Companies Should Take a Holistic Approach to Cybersecurity

Today’s businesses have two broad choices regarding cybersecurity: wait for something bad to happen and react to it, or proactively address the threat. Not surprisingly, we recommend the latter approach.

The grim truth is cyberattacks are no longer only an information technology (IT) issue. They pose a serious risk to every level and function of a business. That’s why your company should take a holistic approach to cybersecurity. Let’s look at a few ways to put this into practice.

Start with leadership

Fighting the many cyberthreats currently out there calls for leadership. However, it’s critical not to place sole responsibility for cybersecurity on one person, if possible. If your company has grown to include a wider executive team, delegate responsibilities pertinent to each person’s position. For example, a midsize or larger business might do something like this:

• The CEO approves and leads the business’s overall cybersecurity strategy,

• The CFO oversees cybersecurity spending and helps identify key financial data,

• The COO handles how to integrate cybersecurity measures into daily operations,

• The CTO manages IT infrastructure to maintain and strengthen cybersecurity, and

• The CIO supervises the management of data access and storage.

To be clear, this is just one example. The specifics of delegation will depend on factors such as the size, structure and strengths of your leadership team. Small business owners can turn to professional advisors for help.

Classify data assets

Another critical aspect of cybersecurity is properly identifying and classifying data assets. Typically, the more difficult data is to find and label, the greater the risk that it will be accidentally shared or discovered by a particularly invasive hacker.

For instance, assets such as Social Security, bank account and credit card numbers are pretty obvious to spot and hide behind firewalls. However, strategic financial projections and many other types of intellectual property may not be clearly labeled and, thus, left insufficiently protected.

The most straightforward way to identify all such assets is to conduct a data audit. This is a systematic evaluation of your business’s sources, flow, quality and management practices related to its data. Bigger companies may be able to perform one internally, but many small to midsize businesses turn to consultants.

Regularly performed company-wide data audits keep you current on what you must protect. And from there, you can prudently invest in the right cybersecurity solutions.

Report, train and test

Because cyberattacks can occur by tricking any employee, whether entry-level or C-suite, it’s critical to:

Ensure all incidents are reported. Set up at least one mechanism for employees to report suspected cybersecurity incidents. Many businesses simply have a dedicated email for this purpose. You could also implement a phone hotline or an online portal.

Train, retrain and upskill continuously. It’s a simple fact: The better trained the workforce, the harder it is for cybercriminals to victimize the company. This starts with thoroughly training new hires on your cybersecurity policies and procedures.

But don’t stop there — retrain employees regularly to keep them sharp and vigilant. As much as possible, upskill your staff as well. This means helping them acquire new skills and knowledge in addition to what they already have.

Test staff regularly. You may think you’ve adequately trained your employees, but you’ll never really know unless you test them. Among the most common ways to do so is to intentionally send them a phony email to see how many of them identify it as a phishing attempt.

Of course, phishing isn’t the only type of cyberattack out there. So, develop other testing methods appropriate to your company’s operations and data assets. These could include pop quizzes, role-playing exercises and incident-response drills.

Spend wisely

Unfortunately, just about every business must now allocate a percentage of its operating budget to cybersecurity. To get an optimal return on that investment, be sure you’re protecting all of your company, not just certain parts of it. Let FMD help you identify, organize and analyze all your technology costs.

4 Ways Business Owners Can Make “The Leadership Connection”

To get the most from any team, its leader must establish a productive rapport with each member. Of course, that’s easier said than done if you own a company with scores or hundreds of workers. Still, it’s critical for business owners to make “the leadership connection” with their employees.

Simply put, the leadership connection is an authentic bond between you and your staff. When it exists, employees feel like they genuinely know you — if not literally, then at least in the sense of having a positive impression of your personality, values and vision. Here are four ways to build and strengthen the leadership connection with your workforce.

1. Listen and share

Today’s employees want more than just equitable compensation and benefits. They want a voice. To that end, set up an old-fashioned suggestion box or perhaps a more contemporary email address or website portal for staff to share concerns and ask questions.

You can directly reply to queries with broad implications. Meanwhile, other executives or managers can handle questions specific to a given department or position. Choose communication channels thoughtfully. For example, you might share answers through company-wide emails or make them a feature of an internal newsletter or blog. Video messages can also be effective.

