Skip to Main Content

In light of the recent cyberattacks in higher education across the US, more and more institutions are finding themselves no longer immune to these activities. Security by obscurity is no longer an effective approach—all institutions are potential targets. Colleges and universities must take action to ensure processes and documentation are in place to prepare for and respond appropriately to a potential cybersecurity incident.

All teams experience losing streaks, and all franchise dynasties lose some luster. Nevertheless, the game must go on. 

The world of professional sports is rife with instability and insecurity. Star athletes leave or become injured; coaching staff make bad calls or public statements. The ultimate strength of a sports team is its ability to rebound. The same holds true for other groups and businesses.

Any sports team can pull off a random great play. Only the best sports teams, though, can pull off great plays consistently — and over time. The secret to this lies in the ability of the coaching staff to manage the team on a day-to-day basis, while also continually selling their vision to the team’s ownership.

A professional sports team is an ever-changing entity. To have a general perspective on the team’s fluctuating strengths and weaknesses, a good coach needs to trust and empower their staff to discover the details. Chapter 5 in BerryDunn’s Cybersecurity Playbook for Management looks at how discovery can help managers understand their organization’s ever-changing IT environment. 

Just as sports teams need to bring in outside resources — a new starting pitcher, for example, or a free agent QB — in order to get better and win more games, most organizations need to bring in outside resources to win the cybersecurity game.

As a leader in a higher education institution, you'll be familiar with this paradox: Every solution can lead to more problems, and every answer can lead to more questions. It’s like navigating an endless maze. When it comes to mobile apps, the same holds true. 

It may be hard to believe some seasons, but every professional sports team currently has the necessary resources — talent, plays, and equipment — to win. The challenge is to identify and leverage them for maximum benefit.

It’s one thing for coaching staff to see the need for a new quarterback or pitcher. Selecting and onboarding this talent is a whole new ballgame. Various questions have to be answered before moving forward: 

When it comes to IT security, more than one CEO running a small organization has told me they have really good people taking care of “all that.” These CEOs choose to believe their people perform good practices. 

For professional baseball players who get paid millions to swing a bat, going through a slump is daunting. The mere thought of a slump conjures up frustration, anxiety and humiliation, and in extreme cases, the possibility of job loss.

In healthcare, coding compliance isn’t just about accuracy—the true why behind it is to protect integrity, revenue, and trust. When hospitals and health systems need to develop an internal coding compliance audit plan, it’s important to focus on education, building a culture of accountability, and accuracy. Starting with the why will help staff understand the importance of proactive auditing. It’s far better to identify issues internally than to discover them during an external review. 

Assess your coding compliance process

After connecting staff and leaders to the “why” of proactive coding audits, assess current processes by asking: 

  • Where are the gaps?

  • Are coders supported with regular education?  

  • What topics have been covered?  

  • Is the education provided by an accredited source? 

  • When are the audits conducted (monthly, quarterly, yearly)? 

  • Are the audits conducted internally or from a vendor? 

  • Has a clear baseline been established to make it easier to design an effective, realistic plan? 

Key ingredients for a good audit plan 

Every good audit plan should define the what, how, who, and why: 

  • What services will be audited and why? 

  • How often will audits be conducted and what triggers expanded audits?  

  • How will results be communicated with staff? 

  • Who is responsible for implementing corrective action plans? 

  • Why is this audit being conducted? (Is it based on payer denials or has an internal issue been identified?) 

Corrective action plans and oversight

While conducting audits and reporting findings is essential, it is equally imperative to implement documented, corrective action plans to ensure that any identified deficiencies are properly addressed and resolved. Throughout this process, establishing a strong partnership with the revenue cycle team can be invaluable, especially for managing rebilling, processing refunds, or addressing charge master discrepancies.  

This collaborative approach helps drive meaningful improvements and supports the overall integrity of the organization’s compliance efforts. Once corrective action plans are in place, ongoing monitoring is crucial to verify their effectiveness and to ensure that identified issues do not recur. Continuous oversight not only validates the success of corrective actions but also reinforces a culture of sustained compliance and accountability. 

