The safety and well-being of a campus community is of top priority for higher education institutions. In order to effectively manage any environmental risks and events, it is crucial for an institution’s environmental health and safety (EH&S) function to operate smoothly and be audited regularly.   Baker Tilly’s higher education risk advisory specialists, Adrienne Larmett MBA, CRA and Kyra Castano, CIA, recently collaborated on authoring an article for the Association of College & University Auditors (ACUA) Journal, College and University Auditor, highlighting the importance for institutions to add a review of their EH&S functions on campus to maintain a safe and compliant environment for students, faculty, staff and the broader community.

Reviewing your institution’s internal controls for environmental health and safety functions is key to maintaining a safe campus community.

Higher Education

Internal Audit

Environmental health and safety in higher ed – how institutions can implement internal controls to protect their communities

What is HITRUST?  What is HITRUST CSF?  Formerly known as Health Information Trust Alliance Common Security Framework, HITRUST is a security and privacy framework across all industries (not only healthcare). HITRUST was built upon the International Organization for Standardization (ISO) framework and the National Institute of Standards and Technology (NIST) framework but it has expanded to include other regulatory advancements such as the General Data Protection Regulation (GDPR) and the Cybersecurity Maturity Model Certification (CMMC). HITRUST aims to standardize requirements and is a certifiable framework.  What is the most recent version of HITRUST?  As of August 2022, the most recent version of the HITRUST CSF is version 9.6. Subscribers of HITRUST can be certified on lower versions of the HITRUST CSF. What are the differences between HITRUST and other assurance programs?  As an assessor, Baker Tilly executes the HITRUST certifiable validated assessments under non-attest standards (vs. the American Institute of Certified Public Accountants (AICPA)). HITRUST is the organization that provides its certification of the report, not the assessor.  What is the MyCSF tool? MyCSF is an online Software as a Service (SaaS) application that HITRUST owns and provides support. Once an organization becomes a subscriber to HITRUST, it will gain access to the online tool. This is the only way to efficiently tailor an assessment and generate the control requirements. The tool maintains the administrative requirements along with the selected factors used for scoping an assessment, a library of documentation and maturity of controls and domains. What are the HITRUST assessment portfolio options? HITRUST Basic, Current–state (bC) Assessment This assessment option is most closely considered a readiness or verified self-assessment which provides a low level of assurance. The organization will utilize the MyCSF tool to manage and score 71 control requirements. 

Follow-up question: Does it require an external assessor to assist?  No, you do not need an external assessor. However, Baker Tilly can help you through the process as it relates to evaluating the control requirements and whether there is a potential gap in implementation of the control. This assessment option is not certifiable by HITRUST.

Follow-up question: Does my organization have to complete a bC?  A bC is not required but it is highly recommended to go through a similar readiness assessment to prepare your organization before the final validation.  HITRUST Implemented, 1-year (i1) Validated Assessment  This assessment option is certifiable by HITRUST and is considered a moderate level of assurance. The organization and the external assessor will utilize the MyCSF tool to manage and score 219 control requirements. This is an annual assessment that provides coverage of the fixed control requirements over implementation only.

Follow-up question: If it's certifiable, does HITRUST provide quality assurance (QA)? Yes, the QA process is very similar to the r2 Validated Assessment option.  HITRUST Risk-based, 2-year (r2) Validated Assessment  This is the former HITRUST Validated Assessment and is considered a comprehensive risk-based assessment for a rigorous approach to security and privacy. It is a tailored approach, and control requirements can be more than 1,900 (average is 360). The maturity assessment of the control requirements includes an external assessor evaluation of at least policy, procedure and implementation. The validated assessment is certifiable and involves the HITRUST QA process every two years.  How do I know which assessment I need? Baker Tilly can help you identify which assessment is most appropriate for your organization. The assessment that best meets your needs depends on multiple external and internal factors such as required level of strength your board would like to have for your organization, level of compliance with contractual commitments and third-party assurance, competitive advantage against your organization in the marketplace, type of data your organization processes, and the industry of your organization. Connect with us.  What is an interim review?  An interim review is only related to the r2 Assessment referenced above. It occurs no earlier than 120 days prior to the one-year anniversary of the certification date. The review includes at least one control from each of the 19 domains that is randomly selected by HITRUST for the external assessor to test and validate the control is still operating effectively. 

