JAK + CO.

Certified Public Accountants

Call Our Minnesota CPA Firm: 651.641.1099

10 Ways to Protect Your Business From a Cyber Attack

By

Steve Fox - CPA Firm MinneapolisBy Steve Fox

The words “cyber attack” have become part of our American vernacular. Unfortunately, there isn’t a standalone silver bullet that can keep your business safe from hackers and their seemingly ubiquitous malware. Preventing a cyber attack requires multiple layers of defense.

Here are 10 cybersecurity measures every business should practice:

  1. Keep up with software patches and updates

Software providers such as Microsoft, Adobe, and Java—to name a few—release software updates and patches each month to address newly discovered security lapses. Don’t neglect them. If you do, you could create system vulnerabilities that hackers could easily exploit.

  1. Run an antivirus program

Your antivirus program should scan your files in real time and your system on a weekly or, preferably, daily basis. Be sure to install antivirus software on all workstations (i.e., anything your end users operate on) as well as your server.Accounting Technology Solutions Minneapolis - CPA Firm Minneapolis

  1. Employ a third-party spam filtering company

It’s nearly impossible to keep spam emails out of your inbox. There are numerous ways to block them, but the most effective solution is almost always a third-party spam filtering company. These companies receive your emails, scrub them using the latest spam-skimming filters, and then deliver the spam-free emails to your inbox.

  1. Implement cloud-based malware protection

Cloud-based malware protection companies divert data going to and from your computer to their domain name system (DNS) servers. (The DNS is like an address book for the Internet.) These companies have real-time scanning capabilities that check the web or IP address your computer is trying to reach against known malicious addresses. If the address is bad, the company blocks the connection, preventing your computer from “talking” to the bad guys.

  1. Maintain a corporate firewall

Most businesses have this basic cybersecurity measure in place. Nevertheless, it’s worth a mention. A firewall on the outside perimeter of your network is critical to filtering and blocking data. Think of it as the gatekeeper of your network.

  1. Establish backup and disaster recovery protocols

Daily system backups have become antiquated. Today’s backups are image based: when the backup runs, it takes a snapshot of the entire system—typically on an hourly basis. If your system crashed or your hardware became disabled, you can simply take the snapshot to a different system and restore it to a new piece of hardware.

It’s important to test your backups regularly. Through our managed backup services, we test backups on a weekly or monthly basis, depending on our client’s needs. An entire disaster recovery test—during which all company servers are shut down—can help to ensure your system can be restored if needed.

  1. Use password management and authentication methods

It goes without saying that your password shouldn’t be “p-a-s-s-w-o-r-d” or one that matches your name. Password management—promoting the use and regular updates of strong passwords across your organization—can help your company avoid this all-too-common mistake. You may also want to consider dual authentication, which requires end users to provide a second method of authentication, such as a code sent to their cell phone via text message, in addition to a password.

  1. Manage the use of file-sharing applications

Many employees rely on file-sharing applications such as Dropbox and Google’s OneDrive to keep their files readily accessible. Obviously, this practice can lead to security deficiencies relating to company data. Are your employees using file-sharing applications? If so, consider developing a policy to address potential security lapses.

  1. Train employees in cybersecurity

The end user is the weakest link in preventing a cyber attack. For instance, if an employee uses a weak password or falls for a phishing email scam, there’s little your cybersecurity measures can do. Training your employees on how to recognize and respond to potential threats can keep your business from becoming a victim.

  1. Monitor, monitor, monitor

Keeping an eye on everything we just talked about—the software updates and patches, antivirus program, spam filtering, data backups, etc.—is critical. If you’re not monitoring them, they could go offline or fall behind on updates and you’d be none the wiser.

Actively maintaining a layered defense can help you thwart a cyber attack—and keep your business name from ending up as a late-night TV punch line. If you have questions or would like to learn how a managed IT service provider such as Minnesota based cyber solutions can help, give us a call today.

