Business Data Storage in the Cloud – Accountex Report

The term “cloud” has been applied to all sorts of online or Internet-based application models, and there are a great many approaches to developing cloud-based services and solutions. What this translates to is a volume of options and possibilities for information storage, management, and access in the cloud.Understanding where information is stored, how it may be accessed, and how it might be transmitted to others becomes essential knowledge that business owners should have when they engage with any information technology (IT) solution or service. Yet the plethora of “simple, affordable, and instantly gratifying” services currently available on the web all but ensure that businesses will engage with one or more solutions that provide them with little or no information (much less control) over the placement and management of their data.

Source: Business Data Storage in the Cloud – Accountex Report

Read more about Compliance in the Cloud, and making sure your data doesn’t get lost or compromised, even when you use a hosting company…

SEC Watchful Eyes Focus On Cybersecurity and Protecting Personal Information

SEC Watchful Eyes Focus On Cybersecurity and Protecting Personal Information  #cybersecurity BehindBars

Information privacy used to be a fairly simple thing.   Systems – what systems there were – weren’t so interconnected and information wasn’t so easy to share with thousands (millions) of people all over the world.  Security used to come down to gaining physical access to the information, which was usually on paper.  If you couldn’t get to the paper, you couldn’t get to the information. Yet those very analog days are long gone, and most of us have come to recognize that our personal information assets are no longer so tangible that we can touch them and feel them and keep them secured safely in the lockbox in the closet. What’s disturbing about the landscape of security in the cyber-world is that it is risky to trust not just the systems but the users – including the folks you want and need to trust – with your personal information.  It isn’t that you can’t trust anyone these days.  You just can’t trust that everyone is taking the precautions necessary to protect YOUR information.  You need to be sure.

Trust has always been an essential element in business and finances, and in every business relationship there is some element of it present. The prudent customer performs necessary due diligence before entering into any business arrangement, but there are often factors taken for granted in the review; factors which are overlooked or remain unconsidered, often due to an essential level of trust which  is placed with the other party. This is among the issues identified by the SEC as it relates to broker/dealers and their recognition of the importance of securing their clients personal information.  Yet recognition of the risk and responsibility isn’t always enough, especially with the number and makeup of bad actors out there. As the threat landscape changes, so must the approaches and technologies used to protect information from those threats.

Consumers place a high level of trust with their financial advisors and generally provide them with a great deal of personal information, and the broker-dealers and advisors generally recognize the importance of protecting the personal information they are entrusted with.  The problem is that these entities too often approach the problem of information security and protection as something with static and unchanging requirements. Compliance in establishing a baseline of protection is met.  A lack of ongoing diligence required to adjust to new threats and changing conditions… not so much. According to a summary report on the subject issued by the SEC in February 2015, the “vast majority” of examined broker-dealers and advisors have adopted written information security policies, yet the report goes on to discuss additional measures and constant reviews which should be applied to better guard the personal information of consumers.

Most of the examined firms reported that they have been the subject of a cyber-related incident.  A majority of the broker-dealers (88%) and the advisers (74%) stated that they have experienced cyber-attacks directly or through one or more of their vendors.  The majority of the cyber-related incidents are related to malware and fraudulent emails.

National Exam Program Risk Alert issued By the Office of Compliance Inspections and Examinations (“OCIE”); Volume IV, Issue 4 February 3, 2015

Among the agencies placing focus on the issues of cybersecurity and personal information protection is the SEC.  Within the SEC (Securities and Exchange Commission) is an office called the Office of Compliance Inspections and Examinations (OCIE).  The OCIE exists to “protect investors through administering the SEC’s nationwide examination and inspection program”.  Registered entities examined by this office (in Washington, DC and the Commission’s 11 regional offices) include broker-dealers, transfer agents, investment advisers, investment companies, municipal advisors, the various national securities exchanges, clearing agencies, and certain self-regulatory organizations (SROs) such as the Financial Industry Regulatory Authority (FINRA) and the Public Company Accounting Oversight Board (PCAOB).

