CFO Consulting Partners

Experience, focus and integrity. CFO Consulting Partners improves shareholder value.

Featured News

Update on CFO Consulting Partners’ SEC & Pre-Audit Services

By

CFO Consulting Partners’ SEC and pre-audit services help public and private companies produce workpapers and a full set of GAAP financial statements, including notes, for review by its independent auditors. Workpapers are cross-referenced and references are made to supporting documentation. For public companies, CFO Consulting Partners offers SEC report preparation services (i.e., 10-Qs and 10-Ks, including MD&As).

Typically in an SEC and Pre-Audit engagement we:

  • Prepare or assist in preparing a full set of GAAP financial statements, including notes, and if applicable, the MD&A section
  • Research GAAP and disclosure issues and the application of accounting principles to a company’s facts and circumstances
  • For public companies, draft Form 10-Ks, 10-Qs, registration statements and proxy reports
  • Provide support related to SEC Comment Letters
  • Restate financial statements for prior period errors
  • Assist with preparing delinquent SEC filings
  • Assure a high level of quality control, as all engagements are reviewed by another partner

Benefits include:

  • Potential cost savings due to lower staffing needs or lower outside accounting fees
  • More available time for CFOs and Controllers to focus on internal company needs
  • Provision of accounting research. Many accounting firms do not provide this service to their audit clients due to independence issues
  • Development of accounting analyses, such as goodwill impairment, fair value accounting and IFRS reporting
  • Resource to answer SEC and auditor comments

The New Revenue Recognition Standard (ASC 606)

By

Introduction

On May 14, 2014 the FASB issued the standard ASC 606 Recognition of Revenue from Contracts with Customers. It is a converged standard with the IASB (IFRS 15) The FASB issued an Accounting Standards update to the Standard (ASU 2016 -10) in April 2016.

The implementation date for the standard is:

  • For public business entities, certain not-for-profit entities, and certain employee benefit plan
    • Reporting periods beginning after Dec 15, 2017
  • For all other entities
    • Reporting periods beginning after December 15, 2018

ASC 606 will have a major impact on the reporting of revenue for all entities, public and private that enter into contracts that promise the exchange of goods and services to their customers with a relatively minor impact on some costs associated with fulfillment of the contracts.

The standard is both complex and far reaching. It impacts not only marketing groups but lilely other groups, for example R&D, that enter into collaborative or other contracts or arrangements with third parties. As a result implantation is likely to require considerable effort and expertise.

Entities that plan to report GAAP financials, both public and private, if they have not already done so, would be well advised to consider moving quickly to initiate a thoughtful plan of action to comply with the standard.

 

Overview of the Standard

The following reviews the authors view of the high points in the standard.

Performance obligations

The basic economic transaction addressed by the standard is the contract between an entity and its customers. The standard address the accounting for the promises embodied in the contract, which it refers to as performance obligations.

The core principle of the standard is that an entity recognizes revenue to depict the transfer of the promised goods or services in amounts and timeframe that reflects the consideration to which the entity expects to be entitled in exchange for those goods or services when (or as) the said goods and services are delivered or fulfilled.

To achieve the core principle the standard promulgates a series of action that an entity must undertake to determine the amount and timing of revenue to be recognized. These are:

  • Identify the contract with the customer
  • Identify the distinct performance obligation(s) in the contract
  • Determine the transaction price
  • Allocate the transaction price to the distinct performance obligations in the contract
  • Recognize revenue when (or as) the entity satisfies the performance obligation(s)

1) Identify the Contract

The contract with the customer is a central aspect of the standard as revenue recognition flows directly from it. Without a contract there can be no revenue recognized under this standard. Evidence that a contract exists is based on:

  • Approval: All parties to the contract have approved the contract (in writing, orally or in accordance with customary business practices)
  • Rights: The contract clearly identifies the rights of the parties
  • Payment: The payment terms are clearly stated
  • The contract has commercial substance (i.e. parties cannot agree to artificially swap goods or services in order to boost revenue)
  • Probability: It is probable that the contract terms will be honored

Note that that new standard by requiring clear identification of the parties’ rights brings a focus on legal enforceability. Therefore, a contract will exist once legal enforceability exists, even if it differs from an entity’s normal and customary business practice.