Will there be more than 19 controls selected?  At times, HITRUST may select additional controls within a domain and will always select controls that were identified to have a corrective action plan (CAP) associated to the score of the control.  What is the timeline for certification?  How long is readiness and remediation?         Follow-up question: Can Baker Tilly help with remediation and policies and procedures?  Yes, a separate independent team that is part of the Baker Tilly risk advisory practice can assist with remediation.  How long will it take my organization to get certified?  If your organization has already completed a readiness assessment and remediation, the largest variable for time is identifying your period for the assessment. The minimal period required is 90 days for the implemented controls requirements.  What is an external assessor? What is an external assessor?  External assessors are organizations approved by HITRUST to perform assessments related to the HITRUST Assurance Program. Baker Tilly has been an approved external assessor since 2016. Baker Tilly also sits on the HITRUST Assessor Council for 2022. What is a Certified CSF Practitioner (CCSFP) A CCSFP is an individual who has completed the required HITRUST training and exam. External assessors are required to have no less than five CCSFPs and two Certified HITRUST Quality Professionals. How many external assessors does Baker Tilly have? We have well over the minimal requirement, and we are supportive of having team members certified if they are interested.

Here are the answers to frequently asked questions regarding HITRUST, HITRUST assessment types, external assessors and HITRUST certification timelines. 