Strengthen your organization with an audit plan

In the Health Care Compliance Association’s® 2025 Healthcare Industry Compliance Staffing & Budget Benchmarking Survey, more than half of publicly traded healthcare organizations reported annual compliance budgets of $1 million or more—reflecting the investment being made in compliance functions, which typically includes audits, monitoring, etc. This seems like a hefty budget, but the key here is scalability. Healthcare organizations across the care continuum, regardless of size or tax status, should focus on developing a reasonable, risk-focused plan. 

Remember, an audit plan isn’t a one-time project. It’s an ongoing process that evolves with regulatory and payer policy changes, new technology implementations, and organizational growth. Even more important than adapting to these changes is fostering a non-punitive culture. The goal isn’t to assign blame; it’s to strengthen accuracy, compliance, and confidence across the organization. 

BerryDunn can help

BerryDunn’s healthcare compliance team includes experts in coding, auditing, clinical documentation improvement, and revenue integrity. We can assess or develop your organization’s coding compliance audit plan, perform regular audits, and provide coder or provider education. Reach out to learn more about our team and services.  

Article
How to build a strong healthcare coding compliance audit plan

Read this if you are a CEO, CFO, or COO at a Federally Qualified Health Center (FQHC). 

This article is the second in a three-part series to help FQHCs understand how site- and program-specific accounting is essential to sustainability. Next up: Gaining operational insights on programs and sites from your data.

Site- and program-specific accounting can be a lifeline to FQHCs struggling with sustainability by providing a more granular look into operations. This approach allows an FQHC to gain key insights into the performance of its programs and sites and use those insights to make data-driven decisions to improve operations. To implement this method, an FQHC must set up its general ledger (GL), payroll, and Electronic Health Record (EHR) systems to report at the appropriate level of detail so that data flows cleanly into its accounting system. 

Step 1: Restructuring your general ledger 

The first step is to fine-tune the GL. This requires defining all programs and sites in the GL and creating processes for identifying expenses so that you can begin to record them accordingly. Programs and sites need to be set up to include a general administrative program, along with a mechanism to ensure those administrative costs are coded into that cost center. It’s imperative to establish a consistent allocation method for applying those overhead costs to the respective programs and sites. This will give you the gross margin for each program and site. Overhead costs, which are generally fixed, must also be factored in to give a view of your bottom-line profitability. 

Having this level of insight into programs and sites gives FQHCs a clearer view to determine strengths, weaknesses, and opportunities for maximizing efficiencies and operational effectiveness. This data helps an FQHC model what is possible and make informed operational decisions. 

Step 2: Modifying your payroll data 

Next, an FQHC must adjust its payroll system setup. Payroll data is typically exported to generate journal entries for recording in the GL or is uploaded directly to the GL. The same principles for identifying programs and sites apply to payroll. While the GL is the easiest route to refining payroll setup, an entity may not be able to define sites due to limitations on the number of labor distribution elements in its payroll system. Another option is to export payroll data into Excel and use lookup tables that denote an employee’s role (i.e., medical provider, dental provider, behavioral health provider) and location, so that their salaries can be assigned to the appropriate program and site. Using the Excel spreadsheet, an FQHC can generate a journal entry by site and program and then upload it to the GL. This is often the easiest and most effective method.  

If an entity has a payroll system that can be defined at this level of site- and account-specific detail, that is another possible route. However, this approach requires significant upfront and ongoing resource commitment, and many smaller entities do not have the bandwidth to dedicate staff and time to configure and maintain the system, which often makes it impractical. 

Step 3: Setting up your EHR 

The third step is to record patient service revenue by program and by site. This requires structural adjustments within the EHR system to clearly define programs and sites. Once set up, EHR reports can be exported to generate revenue entries that are uploaded to the GL. Expenses can be viewed by program and site, indicating profitability and providing visibility into the ROI of providers. Looking at patient revenue less direct expenses serves as a good measurement tool.  

How much data is enough? 

With processes in place and systems modified appropriately, an entity can start measuring profitability with a greater level of detail. When generating financial statements for the month, additional income statements by program and site should also be produced, which makes viewing data monthly a good starting point.  

A month’s worth of data helps an entity uncover if one site or program is excelling, or others are underperforming or have higher costs. A closer look can reveal how success in one program might be replicated in others, or how a high-performing site could be masking the failure of another site. Site- and program-specific accounting supplies the data needed to support key decisions related to programs and sites.  

About BerryDunn 

Faced with rapid changes in an increasingly competitive environment, community health centers rely on our seasoned professionals to refine business strategies, streamline operations, and introduce proven best practices to enhance performance while managing costs. Our team works with a comprehensive range of community health providers, including FQHCs, FQHC Look-Alikes (LALs), and Rural Health Clinics (RHCs). Learn more about our team and the services we provide. 

Article
Three steps to modify accounting for FQHC sustainability

November 25, 2025 updateOn November 25, 2025, the FDIC finalized its regulatory threshold updates rule. As mentioned in an FDIC press release, “the changes set forth in the final rule provide a more durable framework preserving certain regulatory thresholds in real terms, thereby avoiding unintended and undesirable consequences.” Although effective January 1, 2026, the final rule provides immediate burden relief to insured depository institutions that are currently subject to part 363 requirements but will no longer be subject to such requirements under the updated thresholds in effect as of January 1, 2026.

Originally published on August 29, 2025

The FDIC has proposed raising several key regulatory thresholds, including those that determine which institutions must comply with Part 363’s audit and internal control requirements. The primary driver behind these proposed changes is the growth experienced by institutions since the original thresholds were set decades ago. Due to inflation, the proposal aims to cover a similar number of institutions as when the thresholds were originally set. For example, the proposed increase to $5 billion for the Internal Control over Financial Reporting (ICFR) threshold, as described below, would still cover approximately 75% of institutions today.  

In addition to increasing these thresholds, the proposal also recommends that the thresholds be automatically adjusted based on some inflationary factors going forward. While the changes are designed to ease compliance burdens for smaller institutions, they also come with a cautionary tale—they would reduce regulatory requirements, but not the risk. 

What the FDIC proposal means 

Under the proposal

  • Approximately 800 institutions may find themselves newly exempt from Part 363 compliance due to changes in 24 regulatory asset thresholds. The following items are the most likely to be relevant for community banks:

    • Banks under $1 billion in total assets would no longer be required to: 

      • Create a separate audit committee as part of the institution’s board of directors

      • File annual reports 

    • Banks under $5 billion would no longer need to: 

      • Include management assessments or auditor attestations on ICFR 

      • Require the audit committee directors to be independent from management 

      • Require the audit committee directors to include members with banking or related financial management expertise, have access to its own outside counsel, or exclude large customers of the institution 

    • Audit committee independence criteria would increase from $100,000 to a $120,000 compensation threshold. This threshold would not be indexed against inflation as it is meant to align with the listing standards of national securities exchanges. 

  • Parts 303, 335, 340, 347, and 380 would also have changes if this proposal is enacted: 

  • Part 303 – de minimis thresholds: 

  • Increased from $1,000 to $1,225 and from $2,500 to $3,500 for certain criminal offenses 

  • Part 335 – Insider loan disclosures: 

  • Raised the threshold from $5 million to $10 million 

  • Parts 340 & 380 – Asset sales restrictions: 

  • Raised the “substantial loss” threshold from $50,000 to $100,000, which could allow an increase in potential bidders who are eligible to purchase failed institution assets 

  • Part 347 – International banking: 

  • Raised limits for foreign underwriting and dealing from $60M to $120M and from $30M to $60M. This is less likely to have an impact unless you have foreign operations. 

Why ICFR still matters for community banks 

Even without a federal mandate, effective ICFR offers tangible benefits: 

  1. Fraud prevention: Segregation of duties, account reconciliations, and control monitoring are critical to detecting and preventing fraud—especially in lean staffing environments. 

  1. Operational efficiency and reducing material misstatements: ICFR can help identify process inefficiencies and reduce errors. It can also help with training, as processes tend to be more clearly documented when they are being tested on an ongoing basis. 

  1. Regulatory confidence: Examiners still expect clear documentation of key controls and risk assessments—even if an ICFR opinion is no longer required. 

  1. Merger and acquisition readiness: Strong internal controls enhance bank value in due diligence settings, especially in today’s consolidation-driven environment. 

  1. Board-level accountability: Internal controls provide visibility into operational risk that supports informed governance and oversight. 

  1. Preparing for the next threshold: Many hours have been spent getting your documentation ready for audits, including creating, updating, and monitoring your internal controls. Walking away from the effort already put forth would mean a significant amount of time and resources to re-establish your documentation and controls as you prepare for the next threshold. Keeping your current internal practices in place with annual updates and regular monitoring will help make that next transition as smooth as possible. 

What we recommend 

For banks that would be newly exempt under the FDIC’s proposed changes, we suggest a right-sized, risk-based approach

  • Maintain documentation of your key accounting controls and processes, including reconciliations, journal entries, and credit loss provisioning. This documentation should be updated at least annually by control owners. 

  • Conduct periodic walkthroughs of high-risk processes (e.g., wire transfers, loan approvals) to identify gaps, inefficiencies, and areas of documentation that need to be updated. 

  • Leverage internal or outsourced testing of controls. The frequency of this testing will likely be dependent on your institution’s risk assessment of each operational area. 

  • Educate your board on how ICFR practices support accountability, even without formal reporting requirements. 

  • Create a compliance checklist related to threshold changes to stay up-to-date with compliance requirements going forward: 

  • Indexing monitoring plan 

  • Establish a process to track inflation-based threshold changes: 

  • Every 2 years, or 

  • More frequently if the Consumer Price Index for Urban Wage Earners and Clerical Workers (CPI-W) rises above 8%. Thresholds will not be reduced in deflationary periods. 

  • Assign responsibility for monitoring CPI-W and updating compliance scope 

  • Governance and board oversight 

  • Reassess audit committee composition and independence under new thresholds 

  • Review director compensation against the $120,000 independence threshold 

  • Document any changes to board and/or audit committee structure or oversight responsibilities 

  • Audit planning adjustments 

  • Revise audit scope and frequency based on updated regulatory requirements 

  • Coordinate with external auditors to align expectations and engagement terms 

  • Adjust risk assessments to reflect changes in compliance burden and oversight 

  • Reporting and documentation 

  • Ensure proper documentation of decisions not to file Section 19 applications due to new thresholds 

  • Maintain records of threshold applicability reviews and indexing updates 

  • Prepare for potential regulatory inquiries regarding compliance scope changes 

  • Stakeholder communication 

  • Brief the board on regulatory changes, compliance impacts, and audit committee implications 

  • Provide training or guidance to relevant teams (e.g., HR, compliance, finance) 

Final thoughts 

We understand the burden of ICFR compliance—and for many small banks, the relief reduces their already heavy regulatory burden. However, a move to step away from a well-established control environment has the potential to create downstream issues you might not see until it’s too late. 

Strong internal controls are not just a box to check for regulators and auditors—they're a tool for protecting your institution, your people, and your reputation. Regulators, investors, and auditors still care about the strength of your bank’s control environment—whether or not it's required by regulation. 

Maintaining strong internal controls remains a best practice—and a strategic imperative. Both are essential to your bank’s resilience, integrity, and long-term success. 

Let’s talk 

If your bank is approaching a new threshold or deciding whether to scale back ICFR documentation, we’d love to help you build a right-sized internal control approach that matches your risk profile. Reach out to our team with questions. 

Article
FDIC Proposal: How community banks can adopt a right-sized risk-based approach

Liquidity is the lifeline of any nonprofit organization. Strong liquidity ensures uninterrupted programs, financial stability, and the flexibility to respond to unexpected challenges. This article shares practical steps to monitor and manage liquidity effectively, including setting clear policies, tracking cash flow, using key financial ratios, managing reserves, and leveraging technology. By following these best practices, organizations can maintain resilience, build trust with stakeholders, and stay focused on their mission—even during uncertain times. 

