures should encompass testing of revenue recorded in the period covered by the financial statements — and in the subsequent period.
A typical cutoff procedure might involve testing sales transactions by comparing sales data for a sufficient period before and after year end to sales invoices, shipping documentation or other evidence. Such comparisons help determine whether revenue recognition criteria were met and sales were recorded in the proper period.
Starting in 2018 for public companies and 2019 for other entities, revenue must be reported using the new principles-based guidance found in Accounting Standards Update (ASU) No. 2014-09, Revenue from Contracts with Customers. The updated guidance doesn’t affect the amount of revenue companies report over the life of a contract. Rather, it affects the timing of revenue recognition.
In light of the new revenue recognition standard, companies should expect revenue to receive renewed attention in the coming audit season. Contact us to help implement the new revenue recognition rules or to discuss how the changes will affect audit fieldwork.
Audit opinions differ depending on the information available, financial viability, errors discovered during audit procedures and other limiting factors. The type of opinion your auditor issues tells stakeholders whether you’re in compliance with accounting rules and likely to continue operating as a going concern.
To find out what type of audit opinion you’ve received, scan the first page of your financial statements. Known as the “audit opinion letter,” this is where your auditor states whether the financial statements are fairly presented in all material respects, compliant with Generally Accepted Accounting Principles (GAAP) and free from material misstatement. But the opinion doesn’t constitute an endorsement or evaluation of the company’s financial results.
Most audit opinion letters consist of three paragraphs. The introductory paragraph identifies the company, accounting period and auditor’s responsibilities. The second discusses the scope of work performed. The third paragraph contains the audit opinion.
In general, there are four types of audit opinions, ranked from most to least desirable.
1. Unqualified. A clean “unqualified” opinion is the most common (and desirable). Here the auditor states that the company’s financial condition, position and operations are fairly presented in the financial statements.
2. Qualified. The auditor expresses a qualified opinion if the financial statements appear to contain a small deviation from GAAP, but are otherwise fairly presented. To illustrate: An auditor will “qualify” his or her opinion if a borrower incorrectly estimates warranty expense, but the exception doesn’t affect the rest of the financial statements.
Qualified opinions are also given if the company’s management limits the scope of audit procedures. For example, a qualified opinion may result if you deny the auditor access to a warehouse to observe year-end inventory counts.
3. Adverse. When an auditor issues an adverse opinion, there are material exceptions to GAAP that affect the financial statements as a whole. Here the auditor indicates that the financial statements aren’t presented fairly. Typically, an adverse opinion letter contains a fourth paragraph that outlines these exceptions.
4. Disclaimer. Even more alarming to lenders and investors is a disclaimer opinion. Disclaimers occur when an auditor gives up midaudit. Reasons for disclaimers may include significant scope limitations, material doubt about the company’s going-concern status and uncertainties within the subject company itself. A disclaimer opinion letter briefly outlines the auditor’s reasons for throwing in the towel.
Ready, set, audit
Before fieldwork starts for the audit of your 2018 financial statements, let’s discuss any foreseeable scope limitations and possible deviations from GAAP. Depending on the situation, we may be able to recommend corrective actions and help you proactively communicate with stakeholders about the reasons for a less-than-perfect audit opinion.
For several years now, cloud computing has been touted as the perfect way for companies large and small to meet their software and data storage needs. But, when it comes to choosing and deploying a solution, one size doesn’t fit all.
Many businesses have found it difficult to fully commit to the cloud for a variety of reasons — including complexity of choices and security concerns. If your company has struggled to make a decision in this area, a hybrid cloud might provide the answer.
Public vs. private
The “cloud” in cloud computing is generally categorized as public or private. A public cloud — such as Amazon Web Services, Google Cloud or Microsoft Azure — is shared by many users. Private clouds, meanwhile, are created for and restricted to one business or individual.
Not surprisingly, public clouds generally are considered less secure than private ones. Public clouds also require Internet access to use whatever is stored on them. A private cloud may be accessible via a company’s local network.