In February 2015, OCIE published a summary of observations of the findings from a SEC-sponsored Cybersecurity Roundtable which included SEC Commissioners and staff as well as industry representatives.  The roundtable discussion, held in March 2014, focused on the important part cybersecurity plays in preserving the integrity of the market system and protecting customer data.  On the heels of the roundtable came a Risk Alert published by OCIE, in which it announced a series of examinations and tests aimed at the identification of cybersecurity risks and assessing the preparedness of the securities industry to meet the challenge.  After all, federal securities laws require registered investment advisers to adopt written policies and procedures reasonably designed to protect customer records and information.

Paperless_468x80

The watchful eyes of the SEC are looking directly at broker-dealers and advisers, bringing additional attention to messaging about the requirement for these entities to protect consumer personal information.  The message is more likely to be heard when it includes the threat of censure and big fine. In September 2015 the SEC charged an “investment adviser with failing to adopt proper cybersecurity policies and procedures prior to a breach”.  According to the SEC release, the firm “failed to establish the required cybersecurity policies and procedures in advance of a breach that compromised the personally identifiable information (PII) of approximately 100,000 individuals, including thousands of the firm’s clients.”  Also in September, the OCIE communicated another Risk Alert notifying of their intent to focus on cybersecurity compliance and controls, including information about the next round of examinations which will include more testing to evaluate firms’ implementations of procedures and controls around information protection and cybersecurity.

Gathering information on information security and privacy practices is not always easily accomplished for the SEC OCIE.  FinCin (US Dept of the Treasury Financial Crimes Enforcement Network), on the other hand, seems to get more reports of breaches from broker-dealers than does OCIE.  Maybe it is due to the advisor wanting to take more the role of the victim rather than admittance of culpability in any way, but the OCIE reports that roughly 65% of broker-dealers that acknowledged receiving fraudulent emails, for example, reported them to FinCen, yet perhaps 7% or fewer actually reported the information to law enforcement or other regulatory agencies.  It is the public report of the breach which gets the attention, and which continues to spur the efforts within the OCIE.

Public reports of cybersecurity breaches occur with too much frequency.  Sadly many of these events are due to failures or weaknesses in basic controls – failures which might have been identified if testing and review of basic processes, systems and controls was part of regular procedure.  With some of the largest data breaches possibly resulting from hacking of 3rd party vendor systems and platforms, review and assessment of vendors and suppliers must also be folded into the realm of consideration.  Failure to protect personal information of consumers and clients is risk to not just the firm or the client, but also to the entire market.  Risk reduction and management is among the focus areas for OCIE, a charter which supports the recent creation of the Office of Risk and Strategy, and which recognizes the challenge in gaining the information necessary to effectively inform the SEC and the market on cybersecurity issues.

jmbunnyfeetMake Sense?

J

Confusing Value Propositions: Cloud Platforms and Hosted Applications

it-balancing-actConfusing Value Propositions: Cloud Platforms and  Hosted Applications

When a service provider is in the business of selling computing resources – like bandwidth, processors and memory, and disk storage – it makes a lot of sense to also leverage the value of software products and systems which drive consumption of computing resources.  In short, they market and sell software that runs on the platform in order to get folks to buy the platform, no different from selling desktop and server software in order to sell the hardware to run it.  It’s just that these days the hardware and networking components are often referred to as the “platform” or maybe “the cloud”.

Let’s face it… cloud computing platforms are just no fun if there’s nothing to run on them, and a hard drive has little value when there isn’t anything stored on it.  Once there is something there – an application, data… something – then the part has actual value in terms of driving revenue.  This is the difficulty and the basis for confusing value propositions when it comes to offering and delivering services in the form of a hosting platform.  Once again: platforms are just no fun if there’s nothing to run on them.  Is the value is really about the applications, not the platform? Or is the value in the platform, because it’s necessary for running the applications?

The truth is that both are essential parts of the entire “solution”, and the value of how the solution is packaged and offered is purely up to the purchaser to determine in terms of applicability to the business.  When it comes to hosted application offerings for businesses, there isn’t a single one-size-fits-all approach that will work.  Sometimes people want to purchase from different vendors and put their own solutions together, and sometimes folks want turnkey delivery of whatever they need.  Even channel partners and value-added resellers are finding that, with diminishing margins and aggressive competition prevalent in the market, removing the time-consuming aspects of solution delivery becomes paramount to achieving some level of profitability on the work.

