Not for profit

The External Reporting Board (XRB) has released updated reporting thresholds for public benefit entities (PBEs): Tier Old criteria New criteria Tier 1* Total expenses greater than $30m Total expenses greater than $33m Tier 2 Total expenses less than $30m Total expenses less than $33m Tier 3 Total expenses less than $2m Total expenses less than $5m Tier 4 Total operating payments $140,000 No change *Note; an entity is also required to apply Tier 1 if it has “public accountability”. This decision is welcome as many PBE entities will see a reduction in reporting requirements and compliance costs. These thresholds have not been updated since 2012; in that time, various new pieces of legislation have been introduced and inflation has pushed many entities from Tier 3 to Tier 2 reporting without becoming any larger or more complex. Several new PBE standards have also been issued over the last decade, causing concerns that the costs of reporting exceeded the benefit to users under the previous size thresholds. Research by the XRB on the expenditure of PBE entities shows there is substantially less clustering around the $5 million threshold, compared to the $2 million threshold. In total there are 33 entities with total expenditure between $4.8 million and $5.2 million, while there are 115 entities with total expenditure between $2.8 million and $3.2 million. When does this change apply? The new thresholds are mandatory for periods beginning after 28 March 2024, which impacts 31 March 2025 balance dates onward. However, the change can be applied for periods that end after the standard takes effect (28 March), so those preparing reports for 31 March 2024 balance dates onward are also eligible. This news is timely for Incorporated Societies applying XRB PBE reporting standards for the first time under the Incorporated Societies Act 2022, as more Incorporated Societies will also now have lower reporting requirements. Determining your expenditure Total expenses for the purpose of determining a reporting threshold include all of an entity’s operating expenditure. This includes grants or donations made by an entity, but does not include capital expenditure (assets) or loan payments. How does it work in practice? If you now find yourself eligible to apply a lower reporting tier due to this change, it can be implemented immediately. However, you need to consider future expenditure as you may end up transitioning back quickly if this grows year on year. It’s also important to think about consolidation requirements if your entity sits within a group, so that a change in reporting tier at the entity level doesn’t interfere with group reporting. PBEs can apply requirements of a higher tier if they want to, so if you are happy to stay at the current reporting tier – that’s fine. For example, we have seen this with recently established PBEs that knew they would exceed the previous $2m expenditure threshold in future years, so they start by adopting Tier 2 rather than waiting until they hit the threshold. If your PBE previously applied Tier 1 requirements and you are transitioning to Tier 2 requirements due to your expenditure, the recognition and measurement accounting policies will remain the same, but there will be less disclosure requirements in the notes to the financial statements. Tier 2 and Tier 3 reporting requirements have some differences, mainly around presentation of revenue and expenses, and accounting for property, plant and equipment, investment property and publicly traded financial investments. Entities that previously applied Tier 2 requirements and are transitioning to Tier 3 can choose to either provide comparative data in accordance with Tier 2 requirements (i.e., leave it as it was) or restate them in line with Tier 3. If your entity is thinking about transitioning reporting tiers, start engaging in the process early so you can navigate this transition which can be deceptively complex at times.

