Not-for-Profit Update

Transcription

1 Not-for-Profit Update Fraud Prevention Where do we start? March 17, 2016 We are all faced with limited resources everywhere we turn. In the world of accoun ng and finance, having limited resources means that we have to make choices about how we allocate those resources when it comes to internal controls, financial repor ng capabili es, personnel, and so on. These are difficult decisions to make. If resources are scarce for accoun ng departments, the por on that can be devoted to specific fraud preven on tools is even scarcer. This can be par cularly pronounced in notfor profit organiza ons as dollars tend to be allocated first to mission based func ons and providing the absolute best for the community the organiza on serves. Having said that, losses due to fraud are always damaging both in terms of reputa onal damage and the loss of funds. For these reasons, selec ng the right controls to defend against fraud is important. The no on of limited resources is problema c for the preven on of fraud. Would be fraudsters consistently look for weaknesses in an organiza on and iden fy ways they can exploit those weaknesses to complete the fraud. All organiza ons have flaws and weaknesses, whether they are inherent or by poor design, and the specific weaknesses will be different in each case. Therefore, a one size fits all approach to internal controls or fraud preven on is very difficult to design. For these reasons, a thorough and unique risk assessment is a necessary step each organiza on needs to complete to design adequate controls in the effort to prevent fraud. To this first point, risk assessments provide management and the accoun ng and finance team direc on and strategy when it comes to implemen ng internal controls. Without this direc on, it can be like going for a walk but not really knowing where you are heading. You put one foot in front of the other because that is what you ve always done. But how do you know if the next step you take is poin ng you where you want to go? In the context of accoun ng and internal controls, you perform certain tasks because that is what you ve always done. But how do you know that those tasks will safeguard your assets, or strengthen your financial repor ng, or guarantee accuracy? Just because you did those tasks at your previous employer doesn t mean they are necessarily right for this organiza on. It doesn t mean that they are wrong either, but you won t know for sure un l you understand the risks facing the organiza on and the most effec ve ways to mi gate those risks. To the second point, having the right controls in place is much more important than having a lot of controls in place, for many reasons. Here s an example to illustrate this point. A theatre is having a very successful season and is filling the house. However, they have been having cash flow troubles and have not been able to understand why. The CFO does some digging around the box office and suspects that one of the tellers has been commi ng fraud. Register sta s cs for each teller employee shows that one employee has been selling a dispropor onate number of ckets to senior ci zens and students, who are afforded a 50% discount. It turns out that the employee was receiving enough cash from the patron for full price ckets, but ringing up a discounted cket and pu ng the difference in her pocket. In this example, the theatre had a control in place to make sure that the register tapes reconciled to the cash in the ll at the end of each teller s shi, but they did not have a control in place to regularly look at register sta s cs for any anomalies. cont d page 2

2 Fraud Prevention Where do we start? Cont d This is an example of an organiza on se ng up internal controls in reverse. Controls were set up without first iden fying the risks they would mi gate. Controls are o en set up in the hopes that they mi gate risk somewhere in the opera on, but they are not always implemented to address specific risks (the random walk we talked about earlier). The register reconcilia on control was implemented because it sounded like a good control to have in place for the retail por on of the opera on, not because it was responding to a specific risk iden fied in a risk assessment. The risk assessment may have told us that the register reconcilia on control needed to be there; however, that same process likely would have told us that other controls needed to be in place too (i.e., review of register sta s cs). It becomes much easier to iden fy useful and crea ve controls if you have completed a brainstorming session on risks facing the organiza on s opera ons. If the brainstorming session iden fied the risk that a teller could be skimming from the register, it would have been much easier for the CFO to iden fy that reviewing register sta s cs could mi gate that specific risk. Jumping right into a brainstorming session on which internal controls should be used, without first discussing risk, is ineffec ve. Without first understanding the risk of skimming, it is difficult to understand why reviewing the register sta s cs is a necessary step. The study provides a more complete list, but what is included here is the top 10 most effec ve internal controls. The table lists these controls and then displays how o en the control was implemented, the dollar loss of the fraud in cases where that control was implemented ( Yes column), the dollar loss of the fraud in cases where that control was not implemented ( No column), and the percentage of difference between the Yes and No columns. Proac ve data monitoring has jumped to the forefront. Accoun ng systems are churning out so much data and those organiza ons/companies that are monitoring that data have a leg up on their peers when it comes to fraud preven on. The register sta s c control men oned in the example above would be a great example of proac ve data monitoring. This most current ACFE study (published in 2014) shows that proac ve data monitoring is enhanced when financial oriented informa on (i.e., revenues, expenses, etc.) is paired with non financial data (i.e., ckets sold by category, number of performances, number of performers). The opera onal success of an organiza on should be ed to its financial performance. When these two elements are telling a different story, then that is a sign that something unusual may be going on. As you can tell from the list above, these are not the ordinary, run of the mill accoun ng controls. These are more targeted and typically aimed at specifically iden fying and preven ng fraud. As you might guess, a fraud risk assessment is among the controls listed. A though ul discussion around how fraud can happen will naturally lead to ideas about how to prevent it. The studies conducted by the ACFE have shown that these controls are very effec ve at reducing the dollar loss of an ongoing fraud and catching those issues early. With reputa onal damage being a paramount risk for any not for profit, the risk assessment process is a cri cal step for each organiza on to complete and periodically update. Pu ng controls like these in place to address specific risks at your organiza on creates a proven combina on for early interven on and fraud reduc on. 2

