Skip to Main Content

insightsarticles

Paycheck Protection Program: FAQs

04.13.20

Read this if you want more information about the Paycheck Protection Program (PPP).

Most likely you have heard of the PPP within the Coronavirus Aid Relief and Economic Security (CARES) Act that was passed into law March 27, 2020. Below, we’ve shared some of the questions we have heard from many of our clients. If you need more information or have questions regarding your specific question, please contact us

Question #1: What was the PPP designed for? 
Answer:
The PPP was designed with the goal of keeping American workers paid and employed. It aims to accomplish this by issuing loans to qualified businesses so that they can continue paying employees and other qualified expenses.

Question #2: Do you or your business qualify for this? 
Answer: There are several considerations when determining whether or not a business qualifies. For more information, see this recent blog post from Seth Webber, which address a number of these considerations. 

Question #3: What should the PPP loan be used to cover in your business?
Answer: The intent of allowable uses includes: (i) payroll costs, including (a) employee salaries, commissions, or similar compensations, (b) group health care benefits, (c) paid vacation, parental, sick, medical, or family leave, (d) allowances for dismissal or separation, (e) retirement benefits, and (f) state or local tax assessed on the compensation on employee;  (ii) payments of interest on any mortgage obligation, but not prepayment or payment of principal amounts; (ii) rent (including rent under a lease agreement); (iv) utilities; and (v) interest on any other debt obligations incurred before February 15, 2020. However, certain payroll costs are excluded, including salaries and wages which annualized amounts would result in compensation over $100,000 and sick and family leave wages for which a credit is allowed under the Families First Coronavirus Response Act.  

Additionally, you should consider the time period your allowable expenses are designated for. The Small Business Administration (SBA), in consultation with the Department of the Treasury (Treasury) issued a list of frequently asked questions (FAQs) and responses to these FAQs as of April 10, 2020, Paycheck Protection Program Loans FAQs. Within these FAQs, Question 20 asked, “The amount of forgiveness of a PPP loan depends on the borrower’s payroll costs over an eight-week period; when does that eight-week period begin?” The SBA and Treasury noted, “The eight-week period begins on the date the lender makes the first disbursement of the PPP loan to the borrower. The lender must make the first disbursement of the loan no later than ten (10) calendar days from the date of loan approval.” 

Question #4: What portion of the loan, if any, can be forgiven?
Answer:
The Treasury Department issued guidance on March 31, 2020 indicating that at least 75% of the forgiven amount should be used for qualified payroll costs. Although the covered period is specified as February 15, 2020 through June 30, 2020, forgiveness amounts of the loan are based on expenses (primarily payroll) during the eight-week period following the receipt of the loan. There are other aspects of the forgiveness provisions that impact the actual amount forgiven, including maintaining or quickly rehiring employees and maintaining salary levels, with the overall forgiveness amount being reduced if full-time headcount declines, or if salaries and wages decrease more than 25%.

Question #5: What about the portion of your loan that is not forgiven?
Answer:
For the portion of loan not forgiven, the life and terms of the residual loan appear favorable. Current guidance indicates a repayment period of two year loan at 1% interest. Included within this is a six-month deferral period on principal repayment. The loan does not require collateral or a personal guarantee.

Question #6: How should you keep track of the funding and allowable costs?
Answer
: Best practice would be to set up a separate banking account. This will allow you to bifurcate the funding source and offset that amount by costs tracked over the covered period directly. This allows you to use other cash reserves and funding sources to meet other expense needs during the covered period. The funds need to be brought over (into that separate banking account) within 10 days of the application being approved.

Question #7: What other resources are available if the PPP is not a good fit for you?
Answer:
There are additional programs available through the Small Business Administration (SBA) including the Economic Injury Disaster Loan (EIDL) program, which features an advance amount (EIDL Emergency Grant) of up to $10,000. Guidance remains outstanding on exact implications of the EIDL Emergency Grant amount with some SBA offices pointing to $1,000 per employee up to a total max of $10,000. This EIDL Emergency Grant does not have to be repaid, but if you subsequently receive funding through the PPP, your forgiveness amount will be reduced by the EIDL Emergency Grant amount. The EIDL program also features a max life of 30 year loan with interest rates of 3.75% and 2.75% for entities that are for-profit and non-profit, respectively. More information on this is detailed in Dave Erb’s recent blog post.

If you do not need to make use of the PPP and EIDL programs, but still face significant downturns in your revenue base, tax relief in the form of the Employee Retention Credit (ERC) may also be an option. The provisions of the ERC within the CARES Act specify eligibility as, an employer that does not participate in the PPP and: (i) a complete or partial shutdown in operations; or (ii) at least a 50% decline in gross receipts, based on quarterly comparison from 2020 to 2019. The ERC allows for a tax credit of 50% of qualified wages (max wages of $10,000 per employee and max credit of $5,000 per employee). For more information on the ERC provisions, see Bill Enck’s blog post.

As developments continue to unfold and changes in guidance continue to emerge, the BerryDunn Recovery Advisory Team can help you stay informed through the BerryDunn COVID-19 Resource Center.

Related Professionals

Principals

BerryDunn experts and consultants

Read this if you are a business owner or an advisor to business owners.

With continued uncertainty in the business environment stemming from the COVID-19 pandemic, now may be a good time to utilize trust, gift, and estate strategies in the transfer of privately held business interests. 

As discussed in our May 26, 2020 article, 2020 estate strategies in times of uncertainty for privately held business owners, there may be opportunity to free up considerable portions of lifetime gift and estate tax exemption amounts. This is due to suppressed values of privately held businesses, the uncertainty surrounding the impact of the 2020 presidential election on tax rates, and future exemption and exclusion thresholds.

An element of consideration is the ability to transfer non-controlling interests in a business. These interests are potentially subject to discounts for lack of control and lack of marketability, which may further reduce the overall value transferred through a given strategy. You could potentially offload a larger percentage of ownership in a business while retaining large portions of the gift and estate lifetime exemption. Part I of this series focused on the discount for lack of control (“DLOC”). Part II focused on the discount for lack of marketability (“DLOM”). In Part III, let’s focus on the application of discounts.

Application of discounts

One area that often trips up people unfamiliar with business valuations is the application of the DLOC and DLOM. These discounts are multiplicative, not additive. The combined effect of a 10% DLOC and a 30% DLOM is not an additive result of 40%, rather a multiplicative result of 37% (mathematically, 1 – [(1 – DLOC) x (1 – DLOM)]). Consider the following example:

Julie has a 10% minority, nonmarketable interest in a business. The equity of the business is worth $1,000,000. Her interest has a pro-rata value of $100,000 (10% of $1,000,000). Julie retained a qualified valuation analyst, who estimated that a 10% discount for lack of control and a 30% discount for lack of marketability were appropriate for the valuation of her interest. The difference in applying these discounts correctly through a multiplicative process and incorrectly through an additive process is demonstrated in the following chart:

It does not matter the order in which a DLOC and a DLOM are applied. Because these discounts are multiplicative, applying either one first will not affect the concluded minority, nonmarketable value.

Conclusion

Business owners are knowledgeable of the facts and circumstances surrounding a business interest. They take a close look at what they are buying before they make an offer. Like most people, they like to be in charge, and they prefer investments that they can readily convert into cash should they so desire. Therefore, people are generally not willing to pay the pro-rata value for a minority interest in a business when the interest lacks control and marketability. To assess appropriate discounts for lack of control and discounts for lack of marketability, consider resources such as those referred to in Part I and Part II of this series, then ensure the selected discounts are appropriate based on the factors specific to the company and interest being valued. From there, the application of the DLOC and DLOM is multiplicative, not additive, as noted in the example above. 

