Changes to Form 990-T after Tax Cuts and Jobs Act (TCJA).

The TCJA made several changes that affected exempt organizations Form 990-T. These changes are effective for the 2018 tax year.

Non-profit organization with unrelated business income (UBI) in excess of $ 1,000 is required to file annual form 990-T.

Unrelated business income is the gross income from any unrelated trade or business regularly carried on, minus business deductions directly connected therewith.

Taxation of Unrelated Business Income

Although the non-profit organization may have tax exempt status, it may become subject to regular corporate income tax on income from a business or trade that is not related to its tax-exempt purpose. This income from unrelated trade or business is called unrelated business income.

Tax exempt organization with unrelated business taxable income (UBTI) is subject to tax and is required to file a Form 990-T and must also comply with code provisions regarding installment payments of estimated income tax by corporations.

The new enacted tax law (TCJA) changed how the exempt organizations determine the unrelated business taxable income (UBTI).  Section 512(a)(6) of Internal Revenue Code, require organization with one or more unrelated trade or business to determine UBTI for each trade or business separately without regard to the specific deduction under Section 512(b)(12)). Then, subtract the deduction under Section 512(b)(12)) ( allowing a specific deduction of $1,000), from the sum total of the amounts calculated. 

This is a departure from the prior law where UBTI was calculated as the gross income of all unrelated trades or businesses less the allowed deductions from all unrelated trades or businesses.

Notice 2018-67 provides interim guidance and transition rules under section 512(a)(6) on which exempt organizations may rely on pending publication of proposed regulations.

Another significant change, the exempt organizations are not allowed to use loss, including the net operating loss, from one trade or business to offset the income from a separate trade or business.   

TCJA also imposes tax on qualified transportation and qualified parking fringe benefits, and any on-premises athletic facilities. Which means fund used to pay for these benefits will be treated as unrelated business taxable income, provided the amounts are not deductible under Section 274.

In addition, significant changes were made to international tax rules. A newly revised section 965 imposes a one-time transition tax on a 10% US shareholder’s pro rate share of foreign corporation’s accumulated post-1986 deferred foreign income.

The Changes in Reporting UBTI

With the changes in TCJA the exempt organizations are now required to list the number of the organizations trades or businesses. If the organization has more than one trade or business, the organization is required to complete a schedule M for each unrelated trade or business before completing the new Part III (Total Unrelated Trade or Business).

The interim guidance under notice 2018-67 provides that exempt organizations may rely on a reasonable, good-faith interpretation of sections 511 through 514 when determining whether an exempt organization has more than one unrelated trade or business.

The Internal Revenue Service (IRS) through Notice 2018-67 also solicits comments which means, the IRS is more likely to make more clarification under § 512(a)(6 when they published the proposed regulations.           

For more information, contact a tax professional at mercy@mercynjengacpa.com

Cybersecurity Basics for Startups and Small Businesses

In today’s digital age, cyber threats come in all shapes and sizes. They are ever-evolving and becoming complex. The evolution and sophistication of cyber threats are a cause for alarm for company executives, who cannot realistically prevent every single incident of cyber threats. From a small business to a multinational corporation, cyber threats are real and occurring almost every single day. These cybersecurity breaches leave behind a trail of great financial losses and serious damage to a company’s reputation.

In large companies, the CEO and the CSO are working around the clock to establish essential cybersecurity risk management programs to help them keep up with latest trends in cybersecurity, to manage risks, and to detect cybersecurity incidents before they infiltrate their IT systems.

On the other side, small businesses with limited cybersecurity expertise and resources can reduce cyber breaches by adopting cybersecurity basics. It is reported widely that cyber criminals target companies of all sizes, and small businesses and startups are a major casualty. These companies lack the necessary IT expertise and have limited budget to allocate funds for cybersecurity risk management. Instead, they tend to rely on staff who know little about cybersecurity threats and trends.

This blog addresses some cybersecurity basics that small business executives can adapt to help their companies reduce cyberattacks and safeguard their data across multiple devices, browsers, networks and on the cloud.