Healthcare & Life Sciences

Hospitals & Health Systems

Health Plans

Life Sciences

Banking & Capital Markets

Insurance

Risk Advisory

HITRUST CSF Assessment Services

Cybersecurity

HITRUST FAQ

Introduction After the surprise announcement at the end of July, the Inflation Reduction Act (the Act) has passed the Senate. Estimated to raise $740 billion with $306 billion earmarked toward deficit reduction, the Act includes provisions to control price increases on prescription drugs, promote climate change remediation along with clean energy provisions and reduce the deficit through targeted tax increases.  The most notable change since it advanced from the Senate Finance Committee to the floor is that the carried interest provision was dropped following negotiations to ensure the support of Sen. Kyrsten Sinema (D-Ariz.). Other changes include modifications to the computation of the corporate minimum tax, the addition of an excise tax on stock buyouts, and an extension of the excess business loss limitation rule for noncorporate taxpayers. The Act now heads to the House, where potential opposition from the SALT caucus appears to have gone away. The Act does not address the $10,000 state and location tax deduction limitation, but on Sunday, two key Democratic representatives from New Jersey, Mikie Sherrill and Josh Gottheimer, who previously said “no SALT, no deal,” indicated they would support the Act. While not assured, we anticipate the need for a political victory in an election year will result in any opposing House members conceding to the Senate version. If and when the Act passes both chambers of Congress, it is expected to be signed into law by President Joe Biden.  Key provisions 15% corporate minimum tax Estimated to be the largest revenue raiser in the Act, the 15% corporate minimum tax generally is computed on applicable corporations averaging over $1 billion in adjusted financial statement (AFS) income for three consecutive years. Certain foreign-owned corporations with book income over $100 million are also subject to the minimum tax. While aggregation rules could pull more entities into these thresholds, S corporations, regulated investment companies (RICs) and real estate investment trusts (REITs) are not considered applicable corporations.  Essentially, the tax is calculated at 15% of adjusted financial statement income (AFSI) less any corporate alternative minimum foreign tax credit and net operating losses for the tax year. AFSI is defined to be net income or loss as reported on the AFS with certain modifications, including items related to controlled foreign corporations, disregarded entities, federal income taxes, non-reasonable compensation, covered benefit plan amounts and tax depreciation. Affected taxpayers pay the higher of regular tax or the computed corporate minimum tax. This tax will impact a wide range of industries, including pharmaceutical, technology, clothing, manufacturing (such as chemical and transportation equipment) as well as wholesale and retail trade, information and holding companies.  While the Act authorizes the Department of Treasury to prescribe regulations or other guidance, this new corporate minimum tax will be complex. Areas needing direction include determining which corporations meet or are exempt from the different thresholds, defining modifications to AFSI, analyzing the impact of ownership changes, among others. Taxpayers should prepare for increased record-keeping requirements and compliance costs. This tax is effective for tax years beginning after Dec. 31, 2022. Carried interest modifications dropped from final bill The Act’s original draft called for an extended holding period for partnership interests held in connection with the performance of services before qualifying for long-term capital gain treatment. Essentially, investors would be required to own an applicable partnership interest for five years (instead of the three-year period under current law) before they could take advantage of the 20% long-term capital gain tax rate. This provision would have primarily impacted the private equity and hedge fund industries and was expected to raise approximately $14 billion. Sen. Joe Manchin (D-W.Va.) was adamant about closing this perceived loophole when negotiating with Senate Majority Leader Chuck Schumer (D-N.Y.). However, Sinema required its removal before agreeing to vote for the Act.  Corporate stock repurchase excise tax The Act replaced the carried interest changes with a 1% nondeductible excise tax on the fair market value of any stock repurchased by a domestic corporation with stock traded on an established securities market. The excise tax applies to repurchases after Dec. 31, 2022. The tax extends to certain affiliates of U.S. corporations as well as specified affiliates of foreign corporations performing buybacks on behalf of their parent organization. This provision is expected to raise $73 billion. There are several exceptions to the tax, including: (1) tax-free reorganizations, (2) repurchased stock that is contributed to a pension plan or ESOP, (3) total annual repurchases of $1 million or less, (4) the purchase is completed by a dealer in securities in ordinary course of business, (5) the repurchase is treated as a dividend and (6) the repurchase is by a RIC or REIT. Additionally, repurchases subject to tax are netted with new public and employee stock issuances during the taxable year. As with the new corporate minimum tax, the rules around this stock repurchase excise tax will be complicated and require additional recordkeeping and compliance. Business losses of noncorporate taxpayers  The Act extends the limitation for noncorporate taxpayers with “excess business losses.” For this purpose, excess business losses are the amount by which business deductions exceed gross business income. This provision would limit such losses to $500,000 per year (for married filing jointly filers and $250,000 for others) with both amounts indexed for inflation. This provision was scheduled to sunset but has been extended through taxable years beginning before Jan. 1, 2029.  Energy credits The Act aims to incentivize cleaner energy production and consumption using a variety of tax credits and targeted qualified loan programs. The Act expands the number of credits designed to lower the cost of residential energy-efficient improvements, such as HVAC systems, solar and water heaters. There is also a $4,000 credit to make it more affordable for certain lower- and middle-income individuals to purchase used clean energy vehicles, and a $7,500 credit for the purchase of a new clean energy vehicle. We will provide greater details on the energy credits enacted once the Act passes the House. Other provisions The Act allocates an additional $80 billion in funding toward IRS enforcement and operations support. Furthermore, the premium tax credit program under the Affordable Care Act was extended through 2025. This effectively lowers healthcare premiums for taxpayers purchasing health insurance through the federal marketplace. Please reach out to your Baker Tilly advisor if you have questions regarding your tax position. We continue to monitor legislative developments and will issue additional alerts as warranted.
The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.

After the surprise announcement at the end of July, the Inflation Reduction Act (the Act) has passed the Senate.