Given the current environment, using trust, gift, and estate strategies that take advantage of discounts for lack of control and marketability offers the opportunity to transfer a higher percentage of interest in a privately held company at a lower value. This potentially frees up additional amounts of remaining thresholds of the lifetime gift and estate tax exemptions. 

Our mission at BerryDunn remains constant in helping each client create, grow, and protect value. If you have questions about your unique situation, or would like more information, please contact the business valuation consulting team.  

Article
Discounts for lack of control and marketability in business valuations (Part III)

Read this is you are a business owner or an advisor to business owners.

With continued uncertainty in the business environment stemming from the COVID-19 pandemic, now may be a good time to utilize trust, gift, and estate strategies in the transfer of privately held business interests. 

As discussed in our May 26, 2020 article 2020 estate strategies in times of uncertainty for privately held business owners, there may be opportunity to free up considerable portions of lifetime gift and estate tax exemption amounts. This is possible due to suppressed values of privately held businesses and the uncertainty surrounding the impact of the 2020 presidential election on tax rates and future exemption and exclusion thresholds.

An element to consider is the ability to transfer non-controlling interests in a business. These interests are potentially subject to discounts for lack of control and lack of marketability. The discounts may further reduce the overall value transferred through a given strategy, potentially offloading a larger percentage of ownership in a business while retaining large portions of the gift and estate lifetime exemption. Part I of this series focused on the discount for lack of control. In Part II, let’s focus on the discount for lack of marketability.

Discount for lack of marketability

In the context of a hypothetical willing buyer and willing seller, the buyer may place a greater value on an ownership interest of an investment that is “marketable.” Marketable investments can be bought and sold easily and offer the ability to extract liquidity compared to an interest where transferability and marketability are limited. 

Simply put, buyers would rather own investments they can sell easily, and will pay less for the investment if it lacks this ability. Non-controlling interests in private businesses lack marketability—few people are interested in investing in a business where control rests in someone else’s hands. Discounts for lack of control commonly reduce the value of the transferred interest by 5% to 15%, discounts for lack of marketability can drop value of the business by 25% to 35%.

Market-based evidence of proxies for discounts for lack of marketability can be found within the following resources, studies, and methods (including, but not limited to):

  • Various restricted stock studies
  • The Quantitative Marketability Discount Model (QMDM) developed by Z. Christopher Mercer
  • Various pre-initial public offering studies
  • Option pricing models
  • Other discounted cash flow models

In addition to these resources, to fully assess the degree of discount applicable to a subject interest, consider company-specific factors when estimating the discount for lack of marketability. The degree of marketability is dependent upon a wide range of factors, such as the payment of dividends, the existence of a pool of prospective buyers, the size of the interest, any restrictions on transfer, and other factors. 

To establish a comprehensive view on the applicable degree of discount, here are more things go consider. In a ruling on the case Mandelbaum v. Commissioner1, Judge David Laro outlined the primary company-specific factors affecting the discount for lack of marketability, including:

  1. Restrictions on transferability and withdrawal
  2. Financial statement analysis
  3. Dividend policy
  4. The size and nature of the interest
  5. Management decisions
  6. Amount of control in the transferred shares

Conclusion

Business owners are knowledgeable of the facts and circumstances surrounding a business interest. They take a close look at what they are buying before they make an offer. Like most people, they prefer investments they can readily convert into cash, and are therefore generally not willing to pay the pro-rata value for a minority interest in a business when the interest lacks marketability. To assess an appropriate discount for lack of marketability, consider resources such as those referred to above, then ensure selected discounts are appropriate based on the factors specific to the company and interest being valued. 

Our mission at BerryDunn remains constant in helping each client create, grow, and protect value. If you have questions about your unique situation, or would like more information, please contact the business valuation consulting team.

Part III of this series will focus on the application of DLOC and DLOM to a subject interest.

1Mandelbaum v. Commissioner, T.C. Memo 1995-255 (June 13, 1995).

Article
Discounts for lack of control and marketability in business valuations (Part II)

Read this is you are a business owner or an advisor to business owners.

With continued uncertainty in the business environment stemming from the COVID-19 pandemic, now may be a good time to utilize trust, gift, and estate strategies in the transfer of privately held business interests. 

As discussed in our May 26, 2020 blog post 2020 estate strategies in times of uncertainty for privately held business owners, there may be opportunity to free up considerable portions of lifetime gift and estate tax exemption amounts through transfers due to suppressed values of privately held businesses, and the uncertainty surrounding the impact of the 2020 presidential election on tax rates and future exemption and exclusion thresholds. 

An element to consider when building on this opportunity is the ability to transfer non-controlling interests in a business. These interests are potentially subject to discounts for lack of control and lack of marketability. This may further reduce the overall value transferred through a given strategy, potentially offloading a larger percentage of ownership in a business while retaining large portions of the gift and estate lifetime exemption. Let’s focus on the discount for lack of control (DLOC).

Discount for lack of control

In the context of a hypothetical willing buyer and willing seller, the buyer may place a greater value on an ownership interest with the ability to make changes at their discretion, compared to an alternative ownership interest lacking control. Simply put, buyers like to be in control, and they will pay less for the investment if the interest lacks these characteristics. 

When valuing non-controlling business interests there is an inherent discount to full value recognized to reflect the fact that the subject interest does not hold a controlling position. As a result of this discount, the value of a non-controlling interest in a company will differ from the pro-rata value per share of the entire company. DLOCs alone commonly reduce the value of the transferred interest by 5% to 15%.

All else being equal, a non-controlling ownership position is less desirable (valuable) than a controlling position. This is because of the majority owner’s right to control any or all of the following activities: managing the assets or selecting agents for this purpose, controlling major business decisions, asset allocation choices, setting salary levels, admitting new investors, acquiring assets, selling the company, and declaring/paying distributions.
 
Market-based evidence of proxies for DLOCs can be found within the following subscription-based databases (including, but not limited to): 

  • Control premium studies published in the Mergerstat® Review series by FactSet Mergerstat/Business Valuation Resources
  • Closed-end fund data
  • The Partnership Profiles, Inc. Minority Interest Database and Executive Summary Report on Re-Sale Discounts for applicable entity types

In addition to these resources, to fully assess the degree of discount applicable to a subject interest, consider company-specific factors when estimating the DLOC. The degree of control for a subject interest may be impacted by relevant state statutes and the governing documents of the subject company. These factors are analyzed in conjunction with the current operational and financial policies established and implemented in practice by management to establish a comprehensive view on the applicable degree of discount.

Conclusion

Hypothetical business owners are knowledgeable of the facts and circumstances surrounding a business interest. They take a close look at what they are buying before they make an offer. Like most people, they like to be in charge, and are therefore generally not willing to pay the pro-rata value for a minority interest in a business when the interest lacks control. To assess an appropriate discount for lack of control, consider resources such as those referred to above, then ensure the selected discounts are appropriate based on the factors specific to the company and interest being valued. 

Our mission at BerryDunn remains constant in helping each client create, grow, and protect value. If you have questions about your unique situation, or would like more information, please contact the business valuation consulting team.

Article
Discounts for lack of control and marketability in business valuations

Read this if you are a business owner or advisor to business owners.

With continued uncertainty in the business environment stemming from the COVID-19 pandemic, now may be a good time to utilize trust, gift, and estate strategies in the transfer of privately held business interests.

In simple terms, business valuation is a function of future cash flow and the risk in achieving those cash flows. As uncertainty in the ability to achieve future cash flow rises, risk rises at the same time. The value of a business is driven by risk. Holding all else equal, as risk continues to increase, the value of a business decreases. Similarly, if all else is equal, a continuing decline in anticipated cash flow results in decreased business values. An increase in risk, coupled with growing uncertainty and decline in cash flow may create a compounding effect of depressing business values. 