2. Stage formal get-togethers

Although leaders at every level need to be careful about calling too many meetings, there’s still value in getting everyone together in one place in real time. At least once a year, consider holding a “town hall” meeting where:

• The entire company gathers to hear you (and perhaps others) present on the state of the business, and

• Anyone can ask a question and have it answered (or receive a promise for an answer soon).

Town hall meetings are a good venue for discussing the company’s financial performance and establishing expectations for the immediate future.

You could even take it to the next level by organizing a company retreat. One of these events may not be feasible for businesses with bigger workforces. However, many small businesses organize off-site retreats so everyone can get better acquainted and explore strategic ideas.

3. Make appearances

Meetings are useful, but they shouldn’t be the only time staff see you. Interact with them in other ways as well. Make regular visits to each unit, department or facility of your business. Give managers a chance to speak with you candidly. Sit in on meetings; ask and answer questions.

By doing so, you may gather ideas for eliminating costly redundancies and inefficiencies. Maybe you’ll even find inspiration for your next big strategic move. Best of all, employees will likely get a morale boost from seeing you take an active interest in their corners of the company.

4. Have fun and celebrate

All work and no play makes business owners look dull and distant. Remember, employees want to get to know you as a person, at least a little bit. Show positivity and a sense of humor. Share appropriate personal interests, such as sports or caring for pets, in measured amounts.

Above all, don’t neglect to celebrate your business’s successes. Be enthusiastic about hitting sales numbers or achieving growth targets. Recognize the achievements of others — not just on the executive team but throughout the company. Give shout-outs to staff members on their birthdays and work anniversaries.

It’s all about trust

At the end of the day, the leadership connection is all about building trust. The greater your employees’ trust in you, the more loyal, engaged and productive they’ll likely be. FMD can help you measure your business’s productivity and evaluate workforce development costs.

Cost Management is Critical for Companies Today

Many business owners take an informal approach to controlling costs, tackling the issue only when it becomes an obvious problem. A better way to handle it is through proactive, systematic cost management. This means segmenting your company into its major spending areas and continuously adjusting how you allocate dollars to each. Here are a few examples.

Supply chain

Most supply chains contain opportunities to control costs better. Analyze your company’s sourcing, production and distribution methods to find them. Possibilities include:

• Renegotiating terms with current suppliers,

• Finding new suppliers, particularly local ones, and negotiating better deals, and

• Investing in better technology to reduce wasteful spending and overstocking.

If you haven’t already, openly address what’s on everyone’s mind these days: global tariffs. Work with your leadership team and professional advisors to study how current tariffs affect your company. In addition, do some scenario planning to anticipate what you should do if those tariffs rise or fall.

Product or service portfolio

You might associate the word “portfolio” with investments. However, every business has a portfolio of products and services that it sells to customers. Review yours regularly. Like an investment portfolio, a diversified product or service portfolio may better withstand market risks. But offering too many products or services exhausts resources and exposes you to high costs.

Consider simplifying your portfolio to eliminate the costs of underperforming products or services. Of course, you should do so only after carefully analyzing each offering’s profitability. Focusing on only high-margin or in-demand products or services can reduce expenses, increase revenue and strengthen your brand.

Operations

Many business owners are surprised to learn that their companies’ operations cost them money unnecessarily. This is often the case with companies that have been in business for a long time and gotten used to doing things a certain way.

The truth is, “we’ve always done it that way” is usually a red flag for inefficiency or obsolescence. Undertake periodic operational reviews to identify bottlenecks, outdated processes and old technology. You may lower costs, or at least control them better, by upgrading equipment, implementing digital workflow solutions or “rightsizing” your workforce.

Customer service

Customer service is the “secret sauce” of many small to midsize companies, so spending cuts here can be risky. But you still need to manage costs proactively. Relatively inexpensive technology — such as website-based knowledge centers, self-service portals and chatbots — may reduce labor costs.

Perform a comprehensive review of all your customer-service channels. You may be overinvesting in one or more that most customers don’t value. Determine where you’re most successful and focus on leveraging your dollars there.