If you only make one security tweak to your business, it should be this: turn on multifactor or two factor authentication. Multifactor authentication (MFA) is a simple change that can massively improve data protection. Without it enabled, your business or Not for Profit organisation could be in breach of the Privacy Act depending on the type of information you hold. What is multifactor authentication? Multifactor authentication means accessing a particular app or system requires more than one method of identification. Without MFA, you log on via one device, with a single set of credentials. MFA requires more from users based on three factors: Something you have, like a smartphone or a secure USB key Something you are, like a fingerprint or facial recognition. Something you know, like a password or PIN. For example, to log into Xero online, you enter your email and password. With MFA, you then need to confirm your identity another way – such as on your phone via the Xero app. If MFA is enabled for Microsoft Outlook and you log on using a device that isn’t trusted, you will also need to enter a security code that has been sent to a trusted email account or phone number. Whether it’s a text code, a fingerprint or a phone confirmation, MFA ensures more than one ID method is required to get into your important data. Most platforms and applications give you the option to switch it on through your security settings. It seems inconvenient – why would you bother? Single-factor authentication can make it much easier for a cybercriminal to compromise your bank accounts, accounting software, or business systems from anywhere in the world. All they need is your email address and password, which might have been stolen or leaked, or gained through phishing. With two-factor authentication, it becomes exponentially more difficult for malicious users to get access to your systems. According to Microsoft, there are more than 300 million fraudulent sign-in attempts on its cloud services daily: “All it takes is one compromised credential or one legacy application to cause a data breach.” It estimates that MFA can block more than 99.9% of account compromise attacks. If that seems too high, perhaps it is, but MFA is still highly effective; Google says its implementation of MFA halved the number of account compromises. When you have MFA enabled, it’s less concerning if your password is leaked or compromised. That alone won’t be enough to allow a hacker to gain access. Without MFA, you’re probably in breach of the Privacy Act The Office of the Privacy Commissioner recommends all organisations, regardless of their size to introduce MFA. When a breach occurs, one question often asked is whether an organisation has taken reasonable steps to protect the data they hold. If it is deemed the organisation did not take reasonable steps to protect its data, this could result in a breach of the Privacy Act. What’s reasonable depends on the size of the organisation breached and the scale and sensitivity of data it holds. No matter how small your business or charity might be, it almost certainly holds some personal information. It might be as basic as a list of members’ names, phone numbers and email addresses. Or perhaps it’s a more complex customer management system that includes payment details, health information or biometric data. As such, implementing the MFA is no brainer. Under the Privacy Act, every organisation or individual that holds data must collect it appropriately, keep it safe and allow the people it concerns to be able to access it (for more details, read the Privacy Principles). The Office of the Privacy Commissioner describes two-factor authentication as a bare minimum for small businesses or organisations that hold digital information. Without MFA in place, if someone unauthorised accesses your business data, you are likely to be in breach of the Privacy Act. This could lead to a penalty under the Act starting from $10,000; the most ever awarded is just over $168,000. The risks of a data breach go far beyond penalties, though. Your organisation may also experience potentially huge financial losses, reputational damage, and be forced to shut down. We know of one instance where a small online business experienced a data breach, and the cost of remediation and compliance was so high that dissolving the business was the best outcome. Cyber incursions are such a significant risk it’s hard to overstate their potential impact – yet many organisations are unaware of their responsibilities and risks. It’s all part of everyday risk management Cyber security can feel like a particularly thorny specialist topic that sits outside business as usual. But there’s a better way to think about it – cyber security is simply another risk management activity. It’s not separate or unique or different to other risks in your business, so managing it should equally be an everyday task. This means switching on MFA and getting everybody using it automatically, as well as keeping up to date with software patches and managing passwords effectively. Simple steps like these go a long way to protecting your organisation from breaches. In some cases, you might need to switch platforms to be able to access MFA for your organisation. We also occasionally see small regional organisations in areas that are digitally excluded, which can make this tricky. There may be workarounds available, or alternative platforms that can help. Create awareness and provide training We know that it can feel inconvenient to add MFA to apps you use frequently. If those who use your systems don’t understand the importance of using MFA, they may find this extra effort irritating, or try to switch it off. It’s essential to have all users on board. Education is the key – you need to explain to everyone why MFA is vital and why it is well worth the additional effort. You need to create awareness and provide training. According to research by Verizon, 82% of all cyber attacks “involved a human element”, and phishing scams still dominate social engineering attacks. We know that many small and medium enterprises and Not for Profits, don’t have in house IT and cyber expertise, however, being small or local doesn’t exempt you from the Privacy Act, so you still need to make the effort to not only enable MFA, but to understand your obligations under the Act, establish cyber security policies, and incorporate MFA into your overall approach to risk management.

Service reporting is all about your non-financial performance – the data that showcases the most meaningful parts of what your entity does. The standard is designed to help everyone see the fantastic work your charity is doing, and you might be surprised at the potential benefits of non-financial reporting. This service report tells all of your stakeholders: