UPDATES + INSIGHTS

Understanding 501(c) Organizations: Which Donations Are Tax‑Deductible?

March 23, 2026

Article Summary

• WISP Fundamentals: A Written Information Security Plan (WISP) is a formal, documented cybersecurity strategy that outlines how an organization identifies, assesses, and manages risks to protect sensitive data — an essential foundation for any internal control or compliance program.

Article Summary

• Explains how to determine whether a vendor qualifies as a Subservice Organization in SOC 1 and SOC 2 reports.
• Defines Subservice Organizations based on AICPA SOC Audit Guides, emphasizing “relevant” and “necessary” controls.
• Identifies two key factors: whether vendor controls are...

Article Summary

• Purpose and Value of SOC Reports – SOC (System and Organization Controls) reports are independent audit reports that provide assurance about a service organization’s internal controls, helping build trust with customers, partners, and auditors.
• Differences Between SOC Types – The...

Article Summary

• SOC Framework Overview: SOC reports are independent audits of internal controls relevant to security, availability, processing integrity, confidentiality, and privacy, with criteria defined by the AICPA.
• New SOC 2 Trust Service Criteria: Recent updates have clarified the Trust...

Article Summary

• SOC audits require significant preparation and planning. From readiness assessments to audit fieldwork and reporting, the full SOC journey can take several months to over a year depending on scope, control maturity, and whether the organization is pursuing a Type I or Type II...

Article Summary

• Modernized capitalization model aligned with agile development. The Financial Accounting Standards Board issued ASU 2025-06 to replace the outdated stage-based model in ASC 350-40 with a more flexible framework that reflects agile, iterative, and cloud-based software development...

article Summary

• Nacha’s 2026 rule changes expand ACH fraud monitoring requirements to include all covered Originators (not just banks), requiring risk-based processes to detect entries initiated due to fraud, including “False Pretenses” (authorized payments induced by deception).
• Originators must...

Article Summary

U.S. GAAP allows nonprofit museums to choose whether to capitalize qualifying art collections, recognizing that collections are mission‑driven assets rather than traditional financial resources. Most museums elect not to capitalize collections because they are held in the public...