3 Brave New World of Fundraising and Social Media How do you raise $100 Million dollars in 6 months? Get a few thousand people to challenge each other to pour buckets of ice water over their heads, video tape themselves doing it, and post it on social media websites using #ALSiceBucketChallenge. Easy right? No one expected the ice bucket challenge to take off so stupendously and you can t always know what project or endeavor is going to be a grand slam home run. However, we are truly in an era where social media is the easiest form of communication and charities must embrace the power of individual fundraising through this medium. Whether it is for the ALS Ice Bucket Challenge, the local fun run or the PTA Read-a-thon, individual fundraising is on the rise and people are using their social media accounts and contacts to solicit donations for their favorite charities. Charities, looking for alternative ways to fundraise, and individuals, fundraising on behalf of their favorite charities, use crowdfunding or online fundraising sites such as GoFundMe, Indiegogo, Crowdrise, Fundly, and others. How does online fundraising for or on behalf of charities work? The first and most important step is that the charity selects the online service provider it wants to work with, such as GoFundMe or Indiegogo. These unregulated sites act as agents for charities and distribute information to the public about the fundraising goals of the charity. Once a charity establishes a relationship with a crowd funding site, an individual can set up an account with the site and fundraise on behalf of the charitable organization. There are a number of online fundraising sites so charities must do their due diligence prior to signing up. Each site has different offerings. One site may offer services for charities while another site may only offer services for personal fundraising efforts. In addition, each site may charge different fees in exchange for the services they provide. Some sites only charge a fee to the charity (remitting the donation net of the fees to the charity) which allows the donor the full charitable deduction. Others charge the fee to the donor, limiting the charitable contribution to the donor. Still some other sites may charge a fee to both the donor and the charity. Charities must fully understand the fee structure and clearly communicate it to its donors and individuals who may be soliciting on its behalf to avoid public relations problems. The fees usually include both a fee (usually $0.30 per transaction) and a percentage fee based upon gross amount of funds raised (up to 7.9% of amounts raised). Charities interested in participating in online fundraising should use crowdfunding sites cautiously and consider the following: The charity should make sure the agreement provides that they get all of the donor information collected by the online service provider. Some sites offer the capability for a charity to download an Excel file of donor information which includes names, addresses, amounts, and times donated. The charity should make sure the online service provider has a donor acknowledgment script built into their website and that it is approved by the charity s legal counsel. Some sites, such as GoFundMe, partner with FirstGiving, will process contributions and issue donor acknowledgement letters when donors make online contributions through their site. Charities may also follow up with issuing a donor acknowledgement letter of their own, once they receive information about their donors. The contributions made through the online fundraising sites should be deposited into the charity s bank account as soon as possible to make sure the charity has use of those funds immediately, rather than the online service provider making use of the float on those funds. Most online fundraising sites offer both weekly and monthly deposits, electronically or via check. Do not use these websites to hold raffles. This would likely constitute interstate gaming because it is almost impossible to limit webbased participation to a single state. For states that require the online service provider to register as a professional fundraiser, the charity should require the online service provider to provide proof of such registration. It is important to note that a charity must report on its annual Form 990 the gross amount raised, the donor s information (if they exceeded a specific threshold) and the fees paid to the online service provider. Therefore, having donor detail is essential from both compliance and public relations perspectives. The other side of crowdfunding is what the donor needs to be aware of. Donors will need to independently verify that the organization they are contributing to is a 501(c)(3) organization. Some crowdfunding sites will provide certifications or verifications of a charity s status and those are usually sites contracting directly with those organizations. If there is no certification or verification, contributions to these organizations would likely be disallowed as a tax deductible contribution. Donors should always make sure that they receive a donor acknowledgement letter, especially amounts over $250, in order to claim a charitable contribution deduction on their personal tax return. Crowdfunding sites can help smaller organizations that do not have the resources to develop a robust website and payment processing capabilities while at the same time harnessing the power of social media fundraising. Social media is clearly a trend that is taking hold and to the extent your organization has an active and engaged group of volunteers, harnessing the power of social media fundraising is something worth exploring. 3

