By Lee Klumpp, CPA, CGMA

The Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) 2018-08, Not-for-Profit Entities (Topic 958): Clarifying the Scope and the Accounting Guidance for Contributions Received and Contributions Made in June 2018 to clarify the accounting guidance related to contributions made or received. This ASU applies to all entities (including business entities) that make or receive contributions of cash and other assets, including promises to give and grants. The final ASU can be accessed here.

Background

The purpose of the ASU is to address long-standing diversity in practice and the difficulties in determining whether grants and similar contracts are exchange transactions or contributions. In addition, the ASU addresses the evaluation of whether a contribution is conditional or unconditional, which affects the timing of the revenue recognition. And finally, the ASU addresses the issue of when a contribution is restricted.

As we discussed in our Spring 2018 newsletter in the article entitled, Updates to FASB Proposed Guidance for Contributions, the introduction of the new revenue recognition standard also made it imperative for the diversity in practice to be addressed. The distinction between contributions and exchange transactions is important because it determines whether an entity should follow the guidance in Accounting Standards Codification (ASC) 988-605, Not-for-Profit Entities – Revenue Recognition, if the transaction is deemed to be a contribution, or the guidance in ASC Topic 606, Revenue from Contracts with Customers, if deemed to be an exchange transaction. Contributions are scoped out of Topic 606.

Main Provisions

Characterizing Grants and Similar Contracts in Reciprocal Exchanges or Contributions

The ASU clarifies and improves the scope and accounting guidance for both contributions received and made to assist all entities in evaluating whether a transaction should be accounted for as a contribution or an exchange transaction. The ASU provides sample indicators of a contribution and exchange transaction to assist entities in making this determination.

The amendments in the ASU clarify how an entity determines whether a resource provider is participating in an exchange transaction by evaluating whether the resource provider is receiving commensurate value in return for the resources transferred or on the basis of the following:

• The resource provider is not one and the same with the general public. Benefits received by the public as a result of the assets transferred is not equivalent to comparable value received by the resource provider.
• Exercise of the resource provider’s mission or the positive sentiment from acting as a donor doesn’t constitute comparable value received by the resource provider for purposes of determining whether the transfer of assets is a contribution or an exchange.

If the resource provider itself is not receiving comparable value for the resources provided, an entity must determine whether a transfer of assets represents a payment from a third-party payer on behalf of an existing exchange transaction between the recipient and an identified customer. If this is the case, this should be accounted for under Topic 606 or other guidance that applies.

In completing this analysis, the type of resource provider should not factor into the determination.

See ASC 958-605-15-6 for specific transactions that should be excluded from this analysis of contribution versus exchange.

Determining Whether a Contribution is Conditional

The ASU amendments require an entity to determine whether a contribution is conditional based on whether an agreement includes a barrier that must be overcome and either a right of return of assets transferred or a right of release of a promisor’s obligation to transfer assets. If the agreement includes both of these, it is deemed to be conditional, and the recipient is not entitled to the transferred assets until it has overcome the barriers in the agreement.

The amendments include the following indicators to determine whether an agreement contains a barrier:

• The inclusion of a measurable performance-related barrier or other measurable barrier.
• The extent to which a stipulation limits discretion by the recipient on the conduct of an activity.
• Whether a stipulation is related to the purpose of the agreement.

A probability assessment about the likelihood of the recipient meeting the stipulation is not a factor in determining if there is a barrier.

Examples of barriers are provided in the amendments.  Depending on the facts and circumstances some indicators may be more significant than others, but no single indicator is determinative.

The right of return or right of release must be determinable from the agreement or another document referenced in the agreement.  The agreement does not have to specifically include the phrases “right of return“ or “release from obligations“; however, the agreements should be sufficiently clear to be able to support a reasonable conclusion about whether the recipient would be entitled to the transfer of assets or release of obligation. In the absence of any apparent indication that a recipient is only entitled to the transferred assets if it has overcome a barrier, the transaction should be deemed a contribution without donor-imposed conditions.

