Skip to Main Content

Many software-as-a-service (SaaS) companies operate on a subscription-based model with large payments due up front. This article explores how these companies can manage the significant timing differences between financial reporting and IRS tax requirements. 

While new software applications help you speed up processes and operations, deciding which ones will work best for your organization can quickly evolve into analysis paralysis, as there are so many considerations.

During my lunch in sunny Florida while traveling for business, enjoying a nice reprieve from another cold Maine winter, I checked my social media account.

Every July, the National Recreation and Park Association (NRPA) celebrates Park and Recreation Month. This year's theme, "The Power Of," highlights the power of connection, play, community, nature, belonging, and well-being. But what does that actually look like?

When we posed that question to BerryDunn's Art Thatcher and Nikki Ginger, two longtime parks and recreation professionals who now advise agencies across the country, neither started by talking about facilities, amenities, or capital projects. They talked about people.

By the end of the conversation, a different question emerged: What if the real power of parks and recreation isn't in the places themselves, but in their ability to bring people together? 

The power of connection 

We live in a world designed to make interaction optional. We can stream entertainment without leaving the couch, order dinner without speaking to anyone, and maintain friendships through text chains and social media updates. Yet people continue to flock to parks, concerts, community events, trails, and recreation programs because technology may help us communicate, but it doesn't replace the human need to connect. 

Nikki was reminded of that recently when the Chicago Park District announced plans for moveable outdoor seating, something she first saw during a trip to Paris. This simple, though surprisingly rare, feature allows visitors to pull a chair into the shade, turn it toward a friend, or arrange them into small groups. It's a small design choice, but it reflects a much larger truth. People are looking for opportunities to gather, and parks create the conditions that make those connections possible.

Art sees those opportunities everywhere. He believes parks succeed because they provide something people are increasingly missing: common ground. Walk through a park alone and most people keep to themselves. Walk with a dog, a grandchild, a soccer ball, or even an artist's sketchbook, and the entire dynamic changes. Suddenly people are smiling, asking questions, and striking up conversations.

People look for common ground, and parks create thousands of those moments every day. A soccer game, a walking trail, a community event, or a neighborhood playground may be what brings people to a space, but the relationships that form there are what give it meaning.

Throughout his career, Art has seen parks and recreation bridge generations, cultures, and neighborhoods in ways few other institutions can. As he put it, "A pool table is still a pool table whether you're 12 or 82." The activity may look simple, but it creates a rare opportunity for people of different ages and backgrounds to share an experience. The activity may be different, but the outcome is often the same: people finding a reason to connect. 

The power of play 

Play tends to get dismissed as something that belongs to children, but Art and Nikki would strongly disagree. 

In fact, many of life's most important lessons are learned through recreation. Board games teach strategy and problem solving. Team sports teach collaboration and resilience. Friendly competition teaches us how to win graciously and lose gracefully. 

Art laughed as he described a household rule while raising his children in a highly competitive family: "The first one to cry goes to bed." Behind the humor, though, was a serious point. Play gives people a safe environment to experiment, learn, fail, adapt, and grow. The lessons may begin on a playing field or around a game board, but they often carry into school, work, relationships, and everyday life. 

Play also has a unique ability to bridge divides. Art pointed to the World Cup as a perfect example. Fans from around the globe gather around a shared love of the game, setting aside cultural differences and preconceived notions. Visitors discover that communities are often more welcoming than expected. Residents discover they have more in common with people from different backgrounds than they realized. For a few hours, politics, geography, and stereotypes take a back seat to a shared experience. 

For Nikki, play is also closely tied to wellness and longevity. She pointed to research on Blue Zone communities, where people regularly live longer, healthier lives than average. One of the common threads is meaningful engagement with family, friends, and community. Recreation often provides the vehicle for those interactions, creating opportunities for people to stay active, involved, and connected across generations. 

She's seen that firsthand in her own family. When conversations begin heading into uncomfortable territory, Nikki has a simple solution: bring out a game. Almost immediately, the conversation changes. People stop focusing on their differences and start focusing on a shared experience. The atmosphere lightens. Everyone reconnects. It goes beyond being a distraction from real life. It can actually be the catalyst for helping us navigate real life. 

The power of community 

One theme surfaced repeatedly throughout our conversation: people want to be together. 

The growing popularity of community events proves it. Movie nights in the park, outdoor concerts, food truck festivals, and community celebrations continue to draw strong participation, even though people could enjoy the same entertainment from the comfort of home. That's because the attraction isn't really the movie, the concert, or even the food; it's the shared experience. 

As Nikki put it, people want to gather. Sometimes they just need an excuse.  

Art shared a similar story. When a friend's son was in town playing baseball, a simple invitation went out to a small group of friends. By game time, nearly twenty people had shown up. The baseball game gave them a reason to gather, but seeing one another was what made the evening memorable.

That ability to create community is why Art still remembers something a city manager told him decades ago: 

"You are my feel-good department." While police departments respond to emergencies and public works departments maintain infrastructure, parks and recreation creates experiences people look forward to. It creates moments of joy, celebration, connection, and belonging that shape how people experience their community. 

In a world where so many conversations focus on what's broken, parks and recreation offers something different: opportunities to build relationships, create memories, and strengthen the ties that make communities feel like home. 

The power of nature and belonging 

If the pandemic taught communities anything, it was that access to nature isn't a luxury. It's essential. 

Both Art and Nikki have watched communities rediscover the value of trails, open spaces, neighborhood parks, and outdoor recreation over the past several years. During COVID, people sought refuge outdoors. What many discovered was that these spaces offered far more than recreation. They offered relief, connection, perspective, and resilience. 

The renewed appreciation for outdoor spaces has led to another shift that Art sees in communities across the country. For years, many communities poured resources into destination facilities and large sports complexes. Today, residents increasingly ask for something much simpler: a quality park close to home. 

They want a place to walk with their families, sit under a tree, read a book, or simply spend time outside. They want a place where neighbors recognize one another and where the community feels accessible, familiar, and welcoming. 

In short, they want a place that feels like theirs. As Art noted, if you want to see how much people value a park, tell them it's going away. 

Residents who haven't visited in months will show up at meetings to defend it. Not because they're thinking about a playground or a walking path, but because they're thinking about what that place represents. It's part of their identity, their neighborhood, and their community. 

Common ground 

Throughout our conversation, Art and Nikki kept returning to the same idea, even when they were answering completely different questions. Whether they were talking about play, nature, community events, or neighborhood parks, the underlying value was remarkably similar: Parks and recreation creates common ground. 

A soccer game is a universal language that requires no translation, no matter where in the world you are. A community concert gives friends a reason to gather. A walking trail creates chance encounters. A neighborhood park becomes part of a community's shared identity. 

In a time when people often feel isolated, stressed, or divided, parks and recreation provides something increasingly valuable: opportunities to show up, share an experience, and connect with one another. That's what Nikki sees in crowded movie nights, multigenerational programs, and communities rallying around the spaces they love. It's what Art has seen throughout a career spent helping communities build places where relationships can grow. 

The parks may bring people in. The programs may get them involved. But the real power of parks and recreation lies in what happens next: the conversation that starts on a walking trail, the friendship that forms at a community event, the neighbors who become connected through a shared place. 

Sometimes all it takes is a little common ground to turn a space into a community. 

Innovative strategies for parks, recreation, and libraries 

BerryDunn's consultants work with you to improve operations, drive innovation, identify improvements to services based on community need, and elevate your brand and image―all from the perspective of our team’s combined 100 years of hands-on experience. We provide practical park solutions, recreation expertise, and library consulting. Learn more about our services and team.  


 

Article
What Is the Real Power of Parks and Recreation?