Cash flow challenges

Even if the cash flow of a privately held business has held up thus far, there is great uncertainty as to future cash flow. The duration of this uncertainty is a major concern for many business owners in the current environment. It was not long ago that many were anticipating the pandemic impact would be short-lived, resulting in a v-shaped recovery. Those expectations have given way as national unemployment numbers continue to climb. This continued uncertainty may lessen the value of privately held businesses. Depending on the company, its expectations, and impact from industry and economic factors, the effect on future cash flow may be significant.

With these elements in mind, the current and near-term may serve as an advantageous time to consider the transfer of interests in a privately held business. Increased risk and lowered future expectations will combine, resulting in lower values—particularly as compared to performance during the recent strong economy. 

Further opportunities exist if you are considering transferring a non-controlling interest in a company. Discounts applicable to minority or fractional interests typically include discounts for lack of control and lack of marketability, and in some cases discounts for lack of voting rights. These discounts may serve to further reduce the overall value transferred through a given strategy. 

What strategies can be used to capitalize in this environment?

From a federal perspective, gift and estate tax lifetime exemption amounts are at all-time highs; currently, $11.58 million per individual in 2020. With portability, a married couple can gift or transfer over $23 million in value without incurring a federal gift or estate tax.

Coupled with the ever-increasing annual gift tax exclusion amount of $15,000 per recipient in 2020, executing a succession plan could not come at a better time. Individuals should be aware of the scheduled sunset of the above referenced amounts in 2025 with reversion back to previous levels of $5.0 million (adjusted for inflation).

Building on future uncertainty, the 2020 presidential election is quickly approaching, as well as budget concerns from federal and state administrative agencies resulting from COVID-19. As it is unknown whether the current estate gift and estate tax exemptions will remain at these all-time highs, it may be an opportune time to leverage the current lifetime exemption or annual gift tax exclusion. 

Given the likely decline in value of closely held business interests or marketable securities combined with historically low interest rates currently, transferring assets now that will likely rebound in value later will provide transferors/donors with the most bang for their buck. 

Certain trust vehicles are often beneficial in a low-interest rate environments and provide varying forms of flexibility to the grantor or donor. When combined with the increase in the charitable deduction limits for taxpayers who itemize their deductions, this is an optimal time for transferring assets.  

One of the most important aspects of estate planning is to review and update your estate plan regularly for changes in your financial or family situation. Estate plans are not static and should be periodically reviewed to ensure they achieve your goals based upon your current situation.

Our mission at BerryDunn remains constant in helping each client create, grow, and protect value. If you have questions about your unique situation, or would like more information, please contact the team.

Article
2020 estate strategies in times of uncertainty for privately held business owners

Read this if you are a business owner.

While recent articles within the exit planning community have noted a slowing of business transitions and exits, during times of uncertainty it may be even more important to focus on the opportunity at hand. Rather than waiting it out, we recommend that business owners try to be active, involved, and focus their efforts on improving their business.

The situation is similar to the ebb and flow of the tide. The current economy is the tide at an extreme low point. We know that the economy will recover, so what can be done in the meantime to take advantage of opportunities, and be ready to succeed when the tide rises?

Changing of tides

Suddenly, there has been a rapid and seismic shift in the landscape. Weaknesses and threats, rocks and hazards, may have emerged. How you choose to approach these perils will make a difference in the long term. Will you take the opportunity to discover, identify, assess, shore up, and mitigate these elements?

It is important to view this current state in the context of the larger, long-term perspective. Once the tide comes back, will you be able to set full sail ahead having built resiliency, redundancy, and strength into those areas while you had the opportunity? While the water is low, it presents a great opportunity for business owners to discover and understand: 

  • What broke first and why? 
  • How can you shore it up for better operations in the days ahead?
  • What weak spots you didn’t know about are now apparent?
  • How can you address those weaknesses?
  • How can you leverage existing resources differently to chart a path forward?