Protect Company Files and Devices

The ease of connectivity, mobility and carry-your-own devices puts companies at greater risk of getting hacked. Reports of ever-increasing cases of data breaches and malware, and the growing sophistication of the cybercriminals, should be major wake-up calls for company executives to implement cybersecurity tools to safeguard their data and networks.
 
Use Encryptions

Small businesses should implement encryption as part of their security policy. Encryption is the use of algorithms to transform sensitive information so that it is unreadable to unauthorized users. Here is a good example: credit card information collected from customers is encrypted into unreadable cipher text. This process prevents unauthorized users from accessing the credit card information stored on companies’ server, cloud storage or other networks. If companies’ devices are hacked, encryptions prevent the hacker from reading the hacked data unless they have gained access to the decoder key. If the email or data transfer to the cloud is intercepted, encryption keeps it safe.

Laptops, tablets, smartphones, removable devices and any other media that contain sensitive devices and cloud storage should always be encrypted. Information transferred to the cloud should be encrypted before storage.

Use Passwords

Companies should require passwords to be used on all laptops, tablets and smartphones. Those passwords should not be shared or stored in unsecured networks, and they should be changed at minimum every 90 days. There is a diverse argument of what makes an effective password. The widely accepted norm is that a password must contain a phrase of more than eight (8) characters with a combination of numbers, symbols, upper and lowercase letters. But this norm is now seen as less effective. Longer passphrases with unrelated words tied together for at least 25 characters are more effective because they are harder to crack and easier to remember. Mostly, hacked related breaches are reported to be as result of stolen and/or weak passwords.

Use Multifactor Authentication

Companies should consider the use of multifactor authentication as part of their security policy. Multifactor authentication adds a layer of security to protect companies against data breaches or compromised credentials. With a high level of compromised credentials available to attackers, password-based security alone is no longer effective. Requiring extra information or factors before people can access networks, servers and other sensitive applications is a more effective means to prevent cyberattacks.

 A properly implemented multifactor authentication may ask the user for:

• What the user knows, such as username, password, PIN or security questions.
• What the user may possess, such as smartphone, passcode or smart code
• What is connected to the user biometric, such as fingerprints, retina scans or voice recognition

Update Apps, Software and Devices Often

Ever-evolving cyber threats are forcing software and hardware developers to make security and performance enhancements update periodically. This calls for companies to adapt a security policy that allows updates to run automatically.

Secure Companies Data and Files

Important files and data should be backed up in an offline external hard drive or in the cloud. Sensitive information collected on paper should be stored in a secured location. Access to secured locations should be limited to people who have been granted permission or clearance. The company policy should make it clear that employees are not permitted to copy any company information onto their unsecured personal devices.

Protect Companies Wireless Network

Secure the Router

To protect your wireless network, change the default password to a complex passphrase that contains a mixture of unrelated words, upper and lowercase letters, symbols and numbers. This prevents hackers from accessing your wireless network through a quick search for network equipment vendors’ default passwords.

Change the default Service Set Identifier (SSID) to prevent the hacker from cracking the WPA security and compromising your company network.

Use a router that offers WPA2 or WPA3 encryption. The use of encryption protects information sent over the network from malicious cybercriminals who may want to spy on companies’ activities.

Set up a guest network so your company does not share the complex passphrase with everyone that visits your business location.

Secure Access Points (APS)

Access points have a reset button that an attacker can press to restore factory default settings, allowing anyone to connect to the network. To prevent this from happening, secure all the access points distributed in your company, limit access to access points and ports, and disable any unused ports.

Use WPA2 or WAP3 with 802.1X Authentication

802.1X authentication is ideal for wi-fi security as it authenticates every user. Each user will have their own password and username, which makes it easier to manage and terminate that information in case the wi-fi user leaves the company or loses their laptop or smartphone.

Train Company Staff

What makes an effective cybersecurity management is the people, the processes and the IT systems. Companies can have topnotch IT systems security but become a target of cyber attacks if they have neglected to train their staff about cyber security threats, risks and cyber security risks management. Most cybersecurity incidents arise from phishing emails targeting employees. This leads to cyber criminals taking over the employee’s account or gaining access to sensitive data.