The FDIC's Quarterly Banking Profile for first quarter 2026 reports the performance for the 3,852 community banks evaluated. Here are the key highlights: 

Note: Graphs are for all FDIC-insured institutions unless the graph indicates it is only for FDIC-insured community banks. 

Financial Performance 

  • Quarterly net income increased $302.7 million (3.9%) from the previous quarter to $8.1 billion, with 55.8% of community banks reporting an increase. 

  • Pretax return on assets increased to 1.42%, up 7 basis points quarter over quarter, increasing by 26 basis points year over year. 

  • Net interest margin decreased to 3.71%, down 6 basis points from the prior quarter; however, overall increased by 24 basis points year over year. 

Costs and Efficiency 

  • Noninterest expense decreased by $310 million (1.7%) from the previous quarter but has increased 6.4% year over year. 

  • Provision expense decreased by 34.4% quarter over quarter and 11.3% year over year, while asset quality indicators remained mixed.  

  • Efficiency ratio decreased to 61.87%, down 0.64% from the prior year first quarter, indicating increased cost control relative to revenue. 

Loan and Deposit Trends  

  • Loan and lease balances increased by $16.1 billion, or 0.8%, quarter over quarter and 5.4% year over year. Quarter-over-quarter growth was led by nonfarm nonresidential CRE loans, while year-over-year growth was led by nonfarm nonresidential CRE, 1–4 family residential real estate loans, and commercial and industrial loans. 

  • Domestic deposits rose 1.2% quarter over quarter and 4.6% year over year, with growth in both interest-bearing and noninterest-bearing accounts.

  • Nearly 58% of community banks reported loan growth, and about 69% reported deposit growth during the quarter. 

Asset Quality 

  • Past-due and nonaccrual loans (PDNA) increased 9 basis points to 1.44% from the previous quarter. 

  • Net charge-off ratio decreased 11 basis points from the prior quarter to 0.18%, continuing to be above the pre-pandemic average of 0.15%. 

  • Reserve coverage ratio continued to decline to 146.4%, as the allowance for credit losses decreased while noncurrent loan balances increased. 

Capital and Structural Stability 

  • Most capital ratios increased from the prior quarter. The tier 1 risk-based capital ratio for community banks that did not opt into the CBLR framework rose 13 basis points to 14.43%, while the average CBLR for banks using the framework remained relatively unchanged at 12.36%. The leverage capital ratio for all community banks increased 11 basis points to 11.15%. 

  • Unrealized losses on securities increased by $2.6 billion (8.9%) from the prior quarter to $32.2 billion in total.  

  • Community bank count declined by 59 during the quarter due to transitions, sales, mergers and acquisitions, and one community bank failure. 

Conclusion and Outlook 

The first quarter of 2026 reflected a modest increase in earnings performance for community banks. Quarterly net income increased $302.7 million (3.9%) from the prior quarter to $8.1 billion. Pretax return on assets improved by 7 basis points to 1.42%, marking a 26-basis-point increase from a year earlier. Net interest margin, however, edged down to 3.71%, declining 6 basis points from the previous quarter but remaining 24 basis points above the same period in 2025, suggesting that the benefits of higher asset yields may be stabilizing. 

Expense trends provided some relief during the quarter, supporting improved operating efficiency. Noninterest expenses declined by $310 million (1.7%) from the prior quarter, although they remain 6.4% higher year over year. Provision expenses fell significantly, decreasing 34.4% quarter over quarter and 11.3% year over year. As a result, the reserve coverage ratio continued to trend lower, falling to 146.4%, suggesting that reserve growth has not kept pace with rising levels of noncurrent loans. 

Balance sheet growth remained steady, with both lending and deposit activity continuing to expand. Loan and lease balances increased by $16.1 billion (0.8%) quarter over quarter and 5.4% year over year, driven primarily by growth in nonfarm nonresidential commercial real estate, 1–4 family residential mortgages, and commercial and industrial lending. Domestic deposits rose 1.2% during the quarter and 4.6% year over year, with gains in both interest-bearing and noninterest-bearing accounts. Growth was broadly distributed, as nearly 58% of community banks reported loan growth and approximately 69% reported deposit growth. 

