Category: trusted advisor

Posted on

SEC Watchful Eyes Focus On Cybersecurity and Protecting Personal Information

SEC Watchful Eyes Focus On Cybersecurity and Protecting Personal Information  #cybersecurity BehindBars

Information privacy used to be a fairly simple thing.   Systems – what systems there were – weren’t so interconnected and information wasn’t so easy to share with thousands (millions) of people all over the world.  Security used to come down to gaining physical access to the information, which was usually on paper.  If you couldn’t get to the paper, you couldn’t get to the information. Yet those very analog days are long gone, and most of us have come to recognize that our personal information assets are no longer so tangible that we can touch them and feel them and keep them secured safely in the lockbox in the closet. What’s disturbing about the landscape of security in the cyber-world is that it is risky to trust not just the systems but the users – including the folks you want and need to trust – with your personal information.  It isn’t that you can’t trust anyone these days.  You just can’t trust that everyone is taking the precautions necessary to protect YOUR information.  You need to be sure.

Trust has always been an essential element in business and finances, and in every business relationship there is some element of it present. The prudent customer performs necessary due diligence before entering into any business arrangement, but there are often factors taken for granted in the review; factors which are overlooked or remain unconsidered, often due to an essential level of trust which  is placed with the other party. This is among the issues identified by the SEC as it relates to broker/dealers and their recognition of the importance of securing their clients personal information.  Yet recognition of the risk and responsibility isn’t always enough, especially with the number and makeup of bad actors out there. As the threat landscape changes, so must the approaches and technologies used to protect information from those threats.

Consumers place a high level of trust with their financial advisors and generally provide them with a great deal of personal information, and the broker-dealers and advisors generally recognize the importance of protecting the personal information they are entrusted with.  The problem is that these entities too often approach the problem of information security and protection as something with static and unchanging requirements. Compliance in establishing a baseline of protection is met.  A lack of ongoing diligence required to adjust to new threats and changing conditions… not so much. According to a summary report on the subject issued by the SEC in February 2015, the “vast majority” of examined broker-dealers and advisors have adopted written information security policies, yet the report goes on to discuss additional measures and constant reviews which should be applied to better guard the personal information of consumers.

Most of the examined firms reported that they have been the subject of a cyber-related incident.  A majority of the broker-dealers (88%) and the advisers (74%) stated that they have experienced cyber-attacks directly or through one or more of their vendors.  The majority of the cyber-related incidents are related to malware and fraudulent emails.

National Exam Program Risk Alert issued By the Office of Compliance Inspections and Examinations (“OCIE”); Volume IV, Issue 4 February 3, 2015

Among the agencies placing focus on the issues of cybersecurity and personal information protection is the SEC.  Within the SEC (Securities and Exchange Commission) is an office called the Office of Compliance Inspections and Examinations (OCIE).  The OCIE exists to “protect investors through administering the SEC’s nationwide examination and inspection program”.  Registered entities examined by this office (in Washington, DC and the Commission’s 11 regional offices) include broker-dealers, transfer agents, investment advisers, investment companies, municipal advisors, the various national securities exchanges, clearing agencies, and certain self-regulatory organizations (SROs) such as the Financial Industry Regulatory Authority (FINRA) and the Public Company Accounting Oversight Board (PCAOB).

In February 2015, OCIE published a summary of observations of the findings from a SEC-sponsored Cybersecurity Roundtable which included SEC Commissioners and staff as well as industry representatives.  The roundtable discussion, held in March 2014, focused on the important part cybersecurity plays in preserving the integrity of the market system and protecting customer data.  On the heels of the roundtable came a Risk Alert published by OCIE, in which it announced a series of examinations and tests aimed at the identification of cybersecurity risks and assessing the preparedness of the securities industry to meet the challenge.  After all, federal securities laws require registered investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.