What this means is that providers are looking for ways to increase the overall value and usability of their solutions, and when it comes to platform services there are only two directions to look: automation to support self-service, and application software delivery to drive consumption and usage on the hosting platform.

So now we’re back to the applications again.  There’s no way to avoid them, but there’s no great way for platform companies to engage with them, either.  Working with business application software is sometimes complicated, often annoying, and can be exceptionally time-consuming and resource intensive. And there are few licensing models which make it really easy for hosts and ISVs (Independent Software Vendors) to work together.  Then, of course, there is the desire for exclusivity on one side or the other.

Software companies don’t generally want to select a single platform provider for their software for a very simple reason: they don’t want to limit their potential user base.  Now that Windows platform is available just about anywhere – on local computers, on mobile devices, from platform and infrastructure hosting providers – how does the ISV make a decision on a single delivery channel or model or provider?

Some lean towards working with hosting providers to create branded, point-deliveries of the application.  Too often, however, this approach removes the ability for customers to benefit from other applications or integrations, eliminating some of the value of the solution and certainly curtailing benefits for integrating partners of the ISV.

Host it themselves?  The last thing most software developers want is to be responsible for hosting and maintaining some other guys’ software products; they have enough to worry about with their own offerings.  If the solution is standalone, maybe this approach works.  But there are few solutions made for the desktop which don’t have some strange integration point with MS Office apps, Adobe reader, Internet browsers or other things prevalent on the user desktop.

There isn’t any proven or easy path for software developers, IT suppliers or small business customers looking to create mobility and managed subscription service around desktop and server applications, and there is likely never going to be a single story line that all will follow.  This is among the reasons for the popularity of the “hybrid” cloud approach and growing importance of managed application hosting and ISV-authorized delivery models.  Yet even key providers in those areas have a tough time really communicating what they do in a way that is meaningful to the buyer.  Are they selling a platform, applications, or both? Folks in the industry know the jargon and how to use it, and are often skilled at adjusting their language in order to obfuscate or confuse certain sticky issues regarding software licensing in the cloud and other similar aspects of hosting.  It’s no wonder that many customers remain confused as to what, exactly, they’re being asked to buy, and where the lines of flexibility and responsibility are drawn.

The applications justify the platform, and there are possibly multiple platform approaches to delivering the app. It is a confusing situation for business buyers of IT as well as for their resellers and suppliers, and the increasing number of options for how businesses approach purchasing and using information technology makes it unlikely that the process will become as simple as some suggest.

jmbunnyfeetMake Sense?

J

Revenue Recognition and closing the reporting GAAP

Revenue Recognition and closing the reporting GAAP

chartOne company earns what the other company spends.  This is business, and it seems like it would be pretty straightforward, accounting for the money coming in and the money going out.  But it is really not that simple when it comes to business finances and accounting for revenue.  With investor pressure to improve share prices and market pressures forcing greater competition, businesses have always sought out ways to make the performance look as good as possible – on paper even if not in reality.  It is this requirement to make the business look better than it may actually be that drives “innovation” in financial reporting, and encourages some companies to use whatever rules are available to mislead investors or paint a rosy picture for stakeholders.  When the balance is lost and financial reporting standards become so oblique as to allow regular and gross misrepresentation, it is time to change the standards.

There are numerous instances of fraud and scandal reported from the finance departments of big businesses, but instances of improper or misleading revenue recognition can happen in even the smallest of companies, and not necessarily on purpose.  It is important to understand that properly and accurately reporting business revenue and earnings isn’t done just for investor satisfaction, it is an essential part of describing business performance that any owner or manager must be able to rely on.

Generally Accepted Accounting Principles (GAAP) provide investors and business owners with some consistency in the financial statements they use to analyze company performance, but only minimally.  This is partly due to the fact that GAAP is based not only on some standards established by policy boards (the authoritative standards) but also on “generally accepted” standards, which are often not really standards at all but simply past practice that was found to be accepted.  Especially in the global economy where fewer businesses operate solely within traditional territorial boundaries – and where accepted reporting methods vary widely – having a single financial reporting standard has become more important than ever.