Hybrid computing, as the name suggests, combines public and private clouds. The clouds remain separate and distinct, but data and applications can be shared between them. This approach offers several potential advantages, including:
Scalability. For less sensitive data, public clouds give businesses access to enormous storage capabilities. As your needs expand or shrink — whether temporarily or for the long term — you can easily adjust the size of a public cloud without incurring significant costs for additional on-site or remote private servers.
Security. When it comes to more sensitive data, you can use a private cloud to avoid the vulnerabilities associated with publicly available options. For even greater security, procure multiple private clouds — this way, if one is breached, your company won’t lose access or suffer damage to all of its data.
Accessibility. Public clouds generally are easier for remote workers to access than private clouds. So, your business could use these for productivity-related apps while confidential data is stored on a private cloud.
Risks and costs
Using a blended computer infrastructure like this isn’t without risks and costs. For example, it requires more sophisticated technological expertise to manage and support compared to a straight public cloud approach. You’ll likely have to invest more dollars in procuring multiple public and private cloud solutions, as well as in the IT talent to maintain and support the infrastructure.
Overall, though, many businesses that have been reluctant to solely rely on either a public or private cloud may find that hybrid cloud computing brings the best of both worlds. Our firm can help you assess the financial considerations involved.
With the year underway, your business probably has a strategic plan in place for the months ahead. Or maybe you’ve created a general outline but haven’t quite put the finishing touches on it yet. In either case, there’s a time-tested approach to refining your strategic plan that you should consider: a SWOT analysis. Let’s take a closer look at what each of the letters in that abbreviation stands for:
Strengths. A SWOT analysis starts by identifying your company’s core competencies and competitive advantages. These are how you can boost revenues and build value. Examples may include an easily identifiable brand, a loyal customer base or exceptional customer service.
Unearth the source of each strength. A loyal customer base, for instance, may be tied to a star employee or executive — say a CEO with a high regional profile and multitude of community contacts. In such a case, it’s important to consider what you’d do if that person suddenly left the business.
Weaknesses. Next the analysis looks at the opposite of strengths: potential risks to profitability and long-term viability. These might include high employee turnover, weak internal controls, unreliable quality or a location that’s no longer advantageous.
You can evaluate weaknesses relative to your competitors as well. Let’s say metrics indicate customer recognition of your brand is increasing, but you’re still up against a name-brand competitor. Is that a battle you can win? Every business has its Achilles’ heel — some have several. Identify yours so you can correct them.
Opportunities. From here, a SWOT analysis looks externally at what’s happening in your industry, local economy or regulatory environment. Opportunities are favorable external conditions that could allow you to build your bottom line if your company acts on them before competitors do.
For example, imagine a transportation service that notices a growing demand for food deliveries in its operational area. The company could allocate vehicles and hire drivers to deliver food, thereby gaining an entirely new revenue stream.
Threats. The last step in the analysis is spotting unfavorable conditions that might prevent your business from achieving its goals. Threats might come from a decline in the economy, adverse technological changes, increased competition or tougher regulation.
Going back to our previous example, that transportation service would have to consider whether its technological infrastructure could support the rigorous demands of the app-based food-delivery industry. It would also need to assess the risk of regulatory challenges of engaging independent contractors to serve as drivers.
Typically presented as a matrix (see accompanying image), a SWOT analysis provides a logical framework for better understanding how your business runs and for improving (or formulating) a strategic plan for the year ahead. Our firm can help you gather and assess the financial data associated with the analysis.
Those who run family-owned businesses often underestimate the need for a succession plan. After all, they say, we’re a family business — there will always be a family member here to keep the company going and no one will stand in the way.
Not necessarily. In one all-too-common scenario, two of the owner’s children inherit the business and, while one wants to keep the business in the family, the other is eager to sell. Such conflicts can erupt into open combat between heirs and even destroy the company. So, it’s important for you, as a family business owner, to create a formal succession plan — and to communicate it well before it’s needed.
