Skip to Main Content

As we find ourselves in a fast-moving, strong business growth environment, there is no better time to consider the controls needed to enhance your IT security as you implement new, high-demand technology and software to allow your organization to thrive and grow. Here are five risks you need to take care of if you want to build or maintain strong IT security.

In light of the recent cyberattacks in higher education across the US, more and more institutions are finding themselves no longer immune to these activities. Security by obscurity is no longer an effective approach—all institutions are potential targets. Colleges and universities must take action to ensure processes and documentation are in place to prepare for and respond appropriately to a potential cybersecurity incident.

Who has the time or resources to keep tabs on everything that everyone in an organization does? No one. Therefore, you naturally need to trust (at least on a certain level) the actions and motives of various personnel. At the top of your “trust level” are privileged users—such as system and network administrators and developers—who keep vital systems, applications, and hardware up and running.

Law enforcement, courts, prosecutors, and corrections personnel provide many complex, seemingly limitless services. Seemingly is the key word here, for in reality these personnel provide a set number of incredibly important services.

Best Practices for Educating Your Financial Institution’s Board of Directors on Cybersecurity

According to Cybersecurity Ventures, cybercrime will account for $6 trillion annually by 2021—that’s more than the global trade of all major illegal drugs combined.  Data breaches and other information security events adversely impact organizations through significant losses in revenue, erosion of customer trust, substantial remediation costs, increased insurance premiums, and more.

With the rise of artificial intelligence, most malware programs are starting to think together. Fortinet recently released a report that highlights some terms we need to start paying attention to:

Texting has become a simple, convenient, and entrenched component of our everyday lives. We use it with family, friends, coworkers—and clients. My wife and I text to coordinate day care pickup and drop off of our kids every day.

Of course, we’re all suffering from “data breach fatigue.” But some breach announcements carry considerably more risk to the victim than others. For example, if I had received a letter saying a credit card of mine had been compromised, the end result would be simple:

People love the idea of being able to conveniently charge their phones without a cable or having to hunt for a plug. Free charging stations are popping up everywhere.

This article was adapted from a presentation by BerryDunn’s Art Thatcher and Lisa Wolff at the Joint Carolinas Annual Conference in 2023.

As parks and recreation agencies nationwide undertake the master planning process, a greater focus than ever is being placed on ensuring that all members of their communities have a say in the process. BerryDunn’s parks and recreation consultants have partnered with many clients in this area and we wanted to offer some tips on how to create equitable engagement with your community.

What is equitable engagement?

Equitable engagement is a framework for understanding why equity is meaningful, and consists of tools, strategies, practices, and processes to operate equitably, both internally and externally. It is an evolving resource and one based on the needs and desires of your community. It’s important to note that it is not a one-size-fits-all solution, and may not solve all issues related to equity.

Creating a comprehensive engagement strategy

Creating a comprehensive engagement strategy involves understanding your audience and identifying their preferences by crafting and tailoring experiences across multiple outlets. For many agencies, it may begin with the acknowledgment that previous efforts with engagement may or may not have been successful. It’s important to rethink your strategy with the goal of communication saturation—that is, finding ways to reach areas of your community that are hard to reach in traditional ways.

A proven way to ensure that the message is reaching everyone in an equitable way is through the mixed methods information gathering approach. This approach incorporates a wide range of communication channels through leveraging resources such as social media, email campaigns, events, and personalized content to foster meaningful interactions. This method alleviates bias in communicating only with certain groups of people (for example, online-only communication leaves out people who don’t regularly use computers in their day-to-day lives).

The great thing about the mixed methods communication approach is that you have the opportunity to think creatively, and ultimately there are many methods to choose from. Think about your community and choose the methods that will reach the largest number of people, ensuring you get a wide and diverse representation. Below are some options to consider:

In-person events

In-person events are a great way to meet community members where they are. You can host your own events, such as coffee breaks or town halls (both in-person and virtual) or get out to events that are already well attended, such as farmer’s markets, youth sports games, day camps, and seasonal events. You can also have comment or voting boxes set up at public meetings or other community events where people can provide their comments whenever it’s convenient for them.

Surveys

Mailed or email surveys to households in your community can be effective at reaching community members who are actively using park and recreation facilities, as well as those who are not. They provide accurate insights into community preferences, needs, and levels of satisfaction. Hearing from those who are not actively using your facilities gives you an opportunity to hear about why they aren’t, and potentially make changes to accommodate their interests. Valid surveys help to prioritize initiatives that resonate most with the community, ultimately enhancing participation and satisfaction in parks and recreation programs and facilities. It is important to note that you will need to ensure that the survey is statistically valid prior to acting on any recommendations and be sure to thoroughly analyze the survey results.

Stakeholder involvement

For situations where you are having a difficult time acquiring feedback from or access to certain segments of the community, the best approach is to find influential members of that community, or organizations that are trusted by the community, and partner with them. Their involvement fosters ownership and commitment, leading to representation of diverse perspectives from community members that leads to a more sustainable and effective outcome for planning and management of parks and recreation organizations.