2) Identify the Distinct Performance Obligations in the Contract

Where a contract recites the transfer of more than a single good or service then the seller must evaluate the goods and services to be transferred as to whether any of them are distinct.

A distinct good or service (or bundle of services) is considered a performance obligation. To be distinct the goods of service must be identified in the contract and be capable of performing a service as delivered or in combination with other services that the customer could readily find.

Note that the drafters and approvers of the contract will, normally be careful to ensure that the contract recites the agreed performance obligations.

This section of the standard generated many comments and questions to the extent that the FASB, in 2016 issued an Accounting Standards Update (ASU) that offered further interpretive guidance (ASU No 2016 -10) April 2016 about Identifying distinct performance obligations and licensing

The ASU provided clarification as follows:

Distinct Goods or Services

A good or service that is promised to a customer is distinct if both the following criteria are met:

  1. The customer can benefit from the good or service either on its own or together with other resources that are readily available to the customer (that is the good or service is capable of being distinct)
  2. The entity’s promise to transfer the good or service to the customer is separately identifiable from other promises in the contract

The ASU provided further guidance as follows:

In assessing whether an entity’s promise to deliver separately identifiable services to a customer are distinct the objective is to determine whether the nature of the promise, within the context of the contract is to transfer each of those goods or services individually, or instead, to transfer a combined item or items to which the promised goods or services are inputs.

The ASU goes on to cite factors that merit consideration in making the determination. One such factor cited is the instance where   “ The goods or services are highly interdependent or interrelated, In some cases two or more good or services are significantly affected by each other because the entity could not be able to fulfill its promise by transferring each of the good or services independently.”

The above situation would seem to be evidence that the goods or services merit treatment as a combined item

Immaterial items

  • An entity is not required to assess whether goods or services are performance obligations if they are immaterial to the contract

Administrative activities

  • Promised goods or services do not include the various administrative activities the vendor must perform to setup a contract as those tasks do not transfer services to the customer

Shipping and handling

  • An entity that promises a good to a customer might perform shipping and handling related to the good. If the shipping and handling occur before the customer has control of the good then the shipping and handling is not a performance obligation but rather an activity to fulfill the entity’s promise to transfer the good
    • However if the shipping and handling activities occur after the customer has obtained control of the good the entity is permitted as an accounting policy election to account for them as an activity to effect transfer of the goods rather than as an additional promised service

Combining contracts

An entity may combine one or more contacts entered into at or about the same time with the same customer and account for them as a single contract if one or more of the following criteria are satisfied:

  • The contracts are negotiated as a package with a single commercial objective
  • The goods and services promised in the contracts constitute a single performance obligation
  • The consideration paid in one contract is dependent on the price or performance of the other contract

3) Determine the transaction price

Determining the transaction price as of the inception of the contract may not be straightforward. The price may be subject to discounts, rebates, penalties and/or performance bonuses, which cannot be precisely quantified at the contract inception. However, even if not straightforward it is incumbent on the entity to estimate the price. The standard present certain approaches:

  • Most likely price. The seller develops a range of possible prices and selects the most likely
  • Expected value of the price. The seller develops a range of possible prices, assigns a probability to each and derives the expected value

Whichever method is chosen the seller should apply it consistently throughout the contract and for similar contracts.

Note also that the standard addresses other matters that could complicate price determination such as:

  • Payments over a period of time – price is deemed to include a financing component which must be accounted for separately
  • Non cash consideration – fair value of the consideration must be determined
  • Payments in advance – are not revenue but a liability

4) Allocate the transaction price to the performance obligations

In this step the entity determines the stand-alone selling price of each performance obligation as of the inception of the contract. The best evidence of that price would be an observable price of the good or service when the seller sells it to a similar customer under similar circumstances.

If it is not possible to observe a stand-alone price the entity must estimate it. The following represents possible acceptable ways to estimate a stand-alone selling price:

  • Adjusted market assessment: Reviewing the market for like products and their pricing
  • Cost plus margin: the seller estimates their cost and adds an appropriate margin
  • Residual approach: subtract the determined standalone price(s) from the contract price and apply that difference to the other obligations. This approach can be difficult to use.

