Is There Relief in Sight for Undesirable Results of Supply Chain Interruptions?

Date November 1, 2021
Categories
Article Authors

Many manufacturing companies, and other businesses, have long accounted for their inventory on the last-in-first-out (LIFO) basis. LIFO assumes that inventory acquired most recently is sold first, usually resulting in matching higher-cost inventory with current sales. A company with LIFO inventory that experiences a decrease in their inventory levels may often recognize additional taxable income as a result of the LIFO decrement. A LIFO decrement is the excess of the prior period ending inventory minus the current period ending inventory. Decrements result in a reduction of LIFO layers created in earlier years, thereby creating taxable income. In other words, the capitalized lower-cost products are not being deducted in the cost of goods sold, resulting in higher taxable margins.

Many conditions related to the COVID-19 pandemic severely limited manufacturing capacity and caused major interruptions in the global supply chain. In addition, some businesses exhausted current inventory to assist relief efforts during the early stages of the pandemic. These events made it extremely difficult for U.S. companies to maintain their inventory levels in 2020, often resulting in a substantial reduction in inventory levels. These difficulties have continued into 2021 and, in many instances, have intensified. While the overall economy has rebounded strongly since last year, the spread of the Delta variant has added a great deal of uncertainty to many businesses that may have liquidated their inventory in the past eighteen months.

As a result of these circumstances, many companies are likely to see a decrement in their LIFO inventories and will realize additional taxable income and the associated tax liabilities. This will further exacerbate the recovery efforts of these companies, as the additional cash outlay may prove to be an undesirable drain on their finances.

Sec. 473 of the Internal Revenue Code provides relief for eligible taxpayers that experience liquidations of LIFO inventories as a result of a “qualified inventory interruption.” Sec. 473 can be applicable if a business has had an interruption in the ability to obtain replacement inventory due to a trade embargo or other international event. Under Sec. 473, the company would have three additional years to replenish the liquidated inventory. A “qualified inventory interruption” occurs under Sec. 473(c)(2) when the Treasury Secretary, “after consultation with the appropriate Federal officers, determines that…any embargo, international boycott, or other major foreign trade interruption has made it difficult or impossible to replace any class of goods for any class of taxpayers during the liquidation year, and the application of Sec. 473 to that class of goods and taxpayers is necessary to carry out the purpose of Sec. 473, he shall publish a notice of such determinations in the Federal Register, together with the period to be affected by such notice.”

The AICPA has written two letters, in April and August 2021, including detailed examples, requesting that the Department of the Treasury and the Internal Revenue Service apply the relief measures afforded in Sec. 473 for businesses that were unable to maintain their prior inventory levels due to the effects of COVID-19 on the global supply chain. Specifically, the letters requested a safe-harbor method and expedited relief in this scenario. In particular, the AICPA recommended that the safe harbor provide that the taxpayer would disregard the liquidation for this year and would retain the LIFO layers related to the opening inventory. This would alleviate the burden of paying additional taxes on the related income.

As of this date, there has not been a response from the Department of Treasury or Internal Revenue Service. However, taxpayers should be aware of these potential consequences due to the disruption of the global supply chain and reduced inventory levels.

Please contact HBK Manufacturing Solutions if you would like to discuss the possible effects of a LIFO inventory reduction and any potential relief.

Speak to one of our professionals about your organizational needs

"*" indicates required fields



Doing Business with Microsoft? Privacy Protection is Key

Date September 9, 2019
Article Authors
HBK CPAs & Consultants

Microsoft executives take security and privacy initiatives seriously. Not just their own, but those of their vendors, as well.

Microsoft is committed to Vendor Risk Management (VRM). Suppliers and business partners are often required to undergo varying levels of attestation to their information security initiatives, including SOC 2 or Microsoft’s Supplier Security and Privacy Assurance (SSPA).

Microsoft has established data protection requirements (DPRs) for suppliers who process Microsoft personal or confidential data. More often than not, suppliers must undergo annual attestation as to their ability to meet the requirements defined in Microsoft’s DPR.

“Process” in Microsoft’s DPR refers to any operation or set of operations performed on any Microsoft personal data or confidential data—and whether or not operations are by automated means. Processes include collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or dissemination, and alignment or combination, restriction, and erasure or destruction.

SSPA is a Microsoft program that involves not only making sure that suppliers understand these requirements but ensuring their compliance. The program combines Microsoft Procurement, Corporate External and Legal Affairs, and Corporate Security to make certain that suppliers follow privacy and security principles when processing Microsoft personal data or Microsoft confidential data. It covers all global suppliers processing Microsoft personal or confidential data.