Asset quality metrics presented a mixed picture. Past-due and nonaccrual loans increased 9 basis points to 1.44%; however, at the same time, the net charge-off ratio declined to 0.18%, down 11 basis points from the previous quarter but still above pre-pandemic levels of 0.15%. 

From a capital and structural standpoint, the sector remained sound. Regulatory capital ratios generally improved, with the tier 1 risk-based capital ratio for community banks that did not opt into the CBLR framework increasing to 14.43% and the leverage capital ratio for all community banks increasing to 11.15%. However, unrealized losses on securities grew by $2.6 billion (8.9%) during the quarter to $32.2 billion, reflecting some renewed pressure on securities valuations. 

Looking ahead, community banks enter the remainder of 2026 with improved earnings performance, better expense control, and steady balance sheet growth. However, evolving net interest margin dynamics, modest softening in certain asset quality indicators, and persistent unrealized securities losses may require continued vigilance. As economic conditions shift and consolidation trends persist, institutions will need to remain focused on disciplined credit management, efficient operations, and strategic growth. As the regulatory environment continues to evolve, BerryDunn's Federal Impacts page remains a valuable resource for timely updates that may affect your institution or its borrowers. We wish you continued success in 2026, and as always, your BerryDunn team is here to help.

Article
FDIC Issues its First Quarter 2026 Quarterly Banking Profile

Who this applies to: Owners, administrators, CEOs, COOs, CFOs, finance directors, directors of nursing, HR, and IT at nursing facilities.

The Centers for Medicare and Medicaid Services (CMS) has strict regulations for reporting direct care staffing and census information through the Payroll-Based Journal (PBJ) system, requiring nursing facilities to report this information quarterly. CMS publishes the data and uses it to determine star ratings on the staffing component of the Nursing Home Compare website. While star ratings are obviously important for your facility’s reputation and ability to attract new patients and residents, there are other reasons that you should ensure that the data you submit on your PBJ is accurate and complete. This article offers nine actionable steps you can take to prepare your nursing facility for the CMS Payroll-based Journal audit.

Why accurate PBJ data is important 

The data you provide can be accessed by other regulatory agencies, including state licensing agencies, and may be used for licensing and complaint investigation surveys, with any identified non-compliance resulting in citations, fines, or penalties. In 2026, the Office of Inspector General (OIG) started PBJ data audits as they relate to medical director hours reporting. Some state Medicaid agencies utilize PBJ data in a variety of ways, such as to validate paid nursing hours reported on Medicaid cost reports. Facilities need to be aware of a wide range of potential data uses and have comprehensive internal data review procedures to help ensure the public use file reflects accurate reporting and that the facility is prepared for an audit.

PBJ Data Specifications revisions 

A revised version of the PBJ Data Specifications (Version 4.10.0) is required as of April 2026.  Another recently announced change is that, effective August 17, 2026, the PBJ system will transition to the Internet Quality Improvement and Evaluation System (iQIES). This change impacts an organization’s access to the reporting platform because it requires an HCQIS Access Roles and Profile (HARP) login to access iQIES. Please note, similar to the Provider Statistical and Reimbursement (PS&R) report, providers have an option to request different levels of access to PBJ: 

Access level  Available actions Recommended for 
Provider Security Official (PSO) - required
  • Approve other user access requests
  • View, upload, edit, and submit PBJ data
  • Run PBJ reports
Senior leadership of the organization
PBJ Submitter (Provider or Vendor)
  • View, upload, edit, and submit PBJ data
  • Run PBJ reports
Primary PBJ submitter and back-up
Provider Administrator
  • Run PBJ reports
Facility administrator, director of nursing
PBJ Viewer View-only access with the ability to run PBJ reports HR, Finance, IT, Compliance, or consultants

According to CMS provider file data published June 1, 2026, about 4% of Skilled Nursing Facilities (SNFs) nationwide missed PBJ submission, submitted incorrect/unverifiable data, or failed a PBJ audit. 

Best practices for timely, accurate PBJ reporting 

1. Maintain and test access to the reporting portal(s) 

With turnover and planned and unplanned absences, we recommend that at least two staff members maintain logins and practice submitting reports. With the PBJ reporting transition to iQIES in August 2026 and April – June 2026 reports due by November 14, 2026, it is critical that facilities establish all required access (including back-up personnel) ahead of the reporting deadline. The iQIES Service Center is projecting an increase in the volume of calls and emails between July 2, 2026, and August 14, 2026, in preparation for this transition.  

2. Understand that less might be more  

PBJ reporting includes required and optional elements. The optional data may include worked hours for other service workers. Evaluate whether your organization should report optional data elements. If you opt to report this type of data, be sure that it is accurate and complete. 

3. Plan ahead and consider more frequent submissions 

Allow your team enough time for review after the quarter ends, but prior to the cut-off date. It is a requirement to file quarterly, but you may also submit data more frequently, such as after processing each pay period. This approach allows for more timely identification of employee classification issues or technical challenges. It also gets responsible staff into the habit of maintaining records on an ongoing basis, rather than as a quarterly event.  

4. Don't forget to verify your submission  

Do not skip the confirmations and available reports for review prior to the deadline. A frequent mistake we see in the industry is related to not reading acceptance/rejection reports carefully and assuming that the submission was accepted as submitted. Once the final data file is uploaded, SNF/NFs need to check their Final File Validation Report to verify that the data was submitted successfully. Please be aware that it may require up to 24 hours for the validation report to be available and allow for time to correct any errors and resubmissions, if needed. 

5. Make finding a needle in a haystack easier 

Carefully review and summarize data as described in the PBJ Report User Guide (CASPER Section 12 – Reports). We recommend obtaining all related reports (in CASPER, “D” at the end of the report number indicates detailed reports and “S” refers to summary reports). We recommend utilizing Excel data summarization tools to carefully review data. To help facilities with transition from CASPER to iQIES reporting, below is a list of available reports in both systems. 

Please note that users will only be allowed to run reports for the providers to which they have access with their iQIES role. The iQIES reports are expected to contain the same information as the CASPER reports, updated to have the iQIES formatting. CMS planned to migrate previous submissions for up to 10 years, which will allow users to run all reports except the Submitter Final Validation report for data submitted in QIES and iQIES (see notes in table below). 

CASPER Report Number and Title iQIES Report Description  Available download formats  Use for 
1700D - Employee Report  PBJ Employee Report  Lists the active and/or terminated employees associated with a facility during a specified period  PDF or CSV Verify all employees have a unique ID 

Notes: 

  1. All PBJ reports in iQIES can be located in Report Category/Report Type: Payroll-Based Journal/Staffing. 
  2. The use of the term Contractor was replaced with Contract throughout the report to match PBJ Specifications. 
1702D - Individual Daily Staffing Report PBJ Individual Daily Staffing Report Details facility staffing information during a specified period by Employee ID  PDF or CSV Use pivot table to summarize and review hours by employee or position / category and period (recommend daily, weekly, and monthly reports).
Note differences from CASPER report: The ‘Only Include Data Accepted Prior to the Deadline’ filter on the report criteria page is no longer applicable and will not be available in the iQIES report.
1702S - Staffing Summary Report  PBJ Staffing Summary Report  Summarizes staffing information by job title for a facility during a specified period. PDF or CSV Review summary of hours reported for the quarter to help ensure staff or contractor reports are submitted. Consider comparing this report to the prior quarter.
1703D - Job Title Report  PBJ Job Title Report  Details by work date the staffing hours submitted for select job title(s) during a specified period.  CSV/Excel Review hours by job title and classification. 
Note differences from CASPER report: The ‘Only Include Data Accepted Prior to the Deadline’ filter on the report criteria page is no longer applicable and will not be available in the iQIES report. The use of the term Contractor was replaced with Contract throughout the report to match PBJ Specifications.
1704S,1704D - Daily MDS Census Summary Report PBJ Daily MDS Census Summary Report Provides daily facility census counts for a specified period. Lists the IDs of the residents included in daily facility census counts for a specified period. PDF or CSV Use to reconcile to your internal total daily census.
1705D - PBJ Staffing Data Report PBJ Staffing Data Report

Identifies areas of concern that may trigger follow-up during the survey, including:  

  • Failed to submit data for the quarter  
  • Excessively low weekend staffing  
  • One-star staffing rating  
  • No RN hours  
  • Failed to have licensed nursing coverage 24 hours/day  
PDF Review compliance and error triggers summary (triggered or not triggered, metric suppressed due to invalid data, new facility, special focus facility).
FFVR - PBJ On Demand Final File Validation Report PBJ On Demand Final File Validation Report Indicates whether the submitted file was accepted or rejected and details the warning and fatal errors applicable to the data or the data file structure submitted. PDF Use to confirm submission and acceptance.
Note differences from CASPER report: The 60-day waiting period for requesting the on-demand PBJ Final Validation Reports has been removed to account for new access in iQIES and the QIES system-generated Final Validation Reports being unavailable in the iQIES PBJ Final Validation folders.
PBJ System-generated Final Validation Report PBJ System Generated Final File Validation Report Indicates whether the submitted file was accepted or rejected and details the warning and fatal errors applicable to the data or the data file structure submitted. PDF Use to confirm submission and acceptance.

Notes:

  1. Differences from CASPER report: The system-generated Final Validation Reports in QIES (system used prior to August 2026) will not be migrated into iQIES. Users will be allowed to access CASPER to obtain these until they are automatically deleted based on the report's retention time period, if desired. Alternatively, users can generate the iQIES user-requested final validation reports for submissions performed in QIES if it is more convenient.
  2. The iQIES report now includes a CMS Certification Number (CCN), and error sections such as General, Staffing, Employee, or Employee Link have been delineated to make the report more intuitive for users.

iQIES users can schedule reports to run at their preferred frequency. Review these reports to help ensure the quarterly PBJ data reflects your records. Most of the detail reports (D) are available as a .csv file download, which is instrumental with the assistance of Excel templates to simplify and expedite your review. We recommend using pivot tables, data filtering, and conditional formatting rules to bring attention to potential errors, omissions, or high-risk audit areas, including:

  • Any days without at minimum eight RN hours
  • Exempt staff with >40 reported worked hours per week
  • Non-exempt (hourly) staff with more than 80 hours per week or >300 hours per month
  • High or low average total nurse (aides, LPNs, and RNs) staffing (less than two and more than five hours per patient day. Visit BerryDunn’s senior living self-service benchmarking portal for comparison to your peers
  • Changes in total average nurse staff hours per patient day by over 10% compared to the previous quarter(s)

6. Share the knowledge with PBJ reporting and management teams

Educate your PBJ reporting and management oversight team, discuss, and gain clarity on your internal record-keeping policies and procedures. Obtain the most recent manuals. We recommend electronic bookmarks to the CMS site rather than printed paper copies, as the guidance may change.

7. Trust but verify to help ensure compliance

While you may have complete trust in your team, nobody is immune to an occasional mistake or omission. Responsibility for PBJ compliance is with facility leadership. Review the reports carefully and make timely corrections.

8. Keep a close eye on the Nursing Home Compare website

Check the CMS nursing home compare information for your facility regularly to help ensure information is correct.