In the case of ambiguous donor stipulations, a contribution containing stipulations that are not clearly unconditional should be presumed to be a conditional contribution.

If a contribution has been deemed to be unconditional, the entity should then consider whether the contribution is restricted on the basis of the existing definition of the term “donor-imposed restriction.” The definition of a donor-imposed restriction includes a consideration of how broad or how narrow the purpose of the agreement is, and whether the resources are available for use only after a specified date.

Simultaneous Release Option

The ASU provides a nonprofit entity with the ability to elect a policy to report donor-restricted contributions whose restrictions are met in the same reporting period as the revenue is recognized as support within net assets without donor restrictions. To do this the entity must have a similar policy for reporting investment gains and income, report consistently from period to period and disclose its accounting policy. If this policy is elected for donor-restricted contributions that were initially conditional contributions, they may do so without electing this for other donor-restricted contributions.  The election of this policy has to be used consistently from year to year and be disclosed.

Transition

The amendments in the ASU should be applied on a modified prospective basis; however, retrospective application is permitted as well.

In the financial statements in the year of adopting the ASU under the modified prospective basis the amendments should be applied to all agreements that are either not completed as of the effective date or entered into after the effective date. A completed agreement is an agreement for which all revenue (of a recipient) or expense (of a resource provider) has been recognized before the effective date under the current guidance. The amendments in the ASU should be applied only to the portion of revenue or expense that has not yet been recognized under current guidance before the effective date of the ASU. No prior period statements should be restated and there should be no cumulative effect to opening net assets or retained earnings balances at the beginning of the year of adoption. Standard disclosures for the accounting change should be included in the footnotes in the year of adoption. The ASU contains additional clarifying transition guidance to assist entities if they choose this adoption basis.

Effective Date

The effective dates vary depending on whether you are a resource recipient or resource provider and the nature of the entity as outlined below. The effective dates for resource recipients were established so that the effective date of the ASU would align with the effective date of ASC Topic 606. The effective dates for resource providers was delayed by one year. Early adoption of the ASU is permitted.

Resource Recipient

Public business entities and nonprofits that have issued, or are a conduit bond obligor for, securities that are traded, listed or quoted on an exchange or over-the-counter market should apply the amendments in the ASU on contributions received to annual periods beginning after June 15, 2018.

All others should apply the amendments for transactions in which the entity serves as a resource recipient to annual periods after Dec. 15, 2018.

Resource Provider

Public business entities and nonprofits that have issued, or are a conduit bond obligor for, securities that are traded, listed or quoted on an exchange or over-the-counter market should apply the amendments in the ASU for transactions in which the entity serves as a resource provider to annual periods beginning after Dec. 15, 2018.

All other entities should apply the ASU for transactions in which the entity serves as the resource provider to annual periods beginning after Dec. 15, 2019.

Conclusion

The ASU contains implementation guidance and practical illustrations to assist with the implementation.

The ASU will likely result in more grants and contracts being accounted for as unconditional or conditional contributions rather than exchange transactions compared to current guidance.

This article originally appeared in BDO USA, LLP’s “Nonprofit Standard” newsletter (Fall 2018). Copyright © 2018 BDO USA, LLP. All rights reserved. www.bdo.com

By Ken Eye and Andrea Wilson

The internal audit (IA) function is vital to the health of any nonprofit, regardless of mission or scope. The audit committee and its individual members are crucial partners in safeguarding the integrity, purpose and, ultimately, the success of organizations.

But, they often face challenges navigating a strained regulatory environment, all while trying to do more with less. Adjusting to these new realities means that proper management is more important than ever. This article outlines the top 10 challenges keeping internal auditors up at night, and providing remedies to help them continue their critical work.

