Procuring IV&V Services: A Practical Guide

In April 2024, the Governmental Accounting Standards Board (GASB) issued GASB Statement No. 103, Financial Reporting Model Improvements. The objective of this statement is to improve key components of the financial reporting model to enhance its effectiveness in providing information that is essential for decision-making and assessing a government’s accountability.

The biggest news about GASB Statement No. 103 is that it did not change the basis of accounting or presentation of governmental fund financial statements as we all had anticipated. For the past 10 years, GASB was reexamining the effectiveness of GASB Statement No. 34 Basic Financial Statements – and Management’s Discussion and Analysis – For State and Local Governments. Through this re-examination, they found the guidance was working well, but there were opportunities to make targeted improvements.

Previously, BerryDunn issued an article that, at a high level, summarized GASB Statement No. 103. In this article, we are going to focus specifically on the impact that GASB Statement No. 103 has on your Management's Discussion and Analysis (MD&A).

GASB Statement No. 103 reestablished a full set of requirements for the MD&A. This encourages governments to take a fresh look at the effectiveness of their MD&A. The new guidance directs governments not to just describe what changed during the reporting period, and by how much, but to also explain why those changes occurred. The guidance now requires greater description and detail about items discussed as currently known facts, decisions, or conditions expected to have a significant financial impact in the subsequent reporting period.

What makes a good MD&A and what your organization should focus on

The MD&A should be a story of your financial statements and an explanation of the significant changes in your entity’s finances from the prior year. When well written, the MD&A provides readers of the financial statements highly valuable information.

GASB Statement No. 103 emphasizes the following:

• The MD&A should be written for a reader who may not have a detailed knowledge of governmental accounting and financial reporting and may not be from the government’s geographical area.
• The MD&A should assist the reader in understanding why finances changed from the prior year, NOT just present the amount of the change.
• Encourage governments to avoid repetitive explanations in multiple sections of the MD&A.
• Clarify that the MD&A should discuss significant long-term financing activity during the year, not just debt, but leases, subscription-based information technology arrangements, and all other forms of long-term borrowing.

GASB states that the information presented in the MD&A should be confined to the following five sections:

1. Overview of the Financial Statements
2. Financial Summary
3. Detailed Analyses
4. Significant Capital Asset and Long-Term Financing Activity
5. Currently Known Facts, Decisions, or Conditions

Helpful tips when preparing your MD&A

To assist your entity in preparing the MD&A, we’ve laid out some helpful tips below.

• Write in a manner that is easily readable and can be understood by users who may not have a detailed knowledge of governmental accounting and financial reporting.
• Use charts, graphs, and tables to enhance the understandability of the information.
• Avoid unnecessary duplication.
• Avoid “boilerplate” discussion.
• Focus on the “why” and explanations.

The MD&A should include explanations and interpretations that explain the why. Some specific examples include:

• Increase in intergovernmental grant revenues
• Growth in revenues due to specific economic circumstances
• Increases in specific programs and functions
• Transfers to other funds
• Expenditures due to specific events

Use visuals to make information clear

To make the MD&A more visual and help the reader understand critical information, you can incorporate charts, graphs, and tables.

Below are a few examples that could be incorporated:

Contents of the Basic Financial Statements

Governmental Activities Revenues by Source

Governmental Activities Expenses by Source

If your organization follows the above tips, you will have an impactful MD&A that will be beneficial to the readers of your financial statements. Be sure to check out Exhibit 1 that is included in GASB Statement No. 103 for an example MD&A.

Be on the lookout for future GASB Statement No. 103 articles and how this new standard impacts your entity. When it comes to writing an impactful MD&A, BerryDunn’s Governmental Accounting Team can be a resource to your organization.

Amidst the cycle of public health underfunding, and in the shadows of the COVID-19 pandemic, agencies are trying to find financial stability in a space that has seen volatile and drastic changes in recent years. According to the National Association of County and City Health Officials, “The sustainability of the governmental public health system depends on the financial health of state and local public health agencies.” With this co-dependency of successful and sustainable public health services to financial stability, it is imperative to have a workforce that understands their obligations to effectively manage public funds.

A public health workforce in need of training

According to the 2021 Public Health Workforce Interests and Needs Survey (WINS), 54% of public health employees across the nation identified budget and financial management as a strategic skill that is highly important to their role but their proficiency in the area is low. This category outranked all other training needs assessed including change management, community engagement, and strategic thinking.