How Indirect Construction Costs Can Impact Your Profitability

By

Joy McAdoo

By Joy McAdoo, CPA

Keeping tabs on direct construction costs for a project is pretty straightforward. Take your materials costs, for instance: X number of beams used on the project multiplied by cost of each beam = total cost. Easy! Dealing with indirect construction costs, however, can be another story.

Indirect costs relate to the performance of the job, but they’re hard to track to a specific project. In other words, indirect costs might benefit multiple projects.

Here’s the thing: If you don’t have the full picture of your cost to complete a project, you’ll get a false sense of your profitability. That’s why it’s so important to track and allocate your indirect costs as accurately as possible. Here are a few tips for getting started.

Construction cpa St. Paul, Minneapolis

  1. Identify your indirect costs.

Indirect costs can generally be divided into two buckets: labor and equipment. Some contractors may use only one bucket, while others may use both.  Examples of costs that may be included in the indirect labor cost bucket include payroll taxes, workers compensation costs, and employee benefits. Examples of costs that may be included in the indirect equipment cost bucket include fuel, maintenance, insurance, and storage cost related to your owned equipment. The key is to decide what makes sense for your business to accurately determine your project-related costs.

So, we’ve covered labor and equipment, but what about the costs associated with running your business, such as general liability insurance, advertising, and office-related salaries? These costs are categorized as “overhead.” Although typically flat (i.e., they don’t fluctuate) and easier to predict, they’re often the hardest type of costs to allocate. That’s because it’s likely your overhead costs do support projects—just not 100 percent of the time. For this reason, it’s important to consider allocating some of your overhead costs to specific projects.

  1. Keep separate ledger accounts for each indirect cost bucket.

Once you’ve determined the items included in your indirect costs, it’s time to track them. First, make sure your general ledger has a separate account group for each indirect cost bucket you’ve identified. This is where you will post these costs. Often times a contra account, which is an account with a balance that is opposite of the associated account (e.g., a credit instead of a debit), will be used for each bucket to easily show the total amount allocated to the jobs. From a reporting perspective, this ledger setup will allow you to see a whole bucket of costs and compare the actual amounts incurred to the amount that has been allocated.

  1. Allocate indirect costs using a systematic and rational method.

Once you have your buckets set, you’re ready to allocate. While there are numerous ways to allocate costs, the method you choose should be systematic and rational. For instance, you could allocate labor costs based on direct labor hours incurred, or on a percentage of total cost per labor hour. Equipment costs could be treated in a similar manner—allocated by total equipment hours incurred.

Most often, contractors will estimate their total annual indirect costs for each bucket and set a predetermined rate to allocate those costs throughout the year. Others will use the actual cost incurred each month and allocate the full amount based on activity during that time period. The decisions surrounding how to allocate indirect costs will vary depending on the nature of your business.

  1. Let your accounting software share the load.

Many robust accounting systems have built-in functionalities for indirect cost tracking and allocation. This begs the question: Do you know what your accounting software is capable of? If yours has this functionality, you could automatically track and allocate indirect costs with little effort after the initial setup.

  1. Look forward to better insight into your business.

As I mentioned, keeping up with your indirect costs gives you a clearer picture of your profitability. Another benefit of tracking and allocating indirect costs is the ability to see your actual cost compared to what you expected. This is valuable information to have when bidding and estimating jobs. If you don’t know exactly what your indirect and overhead costs will be, how can you compile an accurate bid?

In order to successfully track and allocate indirect costs, you have to tailor the methods to your business. But don’t worry—at JAK we can help you figure out the right buckets and allocation approach, giving you the relevant financial information you need for increased profitability.

Bookkeeper vs. Accountant: Which is right for your business?

By

By Teri MacNabb, CPABookkeeper vs. Accountant: Which is right for your business?

Part of owning a business is managing its finances. But if you’re up to your eyeballs in account entries, you may want to bring in someone to help. So, do you hire a bookkeeper or an accountant?

The short answer: It depends. If you simply need someone to enter day-to-day transactions into your accounting system, a bookkeeper is likely your best bet. But if you need someone to interpret and analyze your financial data, a business accountant is almost certainly the answer.

Still unsure of which financial professional is right for your business? Here are a few questions to consider when making the call.

How large is your business?

If you have only a handful of employees, it’s safe to say a bookkeeper may be sufficient. But if your company employs 30 or more, consider an accountant. Companies of this size could run into complicated issues with payroll, taxes, and more. An accountant can take care of it all, so you can focus on running your business.

What are your bank’s reporting requirements?

Depending on the size of your loan, your bank may require you to submit financial statements once per quarter or more regularly. Having solid financial statements is critical, as your bank will carefully scrutinize each one. If you’re in this position, working with an accountant is a must. Your accountant can compile your statements in accordance with all applicable regulations, saving you time, money, and, of course, future headaches.

How do you make management decisions?

The typical small business owner doesn’t have to consult financial statements before making every decision. Larger businesses, however, usually have a board of directors that bases its management decisions on the latest financial statements. If you identify with the former, you may get along just fine with a bookkeeper. But if you need to report to a board of directors—or if you plan to in the future—an accountant can help you prepare and present financial statements, and also advise on management decisions.

Final question: Hire or outsource?

Regardless of whether you need a bookkeeper or an accountant, it’s important to weigh your options for hiring a full- or part-time employee or outsourcing the role. Having an accountant or bookkeeper on staff may make sense for some organizations. For others, outsourcing the role eliminates the cost of maintaining a salaried position.

Experience peace of mind with the right person

 The accuracy of your business’ financial data is critical to its success, which is why working with a financial professional—whether it’s a bookkeeper or an accountant—is a wise move. The right person will handle your accounting functions with ease, giving you fewer reasons to worry and more sleep at night. Ready to explore your options? If you have questions about bookkeeping versus accounting, please give me a call.

Will a Nigerian Prince be Your Next Client?

By

By Todd Koch, CPA, MBT, CFP®

Introduction

Many clients are looking for a new CPA, so receiving email requests for proposals is getting more common. Recently, I received an email request from a Nigerian prince offering me a million dollars to review his tax return. He conveniently attached his return to the email. So, all I needed to do was open his email attachment, and we were in business, right?

Now, while I have not had any phishing emails this obvious before, I have received several similar requests in the last 90 days. These are security threats and are a real danger to our clients’ data. We all have heard the warnings that CPA’s are prime targets for identity thieves. For years, cybersecurity criminals have been infiltrating the IRS to steal taxpayer information, but they’ve realized it is a lot easier to get that information from us.

A reputation, once lost, is gone forever

We have a legal duty under the Gramm-Leach Bliley Act to have a plan to deal with our clients’ private information. But I worry about client security for another reason. I am a CPA.

As a CPA, one of my primary business assets is my reputation, and it’s vital that I protect this. It has taken me too long to earn my reputation, and it only takes one mistake to lose a good name. I do not want to be part of a news story that begins “Security breach at…”

Constant vigilance and rigorous cybersecurity policies can help protect your firm’s data. The AICPA Tax Section has some best practices for keeping client data secure. Below are a few of my practical considerations that you should be doing (if you are not doing them already).

Secure emails

Emails are a leading entry point for security breaches. At our firm, we receive about 2.2 million emails a year. A cloud spam filter stops 90-95% of these emails from reaching our server. This is a good first step.

Get your staff into the mindset of never opening email attachments from new client solicitations. Be sure to create a policy that includes how all new client communications must first be addressed by a phone call to the potential client to determine if this is a new legitimate business proposal.

A cooperative between staff and IT

To reduce the possibility of becoming a victim of data breaches, our IT consultants routinely train and remind our staff to be vigilant. Staff should forward questionable emails to your IT department to evaluate and quarantine.

Also, have your IT department send out phishing emails disguised as real client emails. Test your staff to see if they will take the bait by clicking on an email attachment. This is a great way to assess whether your training is working.

Your trash is someone else’s treasure

There is a goldmine of client data on phones, tablets, or laptops. Staff should let their IT department know before they plan to sell or trade in their electronic devices and equipment. The IT department can then wipe all data from the phone before it changes hands.