Marketing and sales

These are two other areas where you want to optimize spending, not necessarily slash it. After all, they’re both critical revenue drivers. When it comes to marketing, you might be able to save dollars by:

• Refining your target audience to reduce wasted “ad spend,”

• Embracing lower-cost digital strategies, and

• Analyzing customer data to personalize outreach.

Data is indeed key. If you haven’t already, strongly consider implementing a customer relationship management (CRM) system to gather, organize and analyze customer and prospect info. In the event you’ve had the same CRM system for a long time, look into whether an upgrade is in order.

Regarding sales costs, reevaluate your compensation methods. Can you adjust commissions or incentives to your company’s advantage without disenfranchising sales staff? Also, review travel budgets. Now that most salespeople are back on the road, their expenses may rise out of proportion with their results. Virtual meetings can reduce travel expenses without sacrificing engagement with customers and prospects.

The struggle is real

Cost management isn’t easy. Earlier this year, a Boston Consulting Group study found that, on average, only 48% of cost-saving targets were achieved last year by the 570 C-suite executives surveyed. Beating that percentage will take some work. To that end, please contact FMD. We can analyze your spending and provide guidance tailored to your company’s distinctive features.

EBHRAs: A Flexible Health Benefits Choice for Businesses

Today’s companies have several kinds of tax-advantaged accounts or arrangements they can sponsor to help employees pay eligible medical expenses. One of them is a Health Reimbursement Arrangement (HRA).

Under an HRA, your business sets up and wholly funds a plan that reimburses participants for qualified medical expenses of your choosing. (To be clear, employees can’t contribute.) The primary advantage is that plan design is very flexible, giving you greater control of your “total benefits spend.” Plus, your company’s contributions are tax deductible.

How flexible are HRAs? They’re so flexible that businesses have multiple plan types to choose from. Let’s focus on one in particular: excepted benefit HRAs (EBHRAs).

4 key rules

Although traditional HRAs integrated with group health insurance provide significant control, they’re still subject to mandates under the Public Health Service Act (PHSA), which was amended by the Affordable Care Act (ACA). This means you must deal with prohibitions on annual and lifetime limits for essential health benefits and requirements to provide certain preventive services without cost-sharing.

Because employer contributions to EBHRAs are so limited, participants’ accounts under these plans qualify as “excepted benefits.” Therefore, these plans aren’t subject to the ACA’s PHSA mandates. Any size business may sponsor an EBHRA, but you must follow certain rules. Four of the most important are:

1. Contribution limits. In 2025, employer-sponsors may contribute up to $2,150 to each participant per plan year. You can, however, choose to contribute less. You can also decide whether to allow carryovers from year to year, which don’t count toward the annual limit.

2. Qualified reimbursements. An EBHRA may reimburse any qualified, out-of-pocket medical expense other than premiums for:

• Individual health coverage,

• Medicare, and

• Non-COBRA group coverage.

Premiums for coverage consisting solely of excepted benefits can be reimbursed, as can premiums for short-term, limited-duration insurance (STLDI). However, under certain circumstances, federal agencies may prohibit small employer EBHRAs in some states from allowing STLDI premium reimbursement. (Contact your benefits advisor for further information.)

3. Required other coverage. Employer-sponsors must make other non-excepted, non-account-based group health plan coverage available to EBHRA participants for the plan year. Thus, you can’t also offer a traditional HRA.

4. Uniform availability. An EBHRA must be made available to all similarly situated individuals under the same terms and conditions, as defined and provided by applicable regulations.

Additional compliance matters

An EBHRA’s status as an excepted benefit means it’s not subject to the ACA’s PHSA mandates (as mentioned) or the portability and nondiscrimination rules of the Health Insurance Portability and Accountability Act (HIPAA).

However, EBHRAs are subject to HIPAA’s administrative simplification requirements. This includes the law’s privacy and security rules unless an exception applies — such as for certain small self-insured, self-administered plans.

In addition, like traditional HRAs integrated with group health insurance, EBHRAs sponsored by businesses are generally subject to the Employee Retirement Income Security Act (ERISA). This means:

• Reimbursement requests must comply with ERISA’s claim and appeal procedures,

• Participants must receive a summary plan description, and

• Other ERISA requirements may apply.