Inflation Reduction Act passes the Senate

Cybersecurity is a challenge that cannot be solved completely or simply checked off an organization’s to-do list. It is continuous work that requires a multi-faceted approach to reducing and managing any associated cyber risks.   One approach for managing cyber risk is cyber insurance, although many organizations are now questioning the feasibility of insurance given the recent changes in the insurance market.  Over the last 12-to-18 months, the cyber insurance market has shifted significantly. Generally, it has become more expensive to purchase cyber insurance – and those pricy premiums now offer some organizations significantly less coverage than before. In some cases, organizations are now paying multiple times more for cyber insurance than they paid in recent years, and yet they are receiving substantially less coverage.  As for why cyber insurance is becoming pricier and providing less coverage for certain organizations, there are many factors, some of which include:  Cyber criminals are becoming increasingly skilled at defeating the various protections that organizations have deployed, while also continuing to take advantage of human errors through phishing and ransomware attacks   Insurance companies are facing a much higher likelihood of claims and those claims are also likely to be more costly as these cyber incidents are larger and more impactful on organizations  Evaluating how well a cybersecurity program protects an organization and reduces risk is difficult to calculate and there is no universally agreed upon standard for that type of evaluation  As such, this makes pricing cyber insurance difficult for the insurance companies. Therefore, insurers have reevaluated their risk tolerances and calculated that this increased risk means they have more potential exposure, which in turn drives the higher costs that are then passed along in the premiums.  Many organizations feel helpless against the surging cost of cyber insurance, wondering if there is anything they can do to combat the increasing premiums and decreasing coverages. Whereas in the past, organizations were likely willing to absorb the reasonable price of cyber insurance because it was an easy cost justification, now organizations are thinking about risk management more strategically by asking the questions, “How much actual risk mitigation are we getting?” and “Is cyber insurance worth it at this price point?”  The good news is that there are methods that organizations can employ to continue investing in their cybersecurity program. These activities should help reduce cyber risk and may even help maintain cyber insurance coverage levels from prior years or may limit the increases in premiums.   People, processes and technology  On a foundational level, an organization’s cybersecurity program should consist of a three-pronged strategy focused on people, processes and technology. Organizations cannot buy some fancy security tools and expect that technology to stop cyber attacks. Rather, they need to invest in all three facets for their cybersecurity program to be effective. The technical tools to protect your systems and monitor your weaknesses are necessary, but also needed are the people to implement those technologies and manage them, all while following well-constructed processes to help everything run effectively.  
Organizations should make sure their cybersecurity program addresses the appropriate risks. Here are just some of the activities that can help reduce risk and may potentially be required to maintain adequate cyber insurance coverage: People Hire skilled cybersecurity talent to cover both the cybersecurity strategy and the tactical protections  Supplement internal cybersecurity talent with service providers, including periodic tests of your protections (e.g., pen test)  Engage leadership and the board to support new investments through frequent reports on the cybersecurity program  Train your people to be aware of cyber threats and how to protect themselves and the organization  Processes Implement an industry-accepted standard or framework as the basis of the cybersecurity program  Develop and test a robust incident response plan to deal with the most likely cyber incidents (e.g., ransomware, account compromise via phishing)  Implement robust monitoring practices to take timely and appropriate action when security tools produce alerts   Assess and monitor all cloud and IT vendors that access organizational data  Technology Require multi-factor authentication for access to all systems  Configure devices (e.g., laptops, phones) to encrypt all data  Implement backups to secure data from ransomware   Protect servers and devices with anti-virus/anti-ransomware security tools  Invest in security event monitoring tools that automate the review of all network and system logs and activities  Organizations are realizing how hard it is to hire full-time cybersecurity specialists. Even if the organization has the monetary resources, finding and hiring the right people is quite a challenge. Not only are there not enough talented cyber professionals to go around, but the pandemic has created an additional challenge by facilitating a remote-work environment in which talented cyber workers can work for any organization, regardless of geography. The result of this is a supply vs. demand imbalance that has driven up the cost of finding, hiring and retaining talent.  