Also, lost electronic devices and equipment should be immediately reported to your IT department so they can help mitigate some of the damage. They can reset your accounts and possibly disable your stolen devices so thieves cannot steal your firm’s data.

Get your clients on the bandwagon

Clients need to be aware of the issues of data security. Educate them on the potential risks and get them to embrace your policies for safeguarding their information.

The days of sending PDF attachments via regular email are over. We encourage our clients to use client portals to share their files. A client portal makes it easy to access, manage, and share data securely.

For those clients who do not use secure client portals, we send attachments to them using a secure email service that encrypts our emails in addition to other security measures. This ensures we have private communication channels with our clients.

Also, we are mindful of the packages we mail out. Not only do they have our clients’ names, addresses, birthdates, banking and investment information, but we put all this information in one convenient package with no means to lock or password protect it. Thus, we make it easy for anyone with motive to easily steal that information.

Make it a standard practice for clients to come and pick up their income tax returns. Very few of our clients come and pick up their returns now, but we are encouraging them to pick up their packages or have their returns couriered to them.

Lockdown those assets

Low-tech considerations, although obvious and simple, should not be overlooked. For years now, we have had a shredding company come to the office regularly to get rid of our paper documents securely. They must have a security card to even gain entry to our office.

One thing we implemented this year was asking the vendor who handles our firm’s janitorial duties to come during the work day. It may be a little inconvenient for both parties, but it helps eliminate any potential security concerns that come from documents ending up in the hands of non-staff.

Closing thoughts

A fully secure environment is not possible. As one human can do, another can undo. We need to continue to keep security at the forefront of our everyday life. Otherwise, we may inadvertently allow the Nigerian prince into our doorway.

Improve Your Internal Controls For a Better 2018

By

By Andy Knutson, CPA

business tax consultants

Internal controls are best defined as the policies and procedures an organization employs to create value and minimize fraud risk. They are critical not only for fraud prevention but also for accurate financial reporting. For these reasons, business owners must be careful to avoid complacency. Even if your controls seem to be sound, there’s always room for improvement.

Here are four ways to improve your internal controls:

  1. Better segregation of duties.

This is a big one, and it’s an easy place to start. Segregating duties allows for double verification. In other words, it prevents a scenario where an employee has unchecked authority. Every process should have at least one review. For instance, if your bookkeeper cuts the accounts payable checks, you (as the owner) or another trusted partner should verify each check for accuracy. With this double verification in place, you have a better chance of catching things such as payment to unapproved vendors, double billing, or unauthorized billing rates. Also, think about the people who currently perform controls—is this still the best use of their time?

  1. Review software privileges.

As more and more processes become electronic, controls over your software platforms are becoming increasingly important. Consider who has access to what modules. As employee roles change, should their software access follow suit?

  1. Revisit inventory counts and pricing.

As your company grows, the frequency at which you count inventory may need to increase. For example, an annual count may have been appropriate when revenues were at $500,000, but now that they’ve doubled you may need spot checks throughout the year. In addition to the frequency of counts, think about pricing: Who’s approving the price of inventory? Should this role change?

  1. Conduct a fixed asset review.

Controls over fixed assets such as vehicles can be easily overlooked. A review or inventory of fixed assets can verify their existence and also serve as a way to strategize maintenance and/or replacement.

Start off the new year with the right fraud controls in place.

Taking steps to improve your internal controls now sets you up for a strong start in 2018. This is particularly important if you are looking to sell, transfer ownership, or bring in investors. Prospective buyers and investors will want to see internal controls, as they indicate a business in good standing. You can also expect your internal controls to be scrutinized during an annual audit.

If you’re unsure of how to improve your company’s internal controls, talk to your JAK accountant. We often help clients with designing and improving their controls, and are happy to help you strengthen yours.

Our Office

1781 Prior Avenue North
Falcon Heights, MN 55113
Main 651.641.1099
Fax 651.647.1099
www.jakcpa.com

John A. Knutson & Co., PLLP

John A. Knutson & Co., PLLP, (JAK) is a Twin Cities-based accounting firm serving clients throughout Minnesota and beyond. A Team Committed to Quality Beyond Expectations