Once the seller derives an approach for estimating stand-alone selling prices it should apply that approach consistently for other goods or services with similar characteristics.

Discounts

It can turn out that the sum of the estimated standalone prices exceeds the contract price in which case the customer is deemed to have received a discount. The discount should be allocated across the performance obligations in proportion to their standalone price except there is evidence that the discount should be applied to one or more specific obligations

5) Recognize revenue when (or as) the entity satisfies the performance obligation

Revenue is to be recognized when (or as) goods or services are transferred to the customer. The transfer is considered to have occurred when the customer has gained control over the good or service, that is, when the customer has taken on the significant risks and rewards of ownership, for example, the seller can sell, pledge or exchange the asset.

It is possible that a performance obligation will be transferred over time rather than at a point in time.  Service contracts or construction contracts are example of performance obligations transferred over time. The seller’s entitlement to payment will be controlled by the contract terms, for example, when milestones are reached and/or when the customer is satisfied with a deliverable or other criteria specified in the contract.

 

Costs incurred to obtain a contract.

An organization may incur costs to obtain a contract. If so, it is allowable to capitalize these costs and amortize then over the life of the contract provided:

  • The costs are incremental: An example would be sales commissions
  • There is an expectation that the costs will be recovered
  • Note that if the amortization period will be one year or less it is allowable to expense these costs as incurred

An entity may incur costs to fulfill a future performance obligation. In general such costs should be recognized as assets if they meet the following criteria:

  • The costs are tied to a specific contract
  • The costs are incurred to satisfy a future performance obligation
  • There is an expectation that the costs will be recovered

Warranties

A warranty is a guarantee related to the performance of a delivered goods or service. In general there are two types of warranty:

  • The seller warrants the goods or service at no cost to the customer. The seller accounts for the warranty cost by establishing a reserve based on prior experience and adjusts it over time to reflect more current experience
  • The seller offers the option to the seller of separately purchasing a warranty. As such the warranty is considered a separate performance obligation

Licensing

An entity may offer a customer a license to use intellectual property owned by the seller. If a contract contains both a licensing agreement and a provision to provide goods and services the seller must identify each performance obligation in the contract and allocate the transaction price.

ASU No 2016 -10   April 2016 Identifying Performance Obligations and Licensing) provided updated guidance on accounting for licenses. That is:

  • On whether an entity’s promise to grant a license provides the customer with a right to use the entity’s intellectual property (which is satisfied at a point in time) OR to access the intellectual property (which is satisfied over time)
  • On the recognition of revenue for a usage or sales based royalty in exchange for a license of intellectual property. Essentially the ASU disallows the splitting of the royalty into a portion based on sales or usage and a portion that is not subject to that guidance

Disclosures

ASC 606 requires considerably more disclosures about revenue. In general, the intent of the disclosures is to enable the reader to understand the nature and amount of the revenue being recognized and the uncertainty of the related cash flows.  More specifically the entity shall disclose:

  • Contracts
    • Disaggregation of revenue
    • Contract Balances
    • Performance Obligations
    • Transaction price allocated to remaining obligations
  • Significant judgments made in the application of the standard
  • Practical Expedients relied upon e.g.
    • Existence of a financing component in the contract
    • Incremental costs of obtaining a contract

Other

The standard provides guidance on several other situations that can arise in the administration of contracts.  For example  (Not a complete recap:)

  • Measurement of progress completion
  • Change in estimate
  • Right of return
  • Contract modification
  • Bill and hold arrangements
  • Cash and non cash consideration

 

Implementation

Given the complexity of this standard and its impact on revenue, a most critical financial metric it is incumbent on entities to have a well thought out implementation and transition plan. Some key issues that the plan should address include:

  • Financial: Determine the revenue streams that are impacted. Assess the need to review all customer contracts, possibly cataloging them and detailing their performance obligations.
    • Review the methodology in place for recognizing revenue and devise an intervention whether interim or final, systematic or manual, that brings revenue recognition into line with the standard
    • If the plan includes significant manual effort be aware of the increased probability of errors and mitigate it with adequate quality controls
  • Information System: Ascertain the need and /or feasibility of reconfiguring the ERP system to seamlessly produce financial information in compliance with the new standard
  • Organization: Communication to internal and external stakeholders. Determine the need for revised guidance to organization units that interface with customers or suppliers with regard to entering into structuring of and reporting on contracts.
  • Transition: Decide on and prepare for full retrospective or modified retrospective presentation for financial statements presented after the implementation date. I.e.
    • Full retrospective: Apply the new standard as of the implementation date and, for the prior comparative periods, restate all contracts on the same basis
    • Modified retrospective: Apply the new standard as of the implementation date and, for the prior comparative periods, the data is not recast but instead apply a single adjustment to equity at the beginning of the initial year of application.

The CECL Approach, 3 of 3

By

For this newsletter CFO Consulting Partners has partnered with Ardmore Banking Advisors to review the potential material financial benefits of a well planned and executed implementation of the new current expected credit loss (“CECL”) accounting standard.

Most banks have an awareness of the need to prepare for the transition to CECL, and that many foundational activities need to be looked at now. Together CFO Consulting Partners (“CFO CP”) and Ardmore Banking Advisors (“Ardmore”) have constructed an approach to help banks address the “early must do’s” of CECL at a reasonable cost.

CFO CP leverages its extensive experience with banking industry finance, and Ardmore it’s deep expertise in credit and credit data to translate the CECL transition process into tasks and activities that create valuable efficiencies and bottom line impact for the Bank. Together we can cut through the noise and assess a bank’s CECL readiness and at the same time help create a CECL action plan that will drive real value for the bank.

We have discussed aspects of CECL implementations in prior newsletters, The New CECL Approach Part I, and Part II. Similarly, Ardmore’s webinar Step #1 Of the CECL Journey provides additional perspective.

CFO CP and Ardmore are each focused on complementary aspects of the CECL implementation process in the finance, accounting, and credit disciplines. Well executed CECL projects led by an interdisciplinary team of Credit, Finance, and other bank management, coordinated by experienced project managers and executed well, can produce tangible bottom line improvements, and better efficiency ratios.

Experienced CFO CP and Ardmore Project Managers can help the bank’s CECL team identify opportunities for process improvements. The resulting databases, internal control enhancements, and automation will produce faster decisions, easy access to controlled and trusted data, high functioning executive teams and, ultimately, improved efficiency ratios. If CECL implementation is managed well, a bank can leverage the implementation to break down silos, upgrade systems, improve processes, and reduce expenses.

CFOs can strategically manage the spending to required accomplish CECL goals AND drive efficiencies which will ultimately reduce the expense ratio. Opportunities exist in:

  • Credit Administration: Ensure that all credit practices are properly aligned with your CECL implementation, upgrade automation, and improve underwriting processes.
  • Finance: Re-engineer financial controls and loan accounting processes, optimize general ledgers, optimize risk adjusted capital levels, and Improve management information for the Board and Management.
  • IT: Improve data governance, develop and data management tools, and retire inefficient loan and credit systems.
  • Operations: Update credit processes (such as data entry and coding processes), and re-engineer controls and processes
  • Lending: Efficient analysis of deal structures and lending to minimize life of loan losses and capital impacts

An assessment for CECL readiness can reveal a lot that can be useful to the institution beyond the needs of CECL compliance including:

  • Assess the current state of the institution’s credit portfolio data and origination process, ALLL, Financial and Credit policies, practices and governance – all within the context of CECL;
  • Review Current ALLL System & Processes;
  • Review controls on data used in the current ALLL process;
  • Identify data points required to support industry best practice portfolio data & regulatory compliance data for CECL;
  • Review loan origination process, stakeholders, criteria and coding;
  • Review data stored in the core for accuracy consistency and robustness;
  • Review all identified credit data source systems for data/database integrity; and
  • Review any existing data warehouse capabilities, and how portfolio data is organized, maintained, and retained.

CECL compliance practices and implementation plans should be in place in 2018. Auditors, regulators, boards of directors and investors will want to know bank’s plans for CECL, including the costs and the benefits beyond compliance.

Those institutions that leverage the potential benefits of the CECL implementation will have a competitive advantage over their competitors through increased efficiencies, automation and clarification of corporate risk management practices.