To help public health state agencies target budget and fiscal management training needs for their workforce, a comprehensive assessment can be utilized to examine four domains of administrative management activities with a focus on financial management. These four domains and topic areas include:

Reviewing these areas can help an agency assess its current decision-making and grant management processes to identify challenges that may lead to opportunities. Opportunities highlight what an agency can do with available resources to support equitable services. The opportunities are then used to inform a roadmap for process improvement and identify action items with a focus on training, policy development, monitoring, and communication. The roadmap defines an implementation strategy with measurable benchmarks and outcomes.

Overall, a comprehensive assessment can kickstart a strategic planning cycle developed to encourage fair and impartial administrative practices that adhere to federal regulations and offer opportunities to leverage additional funds in the future.

Using this framework, your public health agency can begin to manage administrative services wisely and fully leverage funding that can have the greatest impact on population health in the regions you serve. Ask “What are we doing to set up administrative routines for our agency that support equitable services?” and “How are we equipping our staff with the tools needed to effectively leverage resources that promote and improve population health?”

BerryDunn is experienced and poised to support cross-agency governance teams to undertake assessment and implementation activities. Through collaboration with agency leaders, BerryDunn’s team can facilitate discovery of opportunities for improvements in governmental budgeting and finance training, process improvement, development of finance tools and resources, and enhance communication and coordination between program and finance staff.

Learn more about how BerryDunn can support your agency in achieving these goals. If you have a specific question or if you'd like to set up an informational meeting with our team, please contact Julie Sullivan, Senior Manager and Practice Lead.

This article is a condensed version of our in-depth resource Seven well-being focus areas for a resilient workforce. Download the full report, which includes additional considerations, key takeaways, and real-world best practice examples.

It's important for organizational leaders to understand that employee perspectives on well-being are constantly shifting, as are their expectations from employers. To stay competitive in the recruitment and retention of employees, employers need to stay abreast of the current well-being trends—the ones that have the potential to move the needle in creating a thriving, healthy workforce. We’ve identified and analyzed the top seven trends for 2024 that should be top of mind for employers as they think about the future evolution of their well-being strategies.

Ongoing focus on mental health and resilience

Employers can play a pivotal role in cultivating an environment that benefits the mental well-being of all employees. And just as exercising and healthy eating benefit everyone (not only those with a physical health diagnosis), programs, resources, and cultures that cultivate mental well-being can help improve overall workforce resilience. For example, an environment where there is little to no stigma around mental health challenges and where supervisors and peers respect and openly support mental health self-care will better withstand the inevitable ups and downs that every employee and workplace will experience.

Modernizing financial well-being

Financial well-being begins with a fair and competitive salary. Fair and competitive needs to account for a variety of factors—including pay equity, cost of living, health insurance affordability, and executive pay ratios. Additionally, organizations should be providing employees with the resources, education, and benefits to help manage debt levels, save for the future, and cope with financial stress.

Some ways employers are addressing these needs include expanding benefits to include personalized financial counseling, credit/debt counseling, or implementing new incentives to encourage positive financial decisions. Other popular considerations relate to easing the burden of childcare expenditures and student loan repayment. For example, the SECURE 2.0 Act allows employers to match 401(k) contributions with employee student loan repayment (among other things). For organizations where pay is a known concern, it may be time to conduct a more in-depth compensation analysis to understand gaps in employee total rewards. https://www.berrydunn.com/news-detail/secure-20-act-of-2022-introduces-key-changes-for-workplace-retirement-plans

Telling the well-being story as part of the employer brand

An employer brand is how employees and job candidates experience an organization’s mission, values, and workplace norms. Workplaces that lead with a visible emphasis on shared values (versus policies and rules) cultivate trust and belonging. Well-being programs can bring organizational values to life—particularly those related to trust, excellence, collaboration, diversity, integrity, authenticity, and work-life harmony.

Consider the existing programs, benefits, and resources as different building blocks of an organization’s well-being story. Cataloging these elements by well-being dimension (e.g. physical, mental, social, financial, and career) and by employee persona (e.g., stage of life, dependent responsibilities, nature of work responsibilities, work environment) can help build a compelling story while also revealing gaps in the well-being strategy.

Download the full report, including key takeaways and best practice examples.