Finally, EBHRAs must comply with ERISA’s nondiscrimination rules. These ensure that benefits provided under the plan don’t disproportionately favor highly compensated employees over non-highly compensated ones.

Many factors to analyze

As noted above, the EBHRA is only one type of plan your company can consider. Others include traditional HRAs integrated with group health insurance, qualified small employer HRAs and individual coverage HRAs.

Choosing among them — or whether to sponsor an HRA at all — will call for analyzing factors such as what health benefits you already offer, which employees you want to cover, how much you’re able to contribute and which medical expenses you wish to reimburse. Let FMD help you evaluate all your benefit costs and develop a strategy for health coverage that makes the most sense for your business.

How Companies Can Spot Dangers by Examining Concentration

At first glance, the word “concentration” might seem to describe a positive quality for any business owner. You need to concentrate, right? Only through laser focus on the right strategic goals can your company reach that next level of success.

In a business context, however, concentration can refer to various aspects of your company’s operations. And examining different types of it may help you spot certain dangers.

Evaluate your customers

Let’s start with customer concentration, which is the percentage of revenue generated from each customer. Many small to midsize companies rely on only a few customers to generate most of their revenue. This is a precarious position to be in.

The dilemma is more prevalent in some industries than others. For example, a retail business will likely market itself to a relatively broad market and generally not face too much risk related to customer concentration. A commercial construction company, however, may serve only a limited number of clients that build, renovate or maintain offices or other facilities.

How do you know whether you’re at risk? One rule of thumb says that if your biggest five customers make up 25% or more of your revenue, your customer concentration is generally high. Another simple measure says that, if any one customer represents 10% or more of revenue, you’re at risk of having elevated customer concentration.

In an increasingly specialized world, many businesses focus solely on specific market segments. If yours is one of them, you may not be able to do much about customer concentration. In fact, the very strength of your company could be its knowledge and attentiveness to a limited number of buyers.

Nonetheless, know your risk and explore strategic planning concepts that may help you mitigate it. If diversifying your customer base isn’t an option, be sure to maintain the highest level of service.

Look at other areas

There are other types of concentration. For instance, vendor concentration refers to the number and types of vendors a company uses to support its operations. Relying on too few vendors is risky. If any one of them goes out of business or substantially raises prices, the company could suffer a severe rise in expenses or even find itself unable to operate.

Your business may also be affected by geographic concentration. This is how a physical location affects your operations. For instance, if your customer base is concentrated in one area, a dip in the regional economy or the arrival of a disruptive competitor could negatively impact profitability. Small local businesses are, by definition, subject to geographic concentration. However, they can still monitor the risk and explore ways to mitigate it — such as through online sales in the case of retail businesses.

You can also look at geographic concentration globally. Say your company relies solely or largely on a specific foreign supplier for iron, steel or other materials. That’s a risk. Tariffs, which have been in the news extensively this year, can significantly impact your costs. Geopolitical and environmental factors might also come into play.

Third, stay cognizant of your investment concentration. This is how you allocate funds toward capital improvements, such as better facilities, machinery, equipment, technology and talent. The term can also refer to how your company manages its investment portfolio, if it has one. Regularly reevaluate risk tolerance and balance. For instance, are you overinvesting in technology while underinvesting in hiring or training?

Study your company

As you can see, concentration takes many different forms. This may explain why business owners often get caught off guard by the sudden realization that their companies are over- or under-concentrated in a given area. FMD can help you perform a comprehensive risk assessment that includes, among other things, developing detailed financial reports highlighting areas of concentration.

Mitigate the Risks: Tips for Dealing with Tariff-Driven Turbulence

President Trump’s “Liberation Day” announcement of global tariffs caught businesses, as well as foreign countries and worldwide financial markets, off guard. While the president has long endorsed the imposition of tariffs, many businesses expected him to take a targeted approach. Instead, Trump rolled out a baseline tariff on all imports to the United States and higher tariffs on certain countries, including some of the largest U.S. trading partners. (On April 9, Trump announced a 90-day pause on some reciprocal tariffs, with a 10% baseline tariff remaining in effect for most countries and a 145% tariff on imports from China.)