What is liquidity and why it matters 

Liquidity refers to your ability to pay the bills on time, every time. For nonprofits, strong liquidity means uninterrupted programs, happy staff, and the flexibility to handle unexpected challenges. Weak liquidity? That’s like running a marathon without water stations. It’s not pretty. 

Building a solid foundation 

Start with a clear liquidity policy. Define minimum and target levels. Many organizations aim for at least three months of operating expenses. Spell out who monitors compliance and what happens if thresholds aren’t met. A written policy avoids panic and promotes accountability. 

Next, keep an eye on cash flow. A rolling forecast is your financial weather report. Update it monthly—or weekly during uncertainty—to project inflows like grants and donations and outflows like payroll and rent. Comparing actual results to forecasts helps you spot gaps early and act before they become crises. 

Know your numbers 

Ratios tell the story. The current ratio (current assets divided by current liabilities) shows if you can cover short-term obligations; aim for above 1.0. The operating reserve ratio (unrestricted net assets divided by annual expenses) measures your ability to weather revenue shortfalls. Tracking these trends over time helps you plan. 

Operating reserves are your safety net. Target three to six months of expenses and keep funds accessible. Require board approval for use because rainy-day money shouldn’t fund sunny-day shopping. 

Stay on top of receivables and payables 

Stay up to date with accounts receivable billing and collections, and make sure to collect pledges promptly. Manage your accounts payable smartly. Work to align payments with cash inflows and negotiate terms when needed. These habits prevent liquidity bottlenecks and keep relationships strong. 

Understand restrictions and communicate 

Restricted funds aren’t for general expenses, so track them carefully to avoid compliance headaches. Review donor agreements regularly—because “oops” isn’t a strategy. And don’t keep liquidity conversations behind closed doors. Share updates with your board and key stakeholders. Transparency builds trust and can even spark extra support when times are tight. 

Use technology to your advantage 

Modern financial tools can automate forecasts, flag risks, and provide real-time dashboards. Cloud-based systems make oversight easier and reduce manual errors, giving leadership the data they need to make smart decisions. 

When liquidity gets tight 

Act fast: accelerate receivables, negotiate with vendors, cut discretionary spending, and explore bridge financing or emergency grants. Planning ahead beats scrambling later. 

Monitoring liquidity isn’t about fear; it’s about freedom. Freedom to seize opportunities, weather storms, and keep your mission strong. With these practices, your organization can stay resilient and focused on impact. 

BerryDunn can help 

Our nonprofit experts bring a clear understanding of nonprofit funding, in-depth knowledge of complex compliance requirements, and the industry-specific knowledge necessary for accurate, complete financial reporting. That knowledge informs our work—and enhances your performance by addressing your most important operational challenges. Our team applies industry best practices to help move your organization forward. We provide strategic, financial, and operational support tailored to your mission. Learn more about our team and services.  

Article
Best practices for monitoring liquidity in a nonprofit

The Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) 2025-08 in November 2025 to address stakeholder concerns regarding the accounting for acquired financial assets under current US GAAP. This update specifically amends the guidance for purchased loans, aiming to improve comparability, consistency, and decision usefulness in financial reporting.

Key differences from current US GAAP  

Under existing US GAAP (Topic 326), acquired financial assets are classified as either:  

  • Purchased Credit Deteriorated (PCD) assets: Accounted for using the “gross-up approach,” which recognizes an allowance for expected credit losses (ACL) at acquisition, offset by a gross-up adjustment to the purchase price.
  • Non-PCD assets: Recognized at fair value with an ACL charged to credit loss expense, which is seen as double counting expected credit losses.  

ASU 2025-08 expands the use of the gross-up approach to a broader population of acquired loans, specifically “purchased seasoned loans.” These are defined as loans (excluding credit cards) acquired without significant credit deterioration and deemed “seasoned”—either obtained in a business combination or purchased at least 90 days after origination, provided the acquirer was not involved in the origination.  