1. CHANGES TO OPERATIONS OR STRATEGY

For most nonprofit organizations, change is inevitable. As the needs of communities, internal dynamics, priorities and leadership transform, nonprofits adjust their mission and strategies. While this dynamism is essential for organizations to further their work, change can create strain for internal auditors. Whether its expanding operations to a new location, working with new donors or rolling out a new organizational structure, internal auditors are often left scrambling to ensure compliance.

THE REMEDY: Change is unavoidable, but compliance headaches don’t have to be. Nonprofits should be proactive about integrating internal audit into large scale organizational changes. This means allocating IA resources to evaluate emerging compliance and legal requirements, incorporating IA into the strategic decision-making process at the outset, revising policies and procedures with the new compliance environment, and developing succession plans to facilitate smooth personnel changes. And, IA should not just be involved in the change process—organizations should allow internal auditors to conduct post-implementation assessments to ensure ongoing compliance.

2. ORGANIZATIONAL CULTURE

The organizational culture of nonprofit organizations usually centers on a mission that employees are passionate about. This passion attracts staff personally motivated to help the overall organization succeed, but can come at the cost of internal controls. For nonprofits, “the cause” can often be promoted at any cost. Mid-level management professionals can be highly skilled in technical areas, but may lack knowledge in compliance, financial accountability and oversight. A lack of interactive communication between key administrative and program units within the organization can result in insufficient internal controls.

THE REMEDY: To balance maintaining organizational culture with proper operational management, communication is essential. Nonprofits should develop a sound communication strategy that brings the internal audit and compliance functions in regular contact with the rest of the staff. During these interactions, IA professionals should be sure to communicate how risk management practices align with overall organizational strategy and mission objectives. Bringing people together in this way helps make IA an integral part of an organization, rather than an afterthought.

Even when strong communications are in place, breakdowns are sometimes inevitable. Organizations should conduct regular assessments of business processes to determine where breakdowns in communication between business units occur. These assessments should help identify gaps that could pose significant risks to the organization.

Based on the results of these assessments, organizations should design and implement remediation plans, including scheduling necessary trainings for all employees and rolling out new process flows and accountability points to close any gaps.

3. NEW TECHNOLOGY

Technological advances help organizations store and share data, but new technology is often implemented without the knowledge or involvement of the internal audit function, to potentially disastrous and costly results. Ideally, internal auditors should assess new technology well before it’s utilized to review issues like control over sensitive data, continuity of the technologies between offices, and adherence to compliance and regulatory requirements. Without this review, nonprofits leave themselves open to a number of risky consequences, as well as operational inefficiencies.

THE REMEDY: Technology can be a huge boon to nonprofit organizations, but only when it’s used wisely. IA should work with nonprofit leaders to first assess technology currently being used organization-wide, and then identify what the organization still needs to address. Internal auditors can assist with researching and proposing approved technologies for organization-wide usage, to facilitate cohesion and compliance and to help management improve system efficiencies.

Organizations also need to implement proper internal controls to ensure they’re mitigating technology risk as much as possible. IA can conduct a risk assessment of each technology used and implement policies to restrict or prevent the use of high-risk programs or devices. Organizations should also require similar checks and risk assessments for all new technology prior to usage.

4. CYBERSECURITY

With new technologies exploding in popularity, cybersecurity risks abound. Nonprofit organizations often mistakenly believe they aren’t of interest to cyber criminals, but the amount of personal data they store from donors and employees, and the tendency to underinvest in cybersecurity measures, make them an ideal target. It can be difficult for nonprofits to maintain up-to-date technology and hardware, keep pace with technological changes and navigate the shifting regulatory landscape with their limited funding. Nonprofits also frequently partner with technology suppliers and other contractors that leave them open to third-party cyber risks.

THE REMEDY: The first step to mitigating cyber risk is to conduct an organization-wide cybersecurity risk assessment that includes partner, contractor and technology supplier cybersecurity as part of the due diligence process. This assessment should shed light on where internal and external gaps exist. Following the assessment, organizations should implement additional controls by updating policies, procedures and internal controls to address identified gaps.