The tariff plan sent businesses, both large and small, scrambling. Even companies accustomed to dealing with tariffs have been shaken because this round is so much more extensive and seemingly subject to change than those in the past.

Proponents of tariffs say they can be used as a negotiating tool to get other countries to lower their tariffs on U.S. imports, thereby leveling the global trade playing field. They also argue that if domestic and foreign companies relocate to the United States, it’ll create jobs for Americans, fuel construction industry growth and provide additional tax revenue.

Since more changes are expected as countries and industries negotiate with the administration for reduced rates and exemptions, some degree of uncertainty is likely to prevail for at least the short term. In the meantime, businesses have several areas they should focus on to reduce the tariff hit to their bottom lines.

1. Financial forecasting

No business should decide how to address tariff repercussions until they’ve conducted a comprehensive financial analysis to understand how U.S. and retaliatory tariffs will affect costs. You might find, for example, that your business needs to postpone impending plans for capital asset purchases or expansion.

Modeling, or scenario planning, is often helpful during unpredictable periods. Begin by identifying all the countries involved in your supply chain, whether you deal with them directly or through your suppliers, and the applicable tariffs, whether you’re importing or exporting goods.

You can then develop a model that projects how different sourcing scenarios might play out. The model should compare not only the costs of foreign vs. domestic options but also the resulting impact on your pricing, labor costs, cash flow and, ultimately, profitability. This information can allow you to build contingency plans to help reduce the odds of being caught flat-footed as new developments unfurl.

Modeling can provide valuable guidance if you’re considering reshoring your operations. Of course, reshoring isn’t a small endeavor. Moreover, U.S. infrastructure may not be adequate for your business needs.

Manufacturers also should note the shortage of domestic manufacturing workers. According to pre-tariff analysis from the National Association of Manufacturers, the U.S. manufacturing industry could require some 3.8 million jobs by 2033, and more than 1.9 million may go unfilled.

2. Pricing

Perhaps the most obvious tactic for companies incurring higher costs due to tariffs is to pass the increases along to their customers. It’s not that simple, though.

Before you raise your prices, you must take into account factors such as your competitors’ pricing and how higher prices might affect demand. The latter is especially critical for price-sensitive consumer goods where even a small price jump could undermine demand.

Consumers have already been cutting back on spending based on rising fears of inflation and a possible recession. Price increases, therefore, are better thought of as a single component in a more balanced approach.

3. Foreign Trade Zones

You may be able to take advantage of Foreign Trade Zones (FTZs) to minimize your tariff exposure. In these designated areas near U.S. ports of entry, a company can move goods in and out of the country for operations (including assembly, manufacturing and processing) but pay reduced or no tariffs.

Tariffs are paid when the goods are transferred from an FTZ into the United States for consumption. While in the zone, though, goods aren’t subject to tariffs. And, if the goods are exported, no tariff applies.

Note: Trump already has narrowed some of the potential benefits of FTZs, so avoid making them a cornerstone of your tariff strategy.

4. Internal operations

If your company’s suppliers are in high-tariff countries, you can look into switching to lower-cost suppliers in countries that have negotiated lower tariffs.

You may not be able to escape higher costs stemming from tariffs, but you can take steps to cut other costs by streamlining operations. For example, you could invest in technologies to improve efficiency or trim worker hours and employee benefits. You also should try to renegotiate contracts with suppliers and vendors, even if those relationships aren’t affected by tariffs. Such measures might make it less necessary to hike your prices.

You can control your overall costs as well by breaking down departmental silos so the logistics or procurement department isn’t making tariff-related decisions without input from others. Your finance and tax departments need to weigh in to achieve the optimal cost structures.

5. Tax planning

Maximizing your federal and state tax credits is paramount in financially challenging times. Technology investments, for example, may qualify for Section 179 expensing and bonus depreciation (which may return to 100% in the first year under the upcoming tax package being negotiated in Congress). Certain sectors may benefit from the Sec. 45X Advanced Manufacturing Production Credit or the Sec. 48D Advanced Manufacturing Investment Credit. Several states also offer tax credits for job creation, among other tax incentives.