Connecting well-being with other “good for business, good for people” initiatives

Leaders across industries are seeing the business case for organizational strategies around a range of topics, including employee engagement, Diversity, Equity, and Inclusion (DEI), Triple Bottom Line (e.g., Environmental, Social, Governance [ESG] and Corporate Social Responsibility), upskilling, and organizational resilience. While each topic warrants some unique considerations and tactics, there is much opportunity for coordinated initiatives that support multiple goals.

Positioning humans for success in an AI-enabled, not-so-distant future

Generative Artificial Intelligence (AI) was fresh on the scene in 2023 and is already on a fast course to disrupt many aspects of business and work as we know it. From AI-powered personal assistants to chatbots that will write programming code, articles, and resumes, many employees are looking for ways AI can save time or eliminate undesirable tasks, while leaders are looking for opportunities to increase productivity.

AI is coming in hot and presents both risks and opportunities for well-being. Organizations should be looking for ways AI can improve both personal and professional well-being for employees—alleviating aspects of work that do the least for our well-being and augmenting aspects where humans thrive.

Flexibility still in flux

Finding the right flexibility approach is key. Multiple surveys conducted in the last six months indicate return to office results have been mixed. Many leaders have not seen the hoped-for productivity gains and many have lost more employees than expected in the transition. Flexibility is not a one-size-fits all solution, regardless of industry, size, location, or workforce demographics. The best flexibility models will balance performance management with a culture that promotes belonging, development, and trust. To find that balance, organizations will be well-served to take the time to evaluate the needs of their workforce, the needs of their business, and their capability to withstand, support, and manage different flexibility models.

Recalibrating physical wellness

While employers have limited control over personal well-being behaviors (and rightly so), there are steps organizations can take to set up employees for positive health outcomes. Free or low-cost healthy food, yoga classes, on-site fitness centers, and gym membership reimbursements are all fantastic benefits that will resonate with many employees and will also help set a tone that your organization values health. However, think of these as added perks. Most employees want to make healthier choices. It is not the organization’s responsibility or prerogative to convince them to be healthier, but an organization can take steps to make the healthiest choice the easiest and/or most affordable choice. The best way for an organization to support physical well-being is to remove barriers.

While it may be unrealistic to address all seven topics for your workforce, the key to being successful in 2024 is to take a holistic approach to well-being in the workplace. Leaders who recognize well-being’s broad impact and connection to other initiatives, and employ a strategic approach that considers how culture, programs, resources, and benefits work together, will be best positioned in creating a thriving workforce.

Download the full report, including key takeaways and best practice examples.

About BerryDunn's well-being consulting practice

BerryDunn partners with organizations to create work environments where business success and personal growth coexist, and where people are confident knowing their workplace positively contributes to their physical, mental, financial, and social well-being. We take a detailed approach to well-being, considering the whole person and the work environment to design well-being programs that are inclusive, equitable, and integrated into the way people work. Learn more about our well-being team and services. 

Read this if your organization would like to elect to receive clean energy tax credits directly.

Many tax credits and their incentives have often been difficult for tax-exempt and governmental entities to utilize given their lack of taxable income. The Inflation Reduction Act of 2022 (IRA) made several clean energy tax credits available to tax-exempt and governmental organizations under an elective pay option.

With the new election, tax-exempt and governmental entities will be able to treat certain pre-approved clean energy tax credits as an overpayment on a Form 990-T, resulting in a refund of the credit.

Who is eligible for the elective pay option?

Tax-exempt organizations including all entities exempt under IRS code section 501(c); state, local, tribal, US territories and political governments and their agencies and instrumentalities; the Tennessee Valley Authority; and rural electric co-operatives with valid EINs are eligible for the elective pay option.

What kind of credits are available?

IRS Publication 5817g outlines the credits available to these organizations under the elective pay option. This includes up to a 30% credit for qualifying renewable energy projects and up to a $40,000 credit for the purchase of commercial clean vehicles. Credits include:

Energy generation and carbon capture 

• Production Tax Credit for Electricity from Renewables
• Clean Electricity Production Tax Credit
• Investment Tax Credit for Energy Property
• Clean Electricity Investment Tax Credit
• Low-Income Communities Bonus Credit
• Credit for Carbon Oxide Sequestration
• Zero-Emission Nuclear Power Production Credit

Manufacturing 

• Advanced Energy Project Credit
• Advanced Manufacturing Production Credit

Vehicles 

• Credit for Qualified Commercial Clean Vehicles
• Alternative Fuel Vehicle Refueling Property Credit

Fuels 

• Clean Hydrogen Production Tax Credit
• Clean Fuel Production Credit

When to register the clean energy tax credits

IRS Publication 5817 outlines the steps required to claim any elective pay clean energy credits. Once the organization has identified the credit and qualifying project they would like to pursue, they will need to complete a pre-filing registration with the IRS online and obtain a valid registration number for each credit they would like to pursue.

