COVID-19 made the 2019 and 2020 filing seasons so difficult that the IRS recently announced automatic penalty relief for certain tax returns and international information returns that were not timely filed.  In the notice, failure-to-file penalties are waived under section 6651(a)(1) for late-filed Forms 1040s, 1041s, 1120s, 1065s and certain 990s. It also provides relief under section 6721 for certain informational returns, including 1099s.  The administrative pronouncement recognizes that the 2019 and 2020 filing seasons were challenging not just for the IRS but also taxpayers, and this relief will give more certainty to taxpayers as well as free up IRS resources.   In addition to waiving penalties, the notice had three taxpayer-favorable components.  The first component offers a window for taxpayers who have not yet filed their taxes an opportunity to file them and qualify for the relief. Certain 2019 and 2020 tax returns filed before Sept. 30, 2022, are still eligible for penalty abatement.  Second, the notice specifically states certain international information returns filed with tax returns are eligible for the penalty relief. Those that are in scope include Forms 5471 and 5472 attached to a late-filed Form 1120 or 1065 for the 2019 or 2020 tax year for which penalties are systematically assessed. However, Forms 8858 and 8865 attached to a late-filed Form 1120 or 1065, which do not generate an automatic penalty assessment, do not appear to be included in the notice’s scope. It is also not clear if the notice includes late-filed Forms 5471 and 5472 if they were initially omitted as an attachment to a timely filed tax return.  Nevertheless, the notice does grant penalty relief for other international information returns, including Forms 3520 and 3520-A, which are filed separately with the IRS as distinct tax returns and not as attachments to other forms. Many international information returns inflict severe penalties for late filing (e.g., a $10,000 fine per Form 5471 omission and $25,000 fine per Form 5472 omission). Because some tax returns have multiple attached international information returns, this penalty relief could alleviate a significant financial burden for some taxpayers.  The third taxpayer-favorable component is the method by which the IRS is relieving the penalty. Taxpayers do not need to reach out to the IRS to request the abatement; the relief is being granted automatically, and late filers who already paid their penalties will receive refunds.  Taxpayers should note that they will still need to respond to any IRS notices that have a statutory or regulatory deadline to contest penalties. They should also understand that this notice is separate from reasonable cause relief and the first time abatement program.  While this will provide relief for many taxpayers, it only applies to the failure-to-file penalty and not the failure-to-pay penalty. Furthermore, there are omissions as to who may qualify. In fact, the AICPA has requested the IRS “expand, modify and clarify the scope” of the relief as well as extend the deadline to Dec. 31, 2022, from Sept. 30.  Regardless, taxpayers who have the opportunity to take advantage of this relief should strongly consider doing so. Even if a taxpayer isn’t eligible, the IRS’ acknowledgment that those two filing seasons warranted this type of relief may make it easier to receive reasonable cause abatement.  For more information or to learn how a Baker Tilly professional can help you, contact our team. 
The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.

The IRS announced automatic penalty relief for certain tax returns and international information returns that were not timely filed in 2019 and 2020.