Additionally, processes tend to be the most overlooked aspect of a cybersecurity program. Organizations cannot simply pick a framework and do everything it says. Cyber standards are not one size fits all. You should adapt the framework to the specific needs of your organization, your industry, your regulatory requirements and your risks. These processes should be game plans of specific activities that help the people and technology components run effectively and efficiently.   Finally, an organization can have all the “best” technology, but if the tools are not properly implemented or managed by people who are properly trained and are following defined processes, then scenarios can arise where one area (e.g., email) is properly secured, while another area (e.g., cloud) is left vulnerable to attacks.   Assessing risk and addressing cyber insurance questionnaires  As part of their cybersecurity program, organizations should make sure the protections are monitored for effectiveness via an independent cyber assessment. An independent cyber assessment has two benefits: (1) it provides an independent validation of your program and identifies gaps or areas of further improvement; and (2) it helps prepare the organization to respond to cyber insurance questionnaires.   It is important to note, however, that cyber assessments are just a piece of the puzzle.
These questionnaires are the primary driver for the insurers to price and outline cyber insurance coverages. Insurance companies are going to likely ask about antivirus protections, ransomware and malware safeguards, backups, cyber training and other controls in a post-pandemic hybrid world where people are working in the office, at home and everywhere in between. Additionally, insurers will likely ask how frequently the cybersecurity program and practices are assessed using third-party providers, such as:  Does your organization have an independent party periodically assess your whole cybersecurity program?   Does your organization perform periodic penetration testing where an outside independent organization attempts to bypass your protections?   Does your organization have any third-party assurance audits performed, such as System and Organization Controls (SOC) reports, HITRUST certification or Department of Defense Cybersecurity Maturity Model Certification (CMMC)?   Conducting periodic cyber assessments by independent third parties and then using those results to improve the organization’s cybersecurity program can help reduce your cyber risks, if the organization makes the recommended improvements and continues to invest in the cybersecurity program. In turn, these improvements and investments may help the organization maintain or receive better cyber insurance coverage and may potentially help to limit the increases in insurance costs.   Steps to take now  Baker Tilly conducts cybersecurity assessments of all types (e.g., SOC, HITRUST and CMMC) for clients in a variety of industries. We also team up with many internal audit departments by providing trained and skilled IT and cyber internal auditors to help complete their IT/cyber-related internal audits.  Additionally, in many assessments, we create models that demonstrate the financial impact of a cyber attack and the ensuing interruption, as the damage can likely go well beyond simply the data restoration and incident response costs.   Beyond that, we supplement internal teams with our additional expertise, including industry-specific knowledge from experienced cyber professionals. We do not offer generic cyber assessments; we perform tailored, industry-specialized risk assessments, the threats facing those industries, and the individual needs of each organization. We also provide targeted assessments aimed at determining where an organization is potentially open to threat actors.  These assessments add immense value to an organization’s cyber risk posture and cybersecurity program. For more information on how Baker Tilly can assist your organization with cybersecurity risk, contact me. 