Youth engagement

Given that a large proportion of your parks and recreation users are youth in the community, it’s important to engage directly with younger people to hear what they’d like to see offered. We’ve seen excellent examples of youth engagement. You can facilitate a program or pop-up activity to design their “dream park” using craft materials. You might be surprised to find great ideas from the youngest members in your community! You can also meet with day camp or after-school participants to ask questions and guide them through discussion.

Online engagement

Online or virtual engagement is an effective way to reach many people and may be the most convenient way for some to provide feedback, particularly those who work off hours or do not often visit places in the community. We frequently use online tools when we partner with clients on their community engagement efforts. One tool we have found helpful and easy to use is Social Pinpoint. It’s similar to a virtual bulletin board where people can answer questions by posting their feedback and ideas in a public forum where others can then upvote if they agree. Links to these types of tools can be housed on your website or you can use QR codes or short URLs and print them on promotional materials, such as postcards or posters.

While there are many ways to engage your community, finding the best methods is part of the process. BerryDunn’s experienced parks and recreation team partners with organizations across the United States to help them strengthen operations, innovate, and enhance services that benefit their communities. Our expertise includes strategic and master planning, cost recovery, feasibility studies, community engagement, and organizational and operational assessments for parks, recreation, and library organizations.

If you have questions about improving community engagement or questions about your specific organization, please reach out to our Parks, Recreation, and Libraries team. We’re here to help.

Article
Equitable engagement in the master planning process

The rule will help ensure credibility and integrity of automated valuation models. 

On July 17, 2024, the Consumer Financial Protection Bureau (CFPB), Federal Deposit Insurance Corporation (FDIC), Federal Housing Finance Authority (FHFA), Federal Reserve Board (FRB), National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) issued a final rule, quality control standards for automated valuation models, pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act. 

The final rule will implement quality control standards for automated valuation models (AVMs) used by mortgage originators and secondary market issuers in valuing a consumer’s principal dwelling that secures certain mortgages. Click here for the FDIC’s press release, which includes more information on the AVM quality control standards as well as a copy of the final rule. The final rule will become effective on the first day of the calendar quarter following 12 months after the publication in the Federal Register. 

Article
Final rule issued: Quality control standards for automated valuation models

Read this if you are an IT director, information security officer, compliance officer, risk manager, or organizational leader interested in enhancing resilience and robust continuity strategies.

Organizations today must have the capacity and capability to respond and recover from unforeseen disruptions in a timely manner. A Disaster Recovery Plan (DRP) acts as a guide for businesses, outlining strategies to mitigate risks, limit downtime, and expedite the recovery process during a disaster. 

Here are 10 must-have components to include in your organization’s DRP:

  1. Purpose and objectives: Define the plan’s primary goal, which should be focused on strengthening the organization's resilience and continuity during disasters. The goal outlines objectives like minimizing downtime, safeguarding critical assets, and expediting recovery processes.
  2. DR team and responsibilities: Designate the individuals responsible for plan implementation, clearly defining their roles and responsibilities during disasters. Include their contact information and escalation procedures to promote timely, coordinated responses and decision-making.
  3. Disaster definitions and scenarios: Define various types of disasters that could impact the organization and establish criteria for declaring a disaster.
  4. Notification and communication: Detail the procedures for alerting key personnel and stakeholders in the event of a disaster, including contact lists, communication methods, and escalation protocols to promote timely response and coordination. 
  5. Business Impact Analysis (BIA): Identify critical business functions and assess the potential consequences of disruptions, prioritize recovery efforts based on the impact, and identify Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for each function. Recovery Time Objectives (RTOs) refer to the maximum acceptable time it takes to restore a system or service after a disruption. It defines the time frame within which operations must be resumed to avoid significant consequences. A Recovery Point Objective (RPO) is the acceptable data loss tolerance in the event of a disruption. It specifies the maximum amount of data that an organization is willing to lose, determining the point in time to which systems and data must be recovered to resume normal operations.
  6. Emergency procurement: Outline procedures for obtaining necessary resources and supplies during a disaster, including authorization protocols, supplier contacts, and procurement methods to facilitate the efficient acquisition of essential goods and services in the event of a disaster. 
  7. Reconstitution: Detail the steps and processes for restoring normal operations after a disaster, including the sequence for bringing systems, applications, and infrastructure back online, as well as any post-recovery testing and validation procedures to confirm functionality and resilience.
  8. Distribution: Specify how the plan is distributed to relevant personnel, stakeholders, and external parties, outlining methods of dissemination, version control, and accessibility during emergencies.
  9. Testing: Outline the schedule, procedures, and objectives for regular testing and exercises to validate the effectiveness of the plan in mitigating disaster impacts, identifying weaknesses, and preparing personnel for response and recovery actions.
  10. Maintenance: Detail the processes and responsibilities for regularly reviewing, updating, and revising the plan to reflect changes in technology, infrastructure, personnel, and business processes, maintaining its relevance and effectiveness in mitigating the impact of disasters.

