UPDATES + INSIGHTS

Article Summary

• Modernized capitalization model aligned with agile development. The Financial Accounting Standards Board issued ASU 2025-06 to replace the outdated stage-based model in ASC 350-40 with a more flexible framework that reflects agile, iterative, and cloud-based software development...

article Summary

• Nacha’s 2026 rule changes expand ACH fraud monitoring requirements to include all covered Originators (not just banks), requiring risk-based processes to detect entries initiated due to fraud, including “False Pretenses” (authorized payments induced by deception).
• Originators must...

Article Summary

U.S. GAAP allows nonprofit museums to choose whether to capitalize qualifying art collections, recognizing that collections are mission‑driven assets rather than traditional financial resources. Most museums elect not to capitalize collections because they are held in the public...

Article Summary

• A SOC exam typically spans multiple phases:control gap assessment (hours to days), control design and implementation (1–6 months), fieldwork (3 days–3 weeks), and reporting (1–2 months).
• Identifying whether a SOC 1, SOC 2, or SOC 3 report is needed depends on whether services...

Article Summary

• SOC reports provide assurance that a service organization’s internal controls are designed and operating effectively.
• SOC 1 focuses on financial reporting controls, while SOC 2 addresses security, availability, processing integrity, confidentiality, and privacy.
• SOC examinations...

Article Summary

• SOC 2 Trust Services Criteria were updated to align with the 2013 COSO Internal Control Framework and include enhanced focus on cybersecurity, governance, and risk management.
• New description criteria require expanded disclosures, including principal service commitments, system...

Article Summary

• Definition and Purpose of a WISP: A Written Information Security Plan (WISP) is a formal document that outlines how an organization identifies, assesses, and manages cybersecurity risks. It includes administrative, technical, and physical safeguards to protect sensitive data and...

Article Summary

• Explains how to determine whether a vendor qualifies as a Subservice Organization in SOC 1 and SOC 2 reports.
• Defines Subservice Organizations based on AICPA SOC Audit Guides, emphasizing “relevant” and “necessary” controls.
• Identifies two key factors: whether vendor controls are...

Article Summary

• Employee deferrals must be deposited into a retirement planas soon as they can reasonably be separated from an employer’s general assets.
• Common timeframes such as five or seven business days are general expectations, not safe harbors.
• An employer’s fastest historical deposit sets...