Paperless_468x80

The watchful eyes of the SEC are looking directly at broker-dealers and advisers, bringing additional attention to messaging about the requirement for these entities to protect consumer personal information.  The message is more likely to be heard when it includes the threat of censure and big fine. In September 2015 the SEC charged an “investment adviser with failing to adopt proper cybersecurity policies and procedures prior to a breach”.  According to the SEC release, the firm “failed to establish the required cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information (PII) of approximately 100,000 individuals, including thousands of the firm’s clients.”  Also in September, the OCIE communicated another Risk Alert notifying of their intent to focus on cybersecurity compliance and controls, including information about the next round of examinations which will include more testing to evaluate firms’ implementations of procedures and controls around information protection and cybersecurity.

Gathering information on information security and privacy practices is not always easily accomplished for the SEC OCIE.  FinCin (US Dept of the Treasury Financial Crimes Enforcement Network), on the other hand, seems to get more reports of breaches from broker-dealers than does OCIE.  Maybe it is due to the advisor wanting to take more the role of the victim rather than admittance of culpability in any way, but the OCIE reports that roughly 65% of broker-dealers that acknowledged receiving fraudulent emails, for example, reported them to FinCen, yet perhaps 7% or fewer actually reported the information to law enforcement or other regulatory agencies.  It is the public report of the breach which gets the attention, and which continues to spur the efforts within the OCIE.

Public reports of cybersecurity breaches occur with too much frequency.  Sadly many of these events are due to failures or weaknesses in basic controls – failures which might have been identified if testing and review of basic processes, systems and controls was part of regular procedure.  With some of the largest data breaches possibly resulting from hacking of 3rd party vendor systems and platforms, review and assessment of vendors and suppliers must also be folded into the realm of consideration.  Failure to protect personal information of consumers and clients is risk to not just the firm or the client, but also to the entire market.  Risk reduction and management is among the focus areas for OCIE, a charter which supports the recent creation of the Office of Risk and Strategy, and which recognizes the challenge in gaining the information necessary to effectively inform the SEC and the market on cybersecurity issues.

jmbunnyfeetMake Sense?

J

Posted on

Is this email legitimate? QuickBooks Payroll ACH ID Changes go live on the 22nd!

Is this email legitimate? QuickBooks Payroll ACH ID Changes go live on the 22nd!

Trusted QuickBooks Advisors – here’s another thing for you to help your clients with

Intuit recently sent an e-mail to QuickBooks Online Payroll (QBOP) and QuickBooks Full Service Payroll (QBFSP) customers about an ACH ID change.  It kind of looks like a phishing thing, but it is really a legitimate email from Intuit, and it is important to pay attention if your company uses the impacted services and a banking feature called “debit filtering”.  There isn’t much time to act, either, because the changes go live in 3 days (February 22, 2016).

Impacted services are QuickBooks Online Payroll and QuickBooks Full Service Payroll, so it is pretty important to address.  Nobody wants their business payroll processes interrupted, and this could easily do just that.

Intuit has added some new ACH ID numbers for use with direct deposit and other processes which work with the bank, so customers using a fraud-prevention method known as “debit filtering” will need to contact their banks to add the new IDs or their bank transactions will fail.

Debit filtering allows customers to tell their banks which ACH IDs are allowed to perform transactions with the bank account, like removing or depositing funds.  It is an extra level of fraud security that protects the bank account from unauthorized access, but it is also something that can work against the business if it is not managed.  In this case, contacting the bank to add the new IDs is critical to keeping things processing and flowing smoothly.  It is also important that the old IDs not be removed yet, as they may be tied to historic transactions that must be tracked and reported on for tax and other purposes.

“Is this really from Intuit? It seems like Intuit would have a better way to make such changes than to ask millions of subscribers to contact their bank”

Source: Is this email legitimate? ACH ID Changes; – QuickBooks Learn & Support

QuickBooks users don’t have much time to reach their banks and supply the new IDs, so pull the email out of the SPAM folder and call the bank right away. Intuit won’t be sending notices to the banks, and they have no authority to add different IDs to your approved list, anyway… which is a good thing.  If just anyone could add an approved ACH ID on your account, then just anyone could get to your funds.  Better to make the phone call yourself.

jmbunnyfeetMake Sense?