For companies to implement effective cybersecurity management tools that safeguards their data, people must be trained on the current trends of cyber threats. They must be made aware of various forms of cyber attacks and be given tools to help them understand what they can do to prevent their companies from cyberthreats. Companies should implement processes to help employees manage companies’ information and IT systems security from internal and external threats. Lastly, because cybersecurity is complex and constantly changing, they should train their staff regularly.

 Visit www.mercynjengacpa.com for more articles on this topic. As always consult a competent professional expert.

How to Proactively Detect and Prevent Fraud Before It Occurs

Whether it occurs in a small local shop or in large, multinational corporations—or anywhere in between—fraud is a common crime. And when it goes undetected over a long period, it can cause major loss of assets, damage to a company’s reputation, and hefty penalties.

For those new to fraud, there are three categories of occupational fraud (look for an in-depth explanation of these categories in an upcoming blog post):

• Financial Statement Fraud
• Assets Misappropriation Fraud
•  Corruptions and Money Laundering

Fraud is committed when an entity’s officer, director, or employee uses their occupation for personal gain through the act of deliberate stealing, cheating, lying, or misusing the entity’s resources or assets.

Some of ACFE’s “2018 Report to the Nations” Key Findings

In its “2018 Report to the Nations,” the Association of Certified Fraud Examiners (ACFE) found that an assets misappropriation scheme is the most common type of fraud, but less costly. Meanwhile, the financial statement scheme is less common, but very costly.

The report cites tips as the most common initial detection method, claiming 40% of all reported fraud cases. Internal audit came in second with 15%, and management review third with 13%.

In addition, small businesses were cited as the major casualty of fraud, and internal control weakness was reported as responsible for nearly half of the fraud cases.

The report’s findings were based on the study and analysis of 2,690 cases of occupational fraud that the ACFE investigated between January 2016 and October 2017. You can read the full report here!

Fraud Warning Signs, or Red Flags

Through study and analysis, ACFE has identified the following six common behavioral attributes of most fraudsters. These traits can be warning signs for those tasked with detecting and preventing fraud.

1.       Living beyond one’s means

2.       Financial difficulties

3.       Unusually close association with a vendor or customer

4.       Excessive control issues or unwillingness to share duties

5.       Recent divorce or family problems

6.       A general “wheeling and dealing” attitude involving shrewd or unscrupulous behavior

Officers and employees who display these traits need resources to serve their over-the-top lifestyle. So, when these traits become noticed, it can be an initial clue of the fraudulent activities occurring within the entity.

To prevent fraud from occurring, divide tasks among various employees and designate oversight authority to competent people who understand their role. For example:

• Ensure that the person who runs payroll is not tasked with changing the pay rate or reviewing the payroll reports.
•  Make sure the staff tasked with disbursement is not reconciling the books or authorizing invoices for payment.
• Assign a designated authority to review the vendor lists to make sure that there are no shell companies sending bills for products or services not provided.

Take proactive steps toward preventing fraud, like employee routine audits and inspections of expenditures. If you are a small company with few employees, hire an external CPA firm to inspect the books or to reconcile your balance sheet accounts once a month or quarterly.

In short, employ the independent checks or audits to ensure that human error and fraud are detected and corrected early.

Security Breaches

Cyber security is a major concern for every company. This is especially true for smaller organizations. They might not have the resources to hire and retain IT experts that will monitor security breaches and ensure integrity of the company’s IT systems.

The most effective means to detect and prevent fraud, as cited in the ACFE’s 2018 report, is strong IT controls.

Weak IT controls are a floodgate for phishing emails or free access to hacking an IT system. A hacker can take control of the company’s email accounts. Posing as the president, the hacker can use this access to write internal emails asking the CFO to transfer hundreds of thousands of dollars to an account that the company does not have a business relationship with. Such unusual emails are a red flag. Appropriate measures should be taken to prevent security breaches from spreading to other IT systems.