A startling number of cyber incidents arise from employees unknowingly exposing the organization to bad actors. Training staff to recognize these exposures is fundamental to their prevention. Nonprofits need to regularly communicate risks to employees and vendors to ensure everyone is adhering to established policies.

Monitoring cyber risk needs to be an ongoing effort. Nonprofits should develop a risk assessment schedule to examine internal partner, contractor and technology supplier cybersecurity on a quarterly or annual basis. Internal audit can assist with implementing these assessments.

5. COMPLIANCE WITH FUNDER REQUIREMENTS

Nonprofit organizations often have the unique challenge of negotiating compliance requirements across multiple funding sources including government entities, individuals, private foundations or other organizations. This challenge is only growing as budget cuts force organizations to focus on diversifying revenue streams and expanding donor pools, and with a recent increase in donor audits of specific grant activity at the materiality level. Further complicating the matter is a growing emphasis on international accounting standards (as opposed to relying on U.S. generally accepted accounting principles).

THE REMEDY: To clarify exactly what funding requirements an organization faces, it should conduct a compliance assessment, comparing requirements across all donor agreements to determine areas of overlap and areas of discontinuity. These agreements should then be compared against written policies and current practices to identify gaps.

Remediation plans can amend policies and procedures, and staff trainings should be conducted to ensure all levels and functions understand their role in maintaining compliance with funding requirements.

Staying current is critical. Nonprofits should develop a compliance assessment schedule, and IA and compliance departments need to stay on top of new funding streams and emerging trends so they can pivot when necessary.

6. FINANCIAL CONTROLS

Even though nonprofits are motivated by making an impact rather than money, organizations still face a host of hurdles when it comes to financial management. Many international nonprofits operate in countries with cash-based economies, making it tough to maintain adequate control of funds and sufficient supporting documentation. And new payment technologies, while enabling new and widespread operational tools, are often accompanied by verification and other control challenges. Nonprofits also face resource constraints and may have a limited number of finance staff to oversee financial management processes, which can be manual and prone to human error. For organizations with several offices, branches often operate with little to no centralized oversight over their accounting and cash management procedures.

THE REMEDY: Nonprofits should review cash management procedures and evaluate typical expenditure cycles to identify potential risk areas across the entirety of an organization. Internal audit is central in assisting management in testing cash management controls.

• Organizations can then implement additional controls in keeping with best practices, like limiting cash handling or volume of cash transactions where possible. Nonprofit managers should consider investing in technologies and resources that limit high risk processes.

Standardizing procedures will help cut down on variance of practices between offices. All branches should centralize accounting and reporting procedures. At a minimum, each location should maintain copies of supporting documentation of all expenditures and financial reporting and should regularly review them with staff.

7. RELIANCE ON THIRD PARTIES

Vendor actions can create extremely adverse consequences for nonprofit organizations. Concerns range from reputation damage to the vendor’s illegal acts being attributed to the nonprofit organization. This risk applies to all types of organizational relationships with vendors and nonprofits, especially those administering federal grant programs given increased subrecipient monitoring and due diligence requirements.

Despite the risks, most nonprofits rely on partners or contractors for critical program functions. This makes it difficult to conduct due diligence reviews and monitoring activities, particularly when the partners/contractors are numerous, geographically dispersed or operating overseas. Partners are normally tasked with self-reporting, meaning frauds like ghost employee payments are easily hidden. Contractors also usually have access to organizational networks and information, creating an additional layer of risk.

THE REMEDY: Organizations should review current policies and procedures to ensure robust due diligence and monitoring processes are in place for all third-party relationships. This should include an assessment of partner/contractor access to project data, systems and networks, and the limitation of access where possible.