About the Authors

CFO Consulting Partners, Tom Van Lenten: Tom leads CFO Consulting Partners CECL consulting services to financial institutions. CFO CP’s CECL services include: CECL readiness assessment, analysis of the accounting and regulatory implications, project management, and assisting with updates of policies, procedures and internal controls which are impacted by CECL.

Ardmore Banking Advisors, Peter Cherpack: EVP, Partner. Peter is a nationally known thought leader in CECL implementation for community banks, and with other Ardmore consultants conducts CECL readiness assessments with a focus on credit and credit data readiness.

Physician Practices: Changing Dynamics

By

In our introductory article introducing our healthcare practice, we provided a general assessment of the American Healthcare system and the state of flux that currently overshadows the industry and its practitioners.

There are significant changes that are profoundly affecting individual practitioners and small physician groups that require self-assessment and adjustment to survive in the changing environment.

Because of a more recent development, a totally different method of provider reimbursement, from fee for service or volume payments, to outcome based reimbursements or Value Based Care (VBC) is being encouraged by both Centers for Medicare and Medicaid (CMS) and by private insurers. Essentially, fees for services under VBC are paid based

on case outcome and the payment must be shared by all providers in the continuum.  VBC reimbursement was originally introduced by the CMS, however now private insurers are moving in the direction of value based reimbursement and they are providing incentives to healthcare providers to participate. What is essential to succeed in the VBC method of reimbursement lie in integration of providers and the ability to aggregate data.

Even prior to the movement to VBC, the PPACA is requiring all practitioners to utilize Electronic Medical Records, (EMR) which is costly in both software acquisition as well as implementation. While a burden to small practitioners and groups, EMR will ultimately allow groups to operate, integrate and bill more efficiently.

As new requirements continue to be heaped on single physician practices and small groups, they have been dwindling as more groups consolidate to gain scale and integration.  Also, there is a significant trend toward physician groups selling their practices to hospitals, as hospitals are a significant cog in the VBC wheel.

Because of PPACA, more insurers are requiring providers to be part of networks and are grouping providers into tiers where reimbursement is based upon a provider’s relationship with the insurance provider and other providers within the network and tiers. It is becoming less likely that practitioners can assume that the patient’s insurance company will cover the services provided, as more insurance companies are restricting out of network reimbursements. As an example, there are no insurance providers offered by the PPACA in the New Jersey marketplace that reimburses out of network services.

Viability in the changing healthcare delivery model for practice groups will require a significant change in how a practice operates, will require investments in information technology, possibly require upgraded staffing as well as the development of relationships with other providers in the continuum.

Sole practitioners and practice groups need to assess their situations and determine if they are positioned to continue independently or should they align with a network of providers or sell to a larger group or hospital.

CFO Consulting Partners’ healthcare practice is here to help you. We can assist you to access your current situation and help you create and implement a plan forward. We can also assist you should you decide to align with a network or sell or consolidate with another group or hospital.

American Healthcare: A State of Flux

By

The United States possibly has the most complex healthcare system in the world. The American healthcare system regulates the industry at both the federal and state level. It is paid for by private health insurance as well as from the government under its Medicare and Medicaid programs. Healthcare services are provided by the private sector; by both for-profit and non-profit entities, however; the government also provides services directly through the Veterans Administration. All of this, in a population with disparate levels of wealthy and poor citizens, leads to highly chaotic distribution of care and a complex payment system. Some facilities reap the benefits of bespoke medical furniture whereas some only have the basic requirements.

While half of all Americans receive healthcare coverage through their employers, the plans are subject to crushing regulations both federally and at the state level. Those Americans receiving healthcare coverage through Medicare and Medicaid, subject the provider to lower reimbursements.  As a result, providers are less willing to take on Medicare and Medicaid patients, leading to a shortage of providers for that patient base. Patients that are not covered by their employer or a federally provided healthcare program are required to seek private insurance. However, because of the Patient Practice and Affordable Care Act (PPACA), patients are provided limited options and those options greatly restrict their choices regarding providers.