Private Wealth

Individual Income Tax Planning & Compliance

Tax Advocacy & Controversy Services

Penalty relief for certain 2019 and 2020 taxpayers

When it comes to cyberattacks, the assumption is only large organizations like banks, hospital systems and multinational companies are affected. But that just isn’t the case. The pandemic forced all types of businesses to quickly move online whether or not they had the right cybersecurity in place, opening small businesses to increased risk.  In fact, the FBI’s cyber division reported a 400% increase in cyberattacks in 2020 over pre-coronavirus times, so it’s no surprise that 58% of small businesses have experienced at least one security or data breach, according to a 2021 report from the Identity Theft Resource Center (ITRC).   And if your company doesn’t have a business continuity plan in place, any kind of breach can be costly: Nearly 45% of small businesses paid between $250,000 and $500,000 to cover the costs of the breach, while 16% spent between $500,000 and $1 million.  Just the immediate aftermath of a cyberattack can be paralyzing to a small business since their systems could be down for possibly days or even a few weeks. All of a sudden, it’s not only customers that are affected, but also employees and vendors. Furthermore, one frightening statistic from Cybercrime magazine said that 60% of small businesses struggle to recover and have to close up shop within six months of a data breach or cyberattack.  Should the business survive, it typically takes them years to recover. The report from the ITRC said 42% needed one to two years to return to normal, and 28% needed three to five years to fully recover. We haven’t even addressed the possibility of being sued by one of your customers for compromising their data, but that is a very real and very costly possibility. All of that said, small businesses can avoid the bulk of these issues with proper planning. First, a small business needs to acknowledge it could be a victim of a cyberattack. The vast majority of small businesses have no cyber liability insurance or any money set aside in case of such an attack, much less a comprehensive plan in place for how to deal with one.  Often, small businesses don’t employ an IT person or if they have, they designated someone as their technology support person who isn’t actually qualified in the first place. Sometimes, they outsource the role but don’t spend a lot of time figuring out what that third party’s responsibilities are and aren’t aware that backing up data or updating certain systems are not considered part of their purview.  So where should a small business start? For Baker Tilly clients, we begin with a small business cybersecurity risk assessment, through which our professionals will help identify their gaps. Gaps could be in how credit card information is stored or how intellectual property is protected. It may be related to how people log into certain systems or access files, or in how the company backs up its data or secures the systems they are using. There may be gaps in how financial information is kept or where employee records are filed. After identifying opportunities for cyberattacks, our professionals provide recommendations to mitigate the risk in their systems and processes, prioritizing based on the client’s needs.  Beyond the assessment, our professionals can help clients outline what their business continuity plan and recovery plan should look like, including what solutions they need to put in place and what activities need to be completed in order to respond and recover from these types of incidents. Because cyberattacks can come in all manner of forms — malware, ransomware, phishing — a business should hope for the best, but plan for the worst, and really look at every possible issue that could go wrong. When a plan is in place, they should conduct dry runs to make sure everyone knows the recovery process and should test the backup systems.  In addition to a continuity plan, a small business should obtain cybersecurity insurance. Policies can cover ransom payments, data restoration, extortion, loss of income, etc. Due to the millions in ransom paid in recent years, insurers have stepped up their expectations for customers, including requiring specific security controls be in place before they insure the company (e.g., multifactor authentication).  Still, the hope is you never have to rely on that insurance because you have identified your risk areas and put in safeguards to prevent such an attack in the first place.  For more information about Baker Tilly’s cybersecurity services, or to discuss how we may be able to assist your organization, contact us.

Understand the risks and protect your small business from cybersecurity threats

Small Business

Baker Tilly Advantage

Cybersecurity Risk Assessments

Cybersecurity

Small business cybersecurity risk: Cyberattacks don’t care how big your business is