The IRS recommends you register for the qualifying credit after placing the property into service but no earlier than the beginning of the tax period when you will earn the credit. Additionally, they recommend you register at least 120 days before the due date of the Form 990-T to allow time for review before issuing registration number(s).

How to register the clean energy tax credits

Registration for elective payment can be found on the IRS website at Register for elective payment or transfer of credits. An authorized representative of the organization may use the tool to complete the application. Your organization will need to start by selecting an authorized representative. This individual can be from within your organization, or your tax advisor may be authorized to file for you via completion of a Form 2848, Power of Attorney and Declaration of Representative. 

The IRS site will require the authorized person to verify their identity with photo identification by creating an ID.me account. Using their ID.me account, the authorized person will navigate to Energy Credits Online where they will enter the entity’s EIN to create a clean energy business account. 

Once signed in, the authorized representative will be required to submit general information, credit specific information, and answer common as well as credit specific questions. Additional information on using the pre-registration tool can be found in the user guide, IRS Publication 5884.

How to claim the clean energy tax credits

Once the project is approved, your organization must satisfy all requirements of the tax credit. For example, most credits are claimed in the tax year the qualifying project is placed into service. 

Many of the clean energy credits increase in percentage of expenditure if certain criteria are met. For example, both the Investment Tax Credit for Energy Property and Clean Electricity Investment Tax Credit start at a base of 6% of the qualified investment but increase five times to 30% if the project pays prevailing wages and uses registered apprentices. 

Tax-exempt and governmental organizations should consult with their project vendors to ensure their projects will qualify for the credits they intend to pursue. 

Finally, the tax-exempt or governmental organization will file an original, on-time Form 990-T and make a valid elective pay payment election using Form 3800 in the appropriate tax period to receive the direct payment. The election will not be permitted on a late or amended Form 990-T.

If your organization is interested in pursuing a clean energy credit made available under the IRA, please contact Scott Davis. BerryDunn is here to help you maneuver this new path forward for tax-exempt and governmental entities in clean energy tax credits.

Many organizations implement well-being strategies to advance culture, engagement, and business performance. They recognize that successful well-being strategies combine work design, benefit and program offerings, and the built environment (physical workplaces and virtual capabilities) to address a myriad of human capital challenges and opportunities. Yet, many organizations aren’t clearly connecting their well-being strategies to their risk management programs and Environment Social Governance (ESG) reporting.  

Reporting on the social component of ESG brings transparency to how an organization is managing human capital-related risks, the most prevalent in current ESG reporting standards being employee turnover. It also gives organizations the opportunity to share how they are supporting a workforce that can thrive both in and outside of work. 

Here are five ways an organization’s well-being strategy fits into their ESG reporting:  

1. Promoting healthy behaviors. The workplace is a recognized social determinant of health and can shape health behaviors for many individuals. Work shifts can influence sleep schedules, available food and beverage options can influence eating patterns, the nature of work and workplace features can influence safety and activity levels, health plan design can influence proactive and preventive healthcare decisions, and the culture drives many health-related behavioral norms. Workplaces that cultivate healthy behaviors not only see benefits to productivity, retention, and engagement, but also make a positive difference in helping to address local and national health challenges.

2. Cultivating social connection and belonging. The workplace is an important source of social connection for working adults. Yet 36% of Americans report feeling “serious loneliness.” Loneliness carries real consequences for individuals and workplaces. For instance, social isolation (even if only perceived) can increase inflammation in the body to the same degree as physical inactivity. Additionally, high belonging in the workplace is linked to a 56% increase in job performance, a 50% drop in turnover risk, and a 75% reduction in sick days. Organizations that emphasize the importance of connection right from the beginning of an employee’s onboarding journey, deliberately build in opportunities to connect as part of the work experience, and encourage workplace friendships can dramatically reduce feelings of loneliness among workers.   

3. Reducing mental health stigma. The quality of mental health in the US is a recognized national health crisis, with one in five adults living with a mental health condition, and mental health conditions on the rise in children and young adults. Unmanaged depression and anxiety have been shown to impair cognition, including problem solving, creativity, memory, and executive functioning. Organizations have the opportunity to bring visibility to mental health challenges, reduce stigma, and improve access to and quality of mental health resources for individuals and families.  