Models of priority

There are various stages or hierarchies of priority in thinking about the progress of a business. 

Each priority model features bases and pinnacles. The pinnacles of each model are realized in a long-term setting, after the remaining bases have been solidified. While continued development of a clear vision for your business is paramount, dynamic shifts in the landscape call for reassessment of the bases. In the long-term, self-fulfillment manifests from properly executed strategy, but in the near- and mid-term, these various frameworks force strategic planning back to assess and address the base components. 

The bases of each model should serve as safe havens for reversion. When facing uncertainty and failure, have you made your base strong enough to redirect your efforts in an actionable plan for the long-term?

Action Planning Pyramid and Value Maturity Index

Action Planning
Five Stages of Value Maturity

The Value Maturity Index, broken into five stages is a stepwise assessment of active exit and business strategy. Inherent in the value acceleration framework are the concepts of resiliency, redundancy, disaster recover, and actionable planning.

While we may have been fully entrenched in the build phase, setbacks due to dynamic changes in the landscape force us back to protect mode—the assessment and methodical shoring up of weaker points of the operation to protect against future downside risks.

Though this stepwise progression is linear in nature, keep in mind that flexibility and adaptability are paramount in changing course to address needs of your current state.

When we look at action planning, parallels can be drawn to the various models. Certainly, we are focused on continuing sales, marketing, and customer relationships, but it becomes a question of reversion to meeting the basic needs and serving client’s pain points rather than  beginning ground-breaking efforts. 

The current climate forces us to the base, with a focus on solidifying the exposed areas that may have been made apparent, and likely compounded, by the current realities. Concerns on management, metrics, core values, and priorities serve as the bases in need of coverage.

Maslow’s Hierarchy of Needs
 

Maslow's Hierarchy of Needs

Maslow’s Hierarchy of Needs1 is a well-known motivational theory in psychology that comprises a five-tiered model of human needs, whereby each successive tier must be fulfilled (beginning at the base) before rising to the next tier. It can be used to view similar information from a psychological perspective.

Value acceleration and creating successful outcomes are largely tied to a clear long-term vision. We typically reside in the Self-actualization level of the hierarchy of needs when undertaking the high-level view of the framework.

Based on the adaptability and call for sudden directional changes in today’s climate, we are not as concerned with these top levels. We have them in our back pocket for easy recall, but they are not the pressing issue staring us in the face.

If we think about shoring up bases (the Protect Stage), in considering this psychological model, our focus is on the “basic needs” level. That is, keeping people (self, family, and employees) safe and remaining connected for immediate continuity.

McKinsey & Company Event Horizons

McKinsey & Company Event Horizons

Many others in related fields are viewing the current situation in similar terms. In the McKinsey & Company Events Horizon view2:

  • Resolve addresses those immediate hurdles and challenges a business is currently facing.
  • Resilience focuses on near-term items to be addressed once the initial base is covered. 
  • Return views the mid-term horizon in understanding how to return to scale by focusing on understanding metrics and increasing the frequency of measurements for informed decision making. 
  • Reimagination and Reform typically go hand in hand, but without covering bases of needs, crafting a dynamic shift in operations to incorporate new environments may be counterproductive. 

However, once these bases have been clearly assessed and addressed, the path forward may appear dramatically different, in which case creative solutions to enhance opportunity should begin to form. Examples of this may include newly emerged revenue streams and opportunity areas, fully integrated systems and dashboards to capture timely decision making data points, or pivots in your business model adaptable and reactive to new environments.

One example that has been in the news recently involves CEOs being pleasantly surprised that productivity of employees has not dropped even though people are working from home. How sustainable is this productivity? What implications might this have for corporate real estate and office settings? The answers will vary widely, depending on your business and competitive environment.

Exposure, discover, and control

Back to our tides analogy for a moment. As the water receded, what new rocks were exposed or what existing challenges became more apparent? What is your plan to address these areas? Is this the time to make large investments in your company or the right investments? Now that the tide is out, it is time to shore up, move the rocks, and address elements of your business to prepare for long-term successes. Through our assessments, risk profiling, and benchmarking analyses, we help business owners discover the largest gaps across the company, prioritize the most impactful problem areas to address, and implement changes to enhance business value through continuous improvement. 

Taking stock of your company’s future through the incorporation of lessons learned will bolster value in the long-term by de-risking and developing new opportunities, methods, work, shifts in productivity, and shifts in mentality. That approach also brings lots of questions: If there are no early warning signs, why not? What should your indicators be? What metrics are crucial in identifying the pulse of your current situation? What is your business reliant on? How can you build information and indicators for rapid shifts in decision making? How strong are your current controls and how integrated are your management and information systems?

To answer these questions, you need to quantify and develop metrics that will aid in the early identification of future challenges, thus increasing your responsiveness with data-driven decision mechanisms. Having your fingers on the pulse of your company and understanding the impact of each input to your strategy will focus your attention on the information that matters most. This allows you to understand, position, and adapt to changes in your business and community environment in a proactive and agile manner. Measurements, forecasts, and dashboards should provide you with regular, valid, and relevant information you can use to take informed action in decision making.

Historical look backs during various points of time will allow you to key in on pivotal data indicators and inflection points. When looking at this from an operational view, industry and economic factors impacting your company can serve as corroborating pieces of evidence to further support data metrics analyzed.

As you perform look backs, it is also best practice to regularly study and update development, pipeline, and reliance metrics for feedback and information discovery with data integrated throughout your operations. This helps avoid lag time in reporting on stale information towards real-time actionable data points.  

Each metric is specific to your business and can be directly mapped back to increases in shareholder value. Understanding these drivers of business value will focus your attention and intention on improving in the right areas, while avoiding distracting and less impactful pain points.

Don’t fret over precision, rather build in flexibility and adaptability with scenario- and sensitivity-based criterion to understand changes, implications, and reliance of each input. Understanding these relationships in a broader scheme aid you in quick, impactful decision making guiding you towards enhanced value.

Resilience until the tides rise

This approach allows opportunity to fully assess the known and unknown problem areas, weaknesses, perils, and hazards your business may be facing. From that base you can begin to address these issues to scale effectively with lower overall risk when activity picks up.

Management metrics, core values, and priorities drive resilience for long-term continuity by shoring up the foundation to build for the future. Assembling evidence in troubled times provides opportunity to capitalize on and fulfill core values. Documenting these decisions and improvements memorialize your decision making, impact on value enhancement, and should serve as a playbook for future events.

What you make of the time you have now through identification, assessment, and addressing newly emerged risk areas provides the opportunity to increase success once the economy rebounds. We are here to help. If you have questions about your particular situation, or would like more information, please contact the business valuation consulting team

1Maslow’s Hierarchy of Needs, Saul McLeod, updated March 20, 2020. SimplyPsychology. www.simplypsychology.org/maslow.html.
2Beyond coronavirus: The path to the next normal, Kevin Sneader and Shubham Singhal, McKinsey & Company, March 23, 2020.  www.mckinsey.com/industries/healthcare-systems-and-services/our-insights/beyond-coronavirus-the-path-to-the-next-normal. COVID-19: Briefing note, March 30, 2020, Our latest perspectives on the coronavirus pandemic. Matt Craven, Mihir Mysore, Shubham Singhal, Sven Smit, and Matt Wilson. McKinsey & Company. www.mckinsey.com/business-functions/risk/our-insights/covid-19-implications-for-business.

Article
Value acceleration in times of uncertainty

Read this if you are responsible for cybersecurity at your organization. 