Cybersecurity is a challenge that cannot be solved completely or simply checked off an organization’s to-do list. It is continuous work that requires a multi-faceted approach to reducing and managing any associated cyber risks.   One approach for managing cyber risk is cyber insurance, although many organizations are now questioning the feasibility of insurance given the recent changes in the insurance market.  Over the last 12-to-18 months, the cyber insurance market has shifted significantly. Generally, it has become more expensive to purchase cyber insurance – and those pricy premiums now offer some organizations significantly less coverage than before. In some cases, organizations are now paying multiple times more for cyber insurance than they paid in recent years, and yet they are receiving substantially less coverage.  As for why cyber insurance is becoming pricier and providing less coverage for certain organizations, there are many factors, some of which include:  Cyber criminals are becoming increasingly skilled at defeating the various protections that organizations have deployed, while also continuing to take advantage of human errors through phishing and ransomware attacks   Insurance companies are facing a much higher likelihood of claims and those claims are also likely to be more costly as these cyber incidents are larger and more impactful on organizations  Evaluating how well a cybersecurity program protects an organization and reduces risk is difficult to calculate and there is no universally agreed upon standard for that type of evaluation  As such, this makes pricing cyber insurance difficult for the insurance companies. Therefore, insurers have reevaluated their risk tolerances and calculated that this increased risk means they have more potential exposure, which in turn drives the higher costs that are then passed along in the premiums.  Many organizations feel helpless against the surging cost of cyber insurance, wondering if there is anything they can do to combat the increasing premiums and decreasing coverages. Whereas in the past, organizations were likely willing to absorb the reasonable price of cyber insurance because it was an easy cost justification, now organizations are thinking about risk management more strategically by asking the questions, “How much actual risk mitigation are we getting?” and “Is cyber insurance worth it at this price point?”  The good news is that there are methods that organizations can employ to continue investing in their cybersecurity program. These activities should help reduce cyber risk and may even help maintain cyber insurance coverage levels from prior years or may limit the increases in premiums.   People, processes and technology  On a foundational level, an organization’s cybersecurity program should consist of a three-pronged strategy focused on people, processes and technology. Organizations cannot buy some fancy security tools and expect that technology to stop cyber attacks. Rather, they need to invest in all three facets for their cybersecurity program to be effective. The technical tools to protect your systems and monitor your weaknesses are necessary, but also needed are the people to implement those technologies and manage them, all while following well-constructed processes to help everything run effectively.  
Organizations should make sure their cybersecurity program addresses the appropriate risks. Here are just some of the activities that can help reduce risk and may potentially be required to maintain adequate cyber insurance coverage: People Hire skilled cybersecurity talent to cover both the cybersecurity strategy and the tactical protections  Supplement internal cybersecurity talent with service providers, including periodic tests of your protections (e.g., pen test)  Engage leadership and the board to support new investments through frequent reports on the cybersecurity program  Train your people to be aware of cyber threats and how to protect themselves and the organization  Processes Implement an industry-accepted standard or framework as the basis of the cybersecurity program  Develop and test a robust incident response plan to deal with the most likely cyber incidents (e.g., ransomware, account compromise via phishing)  Implement robust monitoring practices to take timely and appropriate action when security tools produce alerts   Assess and monitor all cloud and IT vendors that access organizational data  Technology Require multi-factor authentication for access to all systems  Configure devices (e.g., laptops, phones) to encrypt all data  Implement backups to secure data from ransomware   Protect servers and devices with anti-virus/anti-ransomware security tools  Invest in security event monitoring tools that automate the review of all network and system logs and activities  Organizations are realizing how hard it is to hire full-time cybersecurity specialists. Even if the organization has the monetary resources, finding and hiring the right people is quite a challenge. Not only are there not enough talented cyber professionals to go around, but the pandemic has created an additional challenge by facilitating a remote-work environment in which talented cyber workers can work for any organization, regardless of geography. The result of this is a supply vs. demand imbalance that has driven up the cost of finding, hiring and retaining talent.  Additionally, processes tend to be the most overlooked aspect of a cybersecurity program. Organizations cannot simply pick a framework and do everything it says. Cyber standards are not one size fits all. You should adapt the framework to the specific needs of your organization, your industry, your regulatory requirements and your risks. These processes should be game plans of specific activities that help the people and technology components run effectively and efficiently.   Finally, an organization can have all the “best” technology, but if the tools are not properly implemented or managed by people who are properly trained and are following defined processes, then scenarios can arise where one area (e.g., email) is properly secured, while another area (e.g., cloud) is left vulnerable to attacks.   Assessing risk and addressing cyber insurance questionnaires  As part of their cybersecurity program, organizations should make sure the protections are monitored for effectiveness via an independent cyber assessment. An independent cyber assessment has two benefits: (1) it provides an independent validation of your program and identifies gaps or areas of further improvement; and (2) it helps prepare the organization to respond to cyber insurance questionnaires.   It is important to note, however, that cyber assessments are just a piece of the puzzle.
These questionnaires are the primary driver for the insurers to price and outline cyber insurance coverages. Insurance companies are going to likely ask about antivirus protections, ransomware and malware safeguards, backups, cyber training and other controls in a post-pandemic hybrid world where people are working in the office, at home and everywhere in between. Additionally, insurers will likely ask how frequently the cybersecurity program and practices are assessed using third-party providers, such as:  Does your organization have an independent party periodically assess your whole cybersecurity program?   Does your organization perform periodic penetration testing where an outside independent organization attempts to bypass your protections?   Does your organization have any third-party assurance audits performed, such as System and Organization Controls (SOC) reports, HITRUST certification or Department of Defense Cybersecurity Maturity Model Certification (CMMC)?   Conducting periodic cyber assessments by independent third parties and then using those results to improve the organization’s cybersecurity program can help reduce your cyber risks, if the organization makes the recommended improvements and continues to invest in the cybersecurity program. In turn, these improvements and investments may help the organization maintain or receive better cyber insurance coverage and may potentially help to limit the increases in insurance costs.   Steps to take now  Baker Tilly conducts cybersecurity assessments of all types (e.g., SOC, HITRUST and CMMC) for clients in a variety of industries. We also team up with many internal audit departments by providing trained and skilled IT and cyber internal auditors to help complete their IT/cyber-related internal audits.  Additionally, in many assessments, we create models that demonstrate the financial impact of a cyber attack and the ensuing interruption, as the damage can likely go well beyond simply the data restoration and incident response costs.   Beyond that, we supplement internal teams with our additional expertise, including industry-specific knowledge from experienced cyber professionals. We do not offer generic cyber assessments; we perform tailored, industry-specialized risk assessments, the threats facing those industries, and the individual needs of each organization. We also provide targeted assessments aimed at determining where an organization is potentially open to threat actors.  These assessments add immense value to an organization’s cyber risk posture and cybersecurity program. For more information on how Baker Tilly can assist your organization with cybersecurity risk, contact me. 