As the cost of cyber insurance trends upward, often with less coverage, organizations across all industries must improve their cyber controls to minimize premium costs and their risk of a cyber attack.

Not-for-Profit

Real Estate

Retail

Construction

Government Contractors

Small Business

Manufacturing & Distribution

Energy

Software & Technology

State & Local Government

IT Audit Solutions

Cybersecurity Risk Assessments

Forensic Accounting

Combating the rising costs of cyber insurance: how we got here, and what organizations can do

On Thursday, June 30, 2022, the Supreme Court of the United States reached a long-awaited decision in the case of West Virginia v. the Environmental Protection Agency. In a 6-3 ruling, Chief Justice John Roberts delivered the majority opinion of the Supreme Court in favor of the State of West Virginia. This case began in 2015 when the EPA ordered coal power plants to reduce their carbon emissions as part of President Obama’s Clean Power Plan initiative. However, the order was never implemented because it was challenged immediately as both unconstitutional and an overreach of a federal agency. Also at question was whether Congress explicitly gave the EPA authority to adopt and enforce its own set of regulations. The EPA believed it had the authority to make the order on coal power plants under the Clean Air Act of 1970 (the Act), which was enacted by Congress and subsequently led to the creation of the EPA. However, the EPA faced heavy scrutiny, as many argued that the Clean Power Plan exceeded the authority of the EPA to enact and implement national requirements on coal power plants. Ultimately, the Supreme Court agreed the EPA had exceeded its authority under the Act. Overview of the Supreme Court’s analysis The Supreme Court reviewed this case under a relatively new framework called the “major questions” doctrine; in fact, this case was the first time the Supreme Court applied the doctrine. The major questions doctrine requires a federal agency, like the EPA, to have clear and explicit statutory authorization from Congress to regulate an area with national significance. Under the major questions doctrine, a federal agency may not simply rely on what the agency believes its authority to be. When the EPA was founded in 1970, Congress gave the EPA authority to broaden its oversight of carbon emissions, specifically fossil fuel emissions by industrial and motor vehicle companies. However, Congress never gave the EPA explicit authority to regulate and penalize companies in the U.S. for exceeding their annual allotment of carbon emissions. Why is this case significant? According to the EPA, transportation is the leading source of fossil fuel emissions in the U.S., followed by power plants. Moreover, the U.S. is only second to China as the second largest contributor of fossil fuel emissions. In its decision, the Supreme Court acknowledged that the EPA was trying to implement a practical solution to shift energy production from fossil fuels to cleaner energy production sources by creating caps for companies' carbon emissions nationwide. The Court ultimately determined, however, that the EPA was constrained in its ability to set limits on greenhouse gas emissions for existing power plants, absent congressional action to provide the EPA with the authority to create a regulatory structure. Nevertheless, international pressure remains for the United States to continue to address its greenhouse gas emissions and a hope that more countries will follow. While the Biden Administration has been hopeful to achieve a goal of zeroing out the carbon emissions from power plants in the United States by 2035, this decision jeopardizes this goal and creates obstacles to reducing climate change impacts. Nevertheless, the EPA’s authority has not all been lost, as the EPA retains some authority to limit greenhouse gases emissions within the country. Moving forward Now that the major questions doctrine is officially in play for the Supreme Court, it is likely that additional regulatory activity by federal agencies will be closely scrutinized. Two current rules are likely to be challenged: The Securities and Exchange Commission’s proposal to require public companies to disclose their carbon emissions annually The EPA’s standards for new car and light truck tailpipe emissions While the West Virginia decision strictly targets environmental concerns, the doctrine has the potential to make a big impact in the tax and securities world, specifically with how these fields are regulated. Many organizations and their stakeholders will continue to face pressure to address climate change. Evaluating energy transition solutions and greenhouse gas emission reduction strategies are necessary for successful companies and entities to continue to be proactive. Questions and buzz around sustainability aren't going away. In addition to driving strategic business decisions, consumers, investors and stakeholders will continue to expect strong benchmarks and transparent strategies around sustainability. For more information on this topic, or to learn how Baker Tilly specialist can help, contact our team.
Sources 1. On June 30, 2022, the Supreme Court limited the EPA's authority on climate standards for power plants.
2. The Supreme Court's EPA ruling was made using the major questions doctrine. 
3. The decision from the West Virginia v. EPA case could likely lead to other current rules being challenged.

The Supreme Court decision in the case of West Virginia v. the Environmental Protection Agency (EPA) limits the power of the EPA. The EPA does not have the power to enforce regulations limiting companies’ carbon emissions unless it obtains explicit authorization from Congress to do so.

Environmental, Social & Governance

Supreme Court’s West Virginia v. EPA decision limits regulatory power of the agency

Video Are you involved in cross-border sales of goods to consumers in Canada, U.K. or the EU? It doesn’t matter where you are established, changes to e-commerce and value-added tax (VAT) are widespread and complicated.  Watch our on demand webinar featuring specialists in the fields of VAT and e-commerce providing insights to help you understand the updated rules for selling goods to consumers in each country including: The current status of the sales tax obligations when selling goods to consumers  Areas of potential tax liability due to non-compliance with the new e-commerce rules in Canada  The current e-commerce rules in the EU and U.K. 
For more information on this topic or to learn how Baker Tilly professionals can help, contact our team.
The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.