Talk it out
A good succession plan addresses the death, incapacity or retirement of an owner. It answers questions now about future ownership and any potential sale so that successors don’t have to scramble during what can be an emotionally traumatic time.
The key to making any plan work is to clearly communicate it with all stakeholders. Allow your children to voice their intentions. If there’s an obvious difference between siblings, resolving that conflict needs to be central to your succession plan.
Perhaps the simplest option, if you have sufficient assets outside your business, is to leave your business only to those heirs who want to be actively involved in running it. You can leave assets such as investment securities, real estate or insurance policies to your other heirs.
Another option is for the heirs who’d like to run the business to buy out the other heirs. But they’ll need capital to do that. You might buy an insurance policy with proceeds that will be paid to the successor on your death. Or, as you near retirement, it may be possible to arrange buyout financing with your company’s current lenders.
If those solutions aren’t viable, hammer out a temporary compromise between your heirs. In a scenario where they are split about selling, the heirs who want to sell might compromise by agreeing to hold off for a specified period. That would give the other heirs time to amass capital to buy their relatives out or find a new co-owner, such as a private equity investor.
Family comes first
For a family-owned business, family should indeed come first. To ensure that your children or other relatives won’t squabble over the company after your death, make a succession plan that will accommodate all your heirs’ wishes. We can provide assistance, including helping you divide your assets fairly and anticipating the applicable income tax and estate tax issues.
One of the most frequent questions that we receive from taxpayers when their business had a profitable year is "Where is the money". We tell them that they had a profit of $500,000, and yet they have less money in their bank than they did at the beginning of the year.
Business owners sometimes mistakenly equate profits with cash flow. Here’s how this can lead to surprises when managing day-to-day operations — and why many profitable companies experience cash shortages.
Working capital Profits are closely related to taxable income. Reported at the bottom of your company’s income statement, they’re essentially the result of revenue less the cost of goods sold and other operating expenses incurred in the accounting period. Generally Accepted Accounting Principles (GAAP) require companies to “match” costs and expenses to the period in which revenue is recognized. Under accrual-basis accounting, it doesn’t necessarily matter when you receive payments from customers or when you pay expenses. For example, inventory sitting in a warehouse or retail store can’t be deducted — even though it may have been long paid for (or financed). The expense hits your income statement only when an item is sold or used. Your inventory account contains many cash outflows that are waiting to be expensed. Other working capital accounts — such as accounts receivable, accrued expenses and trade payables — also represent a difference between the timing of cash flows. As your business grows and prepares for increasing future sales, you invest more in working capital, which temporarily depletes cash. The reverse also may be true. That is, a mature business may be a “cash cow” that generates ample cash, despite reporting lackluster profits. Capital expenditures, loan payments and more Working capital tells only part of the story. Your income statement also includes depreciation and amortization, which are noncash expenses. And it excludes changes in fixed assets, bank financing and owners’ capital accounts, which affect cash that’s on hand.
To illustrate: Suppose your company uses tax depreciation schedules for book purposes. In 2018, you purchased new equipment to take advantage of the expanded Section 179 and bonus depreciation allowances. The entire purchase price of these items was deducted from profits in 2018. However, these purchases were financed with debt. So, actual cash outflows from the investments in 2018 were minimal. In 2019, your business will make loan payments that will reduce the amount of cash in the company’s checking account. But your profits will be hit with only the interest expense (not the amount of principal that’s being repaid). Plus, there will be no “basis” left in the 2018 purchases to depreciate in 2019. These circumstances will artificially boost profits in 2019, without a proportionate increase in cash.
Look beyond profits It’s imperative for business owners and management to understand why profits and cash flow may not sync. If your profitable business has insufficient cash on hand to pay employees, suppliers, lenders or even the IRS, contact us to discuss ways to more effectively manage the cash flow cycle. © 2019