J

Posted on

Report Right or It’ll Cost You (double)

Report Right or It’ll Cost You (double)

paper-stackReporting requirements for business just keep growing, and so do the penalties for doing it wrong.  New this year and just in time for the annual reporting season (makes it sound almost fun, huh?) are new forms to file and an increase in penalties for not making an effort to get the information correct and into the hands of the proper recipient. Failure to file by the due date can cost businesses $250 per item, up to $3,000,000 in penalties ($1,000,000 for small businesses).  Add to that the warning about intentionally not filing or having an “intentional disregard of the requirements to furnish a correct payee statement”, which carries a penalty of at least $500 per payee statement and has no maximum penalty. Clearly, the cost of making sure the information is correct and filed in a timely manner is far less than the cost of not getting it done – or done right.

Growing problems around wage and revenue reporting have caused the IRS to pursue a variety of measures over the years to try to improve information reporting.  The Affordable Care Act has also had quite an impact on wage and benefit reporting, increasing reporting requirements substantially.  From the introduction of health plan reporting on W2s to the new mandatory forms 1095-C and 1094-C (for applicable large employers), businesses of all sizes are feeling the pressure.

February 2016 marks the date when employers and healthcare providers are required to file those shiny new IRS information returns regarding employer-provided healthcare coverage, providing a copy of the return to each employee much like a W2. The information would then enable the IRS to enforce rules established under the Affordable Care Act by revealing whether an individual might be eligible for a premium tax credit, or if an employer may be subject to non-compliance penalties. Penalties for failing to comply essentially double in 2016.  And the IRS suggests that a “good faith effort” standard will be applied to information reporting, offering no relief for employers that fail to make the effort to file timely and correctly.

It wasn’t very long ago that 1099 filing requirements expanded substantially, forcing businesses to get far more detailed in their production of information to the IRS and to payment recipients.  While this filing requirement impacted businesses both large and small, most lived through it (with the help of their trusted accounting professional!) and were able to comply.  That effort informed the IRS on a wide variety of business payments and expenses not previously tracked, in particular payments made for services and non-employee compensation.

The increasing scrutiny of wage and earning information may also help in efforts to curtail tax refund fraud.  Identity thieves use stolen (or borrowed) social security numbers to file false tax returns early in the year. Unfortunately, with the IRS motto of “pay first, prove later” the cross checking won’t likely be done until after the refund check has been sent. Once the task is performed, however, the taxpayer could end up getting a letter from the IRS stating that more than one tax return was filed using the social security number, they owe for a tax year for which they did not file a return, or the IRS indicates that wages were reported from an employer the taxpayer doesn’t know.

The IRS expects tax refund fraud to top $21 billion by 2016, which is an increase of 223% from 2013 numbers. Tax refund fraud costs every taxpayer.  No wonder the IRS is getting tougher with the penalties for not filing information returns accurately or on time.

jmbunnyfeetMake Sense?

J

Following is the text from the IRS, which outlines the “Increase in Penalties for Failure to File Correct Information Returns and to Provide Correct Payee Statements — 31-JUL-2015

L. 114-27, section 806, increased penalties for failure to file correct information returns and provide correct payee statements for information returns required to be filed after December 31, 2015.

Penalties are discussed in Section O in the General Instructions for Certain Information Returns. The penalties in the bulleted list under “Failure To File Correct Information Returns by the Due Date (Section 6721)” are revised as follows.

  • $50 per information return if you correctly file within 30 days (by March 30 if the due date is February 28); maximum penalty $500,000 per year ($175,000 for small businesses).
  • $100 per information return if you correctly file more than 30 days after the due date but by August 1; maximum penalty $1,500,000 per year ($500,000 for small businesses).
  • $250 per information return if you file after August 1 or you do not file required information returns; maximum penalty $3,000,000 per year ($1,000,000 for small businesses).
Posted on

Two Ways to Get QuickBooks in the Cloud

Get QuickBooks in the Cloud: Hosted QuickBooks Desktop or QuickBooks Online

cloud-computingRunning applications online, or “in the cloud” using today’s parlance, is top priority for a lot of businesses.  It’s not that these organizations have a burning desire to post their financials to the web, which is what a lot of folks thought was going to happen when we first suggested they use their financial applications online.  Rather, business owners and managers have begun to recognize and experience the benefits of connecting their various locations, remote and mobile workers with real time access to business applications and data.  Further, centralization of IT coupled with outsourced IT management and subscription service pricing has introduced financial and operational benefits which make businesses more cost-efficient as well as more agile.  From being the basis for foundational process and workflow improvements to allowing the repositioning of IT costs from capex to opex, online application services are proving their value in various ways every day.