Watch our on demand e-commerce and value-added tax (VAT) webinar for an update on the current rules on selling goods to consumers.

International Tax

E-commerce update: a perspective from Canada, EU and U.K. professionals

It is common for people, particularly those early in their careers, to hop from job to job, or to move from home to home.   In many cases, employees are enrolled in retirement plans that accumulate thousands of dollars during their tenure with a company. Yet when they leave a job, those retirement dollars often get lost in the shuffle, as it is common to change addresses and forget to update contact information with prior employers. Thus, their ability to one day receive their retirement funds takes a major hit.  With this issue in mind, the Employee Benefits Security Administration (EBSA) has started to place a high priority on helping retirement plans locate and communicate with these missing participants.   After all, these accounts are just sitting there dormant – and the money can be rather significant. And from the plan sponsors’ perspective, they are often paying fees on these accounts, or sometimes undergoing an audit because the number of missing participants is causing them to exceed the audit threshold. Not to mention that plan sponsors typically must pay out required minimum distributions when participants reach 72 years old and must disclose unpaid benefits to the public on their Form 5500.  In short, missing participants present a potential hassle for plan sponsors, as well as obviously a potentially squandered financial opportunity for the missing participants themselves.   Be aware of the red flags With so much on the line for plan sponsors, it is certainly important to recognize the red flags that commonly surround missing participants. In fact, plan sponsors quite often do not realize the number of missing participants that they have, so these warning signs can be particularly helpful in those cases.  The first warning sign is having more than a small number of missing or nonresponsive participants. Obviously any company can have one participant, or a few participants, who are difficult to track down. This is particularly true in industries that experience a high turnover rate. But more than a few is an early indicator that some (or many) of those participants might be missing.   Additionally – and this only applies to pension plans, it can be a warning sign when a plan has more than a small number of vested participants who are not receiving benefits despite being at a normal retirement age.   Problems with contact information, or census data, are another red flag. Disconnected phone numbers or mail that gets returned should raise eyebrows that a plan’s information is not up-to-date, which of course can be an indicator of missing participants. In turn, additional signs that missing participants may be a significant problem.  Leading practices to remember The Department of Labor has highlighted four areas of best practices that plan sponsors can focus on as they strive to locate and resolve missing participants – and to avoid falling into a similar situation in the future. We have highlighted the key areas in bold below.  The first is the importance of maintaining accurate census information for the plan’s participant population. That means contacting plan participants periodically to ensure their contact information is current. An important aspect of maintaining accurate contact information is having an online platform for the plan that allows participants to update their contact information and, in turn, the plan’s census information. With that in mind, plan sponsors also should regularly audit the census information and correct any errors.   Implementing effective communication strategies is another area that plan sponsors should focus on to avoid having missing participants. Some of these best-practice strategies in this area are using simple language, offering non-English options, encouraging the use of websites and toll free numbers to update information, and addressing the importance of maintaining accurate information at employee onboarding – and during the employee exit/retirement process.   When it comes to missing participant searches, it is recommended that plan sponsors check other available plan and employee records for correct contact information – not just for the participant, but also for their spouses, beneficiaries and next of kin. In other words, even though one particular plan may not have current contact information (creating a missing participant situation), it is possible that another plan, or other company records (such as payroll) could be updated and accurate.   Other techniques related to this area are to use a commercial locator service (either an agency or an internet search tool) to locate individuals. Sometimes using the postal service to reach out to the participant’s last known mailing address can be a worthwhile endeavor. And of course email addresses, telephone numbers and social media are possible options, as well. Don’t limit yourself to mailing addresses.  Finally, it is very important for plans to document procedures and actions. Not only is it critical to have the plan’s policies and procedures in clear, consistent writing to help past, current and future employees understand the situation. But also if the plan ever came under audit, the documented procedures and actions could prove to be significant.   Having documented procedures and actions is even more critical for plans that use a third party to maintain records and contact information.  For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team. 

The EBSA places high priority on helping retirement plans locate and communicate missing participants to prevent exceeding the audit threshold.