During the financial audit process auditors are required to develop and confirm their understanding of Information Technology (IT) and cybersecurity practices as it relates to financial reporting to better understand risks and because of auditors’ heavy reliance on data pulled from accounting information systems. As auditors, we have seen a significant increase in the amount of impactful incidents affecting not-for-profit organizations and our IT security experts often share valuable advisory comments in annual audit communications with our clients. With recent incidents and a very rapidly changing business environment, here are the three most important from the last six months that impact all not-for-profits. 

Board oversight of cybersecurity 

Cybersecurity gaps within an organization’s systems may lead to risk exposure and have material impacts on all aspects of operations. Responsibility for cybersecurity controls and for establishing a culture of awareness and security should come from the Board and senior leadership. Board members and senior leaders should stay apprised of cybersecurity efforts on a regular basis and incidents should be summarized and reported on a quarterly basis. 

The Board should also consider adding a member who is a professional with IT and cybersecurity experience to help manage and understand the specific risks to the organization and help drive and support cybersecurity efforts.

Ransomware threats and preventive controls

The use of ransomware as a profitable attack on organizations by hackers continues to rapidly increase. Within the last year there have been multiple high-profile incidents that illustrate the impact of a successful attack. These impacts fall into two main areas. One impact may be financial, as millions of dollars are paid to the bad actors as ransom in hopes of being able to regain control of systems. The second impact is operational, resulting in a loss of control of systems and data during the event. Potentially, an unsuccessful data restoration could result in the total loss of information and data maintained on your networks. 

Though no organization may be able to prevent a ransomware attack from occurring entirely, there are basic cybersecurity controls that help reduce the likelihood and impact of an attack. Preventive controls may include: 

  • Security awareness training on phishing emails and overall IT security practices for all organization users
  • Multi-factor authentication 
  • Access controls that prevent users from installing unapproved software onto organization-owned workstations and networks
  • Anti-malware software installed on devices that connect to organization systems 
  • Use of Zero Trust data management tools for backups
  • Disabling macros in emails (prevents back-end processes from automatically running) 

In addition to including these preventive controls to your cybersecurity program, your organization should assess current corrective controls already in place to react to a ransomware event if one is detected or reported. Corrective controls may include:

  • Disaster recovery plans/business continuity plans 
  • Incident response plans
  • Backup controls and restoration tests 

As the risk of ransomware continues to increase and the types of attacks continue to increase in sophistication, your organization should consider regular assessments of IT controls and cybersecurity practices on a regular basis. Such assessments may be performed in conjunction with annual financial statement audits as an expanded scope and/or as a separate annual IT assessment. 

COVID-19 IT considerations 

The global COVID-19 pandemic significantly impacted nearly every aspect of modern life, including the way we work. As personnel were sent home and literally became a remote workforce overnight, changes to IT systems and controls rapidly adjusted to accommodate this new way of business. 

Where controls and procedures were adjusted, if not suspended, your organization should review those changes and determine if controls should revert back to the pre-pandemic process—or be formally changed and documented as policy. 

Guidance from the American Institute of Certified Public Accountants (AICPA) dictates that a gap in controls associated with the pandemic is not a legitimate reason for not completing a control and that any changes must be documented and properly managed.  

Well over a year into the pandemic, the concept of a hybrid workforce has emerged as the predominant way employees and businesses want to work. Your organization should review current policies and procedures that may pre-date the pandemic to ensure that the updates both document and consider the current business environment. 

Additionally, with personnel working remotely or in a hybrid model, or a combination of both, you should assess practices for managing remote access and a hybrid workforce and, where needed, implement industry best-practice tools and procedures to accommodate a remote workforce while maintaining security controls. If you have questions regarding you cybersecurity procedures or want to learn more, please contact our team. We’re here to help. 
 

Article
Cybersecurity update for organizations: Considerations for boards and senior management