4. Educating employees to make sound financial decisions. Four out of five employers report that their employees’ personal financial issues impact their job performance. At a baseline, organizations are responsible for providing fair living wages to their employees. Organizations seeking to be employers of choice will pay competitive wages. Beyond how much employees are paid, organizations can equip employees with the knowledge and resources to make sound financial decisions in support of long-term financial independence. 

5. Supporting inclusion with flexibility. Flexible work schedules, “work from anywhere” arrangements, and alternative work schedules are all ways employers can support retention among talented employees who might otherwise leave the workforce or seek different job paths. Examples of employees who benefit most are those with caregiving roles (for children, elders, or other dependents) or who simply cannot afford to live near the office. Executed effectively, more flexible work arrangements can lead to improved retention and increased diversity.  

If you are interested in exploring how you can implement a well-being strategy for your organization and how you can integrate well-being into your ESG reporting, please contact our team.  

Start by assessing your organization’s well-being program 

Understanding the maturity level of your organization’s well-being program can help you benchmark, assess progress, and gain leadership support by showing a clear path to improvement. Our maturity model can help you assess where you are now.

While ransomware may not necessarily be a new topic, especially for those working in the information technology or security fields, it still is an important one to keep top of mind, particularly as ransomware attacks continue to be both effective and damaging. As we move forward, it may be helpful to first take a look back to learn from those who have fallen victim to ransomware:

• A 2022 Sophos study revealed 66% of participating organizations were attacked by ransomware.
• The same study reported the average ransom payment was $812,360, a number 4.8 times higher than it was in 2020.
• In 2021, the FBI’s Internet Crime Complaint Center (IC3) received 3,729 complaints identified as ransomware with adjusted losses of more than $49.2 million. 
• A 2022 Verizon report indicates that ransomware breaches have increased by almost 13% in one year, “an increase as large as the last five years combined.”

The ransomware threat is here to stay and we expect to see a continued increase in activity as attackers are finding ransomware attacks an effective and profitable venture. Despite the scary facts above, there are some tangible actions you can take to better protect your organization from ransomware.

IC3 and Verizon reports indicate that the top three methods of an initial ransomware attack are:

1. Phishing emails
2. Exploitation of desktop sharing software
3. Exploitation of software vulnerabilities

Let’s review these three popular attack methods and identify the steps that you can take to help protect against each of them.Most people today have at least one, if not more, email addresses. Email is a common attack route because the attacker can exploit human nature’s quick instinctual reactions. By fabricating an urgent, concerning, or stressful situation, an attacker can trick users into performing actions to compromise the security of their accounts and/or devices. In most ransomware cases, the attacker tries to get users to download malicious files or disclose credentials.

This category of software can include proprietary tools, as well as the remote desktop connection application that comes standard with the Windows operating system. While these remote access tools are typically used by IT departments for operational, maintenance, and support activities, they also create a potential entry point for attackers. Credentials obtained from various sources such as phishing (the email method above) or the unauthorized exchange of information (typically stolen from previous breaches), can be used with these remote access tools to gain control of a device. At that point, an attacker is free to gather information or deploy malicious payloads such as ransomware.

Organizations rely on a wide arrange of software to support business operations and manage data. The increasing popularity of cloud-based services and distributed working environments means that more applications and services are exposed to the internet, where anyone can see them. While increased accessibility to software and services can be beneficial to business operations, it can also be detrimental to security operations, as potential weaknesses and vulnerabilities can be identified and exploited by attackers.

These are the basic steps you should be taking in order to help protect your organization against ransomware attacks. First and foremost, ransomware should be identified as a real risk to your organization. Attackers can use email, remote access tools, and vulnerable software as an entry point to deploy ransomware, and deploying the tools and practices discussed in this article can help protect your assets from attackers.

No matter where you are on your security journey, there are things you should be doing to help reduce risk related to cyber-attacks. To learn more, or for help understanding how to improve your organization’s security controls to help prevent and recover from ransomware, please contact our cybersecurity experts. We’re here to help. 