4 OMB Uniform Guidance: the Top 8 Changes to Audit Requirements Cont d This past year, not-for-profits and other non-federal organizations have been implementing the new changes related to the OMB Uniform Guidance (2.CFR.200) as they receive funding under the new regulations. However, the guidance over 2.CFR.200 Subpart F - Audit Requirements will be effective for audit years beginning after December 26, As such, the first audits subject to the new auditing requirements will be for organizations with a year end of December 31, 2015 and later. These requirements replace the audit requirements under OMB Circular A-133 and will impact the way auditors plan and report their results under single audits. The top 8 changes to the audit requirements for auditors are noted below: 1. Single Audit Threshold ( ) - The threshold for requiring a single audit increases from $500,000 to $750,000 in federal expenditures. The OMB is estimating that there will be approximately 5,000 fewer single audits. 2. Type A Thresholds ( ) - The lowest level threshold for type A programs has been increased from $300,000 to $750,000. This matches the Single Audit Threshold in order to help reduce confusion in implementing the new guidance. The remaining Type A thresholds depend on the amount of an organization s Schedule of Expenditures of Federal Awards (SEFA), and is presented in the table below (per 2.CFR (b)(1)). Total federal awards expended Type A threshold Equal to or exceed $750,000 but less than or equal to $25 million $750,000. Exceed $25 million but less than or equal to $100 million Total federal awards expended times.03. Exceed $100 million but less than or equal to $1 billion $3 million. Exceed $1 billion but less than or equal to $10 billion Total federal awards expended times.003. Exceed $10 billion but less than or equal to $20 billion $30 million. Exceed $20 billion Total federal awards expended times Programs that fall under the respective Type A Threshold are considered Type B programs. 3. Type A Program Risk Assessment ( & ) - As with previous OMB guidance (A-133), a risk assessment must be performed on all Type A programs. Under Uniform Guidance, a Type A program will be considered high risk and thus subject to audit as a major program if the program has not been audited in the past two years, or if the program had a high risk finding during its most recent audit period. A high risk finding is defined in the Uniform Guidance as a modified opinion, material weakness in internal control, and/or known or likely questioned costs that exceeded 5% of total program expenditures. In assessing risk, the auditor must consider the impact of program risks including federal or pass-through entity oversight of the program, results on previous audit follow-ups, and changes in personnel or systems. Under prior OMB guidance (A-133), a Type A program would be considered high risk if it had any finding, including significant deficiencies, in the prior period audited. Uniform Guidance now limits this to a high risk finding. Additionally, under A-133, the auditors were also able to assess risk based on certain inherent risk considerations. This has been removed under the new Uniform Guidance. 4. Type B Program Risk Assessment ( & ) - The auditor must perform a risk assessment of Type B programs to assess which programs are high risk. However, the new Uniform Guidance is not requiring that all Type B programs be assessed. Instead, it requires that an assessment be performed on Type B programs that are over 25% of the respective Type A threshold. In addition, an auditor is not required to identify more high-risk Type B programs than 25% of the number of low-risk Type A programs. Additionally, when selecting the Type B programs to assess for risk, the Uniform Guidance encourages an approach that could lead to different high risk Type B programs audited as a major program in a given period Under prior OMB guidance (A-133), Type B program risk assessments were performed on programs over $100,000. An auditor was given two options in performing the risk assessment for coverage of Type B programs assessed. Option 1 was to perform risk assessments on all Type B programs and select 50% of high-risk Type B programs up to the number of low-risk Type A programs. Option 2 was to perform risk assessments on all Type B programs until the number of Type B programs equaled the number of low-risk Type A programs. Under Uniform Guidance and as previously under A-133, a single risk criteria would not cause a Type B program to become a high risk program. Auditor judgment is part of the risk assessment. At a minimum, an auditor must select for major programs all Type A programs assessed at high risk and all Type B programs identified as high risk. Additionally Type A programs may be selected to meet the Percentage of Coverage Rule. 4