For more information on disaster recovery planning or if you have questions about your specific situation, please don’t hesitate to contact our cybersecurity consulting team. We’re here to help.

Article
10 must-have components in your disaster recovery plan

Read this if you work at a not-for-profit (NFP) organization.

BerryDunn’s annual Not-for-Profit (NFP) Recharge event highlighted a wide array of information to support the NFP industry sector. Each year, attendees are asked to identify their top concerns for their NFP organizations. This annual survey provides insight into the real-time concerns of nearly 200 nonprofit leaders from across the country. At Recharge 2024 (you can access presentations from the event here), survey results showed a continued trend by respondents to a financial stabilization focus. 

The 2024 survey results indicated financial stability was a top concern for 69% of respondents, with employment issues listed by 51% of the respondents. This is a switch from 2023, where employment issues held the top spot. 

This continued decline in concern for employment issues (down from a high of 78% from the 2022 survey) is remarkable in the current climate of relatively low unemployment, continued turnover within the industry, and Department of Labor changes to salary exemption rules for overtime.

Overall, the top four concerns for NFP industry leaders were:

Investment in technology

Despite the additional cost of technology investment, the increasing focus on technology (48% of respondents highlighted tech as a top concern) appears to be in recognition that doing nothing in the tech space can cost more (through wasted hours, increased security risks, etc.) than investing in technology. At Recharge 2024, we highlighted some of the trends, benefits, and risks of AI in the current environment.

Organizational development

Concerns around organizational development (a concern for 40% of respondents) seem to represent increased interest in strategic planning, NFP programmatic partnerships, retirement planning, and expanded ESG opportunities. In addition to the survey results and industry update, attendees of Recharge 2024 learned more about the renewable energy tax credit, updates within the accounting sector, trends and opportunities in artificial intelligence, and a fresh look at employee benefit plan opportunities. 

The nonprofit sector continues to move forward with an eye toward long-term stability with a mission focus and a cautious growth mindset. Please contact our NFP team with questions. We’re here to help.

Recharge 2024 event resources
Nonprofit Insights podcast and other resources

Article
Top concerns for NFPs: 2024 Recharge attendee survey results

Read this if you work in finance at a renewable energy company.

The renewables industry includes some fairly unique accounting and financial reporting considerations that aren’t as common in other industries. It is important that the accounting function for these companies has an understanding of these concepts to avoid surprises when brought up by their financial auditor or a third party during due diligence. Here are a few of the more common issues we encounter when working with clients:

  • Company structure 
    The ownership structure for renewable energy projects can be somewhat complex, as they are typically modeled to direct certain tax benefits to investors. There may be issues with variable interest entities, and some structures provide percentages of ownership which may change over time or flip between investors. Because of this changing ownership, owners typically will allocate the equity of the controlling and noncontrolling interests based on the hypothetical liquidation of the project at book value (referred to as “HLBV”) at each year-end. HLBV is not a method prescribed by US GAAP and is only used if it is determined to be appropriate and consistent with the economic substance of the allocation.
  • Power purchase agreements (PPAs)
    PPAs may need to be evaluated if they contain a lease. Accounting Standards Codification (ASC) 842 Leases provides the criteria for what meets the definition of a lease. Under the Implementation Guidance and Illustrations in ASC 842, an example is provided of a contract between a power company and a solar farm where the power company agrees to purchase all the electricity produced by the solar farm; based on the fact pattern provided, the contract is determined to contain a lease. It is important to understand the circumstances and contractual provisions that lead to the determination a contract is a lease versus what leads to the determination that the contract is not a lease.
  • Asset retirement obligations (AROs) 
    Renewable energy companies that construct and operate an asset (such as a solar farm) on land that is leased from another party may have a legal obligation to restore the land to its original condition at the end of the lease. Here is more information on AROs.
  • Land leases 
    Companies may enter into land leases during the development phase of renewable projects. These agreements should be analyzed closely to determine whether they fall under ASC 842 Leases. There are a number of things to consider when looking at land leases, such as whether the lease gives the company the right to control an identified asset and whether the company has the ability to terminate the lease without incurring a significant penalty.
  • Revenue recognition for renewable energy credits (RECs)
    Revenue recognition related to the sales of self-generated renewable energy credits (RECs) can also present some accounting challenges when determining when revenue can be recognized in accordance with US GAAP. RECs generated by project assets sometimes need to go through a certification process that delays the actual sale of the REC; depending on the circumstances, including whether or not the project company has a contract to sell the RECs generated, revenue for RECs may be recognized over time (as power is generated) or at a point in time (when the RECs are actually transferred to a customer).

While this list isn’t exhaustive, it can help you find areas to focus on when preparing your financials. If you have questions about financial reporting for your company or need support for your accounting, financial reporting, or tax needs, please contact our renewable energy team. We’re here to help.

Article
Sustainable books: Financial reporting considerations for renewable energy companies