Many organizations have become aware of the importance of focusing on Diversity, Equity, and Inclusion (DEI) in their workplaces and communities. But where to start? Discovering what DEI means for your organization and creating an environment of openness and trust are two good places to start, according to our guests on the first episode of BerryDunn’s Fresh Perspectives in Social Work podcast. Host Andrea Richardson spoke with Dr. Christine Moses, CEO of Buffalo Cloud Consulting, and BerryDunn’s Melinda Kirrane about things organizations can be thinking about as they embark on their DEI journeys. Here are some highlights from the conversation.

Discover what DEI means for your organization

DEI is not one-size-fits-all. How you define it should be based on your organization and those you serve. A good place to start is to recognize past harm that has been done. Have there been complaints or criticism? Do they have a common theme? Perhaps you need to address access to multi-lingual materials or the lack of diversity in your C-suite. Acknowledge, own, and fix the problems you’re already aware of. Once you start to do that, you start to build a culture of trust and openness that will encourage others to speak up. Whatever dialogue that follows should be encouraged and acted on.

Start where you’re at and don’t be afraid to fail forward

DEI is a journey that can bring up uncomfortable feelings. Understand that everyone has room to grow. Start by listening and spending time with others who have different backgrounds than you and start to understand your own biases – we all have them. This work can bring up feelings of guilt, shame, and blame. Allow yourself and others to be vulnerable and do work to create safe spaces for conversations to happen.

Normalize conversations about race in the workplace

Many of us try to avoid any controversial topics in the workplace because it might seem unprofessional or we’re afraid to start a conflict. But in order to make a workplace truly equitable, you must create a space where people can talk about race openly. If possible, have an independent third party facilitate equity workshops with groups, such as your board, your leadership team, and other cohorts, so employees have safe spaces to explore their biases and provide constructive criticism. For leaders, being humble and listening are your biggest assets. By listening, you not only identify areas for improvement, but often will get viable solutions that you may not have thought of.

Understand that the work benefits everyone

If your organization is undertaking DEI work because it’s something you feel like you should do, it’s probably not going to work. Be in it for the right reasons and understand that this work has the potential to make the workplace better for everyone. DEI can be the first step on a journey to creating an inclusive culture where everyone feels open to expressing themselves and can bring their best selves to work–resulting in greater creativity and innovation across the organization.

Commit to long-term change

DEI work is not a project that you complete and check off your list. To be successful, it’s ongoing, evolving work that never ends. Systemic change takes years to accomplish, so setting milestone goals can help keep you on track. It won’t happen overnight. If you commit to it for the long term, you will create an environment where people can reach their full potential.

Listen to the full two-part conversation on BerryDunn’s Fresh Perspectives in Social Work podcast, with host Andrea Richardson, Senior Consultant for state government at BerryDunn, Dr. Christine Moses, CEO of Buffalo Cloud Consulting, a DEI and belonging coaching, education, and management consulting firm, and BerryDunn’s Mindy Kirrane, Senior Consultant and co-lead of BerryDunn’s internal Diversity, Equity, Inclusion, Belonging, and Access committee. 

Part 1: Achieving equity in human services systems

Part 2: A commitment to DEI

More DEI resources

• Race Forward 
• The Government Alliance on Race and Equity 
• The Racial Healing Handbook 

Read this if you are concerned about cybersecurity.

A glance at the current cybersecurity landscape

Cybersecurity has become a priority for organizations of all types. From small to large businesses, and government agencies to non-profits, leaders must consider an increasing number of cyber threats, risks, and vulnerabilities. The cost of handling a cyber incident can be alarming, and so nearly every cybersecurity-related decision must be measured against its effect on the organization’s cyber risk profile. 

Many leaders manage cyber threats by implementing the best controls and systems their budget will allow in order to mitigate cyber risks and improve their overall cybersecurity posture—this is wise. But regardless of how diligent an organization is, there is always the possibility that a zero-day vulnerability is exploited by a threat actor or that an employee falls victim to a social engineering attack.



Unaddressed gaps in an organization’s cybersecurity controls—which have become increasingly evident during the COVID-19 pandemic—are making it easier for threat actors to target and carry out cyberattacks. These attacks are increasing in frequency and complexity and organizations of all sizes in all industries are being targeted.

Instead of accepting the potential financial risks associated with cyberattacks, many organizations are beginning to consider a more pragmatic approach, similarly to how they address other organizational risks and uncertainties: they transfer some of the financial risk to an insurance company (at a cost of course). In the event of a cyberattack reputational or operational risk still resides within the organization, it can be helpful to use cybersecurity insurance to help with the financial impacts of cyberattacks. 

What is cybersecurity insurance and why is it important?