5 OMB Uniform Guidance: the Top 8 Changes to Audit Requirements Cont d Page 5 5. Percentage of Coverage Rule ( ) - For auditees assessed at low risk, the total major programs selected based on the risk assessment discussed above must be at least 20% of the total federal awards expended. For auditees not considered low risk, the percentage coverage is increased to 40%. Under prior OMB guidance (A-133), the percentage coverage was 25% for low risk auditees and 50% for auditees not considered low risk. 6. Criteria for a Low Risk Auditee ( ) - An auditee must meet all of the conditions described in the Uniform Guidance to be considered a low risk auditee. The conditions take a two-year lookback approach. For the past two years, the following must be applicable for all conditions: Single audits have been performed on an annual basis in accordance with OMB guidance. Unmodified opinion on financial statements in accordance with generally accepted accounting principles or other basis of accounting that is required by a state law (new addition to Uniform Guidance) Unmodified in-relation-to opinion on the SEFA No material weakness identified under the requirements of GAGAS The Type A programs audited as major programs did not have a material weakness, material noncompliance, and/or questioned costs that exceeded 5% of program expenditures Data Collection Form is filed by submission due date with the Federal Audit Clearinghouse Additionally, if the auditor s report included a going concern paragraph, an auditee would automatically be precluded from being considered a low-risk auditee. Lastly, an auditee can no longer obtain a waiver for internal control weaknesses from federal agencies in order to qualify as a low-risk auditee. 7. Audit Findings Changes ( ) - Under Uniform Guidance, the known and likely questioned costs threshold has been raised from $10,000 to $25,000. If there are known and/or likely questioned costs that exceed $25,000, they must be reported as an audit finding. Uniform Guidance also notes that the Corrective Action Plan prepared by the auditee in response to the audit findings should be documented separately from the auditor s findings. This is to help distinguish what is prepared by the auditors versus the auditee. All other requirements related to the audit findings remain consistent with previous OMB guidance (A-133). 8. Schedule of Expenditures of Federal Awards Disclosures ( ) - Uniform Guidance adds new disclosures to be included with the SEFA. This includes a requirement to disclose whether or not the entity elected to use the 10% de minimis indirect cost rate. Additionally, for loans or loan guarantees reported on the SEFA, the notes to the SEFA must disclose the outstanding balance at the end of the audit period. Loans and loan guarantees are reported on the SEFA based on their balance at the beginning of the audit period. 2.CFR.200 Subpart F results in some significant changes in the way single audits are planned and reported. Auditors and auditees should be aware of these changes, and how they will affect their audits. Resources For additional resources related to Uniform Guidance, see the following: Uniform Guidance, 2.CFR.200 Federal Notice with Preamble Council on Financial Assistance Reform (COFAR) and FAQs Various industry organizations are also publishing information as it becomes available: AICPA Government Audit Quality Center Council on Governmental Relations (COGR) an association of research universities National Association of College and University Business Officers (NACUBO) InsideNGO, a global NGO community 5

6 Donor Acknowledgement Sample Form Dear Just Ask Us, We are a charity with many large contributions. We are very good at providing donor acknowledgments. We have no fundraising dinners, auctions, or give-aways, so we don t have to worry about valuing any benefit to the donor which may limit their charitable deduction. So, our acknowledgments thank the donor and state the amount of cash we received or the value of a noncash gift. Are our acknowledgements done correctly? Yours, Thankful Recipient Dear Thankful Recipient, Your donors must appreciate receiving the acknowledgments. Donors that give $250 or more must substan ate their dona ons with donor acknowledgment le ers to take charitable deduc ons for their gi s. Your acknowledgments, however, should be revised to omit the value of noncash contribu ons and include all of the following: Name and address of the donor Name and address of your organiza on The date of the gi The amount of cash received or detailed descrip on (but not value) of any noncash contribu on Tax exempt status of your organiza on Any restric ons placed on the contribu on by the donor A statement regarding whether any goods or services were received by the donor in exchange for the contribu on, and if so, their value. Even if no goods or services or only intangible benefits were provided to the donor, a statement to that effect is required. The descrip on of any noncash contribu on should not include a value for the item. That is for the donor and her tax advisor to decide. A quick review by your tax advisor of your form acknowledgment le er also is a good idea. Yours, Just Ask Us The advice offered in this column is general in nature and is intended for informational purposes only. It is distributed with the understanding that the contributing authors and editors, and the publisher, are not rendering legal, accounting, or other professional services. Due to the complexity of many tax and accounting issues, the result of any matter may vary depending on the circumstances. Specific problems should be directed to your own accountant, tax advisor, or legal counsel. 6

7 Business Tagline or Motto Contact our Education and Not for Pro it Services Team if you have any questions or if we may be of service to you. Visit our website at to ind your nearest of ice. 7