9. Don't panic: It is fixable!

If you have an unfavorable PBJ audit, there are actions you can take to remedy the situation and avoid it in the future. We suggest that your team:

  • Includes the PBJ program compliance review in your QAPI initiatives, which makes it a multi-departmental challenge to get back on track and prevent any future non-compliance
  • Engages your communications team in crafting a meaningful response to any potential community inquiries if you receive a one-star rating in staffing. Be prepared to describe the issue objectively and without blame, while outlining the steps the facility is taking to improve.
  • Takes an objective look at your systems. Consider an external consultant to help with identification of the process gap and ideas for sustainable remediation.

If you have any questions, please reach out to Olga Gross-Balzano or a member of BerryDunn’s Senior Living team of experts.

Article
Nine ways nursing facilities can prepare for a CMS PBJ audit

Research institutions are built for discovery. Decentralized teams, specialized tools, and flexible environments make innovation possible, but they also introduce complexity when it comes to cybersecurity.

At the same time, expectations are rising. Federal agencies and data-sharing partners increasingly require compliance with frameworks like NIST 800-171 and NIST 800-53, along with detailed System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms).

For many institutions, the challenge isn’t whether to comply. It’s how to do it without disrupting research.

The core challenge: Decentralization

Unlike traditional IT environments, research settings aren’t centralized. Labs, departments, and research teams often operate independently, using their own devices, systems, and workflows.

That flexibility is essential, but it can lead to:

  • Inconsistent security practices
  • Gaps in documentation
  • Added strain on IT and security teams
  • Increased risk during audits or reviews

Over time, even well-intentioned efforts can become fragmented.

Where institutions start to see friction

Most research institutions aren’t struggling because they lack security tools. The friction tends to show up in a few common ways:

  • Unclear ownership of security responsibilities across central IT, leadership, and research teams
  • SSPs and POA&Ms developed inconsistently across environments
  • Security controls that don’t fit the realities of research environments
  • Duplicated effort across labs and departments

These challenges are often operational, not technical.

A more practical path forward

Leading institutions are shifting their approach. Instead of trying to force uniform controls across every environment, they’re focusing on coordination, clarity, and scalability.

A few principles consistently make a difference:

Define roles clearly
Security works best when responsibilities are shared and understood across leadership, central IT, and local research teams. Clarity reduces duplication and keeps efforts aligned.

Standardize where it makes sense
Common controls—like identity management, logging, and training—can often be managed centrally and applied across environments. This reduces the burden on individual research teams.

Document with intent
SSPs and POA&Ms shouldn’t be treated as one-time compliance exercises. When used effectively, they become tools for tracking progress, managing risk, and improving consistency.

Adapt controls to the environment
Research environments will always have unique needs. The goal isn’t perfection; it’s demonstrating that risks are understood, documented, and actively managed.

From compliance burden to operational advantage

When cybersecurity is coordinated across the institution, it stops being a reactive exercise and starts supporting the research mission.

Institutions that take this approach often see:

  • More consistent and manageable compliance processes
  • Better visibility into risk across environments
  • Less duplication of effort between teams
  • Greater confidence from funders and partners

Most importantly, researchers can stay focused on their work—without navigating unnecessary barriers.

Go deeper: A practical roadmap for research cybersecurity

This overview highlights what’s possible, but implementing it takes a more structured approach.

In our ebook, Practical Strategies for Managing Cybersecurity in Research Environments, we break this down further, including:

  • How to define roles and responsibilities in distributed settings
  • Common areas where security controls create friction—and how to approach them
  • Frequent compliance gaps and ways to address them
  • Scalable strategies for managing security across multiple environments

If your institution is working to balance compliance requirements with the realities of research, the ebook provides a clear, practical next step.

Download the full ebook to learn how to strengthen your security posture while keeping research moving forward.

How BerryDunn can help

BerryDunn’s cybersecurity team brings deep industry expertise and recognized certifications to every engagement. We work closely with clients to bridge the gap between technical teams and leadership—delivering clear insights, tailored solutions, and lasting security improvements through transparent collaboration. Learn more about our cybersecurity team and services. 