Because of a more recent development, a totally different method of reimbursement to providers, from fee for service or volume payments, to outcome based reimbursements or Value Based Care (VBC) is being encouraged by both Centers for Medicare and Medicaid (CMS) and by private insurers. Essentially, fees for services under VBC are paid based on case outcome and the payment must be shared by all providers in the continuum.  VBC reimbursement was originally introduced by the CMS. However private insurers are moving in the direction of value based reimbursement and providing incentives to healthcare providers to participate. What is essential to succeed in the VBC method of reimbursement lie in integration of providers and the ability to aggregate data.

Even prior to the movement to VBC, the PPACA is requiring all practitioners to utilize Electronic Medical Records, (EMR) which is costly in both software acquisition as well as implementation. While a burden to small practitioners and other small providers, EMR will ultimately allow participants in the continuum to operate, integrate and bill more efficiently.

Adding to the complexity of the American Healthcare system is the attempts to repeal of the PPACA. The potential of repeal is having the greatest impact on the insurance industry, impacting the cost of insurance, as subsidies provided by the federal government are uncertain depending on the success of repeal and its subsequent replacement.

CFO Consulting Partners’ healthcare practice is here to help you. We can assist you to access your current situation and help you create and implement a plan forward that will help insulate your practice as the rapid changes within the industry unfold.

The CECL Approach, 2 of 3

By

Tom Van Lenten, CPA, CFO Consulting Partners LLC

This is the second in the CFO Consulting Partners series of articles analyzing the new FASB Standard on accounting for credit losses (ASU 2016-13). Click here for the first article in the series.

It has been more than a year since the FASB issued ASU 2016-13 Click here for article . The new Standard is most commonly referred to as CECL, which is an acronym for “Current Expected Credit Losses”. The CECL standard requires an entity to recognize a forward-looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses (ALLL), when an asset is booked. Current GAAP requires that the estimate of credit loss is based on incurred losses and banks typically historical losses as the basis for the calculation

CECL is one of the largest and most complex accounting standard implementations ever undertaken in the banking industry. Despite this, many banks have not begun urgent and focused execution of CECL implementation plans. Privately-held companies can see the long transition timeline (implementation is required at January 1. 2021 for non-SEC filers) as a reason for delay. However, public entities must react faster. They are required to include disclosures in their first SEC filings after issuance of ASC 2016-13 on June 16, 2016. The FASB has recently highlighted this disclosure requirement by issuing ACU 2017-3 in January 2017 which gives additional guidance for certain disclosures of standards that are issued but not yet implemented for SEC filers.

  • The basic requirements of ASU 2017-3 are:
    if an SEC filer does not know or cannot estimate the financial impact from adoption of a new ASU it should make a statement to that effect and should consider additional qualitative disclosures to assist the reader in assessing the impact that the standard will have
  • the ASU also requires additional qualitative disclosures to include a description of the effect of the accounting policies that the SEC filers expect to apply together with a comparison to their current accounting policies,
  • additionally, SEC filers should describe the status of the process to implement CECL and the significant implementation matters yet to be addressed.

In a recent informal survey of financial institutions by MST Click here for article covering the implementation of CECL, 5% of the respondents said that they have not yet begun preparation for CECL implementation, and 87% have only held internal discussions about CECL implementation. One experienced CFO has been quoted as saying, “the commonly followed CECL implementation strategy of waiting for other banks to report first is in fact dangerous.”

Considering the size and complexity of CECL implementation we agree that delay is a high-risk approach and that thoughtful planning now will yield significant benefits.

  • The major elements of CECL implementation include:
  • Analysis of CECL impacts on the bank,
  • Project management,
  • Credit modeling,
  • Accounting Policies,
  • Operations,
  • Systems integration [click here for a case study of a CFO CP systems integration].

In our next newsletter, we will discuss further considerations in CECL implementations.

 

The CECL Approach, 1 of 3

By

Tom Van Lenten, CPA, CFO Consulting Partners LLC

In mid-2016 the FASB issued its long-awaited standard on accounting for credit losses (ASU 2016-13). The new standard adds to US GAAP an impairment model known as the current expected credit loss model or CECL. In a shift from current practice the CECL model is based on expected losses rather than incurred losses. Under the new CECL model an entity recognizes its forward looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses, or ALL when an asset is booked.