The evident popularity of cloud solutions is clearly visible in one small corner of the global software marketplace: the small business accounting solution market. Intuit’s QuickBooks product, almost a default go-to with entrepreneurs and small business owners, is still the most prevalent accounting solution in use by US small businesses.  While there may be growing usage of other applications on the web, such as Xero or FreshBooks (both are awesome SaaS apps that do what they do quite well), there is equally strong growth in Intuit’s own SaaS version of QuickBooks.  The SaaS applications are easier to localize for different places in the world – different languages and currencies – so international use of these products is likely to continue to grow.  Even more to the point, these solutions address functionality and pricing levels which are acceptable to entirely different classes of users that previously wouldn’t even consider buying accounting software to do the books (like freelancers and solo/soho operators), so the overall size of the market of “businesses who use accounting or bookkeeping software” is actually growing.

Intuit’s QuickBooks Online edition is a true SaaS solution that is quite different from the desktop-based QuickBooks.  While QBO has gained tremendous popularity, it has yet to reach the user numbers the desktop products have.  The desktop solutions boast not just a particular range of functionality, but integrated applications and add-ons, and – perhaps most importantly – being a foundation for a wide variety of financial and business record keeping, bookkeeping, accounting, operationally oriented and reporting processes.  To sum it up: it’s embedded.  People know the software, the data is in a known format, and the product is simply part of how the business operates.

Once a solution is as entrenched as QuickBooks is – kind of like the entrenchment Microsoft Word and Excel have in the productivity area – it doesn’t go away very quickly and only when the value proposition is much greater… and maybe not even then.  Rather, folks find ways to make the solution they want work for them.  This is where hosting comes in and meets with the market’s demand for running applications (yes! even desktop applications!) online, as managed subscription service.

Running your QuickBooks desktop online via a hosting provider is how businesses take advantage of the best benefits of SaaS without actually converting to a SaaS application. They retain investments in training, process and integration yet introduce mobility, remote access and office connectivity, centralized information and predictable costs. QuickBooks-using businesses need to know about hosting their QuickBooks and the providers who can offer anything from standardized to extremely customized service.

As technology continues to evolve at ever-increasing rates, businesses will continue to be faced with new paradigms for doing business.  Some will adopt early and some will adopt later, and some simply won’t adopt.  Certainly the market as a whole doesn’t adopt as quickly as software companies would like, but then that’s always the way it is.  Customers will do what works for customers, and right now hosting is working for QuickBooks customers.

Joanie Mann Bunny FeetMake Sense

J

Posted on

QuickBooks Online vs QuickBooks Desktop: The Great Debate

QuickBooks users around the country are facing a dilemma like never before – they’re being forced to consider exchanging their beloved QuickBooks desktop editions with a subscription-based online application that seems like an entirely different product.  It not only seems like a different product, it is.  And this is where the debate begins.

For years businesses both large and small found Intuit’s QuickBooks software to be their solution for business bookkeeping and accounting.  Over the years the product line grew to support larger businesses, with the Enterprise edition scaling to 30 users and boasting a load of operational process support features.  Accounting professionals, too, grew to favor the QuickBooks products because there were features just for these “mechanics” who learned to make the software do what was necessary to support the business, even if the software wasn’t intentionally designed to be used in that manner.  After all, it is this “unintentional” activity which often results in really cool new features being introduced in the product – features that the designers didn’t think up but that users did and the news eventually got back to the developers.

dt-v-online-great-debateWhen Intuit introduced QuickBooks Online, however, the tried-and-true solution known as “QuickBooks” became something very different at first glance, creating the need to educate the market about the continuing existence of desktop QuickBooks products as well as the newer online QuickBooks product.  Differentiation of the two is not really the “desktop” versus “online” moniker – Commercial Hosts for QuickBooks, who essentially turn the desktop products into online application service, pretty much eliminate the whole “any time, anywhere” debate, as hosted QuickBooks desktop editions are just as anytime/anywhere as the online edition is.  The benefit of Internet access and running on any device is now removed from the equation, so what’s left to compare other than functionality, benefits and features… and a proven track record?