Make it so, Number One.

Now there are new rules from FASB (Financial Accounting Standards Board) and IASB (International Accounting Standards Board) which provide clear and detailed guidance for how businesses recognize revenues.  These rules are based on a consistently applied set of principles, no matter what sort of business is involved and regardless of where the business is located.

A focus of the new rules of revenue recognition centers on customer contracts, delving into the details of how earnings from those agreements should be recorded. Consider that many businesses combine multiple products and services into a single agreement, even though there may be several deliverables or milestones included.  This method of booking customer contracts allowed companies to report revenues they were not yet due as part of a total agreement, often resulting with inflated earnings reports.   Stakeholders would perceive that the company had reached one earning threshold, but the reality was something quite different and performance expectations were unmet.

“FASB and the International Accounting Standards Board (IASB) issued converged guidance on recognizing revenue in contracts with customers. The new guidance is a major achievement in the Boards’ joint efforts to improve this important area of financial reporting.”  http://www.fasb.org/jsp/FASB/Page/BridgePage&cid=1351027207987

The new rules force an additional level of discussion, including a full set of disclosure requirements that will provide more information about contracts with customers.  Businesses must identify each promised deliverable and attached revenue or earning component, which helps to better understand how the revenue may be earned (and recognized) as the business performs on the various obligations to the customer.

Just take a look at some big ERP companies and the lawsuits generated from problems and failures in delivery – problems that might have been more clearly identified to investors and stakeholders if the tie between product sales and services to be performed were more clearly described.  In many cases, these situations exemplify the revenue recognition reporting problem, where large customer contracts and license sales were fully booked and recognized even though implementation services milestones attached to those license sales remained undelivered.

“2010 – JDA Software (i2) – Dillard’s, Inc.:  Dillard’s had alleged i2 failed to meet obligations regarding two software-license agreements for which the department-store operator had paid $8 million.” http://www.zdnet.com/blog/projectfailures/erp-train-wrecks-failures-and-lawsuits/12055

For private companies, reporting periods beginning after December 15, 2017 must follow the new guidance.  It may seem like a long period of time – from the decision to apply the new rules to the effective date – but the number of businesses the new rules will impact is large.  The FASB made a decision to delay the effective date because of the broad scope of organizations affected and “the potentially significant effect that a change in revenue recognition has on other financial statement line items.”

Business owners and their accounting professionals need to make sure that financial systems and processes are up to the task and can track and produce the detailed reporting these new rules require. For investors and analysts, the new reporting rules and detailed information they generate will go a long way towards minimizing the impact of innovative revenue reporting practices, and will hopefully bring a new level of believability and usefulness to business financial reports.

Make Sense?

J

Small Business IT Governance: You really need it now

it-balancing-actBig changes are going on in the world of information technology and business.  Where social computing and  mobility are no longer purely consumer concerns, enterprise IT departments face a growing requirement to embrace user devices and access in environments which were once strictly and closely controlled.  Enterprise IT may be challenged when presented with user personal devices and demands for remote access to enterprise data, yet the governance of systems is generally well-defined and strictly performed.  In small business, however, the people, policy and process issues (collectively incorporated into “governance”) tend to be more organic, and the use of personal devices and open access is more frequently considered to be a normal part of the overall business IT profile.

It is a focus on defining controls and processes, and influencing the activities and attitudes of the people involved, which has become an essential requirement in small business.  Where management of information technology resources was not of great concern to the small business owner before, increased device and information mobility (removal of physical boundaries) and erosion of logical boundaries around personal and business computing have become a really big deal for everyone in business. Small businesses just don’t often have departments of people working on the problem.

Technology use in business has always come at a price, and as various influences continue to change how users interact with devices, applications and systems, business owners and IT managers will continue to face difficult choices between balancing security of information resources and providing a productivity-enhancing user experience.   Too many security barriers result in avoidance of security protocols, slow or immobile company computers result in users working on their own machines and portables, and restricting access for mobile users results in “shadow IT” implementations of mobile sync and other data access approaches.