As the cost of cyber insurance trends upward, often with less coverage, organizations across all industries must improve their cyber controls to minimize premium costs and their risk of a cyber attack.

Higher Education

Not-for-Profit

Healthcare & Life Sciences

Real Estate

Retail

Construction

Government Contractors

Manufacturing & Distribution

Energy

Software & Technology

State & Local Government

Insurance

Hospitals & Health Systems

Life Sciences

Lodging

Real Estate Investors

Multifamily Housing

Risk Advisory

IT Audit Solutions

Forensic Accounting

Combating the rising costs of cyber insurance: how we got here, and what organizations can do

It is common for people, particularly those early in their careers, to hop from job to job, or to move from home to home.   In many cases, employees are enrolled in retirement plans that accumulate thousands of dollars during their tenure with a company. Yet when they leave a job, those retirement dollars often get lost in the shuffle, as it is common to change addresses and forget to update contact information with prior employers. Thus, their ability to one day receive their retirement funds takes a major hit.  With this issue in mind, the Employee Benefits Security Administration (EBSA) has started to place a high priority on helping retirement plans locate and communicate with these missing participants.   After all, these accounts are just sitting there dormant – and the money can be rather significant. And from the plan sponsors’ perspective, they are often paying fees on these accounts, or sometimes undergoing an audit because the number of missing participants is causing them to exceed the audit threshold. Not to mention that plan sponsors typically must pay out required minimum distributions when participants reach 72 years old and must disclose unpaid benefits to the public on their Form 5500.  In short, missing participants present a potential hassle for plan sponsors, as well as obviously a potentially squandered financial opportunity for the missing participants themselves.   Be aware of the red flags With so much on the line for plan sponsors, it is certainly important to recognize the red flags that commonly surround missing participants. In fact, plan sponsors quite often do not realize the number of missing participants that they have, so these warning signs can be particularly helpful in those cases.  The first warning sign is having more than a small number of missing or nonresponsive participants. Obviously any company can have one participant, or a few participants, who are difficult to track down. This is particularly true in industries that experience a high turnover rate. But more than a few is an early indicator that some (or many) of those participants might be missing.   Additionally – and this only applies to pension plans, it can be a warning sign when a plan has more than a small number of vested participants who are not receiving benefits despite being at a normal retirement age.   Problems with contact information, or census data, are another red flag. Disconnected phone numbers or mail that gets returned should raise eyebrows that a plan’s information is not up-to-date, which of course can be an indicator of missing participants. In turn, additional signs that missing participants may be a significant problem.  Leading practices to remember The Department of Labor has highlighted four areas of best practices that plan sponsors can focus on as they strive to locate and resolve missing participants – and to avoid falling into a similar situation in the future. We have highlighted the key areas in bold below.  The first is the importance of maintaining accurate census information for the plan’s participant population. That means contacting plan participants periodically to ensure their contact information is current. An important aspect of maintaining accurate contact information is having an online platform for the plan that allows participants to update their contact information and, in turn, the plan’s census information. With that in mind, plan sponsors also should regularly audit the census information and correct any errors.   Implementing effective communication strategies is another area that plan sponsors should focus on to avoid having missing participants. Some of these best-practice strategies in this area are using simple language, offering non-English options, encouraging the use of websites and toll free numbers to update information, and addressing the importance of maintaining accurate information at employee onboarding – and during the employee exit/retirement process.   When it comes to missing participant searches, it is recommended that plan sponsors check other available plan and employee records for correct contact information – not just for the participant, but also for their spouses, beneficiaries and next of kin. In other words, even though one particular plan may not have current contact information (creating a missing participant situation), it is possible that another plan, or other company records (such as payroll) could be updated and accurate.   Other techniques related to this area are to use a commercial locator service (either an agency or an internet search tool) to locate individuals. Sometimes using the postal service to reach out to the participant’s last known mailing address can be a worthwhile endeavor. And of course email addresses, telephone numbers and social media are possible options, as well. Don’t limit yourself to mailing addresses.  Finally, it is very important for plans to document procedures and actions. Not only is it critical to have the plan’s policies and procedures in clear, consistent writing to help past, current and future employees understand the situation. But also if the plan ever came under audit, the documented procedures and actions could prove to be significant.   Having documented procedures and actions is even more critical for plans that use a third party to maintain records and contact information.  For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team. 