The FASB believes that the new standard will result in more timely recognition of credit losses. There is a long transition timeline and implementation is required at January 1, 2020 for calendar-year reporters that are SEC filers, and January 1. 2021 for other entities.

The CECL approach is to be applied to most debt instruments that are not measured at fair value. This includes loan commitments, financial guarantees, lease receivables, trade receivables and held-to-maturity securities. Available for sale debt securities are specifically excluded and will continue to be evaluated for impairment under the AFS securities impairment model.

The Standard does not require use of any one method to compute expected credit losses. Management is expected to maintain complete data sets, documentation, and analysis to support how the selected method fits with the standard and produces realistic estimates of future losses. Examples of some of the acceptable methodologies are:

  • Loss rate: Historical loss rates can still be used as a starting point for determining expected credit losses. When using historical loss rates, the Bank would have to consider how conditions that existed during the historical charge-off period differ from current projections and adjust the future loss rates accordingly.
  • Discounted cash flow: Projections of principal and interest flows over the life of the asset.
  • Probability of default method estimates the probability loans in certain risk-stratified segments will default. This approach computes the percentage of loans that have defaulted in a pool over a look-back period.
  • Roll-rate method. The roll-rate method is often referred to as “migration analysis”. It is based on determining a prediction of credit losses based on segmentation (by delinquency or risk rating, for example) of a portfolio of financial assets. No standard roll-rate model is used throughout the financial institutions industry, but most of the models used are based on similar underlying principles.
  • Aging analysis: Banks use aging analysis in determining the effectiveness of their credit and collections functions and for estimating potential loan losses. The information from this analysis is used by Banks as a component of their estimate the allowance for loan & lease losses.
  • Collateral-value: For loans that are collateral dependent, evaluation of collateral and costs of disposal can be used to estimate expected credit losses.

Institutions with multiple loan types will likely need several methodologies to properly analyze the loss content of each portfolio segment and then aggregate the results to understand the expected losses for entire loan portfolio.

Expected credit impairment will be recognized as an allowance, instead of as a direct write-down of the amortized cost of the financial asset. Changes to the ALLL are recorded immediately through credit loss expense. The carrying amount of a financial asset that is considered to be uncollectible will be written-off in a manner similar to current US GAAP.

While there is significant time until required implementation, it is imperative that management begin the implementation process as soon as possible. The most problematic aspects of CECL implementation will likely be: a) developing the support systems and processes, b) gathering and organizing the historical data to support new methodologies, and c) developing going forward data capture and analysis processes.

  • With respect to a) above, existing modeling approaches currently used for Basel, and stress testing may be leveraged and adapted for CECL. However, new credit loss models will likely need to be implemented. It is anticipated that the development or purchase of credit models that estimate future credit losses may be the most time consuming phase of CECL implementation.
  • For b) the historical data requirements for the new models will often not be resident in current financial and credit systems. This data will have to be developed from the bank’s core operating system and organized into databases which the models can access.
  • For data capture and analysis c) the starting point for developing a future loss credit loss data base is current loan and credit loss data. Companies implementing CECL should undertake a robust review and analysis of its current loan and credit data so that the process of developing a future credit loss data base starts with historic data that has a high level of accuracy and integrity.

Many of the disclosures required under the new standard are similar to those required under current GAAP. For example disclosures on credit quality, ALLL roll-forward, policies tor determining credit losses, past due and non-accrual status, and collateral dependent assets are the same. There are, however, significant additional disclosures of credit quality indicators, disaggregated by year of origination for a five-year period.

Cyber Security: A fundamental component of Enterprise Risk Management (ERM)

By

CFO Consulting Partners LLC Cyber Security White Paper March 2015 1 Cyber Security: A fundamental component of Enterprise Risk Management (ERM)

Cyberattacks have hit virtually every industry and the two industries most impacted by incursions, breaches and theft of data are financial services and health care. Financial services and the medical world are inexorably connected to the internet, and they are therefore connected to hackers, cyber criminals and even nation states intent upon getting access to financial and medical records.