Article
Securing research without slowing it down: A smarter approach to cybersecurity

Who this article applies to: CFOs, controllers, and internal audit professionals at financial institutions

Occupational fraud remains a persistent and costly risk for financial services organizations. In its 2026 Report to the Nations, the Association of Certified Fraud Examiners studied 2,402 fraud cases globally totaling more than $3.4 billion in losses across industries, including financial services. The report estimates that organizations lose about 5% of annual revenue to fraud, underscoring that no institution is immune. Equally important, many organizations never fully recover those losses, with over half of victims recovering nothing, highlighting the need for a proactive fraud risk management approach rather than post-event remediation.

Risk profile for banks and investment firms 

The report includes targeted insights for the banking and financial services sector: 

  • Median loss per case: $100,000 
  • Average loss per case: $1,535,000 
  • Median duration: 8 months  

These figures are consistent with overall global trends, but the financial sector’s exposure to high-value transactions, complex systems, and regulatory scrutiny increases both the potential impact and reputational risk associated with fraud events.

Fraud types most relevant to financial institutions 

The report identifies three primary fraud categories: 

  • Asset misappropriation: 90% of cases; lower median loss 
  • Corruption: 45% of cases—includes conflicts of interest and kickbacks; moderate loss 
  • Financial statement fraud: 6% of cases; highest losses at $1 million median

Within financial services, asset misappropriation-related schemes are most prevalent. However, although financial statement fraud is less frequent, it presents the greatest dollar exposure. 

Fraud detection and why whistleblower programs matter 

Because fraud losses escalate over time, improving detection is one of the most effective ways to limit impact. Key insights include: 

  • 43% of fraud cases were detected through tips, over half of which came from employees. 
  • Email and web-based reporting channels are now more commonly used than hotlines. 

Institutions with strong whistleblower frameworks and accessible reporting channels are significantly better positioned to detect fraud early and minimize losses. The most effective frameworks are comprehensive, independent, and trusted by employees.

Higher roles, higher fraud exposure 

Fraud risk is closely tied to access and authority, requiring strong governance and oversight. Employees and managers commit most fraud, but executives cause the largest losses, with risk increasing alongside authority, tenure, and collusion.

Behavioral red flags 

Most perpetrators exhibit warning signs, such as financial pressure or unusual relationships. Behavioral monitoring can enhance fraud detection, particularly for high-risk roles. Always consider the components of the fraud triangle: incentive, opportunity, and rationalization. 

Internal control failure   

Approximately 70% of fraud cases involve control failures rather than absence of controls. For regulated institutions, this highlights the need for effective execution and monitoring of controls, not just design.  

Core controls include management review, data monitoring, and surprise audits. Fraud awareness training and regular reassessment of risk frameworks are also essential, as many organizations still respond to fraud reactively rather than proactively.

Aligning fraud risk management with strategic decision-making 

Fraud risk extends beyond operations to compliance, governance, and reputation. Organizations that emphasize active monitoring, strong controls, and a culture of accountability are best positioned to reduce losses and strengthen risk management. In our complimentary whitepaper on preventing financial institution fraud, we take a deeper look at how to successfully implement a strong anti-fraud plan. Commit to enhancing fraud prevention to build trust with your board, employees, customers, and the broader public—an investment that delivers strong value for any financial institution. 

Key takeaways

  • Recognize persistent fraud risk, with organizations losing an estimated 5% of annual revenue to fraud and many recovering none of those losses. 
  • Improve detection by strengthening whistleblower programs and digital reporting channels, especially for employees. 
  • Address high-impact fraud by focusing on asset misappropriation while monitoring high-cost financial statement fraud. 
  • Increase oversight of senior roles, where fraud risk and losses are greater. 
  • Check internal controls with monitoring, management review, and ongoing risk assessment. 

BerryDunn can help 

Our risk management team helps clients develop and implement effective risk management programs tailored to each organization’s size, risk level, and resources. Learn more about our team and services.

Article
Financial services fraud: Why proactive detection matters