 A company that has implemented proper IT controls and developed procedures for a wire transfer authentication and authorization process will be better equipped to detect and prevent fraud before it occurs.

Companies should be vigilant of unusual emails or attachments that can be used to hack into their IT systems.

Weak Internal Controls

ACFE cited weak internal controls as responsible for nearly half of the fraud cases. Another red flag for fraud is management override of existing controls. When employees or officers are resistant to tighter controls, this is yet another clue that fraud is occurring or is in the offing.

Startup companies as they start to scale are more susceptible to weak internal controls, and subsequently, to fraud, because they are growing fast, and controls are the last thing on their mind. These circumstances create an opportunity where employees can steal from the company undetected for a long time.

Remember, trust is not a control, and it will not stop fraud from occurring. To detect and prevent fraud, companies should ask a CPA to assess their existing controls and to advise them on how to fix any internal control weaknesses.

Written by Mercy W. Njenga, CPA

How to Connect Internal Control Processes to a Client’s Objectives

Internal control consulting clients want to know the opportunity costs of developing and implementing internal control processes. They want to be convinced why their hard-earned money should be diverted to processes instead of business expansion. In addition, they want to know the prolific value they will earn from making such an investment.

A client needs to know how the internal control process affects their value creation. And connecting the internal control process to their company’s mission and objective is a great way to help them see the benefits of strong internal control processes.

Don’t assume that every executive you meet knows what internal control process is. COSO’s Internal Control — Integrated Framework has an executive summary that you can use to better educate your clients. But, for the sake of this blog, internal control is an ongoing process effected by those charged in governance to ensure that:

• Operations are efficient and effective
• Financial reports are reliable
• Entities are complying with laws and regulations

These three fundamental objectives can be broken down further to ensure that your clients understand the importance of developing internal control systems. For example, the first objective, operations effectiveness and efficiency, is more connected to your client’s basic business objective. It includes their profitability, operations performance and safeguarding of company resources.

Help them understand that strong internal control systems are fundamental in creating value and for the bottom line. Weak controls create opportunities for asset misappropriation, theft, fraud and corruption.

Let me explain how a weak internal control can affect the profitability of a client’s business.

The following example is a true story of asset misappropriation, but the names of the company and the perpetrator are withheld for privacy and legal reasons.

Jim was the operations director in company A. He was responsible for all company purchases related to operations and administration. He was also a member of senior management and reported directly to the company’s president. Jim was not only loyal, but also a trusted executive. His corporate-issued card had a large spending limit. And to prevent raising any red flags, he turned in his receipts and expense reports to the accounting department on time.

As director of operations, Jim was responsible for procuring operations goods and services, making payments using the corporate credit card and approving his credit card transactions. The company’s lack of adequate control policies enabled him to charge personal expenses to the corporate card. He stole about $50,000 in a span of five years.

Two issues arise from this example: One, the amount Jim stole from the company could have improved the company’s profitability, had the company developed, implemented and monitored strong internal controls such as segregation of duties and proper oversight. Two, the odd truth was that the auditors did not discover this fraud for the five years they audited the company’s books. Surprisingly, it would have continued if not for a staff member who tipped off the accounting department.

The fraud triangle, as explained by the Association of Certified Fraud Examiners, names the three factors that makes someone like Jim commit fraud. These factors are pressure, perceived opportunity and rationalization.

Lack of control policies, one of the five components of internal control, created an opportunity for Jim to steal from his employer. He was also able to rationalize that he would not be caught because no one had oversight over his credit card expenses. Jim was also able to maintain a great working relationship with the accounting department: He turned his expense reports in on time and volunteered to help his boss to do the same. In his defense, Jim said he stole because he was the least paid member of senior management, and he did it to make him feel even.

Let your clients understand that cases like Jim’s are not rare, but rather, very common. Lack of strong internal control and a proper monitoring mechanism creates the opportunity for fraud and/or error to occur. If no one, or a group of people, is assessing risks and opportunities, their company’s mission and objective might be at risk.

To learn more about NjengaCPA’s internal control consulting services, visit our website at www.mercynjengacpa.com.