Nonprofits need to implement additional monitoring and verification processes, including:

• Conducting regular spot reviews or investigations of reported data
• Requiring partners and contractors to certify financial and programmatic assertions
• Verifying number of partner/contractor staff and salary payment amounts
• Conducting unannounced site visits
• Considering third-party verification systems

These processes should be re-evaluated on a regular basis to ensure their effectiveness.

8. PROCUREMENT PROCEDURES

Nonprofit organizations rely heavily on non-competitive procurement processes due to several reasons. Often, procurement procedures, selection criteria and selection decisions are inadequately documented, leaving organizations unable to show that there was no bias in the selection process. Preferred vendor lists are rarely updated, and control of vendor solicitation, selection and site visits is often left with just a few individuals.

THE REMEDY: IA should review current procurement procedures against industry standards and donor requirements. They should also be transparent about their procurement policies including:

• Publicly announcing tenders as much as possible
• Updating vendor lists through open competition as frequently as possible
• Verifying vendors and prices through in-person or third-party checks
• Comparing bids against market prices
• Documenting criteria and selection procedures to bid samples with procurement files
• Ensuring procurement/selection committees are rotated on a regular basis

9. TRANSPORTATION AND DISTRIBUTION

For organizations that distribute goods, inventory management and oversight can prove to be major sources of stress for internal auditors. Often, nonprofits have difficulties verifying receipt of goods or services by their intended beneficiary, and confirming the goods provided are in the same quality and quantity as what was purchased. Diversion, theft and product substitution are especially difficult to identify. Despite resource and capacity issues, recent increased scrutiny of internal controls and supply chain management means that organizations need to address these issues sooner rather than later.

THE REMEDY: To help combat issues in the distribution chain, organizations need to shore up monitoring procedures by:

• Establishing monitoring teams for critical points along the supply chain
• Implementing two-step or three-step verification procedures at each critical stage
• Hiring a third party to conduct site visits and monitor transportation and distribution
• Using technology to assist in tracking and monitoring, including unique identifiers on products for inventory and tracking purposes and requiring distributors to take time-stamped photos/videos of deliveries
• Another effective risk mitigation strategy is to communicate directly with beneficiaries. Organizations can hold pre-distribution meetings with communities to review any past issues or concerns. Detailed packing lists and/or photographs of parcel contents should be inside packages. Nonprofits can include in the contract clauses with distributors to withhold payments to distributors until delivery is confirmed. This further ensures the distributor is holding up its end of the agreement.

10. FRAUD AND CORRUPTION

It’s the job of the internal audit function to uncover fraud, waste and abuse in nonprofit organizations, but often they are set up for failure. Due to a lack of communication between functional and program units within organizations, increased used of third parties, outdated systems, increased regulations (and the list goes on…), the opportunity to exploit a nonprofit’s controls is growing at a time when IA resources are shrinking and reputational risk for organizations is at an all-time high.

THE REMEDY: Preventing fraud starts within an organization itself. Stakeholders should evaluate current fraud prevention, detection and investigation measures against regulatory requirements and develop a plan to remediate any identified gaps. They should also be sure to provide accessible fraud reporting mechanisms for all employees, partners, grantees/beneficiaries and stakeholders.

• Despite resource constraints, organizations need to ensure IA has the appropriate level of resources to detect and investigate potential cases of fraud. Funds should also be set aside for visits to third parties and office locations and the establishment of a fraud hotline. Put a process in place to notify any impacted funders in a timely manner and in line with donor requirements to prevent exacerbating the impact when fraud does occur.

It’s also key to establish a fraud prevention and detection assessment schedule so practices can stay up-to-date and make sure nothing falls through the cracks.

Internal auditors at nonprofits have a tough, but essential job that’s key to keeping the organization focused on mission fulfillment. By assessing current practices, developing action plans and regularly monitoring activities, organizations can mitigate risk and serve their beneficiaries more effectively.

This article originally appeared in BDO USA, LLP’s “Nonprofit Standard” newsletter (Summer 2018). Copyright © 2018 BDO USA, LLP. All rights reserved. www.bdo.com