Yet “shadow IT” tends to be the norm with many small businesses, where there are often fewer barriers to implementing solutions which address individual user issues or problems.  Lacking the resources or understanding to develop a strong plan for managing information systems and technology within the business, small business owners often consider the computer systems and computerized data to be tools to get jobs done rather than strategically valuable assets to be strictly controlled and protected.  These business owners are not recognizing the ever-increasing need to not simply secure business information, but to establish processes and rules which will govern how users and devices access and interact with the information and systems.

Enterprise IT departments have often viewed their small business counterparts (customers, suppliers, etc.) as potential points of vulnerability, an attitude which was once considered to be centered not on real assessments of the risk but more in terms of ego, level of sophistication, and hierarchy in the food chain.  In today’s world of real risk introduced by myriad technological and human elements in every link in the supply chain, enterprise IT conclusions regarding the risk potential of doing business with anyone – including small businesses – may not be entirely unfounded.  Whether it be commentary and information distributed by individuals via social media or malware or corruption introduced inadvertently (or not) via computerized interaction, there is the possibility of risk introduced with every system, person and process involved.  Enterprise to enterprise, these issues may be more often recognized and remediated; where the SMB is involved, not always so much.

This is a brave new world of computing, and there is truth in that even the smallest of businesses can “compete with the big guys” when the right mixture of technology and process is applied – for good or bad.  Technology enables businesses to be more productive, get more done with fewer resources and perform at higher levels. IT Governance in small business is no longer an optional area of focus, addressed only during infrequent discussions with the local contract IT guy when he comes in to defrag the hard drive on a slow computer.  Establishing the proper processes and controls to wrap around IT use in the business has become an imperative; a necessarily specific and considerate approach to how information technology is used within the business, who uses it, and what IT is composed of.

Just about every business, and most individuals, are connected in some manner via some type of network, representing a dramatic and dynamic change to the traditional composition of business IT and the landscape of vulnerabilities which threaten it.  The increased connectedness, capability and complexity of systems and networks requires a greater focus on overall IT governance – exercising authority and controls – as the impact (just like the information) can easily and unintentionally reach far beyond the boundaries of the individual business.

jmbunnyfeetMake Sense?

J

“People are nothing more than another operating system”, says Lance Spitzner, training director for the Securing The Human Program at SANS Institute.  “Computers store, process and transfer information, and people store, process and transfer information,”  How Hackers Fool Your Employees

4 Rules of Thumb Regarding Workers Compensation Insurance for Employers

In two previous “4 Rules of Thumb” articles, I discussed a few things that businesses can do to create the best possible environment for engaging new customers and providing quality service (4 Rules of Thumb for Business Success) and provided additional tidbits for service businesses – things the company can do to make sure that the work is done completely and correctly the first time, which is what leads to happy and loyal customers (4 Rules for Building Service Customer Loyalty).

This article is focused a bit more internally to the business, discussing a few of the risks and considerations surrounding those dreaded tax burden issues: Unemployment Insurance, Worker Classification and Workers Compensation Insurance. 

Unemployment insurance is one of those items that most businesses pay attention to, because rates are impacted based on unemployment claims made and paid. The cost of unemployment insurance is usually calculated just like workers’ compensation, using standardized arithmetic formulas based on the profile and past record of the company.

Workers Compensation insurance is sort of the “elephant in the room” of compliance – it’s a big problem that is frequently the last item of consideration in business compliance and reporting. It is also an item that frequently goes without scrutiny at the state level, so little attention is generally given it by accounting and human resource professionals.

Workers Comp is one of those payroll reports where you select from a broad list of categories relating (hopefully fairly closely) to the work your people do, you calculate the cost, and you pay the fees.

Ideally you’re classifying workers properly in terms of their being employees versus independent contractors – this being the big focus of most workers comp audits and where many advisors say to pay attention. If you use a company to perform some of the work of your business, also pay close attention to the concept of joint-employer status (see article on joint employer status).

An equally big issue – the issue that impacts the business owner perhaps more than the employee – is classifying worker activities too broadly, potentially costing the business hundreds (if not thousands) of dollars in annual workers comp premiums. Improper classification of worker activities can lead not just to increased premium costs, but heavy penalties in the event of a claim finding the worker was not properly covered.

