UPDATES + INSIGHTS

Article Summary

• Trump Accounts (IRC §530A) are new federal tax-deferred custodial IRA accounts for minors under age 18, created by the One Big Beautiful Bill Act (signed July 4, 2025), with standard traditional IRA treatment beginning at age 18.
• Eligible U.S. citizen children with a Social...

Article Summary

• Modernized capitalization model aligned with agile development. The Financial Accounting Standards Board issued ASU 2025-06 to replace the outdated stage-based model in ASC 350-40 with a more flexible framework that reflects agile, iterative, and cloud-based software development...

article Summary

• Nacha’s 2026 rule changes expand ACH fraud monitoring requirements to include all covered Originators (not just banks), requiring risk-based processes to detect entries initiated due to fraud, including “False Pretenses” (authorized payments induced by deception).
• Originators must...

Article Summary

U.S. GAAP allows nonprofit museums to choose whether to capitalize qualifying art collections, recognizing that collections are mission‑driven assets rather than traditional financial resources. Most museums elect not to capitalize collections because they are held in the public...

Article Summary

• A SOC exam typically spans multiple phases:control gap assessment (hours to days), control design and implementation (1–6 months), fieldwork (3 days–3 weeks), and reporting (1–2 months).
• Identifying whether a SOC 1, SOC 2, or SOC 3 report is needed depends on whether services...

Article Summary

• SOC reports provide assurance that a service organization’s internal controls are designed and operating effectively.
• SOC 1 focuses on financial reporting controls, while SOC 2 addresses security, availability, processing integrity, confidentiality, and privacy.
• SOC examinations...

Article Summary

• SOC 2 Trust Services Criteria were updated to align with the 2013 COSO Internal Control Framework and include enhanced focus on cybersecurity, governance, and risk management.
• New description criteria require expanded disclosures, including principal service commitments, system...

Article Summary

• Definition and Purpose of a WISP: A Written Information Security Plan (WISP) is a formal document that outlines how an organization identifies, assesses, and manages cybersecurity risks. It includes administrative, technical, and physical safeguards to protect sensitive data and...

Article Summary

• Explains how to determine whether a vendor qualifies as a Subservice Organization in SOC 1 and SOC 2 reports.
• Defines Subservice Organizations based on AICPA SOC Audit Guides, emphasizing “relevant” and “necessary” controls.
• Identifies two key factors: whether vendor controls are...