Assurance

Employee Benefit Plan Audit

Retirement plans and missing participants: examining the issues, warning signs and solutions

Amid the always evolving landscape of cybersecurity risks and technological threats, organizations are constantly faced with various pressing concerns. Is our clients’ data secure? Is the data maintaining its integrity throughout the transactional process? Will the data be readily available in situations of potential downtime? These questions, amongst many others, can be addressed by undergoing a System and Organizational Controls (SOC) 2®  examination. What is a SOC 2 report? A SOC 2 report evaluates the design and operating effectiveness of internal controls of a service organization and is focused on the systems that capture, store, transmit or process customer data. The primary focus of the SOC 2 relates to data security, which is one of five trust services categories established by the American Institute of Certified Public Accountants (AICPA). Additional categories can be included within the SOC 2 report. These additional categories include availability, processing integrity, confidentiality and privacy.  AICPA trust services categories Security – information and systems are protected against unauthorized access 
Availability – information and systems are available for operations to meet the service organization’s objectives 
Processing Integrity – system processing is complete, valid, accurate, timely and authorized to meet the service organization’s objectives
Confidentiality – information designated as confidential is protected to meet the service organization’s objectives 
Privacy – personal information is collected, used, retained, disclosed and disposed of to meet the service organization’s objectives  The security, availability, and processing integrity categories are related to the system, and the confidentiality and privacy categories are related to the information processed by the system. SOC 2 report value The SOC 2 report is utilized to inform external stakeholders, which often includes compliance officers, CIOs/CISOs, vendor risk management professionals, potential business partners, and other executives who oversee governance functions. Information that can be obtained via the SOC 2 report includes the systems, processes and internal controls at a service organization that are critical to meeting the organization’s service commitments and system requirements. While SOC 2 has traditionally focused on technical aspects of data security, the 2018 Trust Service Criteria (TSC) updates now also allow organizations to demonstrate their commitment to integrity and ethical values, as well as governance and oversight, by aligning the TSCs with the 17 principles of the COSO framework. Organizations can now not only add insight into the technological procedures and controls within their organization, but they can also demonstrate the efforts being taken organization-wide to address data security risks. Key components for internal stakeholders improved information security practices, governance and oversight  reasonable assurance that internal controls related to data security are designed and operating effectively and mitigating the risks posed to the organization enhanced visibility into information security practices by the board and executive management  Key components for external stakeholders assurance that a third-party service organization is protecting the organization’s data  efficient and effective vendor risk management   understanding of the service organizations service commitments and system requirements  For more information on this topic, contact our team or tell us about your SOC reporting needs.

A SOC 2 report is important for customers to obtain to effectively evaluate the systems that capture, store, transmit or process data for stakeholders.

Financial Services

System & Organization Controls (SOC) Reporting

Importance of obtaining a SOC 2 for your customers

Baker Tilly’s e-book, Innovation culture, reveals strategies and key considerations in creating something new, adding value, improving performance and fueling future success with a culture of innovation. It’s human nature to continually think of new ways to do things. In its simplest form, innovation occurs when a company or organization does something new or different that creates value. Innovation takes time and resources. If an organization has a dollar or an hour to spend, they will spend it servicing a customer, client or constituent. That’s a “today” goal, while innovation is about the future. The focus on near-term profitability and growth or servicing immediate client or constituent needs may distract an organization from realizing that innovation will fuel business growth or an organization’s long-term mission. When organizations allow employees at all levels to be stakeholders in the decision-making process, they foster a culture of innovation. To have an innovation mindset, organizations must recognize the need for change and be committed to supporting change through action. Talent development and data maturity are two primary initiatives that organizations can adopt to start on their innovation journey.
Baker Tilly’s wide array of advisory services can help executives looking to innovate and differentiate their organizations. Our specialists have the experience to help you determine opportunities for innovation and develop a culture of innovation. Baker Tilly’s Value Architects™ can help.

Innovation occurs when an organization does something new or different that creates value. Creating a culture of innovation is essential for organizations.