Most workers compensation policies issue blanket risk classifications, yet how these classifications are used in different industries is where the secrets of cost savings exist.  In the moving and storage industry, for example, the risk is in the warehouse. If a clerk or administrative worker enters the warehouse, that employee is now actually working under a different classification. However, if the worker often checks warehouse inventory or sells items from the warehouse as part of their sales job, they may operate under yet another classification.

There is a balance required when seeking to reduce premiums while keeping the company compliant.  Many companies consider caution to be more affordable than keeping highly detailed activity and work classification records, finding that reporting workers in higher cost work categories is more cost effective than paying for the labor intensive effort of capturing, analyzing and reporting in more detail. That is, until a worker is injured and the risk wasn’t disclosed through accurate workers compensation reporting.

When it comes to workers compensation insurance for the business, give these 4 compliance rules of thumb some strong consideration.

Rule 1: Get informed and get help.

It’s OK for a business owner to not be the expert in all facets of compliance and reporting – – you have accountants and tax advisers that can gain this knowledge from their annual CPE (continuing professional education). The potential costs of mis-handling workers compensation and other aspects of having employees are too great to risk being uninformed and unprepared.

Rule 2: Call an employee an employee

Classifying workers will turn out better for all parties in the long run even if it seems like the more expensive way to go. Misclassification of employee workers as contractors hurts everyone, eventually. There is a big problem with businesses misclassifying workers as contractors rather than as employees, sometimes to avoid paying taxes and benefits, but sometimes not just for that reason. When classified as contractors, workers are generally not covered by the various protections and do not get the benefits that employees do.

Some business owners who are unsure of the state administrative rules may pay workers compensation premiums for workers that are truly independent contractors. Other businesses may require workers to have a workers compensation account as a condition of employment. Either way it is being done improperly and one party or the other ends up bearing unnecessary cost and/or risk.

The unfortunate result is that employers are bearing larger than necessary burdens of supporting injured workers and the unemployed.

Deliberate mis-classification can save dishonest contractors upwards of 30 percent in payroll and other taxes, but for workers, taxpayers and honest employers, the practice amounts to millions in lost wages and revenue. – See more at:

http://www.ibew.org/articles/13ElectricalWorker/EW1305/Misclassification.0513.html#sthash.7u1vtjW

Rule 3: Details Details Details.

Worker classification done properly can save businesses a lot of money simply by being more accurate. Yes, there may be tradeoffs in terms of labor to perform the calculations and reporting, but it can prove to be well worth the effort.

Particularly in businesses where workers may perform multiple duties or work in a variety of locations and conditions, there is value in delving into the details of time, location and work performed to make sure the business is adequately covering itself. Filling out the report by simply selecting the broad category that “seems most likely” is not the best way to go. There are details in the rules, and the smart business takes advantage rather than being surprised by them.

A home installation satellite company did not keep sufficient records for their most hazardous business classification: tower work. During the audit, all their hours were assessed in this one classification that was six times the reported amount. – See more at:http://cath235lni.wordpress.com/

Rule 4: If there is a worker injury claim, pay attention and deal with it right away.

While it seems somewhat like getting car insurance after the wreck, there may be some risk mitigation that can occur if the issue is dealt with directly and in a timely manner – possibly avoiding a claims nightmare.

The last item is more of a suggestion than a rule, which is to be fair and truthful. Treating employees well is part of growing a successful team that will propel the business towards success.

Surprisingly enough, the benefits to the business may not only be a more productive and happier workforce, but lower risk exposure and lower workers comp premiums due to more detailed use of classifications in reporting.Tell employees and independent contractors what workers’ comp does for them – it’s essentially a medical and lost wage policy to protect them and those close to them.

Explaining to employees that keeping the boss informed about what is happening in the plant or in the field is simply part of helping ensure their proper protection.

Joanie Mann Bunny FeetMake Sense?

J

Many thanks to my friend Ted Carlson, Certified Fraud Examiner (retired), a veteran of the Department of Labor and Industries (L&I) in Washington State – responsible for Tax Discovery and Fraud Prevention field Audits.