Suppliers considered high risk are required to provide independent verification of DPR compliance. Such companies are asked to select an independent auditor affiliated with the American Institute of CPAs (AICPA) or the International Association of Privacy Professionals to assess DPR compliance; that auditor is responsible for providing an unqualified letter of attestation to the Microsoft SSPA.

At HBK, our affiliation with the AICPA is merely one aspect of our capabilities. Our auditors have years of experience performing attestation engagements, including extensive SOC 2 work. We have intimate knowledge of security and privacy best practices and hold these critical credentials: Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA).

Most importantly, we are experienced in navigating businesses through Microsoft’s SSPA and compliance with the company’s Data Protection Requirements.

We can help you if Microsoft is on your business horizon and you want to maximize the value of these efforts–or if you’re preparing for a security audit. Call us at 724.934.5300 or email me at MSchiavone@hbkcpa.comand let’s get started.

Speak to one of our professionals about your organizational needs

"*" indicates required fields



Are You Cyber Secure and Who Wants to Know?

Article Authors
HBK CPAs & Consultants

This is an update to the original INSIGHT article Are You Cyber Secure?, which was published in July 2017.

System and Organization Controls 1 or SOC 1 (SOC) report provides assurance over controls at a service organization which are relevant to user entities’ internal control over financial reporting. Obtaining a SOC for Cybersecurity report can prove that a cybersecurity risk management program is designed and functioning effectively. It can also reassure everyone a member of a board of directors to a potential customer that information with which your company has been entrusted is being handled in accordance with cybersecurity best practices.

No matter your business or industry, cybersecurity is a concern. If you operate in cyberspace – and what business doesn’t? – you are vulnerable. To guard against the many risks ranging from exposure of confidential information to loss of business reputation, every organization should have a cybersecurity risk management program. However, conveying the maturity of your risk management program to stakeholders is a challenge that needs overcome.

To meet that need the American Institute of Certified Public Accountants (AICPA), the certification and standards organization governing the practice of accounting, has introduced Systems and Organization Controls (SOC) for Cybersecurity. Building upon the profession’s experience in auditing system and organization controls, SOC for Cybersecurity enables CPAs to examine and report on an organization’s cybersecurity risk management program.

HBK CPAs & Consultants (HBK) has been performing SOC 1 and SOC 2 attestations since they replaced the SAS 70 report in 2010. In the area of SOC for Cybersecuity, we offer management two types of assurance services, advisory and attestation.

In an advisory role, we perform a readiness assessment, which helps businesses assess their cybersecurity program against the industry’s leading frameworks, and more appropriately, against the AICPA Cybersecurity criteria. We assist with identifying gaps in the framework and remediating those gaps to further develop or implement an effective cybersecurity program. For more established programs, we help organizations formally align the existing program with the three criteria as established by the AICPA:

Security – The system is protected, both logically and physically, against unauthorized access.

Availability – The system is available for operation and use

Confidentiality – Information designated as confidential is protected as committed or agreed

In an attestation engagement, we examine your cybersecurity program and provide an opinion on whether it is effective. We map your controls to ensure your program complies with the AICPA-established criteria. We review your description of how those criteria are accommodated, then test and validate the effectiveness of these controls and issue a report.

A cybersecurity risk management examination report includes the following three key components:

Management’s description of the entity’s cybersecurity risk management program. The first component is a management-prepared narrative description of its cybersecurity risk management program, The report provides information on how the company identifies its information assets, how it manages the cybersecurity risks that threaten it, and the policies and processes implemented and operated to protect its information assets against those risks.

Management’s assertion. The second component is an assertion provided by management that the description is presented in accordance with the description criteria and the controls within the company’s cybersecurity risk management program achieve its cybersecurity objectives.

Practitioner’s report. The third component is a practitioner’s report, which contains an opinion on whether management’s description is presented in accordance with the description criteria and the controls within the company’s cybersecurity risk management program achieve its cybersecurity objectives.

Our attestation is justification management can use to demonstrate to everyone from the board of directors to a potential customer that their cybersecurity program is in accordance with best practices. The AICPA logo of SOC Cybersecurity certification is a key differentiator for a business, assuring stakeholders the security of the information they handle.

All organizations should have a cybersecurity program in place. Having it assessed for readiness, that is, ensuring your controls are aligned with the AICPA-defined standard and criteria, will afford assurance that it is designed appropriately. Receiving official attestation demonstrates the design is functioning as it should, and only makes sense in providing a level of confidence to your stakeholders that you are a business that has implemented a robust and comprehensive cybersecurity program, that your organization is cyber secure.

Speak to one of our professionals about your organizational needs

"*" indicates required fields