We could, in the past, have a conversation about the features, benefits and functionality in QuickBooks and know that the flow-through of product use knowledge, stored data and integration with other business solutions would be fairly seamless and consistent.  QuickBooks Online has demonstrated none of this, fracturing the seamlessness and consistency users could previously expect as they move through the product line – as businesses will do as they grow larger and have more demands from their software solutions.

So now there’s a debate – which solution is best?  The answer really isn’t necessarily about which is best, but which addresses the business need now and, if the business intends to be around for a while, in the future.  Sometimes the argument is more about getting you where you need to be rather than simply supporting where you are now.  I know I’m not yet ready to place any hard bets on whether or not the QBO  model will truly deliver the goods for growing businesses long-term.

Joanie Mann Bunny FeetMake Sense?

J

Posted on

EMV and Retail – Your Trusted Advisor Should Be Advising You about This

EMV and Retail – Your Trusted Advisor Should Be Advising You about This

EMVChipCardThere is ‘big change a comin’ for retailers, merchants and any business that accepts credit cards for payments, and there are a great many businesses that are completely unprepared for it.  The change, what is being referred to as the “Payment Networks’ Liability Shift”, goes in to effect in October 2015 and places the burden of liability for fraud squarely on the shoulders of the merchants and card issuers who are not compliant with certain payment system security standards.  Accounting professionals and Trusted Advisors – here’s one of those things you should be helping your clients with.  Help them get informed, trained, and prepared.  Help them to understand the risk and decide on a course of action.  This is part of what makes a trusted advisor: they got your back.

The way things generally work in the US today, a fraudulent charge on a credit card is likely to end up being covered by the credit card company (the issuer). Starting in October, retailers are supposed to be able to accept payment cards with EMV chips (named for the founders of the standard: Europay, MasterCard and Visa), and must process those cards using the compliant technology that takes advantage of what the chip processing and security offers.  If these conditions aren’t met – like having a POS or payment terminal not capable of reading the EMV chip – the merchant is on the hook for the fraudulent transaction.  Given the volume of credit card and payments fraud in the country you’d think that most merchants would already be ready for this, but replacing all the POS and terminal equipment could be pretty costly.  It may take a bit of analysis to understand the real risk and compare that to the cost of compliance.  Certainly it makes sense to always be in compliance, but there are always factors which influence how quickly (or how completely) compliance may be met.

The liability shift is part of the influence being leveraged to get businesses to adopt newer and more secure models of electronic payment acceptance and processing.  It is simply the case that the magnetic strip on a credit card isn’t good enough any longer.  The new EMV Chip reading payment terminals require that the card be inserted and processed by the terminal rather than simply swiping the magstrip across a reader.  Over 40 years of using the magstrip approach has helped to earn the United States a top spot on the leaderboard for credit card and financial fraud, and we seem to be lagging behind in adoption and implementation of the EMV technology even though it has been shown to seriously curtail fraud even as payment card usage increases.  The EMV chip process, which encrypts information about the card so that even the local POS system doesn’t get access to it, is far more secure and is being widely adopted and used in Europe, Canada, Latin America and the Asia/Pacific regions.  Now the clock is ticking for US businesses to get ready to either update their systems or accept the liability for not doing so.

The shift in how payment cards are made and processed is simply one of many changes which will continue to occur as technology and human ingenuity continue to be applied in both good and not-so-good ways.  Recognizing that the pace of change is increasing, businesses must find ways to remain informed and prepare for those changes which will impact the business operation and sustainability.  This is among the essential roles the trusted advisor plays, and the current imperative simply underscores the growing need for such advisors by business large and small.

jmbunnyfeetMake Sense?

J