Cybersecurity insurance, also called cyber insurance or cyber liability insurance, is a type of insurance policy that provides organizations with a combination of coverage options to help protect against the financial losses caused by cyber incidents like data breaches, ransomware, and other cyberattacks. Cybersecurity insurance coverage works just like other insurance policies that cover financial losses in the event of physical risks and natural disasters.

Cybersecurity insurance policies can cover financial costs associated with legal fees and expenses, notifying customers about a data breach, restoring personal identities of affected customers, recovering compromised data, repairing damaged computer systems, as well as other potential costs. Financial assistance with notification to those impacted by a breach is getting increasingly more important because more and more states are requiring organizations to notify customers of a data breach involving personally identifiable information (PII) in a timely manner—a process that has proven to be very expensive. For example, the California Consumer Privacy Act (CCPA) requires organizations to notify all California residents who were affected by a data breach without unreasonable delay. Other states have enacted similar requirements. 

A cybersecurity insurance policy can be a valuable component of an organization’s cyber risk management program, as it is designed to improve the organization’s cyber risk profile—at least in terms of financial risk. However, a cybersecurity insurance policy should only be considered after an effective cybersecurity strategy, with sufficient cybersecurity controls in place, has been implemented. In other words, cybersecurity insurance should complement an organization’s existing cybersecurity processes and technologies to help reduce the financial burden of a potential cyberattack, but it should not be the only strategy that is implemented by an organization. 

Who should buy cybersecurity insurance?

All organizations that create, store, and manage electronic data online, such as PII, protected health information (PHI), and personally identifiable financial information (PIFI), can benefit from cybersecurity insurance; however, enterprise risk management drives cybersecurity decisions, and that includes whether to purchase cybersecurity insurance or not.

Due to the increasing number of cyberattacks over the last few years, the cybersecurity insurance market is evolving and becoming more complex, and many organizations are choosing to forgo this type of insurance because of increasing costs. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) is encouraging organizations to focus on improving their cybersecurity controls first, in order to receive cybersecurity insurance coverage at more affordable rates.

Even before the COVID-19 pandemic, insurance companies had been tightening requirements for coverage and asking for more evidence that organizations are doing their due diligence to mitigate against cyberattacks. Whether it is detailing backup procedures or answering questions on specific security controls or systems in place, organizations looking for cybersecurity insurance can expect a more rigorous underwriting process going forward—the days of simple questionnaires are over. 

How to lower cybersecurity insurance costs

Fortunately, for organizations interested in purchasing cybersecurity insurance, there are ways to decrease premium costs. This includes implementing strong identity security controls and following industry best practices to protect against phishing and credential theft, ransomware, data breaches, and other cyber risks. More specifically, this includes implementing a robust cybersecurity strategy comprised of layered security controls. Examples of cybersecurity controls and best practices that insurance companies look for are included in the table below. By demonstrating that these controls are implemented and best practices are followed, an organization can significantly reduce their cybersecurity insurance premiums. 

Conclusion

Organizations can accept the risk of financial loss from a cyberattack, avoid risky endeavors, implement cybersecurity controls and systems, and adhere to industry best practices, but some risk of a cyberattack will remain. 

The most important step an organization can take to help prevent cybersecurity attacks or mitigate the impact of a cyber incident is to focus on improving cybersecurity controls, processes, and technologies. By doing so, the organization is not only reducing potential risks, but also positioning itself to purchase cybersecurity insurance coverage at more affordable rates. While each insurance company’s evaluation process varies, there are certain security controls that are almost always required for an organization to acquire cybersecurity insurance coverage. This often involves Identity and Access Management (IAM) controls and best practices in alignment with industry standards put forth by the Center for Internet Security (CIS), CISA, and others.

For organizations looking to address the financial costs associated with cyber risk, they should look to an insurance company to understand if the cost of insurance and coverage received would complement their existing cybersecurity risk management program. However, in the event of a cyberattack, it is critical the organization understands that other risks such as reputational and operational risk will always remain, regardless of the insurance coverage.

If your organization is interested in purchasing cybersecurity insurance, the following link provides more information and general tips on what your cybersecurity insurance policy should include: Cyber Insurance | Federal Trade Commission.

Below are some helpful takeaways from recent breach reports to consider: 

Sources:
Cyber Readiness Report 2022 | Hiscox
Cost of a data breach 2022 | IBM
2022 Data Breach Investigations Report | Verizon