UPDATES + INSIGHTS

Understanding 501(c) Organizations: Which Donations Are Tax‑Deductible?

March 23, 2026

Article Summary

• WISP Fundamentals: A Written Information Security Plan (WISP) is a formal, documented cybersecurity strategy that outlines how an organization identifies, assesses, and manages risks to protect sensitive data — an essential foundation for any internal control or compliance program.

Article Summary

• Explains how to determine whether a vendor qualifies as a Subservice Organization in SOC 1 and SOC 2 reports.
• Defines Subservice Organizations based on AICPA SOC Audit Guides, emphasizing “relevant” and “necessary” controls.
• Identifies two key factors: whether vendor controls are...

Article Summary

• Purpose and Value of SOC Reports – SOC (System and Organization Controls) reports are independent audit reports that provide assurance about a service organization’s internal controls, helping build trust with customers, partners, and auditors.
• Differences Between SOC Types – The...

Article Summary

• SOC Framework Overview: SOC reports are independent audits of internal controls relevant to security, availability, processing integrity, confidentiality, and privacy, with criteria defined by the AICPA.
• New SOC 2 Trust Service Criteria: Recent updates have clarified the Trust...

Article Summary

• SOC audits require significant preparation and planning. From readiness assessments to audit fieldwork and reporting, the full SOC journey can take several months to over a year depending on scope, control maturity, and whether the organization is pursuing a Type I or Type II...

Article Summary

• Trump Accounts (IRC §530A) are new federal tax-deferred custodial IRA accounts for minors under age 18, created by the One Big Beautiful Bill Act (signed July 4, 2025), with standard traditional IRA treatment beginning at age 18.
• Eligible U.S. citizen children with a Social...

Article Summary

• Modernized capitalization model aligned with agile development. The Financial Accounting Standards Board issued ASU 2025-06 to replace the outdated stage-based model in ASC 350-40 with a more flexible framework that reflects agile, iterative, and cloud-based software development...

article Summary

• Nacha’s 2026 rule changes expand ACH fraud monitoring requirements to include all covered Originators (not just banks), requiring risk-based processes to detect entries initiated due to fraud, including “False Pretenses” (authorized payments induced by deception).
• Originators must...