This may be a wise time to consider changing your inventory accounting method, if possible. The last-in, first-out (LIFO) method assumes that you use your most recently purchased materials first. The cost of the newer, pricier items is charged first to the cost of goods sold, boosting it and cutting both your income and taxes. Bear in mind, though, that LIFO isn’t permitted under the International Financial Reporting Standards and is more burdensome than the first-in, first-out method.

6. Compliance

Regardless of the exact percentages of U.S. and retaliatory tariffs, you can count on tighter scrutiny of your compliance with the associated rules and requirements. These probably will become more complicated than they’ve been in the past.

For example, expect greater documentation requirements and shifting rules for identifying an item’s country of origin. The higher compliance burden alone will ramp up your costs — but the costs of noncompliance could be far greater.

Stay vigilant

The tariff landscape is rapidly evolving. You need to monitor the actions by the Trump administration, the responses of other countries and how they affect your business operations. You may have to pivot as needed to keep costs low (by reshoring or switching to suppliers in low-tariff countries). If you don’t have the requisite financial expertise on staff to keep up with it all, we can help. Contact FMD today about how to plan ahead — and stay ahead of the changes.

Businesses Considering Incorporation should Beware of the Reasonable Compensation Conundrum

Small to midsize businesses have valid reasons for incorporating, not the least of which is putting that cool “Inc.” at the end of their names. Other reasons include separating owners’ personal assets from their business liabilities and offering stock options as an employee incentive.

If you’re considering incorporation for your company, however, it’s essential to be aware of the associated risks. One of them is the reasonable compensation conundrum.

How much is too much?

Let’s say you decide to convert your business to a C corporation. After completing the incorporation process, you can pay owners, executives and other highly compensated employees some combination of compensation and dividends.

More than likely, you’ll want to pay your highly compensated employees more in compensation and less in dividends because compensation is tax deductible and dividends aren’t. But be careful — the IRS may be watching. If it believes you’re excessively compensating a highly compensated employee for tax avoidance purposes, it may challenge your compensation approach.

Such challenges typically begin with an audit and may result in the IRS being allowed to reclassify compensation as dividends — with penalties and interest potentially tacked on. What’s worse, if the tax agency succeeds with its challenge, the difference between what you paid a highly compensated employee and what the tax agency considers a reasonable amount for the services rendered usually isn’t deductible.

Of course, you can contest an IRS challenge. However, doing so usually involves considerable legal expenses and time — and a positive outcome is far from guaranteed.

Note: S corporations are a different story. Under this entity type, income and losses usually “pass through” to business owners at the individual level and aren’t subject to payroll tax. Thus, S corporation owners usually prefer to receive distributions. As a result, the IRS may raise a reasonable compensation challenge when it believes a company’s owners receive too little salary.

What are the factors?

There’s no definitive bright-line test for determining reasonable compensation. However, over the years, courts have considered various factors, including:

• The nature, extent and scope of an employee’s work,

• The employee’s qualifications and experience,

• The size and complexity of the business,

• A comparison of salaries paid to the sales, gross income and net worth of the business,

• General economic conditions,

• The company’s financial status,

• The business’s salary policy for all employees,

• Salaries of similar positions at comparable companies, and

• Historical compensation of the position.

It’s also important to assess whether the business and employee are dealing at an “arm’s length,” and whether the employee has guaranteed the company’s debts.

Can you give me an example?

Just a few years ago, a case played out in the U.S. Tax Court illustrating the risks of an IRS challenge regarding reasonable compensation.

The owner of a construction business structured as a C corporation led his company through tough times and turned it into a profitable enterprise. When the business recorded large profits in 2015 and 2016, primarily because of the owner’s personal efforts and contacts, it paid him a bonus of $5 million each year in addition to his six-figure salary. The IRS claimed this was excessive.

The Tax Court relied heavily on expert witnesses to make its determination. Ultimately, it decided against the business, finding that reasonable amounts for the bonuses were $1.36 million in 2015 and $3.68 million in 2016, respectively. (TC Memo 2022-15)

Who can help?

As your business grows, incorporation may help your company guard against certain risks and achieve a greater sense of stature. However, there are tax complexities to consider. If you’re thinking about it, please contact FMD for help identifying the advantages and risks from both tax and strategic perspectives.