This change eliminates much of the complexity and subjectivity in distinguishing between PCD and non-PCD assets and reduces the risk of double counting expected credit losses that are already reflected in fair value measurements determined at the time of acquiring the financial assets. 

Effective date for ASU 2025-08 

ASU 2025-08 is effective for all entities for annual reporting periods beginning after December 15, 2026, and interim periods within those annual periods. Early adoption is allowed.  

Transition methods 

The amendments must be applied prospectively to loans acquired on or after the initial application date. Early adoption is permitted for interim or annual reporting periods in which financial statements have not yet been issued or made available for issuance. If adopted in an interim period, the amendments should be applied as of the beginning of that interim period or the annual period that includes it.  

Rationale and benefits 

The FASB’s post-implementation review revealed that the dual approach for PCD and non-PCD assets under current US GAAP created unnecessary complexity, reduced comparability, and did not accurately reflect the economics of acquired financial assets. The gross-up approach, now expanded to purchased seasoned loans, better aligns accounting with the economic reality that the fair value of acquired assets already incorporates expected credit losses. This method:  

  • Enhances comparability and consistency across entities.  
  • Reduces complexity and subjectivity in acquisition accounting.  
  • Minimizes the “double count” of expected credit losses, improving the usefulness of financial information for investors and other stakeholders.  
  • Is expected to reduce costs and operational burdens associated with the previous model. 

Journal entry examples 

The following journal entries are meant to display the differences in accounting for acquired loans as a result of ASU 2025-08. Thus, this is a simplified example. Acquisition accounting, particularly for business combinations, tends to be much more complex. Stay tuned for additional resources on acquisition accounting. 

Before ASU 2025-08 (current US GAAP)  
 

A. Purchased Credit Deteriorated (PCD) loan (gross-up approach)  

At acquisition: 

  • Record the loan at purchase price (fair value).  
  • Recognize an ACL.  
  • Increase the fair value by the ACL.   

Journal Entry: 

Dr. Loan Receivable                                          $1,000,000 
          Cr. Cash                                                                        $950,000 
          Cr. Allowance for Credit Losses                                    $  50,000 

(Assume purchase price is $950,000 and ACL is $50,000) 

B. Non-PCD loan (day-one expense approach)

At acquisition: 

  • Record the loan at purchase price (fair value).  
  • Recognize an ACL with a charge to credit loss expense.  

Journal Entry: 

Dr. Loan Receivable                                    $950,000 
Dr. Credit Loss Expense                              $  50,000 
             Cr. Cash                                                                      $950,000
             Cr. Allowance for Credit Losses                                  $  50,000 

(Here, the ACL is recognized as an expense, not as a gross-up to the loan balance.)   

After ASU 2025-08 (for purchased seasoned loans) 
 

All purchased seasoned loans (excluding credit cards) are accounted for using the gross-up approach, regardless of credit deterioration. 

At acquisition: 

  • Record the loan at purchase price (fair value).  
  • Recognize an ACL.  
  • Increase the fair value by the ACL.    

Journal Entry: 

Dr. Loan Receivable                                           $1,000,000 
                 Cr. Cash                                                                  $950,000 
                 Cr. Allowance for Credit Losses                              $  50,000   

(Same as the PCD approach but now applied to a broader population of acquired loans.)  

Improvement in accounting for acquired loans


In summary, ASU 2025-08 represents a significant improvement in the accounting for acquired loans, providing more meaningful and decision-useful financial reporting while streamlining the application of credit loss standards. Although not seen as a cost-burdensome ASU to adopt, as most information needed to adopt the ASU should be readily available, the ASU does introduce a new concept, namely, purchased seasoned loans. Thus, those impacted by the ASU should start assessing its impact now, especially given early adoption may be seen as favorable since the ASU is expected to reduce complexity compared to current US GAAP.  

As always, your BerryDunn team is here to help. Learn more about our team and services, and reach out with questions on the ASU or acquisition accounting. 

Article
How purchased seasoned loans & ASU 2025-08 impact acquisition accounting