The EBSA places high priority on helping retirement plans locate and communicate missing participants to prevent exceeding the audit threshold.

Assurance

Employee Benefit Plan Audit

Retirement plans and missing participants: examining the issues, warning signs and solutions

Baker Tilly’s e-book, Innovation culture, reveals strategies and key considerations in creating something new, adding value, improving performance and fueling future success with a culture of innovation. It’s human nature to continually think of new ways to do things. In its simplest form, innovation occurs when a company or organization does something new or different that creates value. Innovation takes time and resources. If an organization has a dollar or an hour to spend, they will spend it servicing a customer, client or constituent. That’s a “today” goal, while innovation is about the future. The focus on near-term profitability and growth or servicing immediate client or constituent needs may distract an organization from realizing that innovation will fuel business growth or an organization’s long-term mission. When organizations allow employees at all levels to be stakeholders in the decision-making process, they foster a culture of innovation. To have an innovation mindset, organizations must recognize the need for change and be committed to supporting change through action. Talent development and data maturity are two primary initiatives that organizations can adopt to start on their innovation journey.
Baker Tilly’s wide array of advisory services can help executives looking to innovate and differentiate their organizations. Our specialists have the experience to help you determine opportunities for innovation and develop a culture of innovation. Baker Tilly’s Value Architects™ can help.

Innovation occurs when an organization does something new or different that creates value. Creating a culture of innovation is essential for organizations.

Application Services

Digital Strategy

Enterprise Solutions 

Global Trade Management

Human Capital

Municipal Advisory

Nearshoring Services

Supply Chain & Manufacturing Consulting

Supply Chain Strategy, Planning & Optimization

Innovation culture – jumpstarting new ideas to drive organizational success

Attracting and retaining talent was a significant problem for many organizations before the COVID-19 pandemic, and it continues to be a major issue across most industries. The pandemic complicated matters, of course, by lowering the number of job seekers, expanding the geographic options for remote applicants, and generally altering the expectations of today’s job seekers. With these COVID complications in mind, Baker Tilly has updated its 2019 e-book, “The talent problem,” to reflect the modern-day environment and the new challenges that businesses face when it comes to finding and retaining talented employees. Topics include: Candidate-centric recruiting Culture  and  engagement Valuing expertise Apprenticeships and education Pivoting the workforce Diversity in the workplace

Penalty relief for certain 2019 and 2020 taxpayers

Small business cybersecurity risk: Cyberattacks don’t care how big your business is

Combating the rising costs of cyber insurance: how we got here, and what organizations can do

Retirement plans and missing participants: examining the issues, warning signs and solutions

Innovation culture – jumpstarting new ideas to drive organizational success

The talent problem, revisited

Penalty relief for certain 2019 and 2020 taxpayers