Banks are a particular focus of cyber criminals. In a recent speech OCC Head Thomas Curry said,” The financial-services industry is one of the more attractive targets of cyberattacks, and unfortunately the threat is growing.” Further, one growing area of concern is the potential for criminals to target smaller banks. In late 2014 New York State banking regulator Benjamin Lawsky asked the institutions he supervises to understand the increasing complexity and interconnectedness of the financial system, as well as the importance of strong controls and of carefully monitoring the ways in which they connect to third parties.

Banks routinely use advanced statistical models and behavior analytics programs that can spot possible fraud and, to some extent, have a cultural data governance advantage over other industries. Analysts at the Gartner research group estimate that the health care industry is generally about ten years behind the financial services sector in terms of protecting consumer information.

In the healthcare world, major cyber breaches go back to 2010 when the WellPoint medical records breach set two records: the number of members’ records exposed in a security breach, and the size of the settlement amount paid to the Federal Government. The WellPoint breach is estimated to have cost $143 million dollars. These costs were for legal recovery actions, new security control investments, and extended credit and protection services for victims. During an investigation of WellPoint’s information systems, The US Department of Health and Human Services (HHS) found that the Indianapolis-based insurer had not enacted the appropriate administrative, technical and physical safeguards for data which are required Health Insurance Portability and Accountability Act of 1996 (HIPPA).

More recently the dangers of health care cyberattacks were highlighted early in 2015 when Anthem, the nation’s second-largest health insurer, said hackers broke into a database storing information on eighty million people. The hack led to a particularly valuable trove of data because it exposed Social Security numbers.

Basic components of cyber controls framework, and ERM (Risk Management):

• Governance: Cyber Security Companies in all industries need to establish a cybersecurity governance framework which is a central component of the ERM infrastructure. Regular reporting to the Board of Directors will help assure active participation among the Board, Senior Management and IT Management. The visibility of the cybersecurity infrastructure and processes are an important driver of adequate resourcing, which is essential for companies to stay ahead of the many bad actors in the cyberattack world. CFO Consulting Partners LLC Cyber Security White Paper March 2015 2

• Cyber Risk Assessment: Through risk assessments, companies understand the specific risks to their organizational infrastructure and operations. Risk assessment processes identify and document vulnerabilities, highlight internal and external threats, and ultimately prioritize the risk and related responses. The related controls should be organized and implemented as preventive, detective and corrective.

• Technical Controls: The selection of specific controls by any company is dependent the company’s individual risk profile. Many companies use a “defense-in-depth” strategy in which they layer multiple independent security controls strategically throughout their technology systems. One way of looking at this approach is to view the components of a company’s technical infrastructure as residing in partially redundant layers.

• Vendor management: At every touch point vendors can introduce cyber threats (e.g. – viruses) into a company’s systems and data bases. While third party penetration testing is almost impossible with vendors, the company’s threat assessment must thoroughly evaluate each third party touch point for cyber risks.

• Incident Response Planning: An incident response plan is a framework to manage a cybersecurity event and limit the damage. A company’s incident response plan should establish a dedicated Cyber Security Incident Response Team, address all the possible attack vectors and take the legitimate concerns of third parties into account.

• Staff Training: Without adequate staff training and related awareness, the rest of a company’s cybersecurity program can be easily compromised. Companies must define cybersecurity training needs and requirements. Staff need to understand the possible vectors and techniques that the bad actors use to penetrate systems and data bases.

• Cyber Insurance: While almost unknown five years ago, many companies have chosen to obtain cyber risk insurance. Coverage is offered my most major insurance underwriters; premiums vary widely. Underwriting relies heavily on the quality of a company’s cyber control infrastructure. In other words, insurance premiums depend greatly on the quality and strength of the company’s cyber control infrastructure. Note: Cyber Control Framework items above extracted from FINRA 2014 “Report on Cybersecurity Practices”.

Download PDF

We are a proud sponsor of XPX. XPX is a multi-disciplinary community of professional advisors who work collaboratively to help owners build valuable businesses and assist them in preparing and executing a successful transition. Learn more...

We are a proud member of FINACA. FINACA is a nationwide network of independent finance and accounting consulting firms focused on delivering exceptional client service. Learn more...

Subscribe to our Newsletter

Sign-Up Now

Privacy Policy