#risk-management
Strategies for identifying and mitigating business risks including insurance
How small businesses can detect and deter occupational fraud — using the ACFE fraud triangle, segregation of duties, surprise audits, management review, and proactive data monitoring — with a 90-day plan tailored to a 20-person organization.
A 2026 operating guide to SEC Item 1.05 Form 8-K cybersecurity disclosure — when the four-business-day clock starts, how to make the materiality call without unreasonable delay, when the Attorney General can grant a delay, the Item 1.05 vs. Item 8.01 trap, and what Regulation S-K Item 106 requires in your annual 10-K.
A founder's guide to SOC 2 Type II in 2026 — what it actually tests, realistic cost ($20K–$35K first year) and timeline (3–12 month observation window), which Trust Services Criteria to scope, the seven controls that trip startups up, and how to keep enterprise deals moving with Type I bridge letters while the audit runs.
Public construction contracts above the FAR $150,000 threshold require performance and payment bonds under the Miller Act, with state Little Miller Acts setting thresholds from $25,000 to $500,000. The SBA Surety Bond Guarantee Program—which guaranteed $10.6 billion in bonds for 2,200+ small businesses in FY2025—lets approved sureties write bonds for small contractors by absorbing 80–90% of loss risk.
OFAC enforcement now targets fintech, crypto, real estate, and small e-commerce firms with civil penalties up to $377,700 per violation. A practical guide to SDN list screening, the 50 percent ownership rule, voluntary self-disclosure under the 2026 portal, and the five-pillar compliance program Treasury expects from any company touching cross-border money.
PCI DSS v4.0.1 governs every 2026 assessment, and FAQ 1588 has narrowed who qualifies for SAQ A. This guide walks small merchants through the new script-tampering rules (6.4.3 and 11.6.1), the 12-character password and MFA requirements, what non-compliance actually costs, and a 12-step checklist for getting it right.
Section 1259 treats short-against-the-box trades, equity swaps, and tight collars on appreciated stock as constructive sales — taxable today, even with no proceeds. Covers the variable prepaid forward workaround, the 30-day closing exception, and the related-party trap.
A practical guide to building a Written Information Security Plan that satisfies the FTC Safeguards Rule and IRS Publication 5708 — covering the nine required elements, technical controls like MFA and encryption, penalty exposure up to $46,517 per violation per day, and a six-week roadmap for tax preparers, CPAs, and bookkeepers.
ASC 326's Current Expected Credit Loss model requires private companies, community banks, and credit unions to book lifetime expected losses on receivables and loans from day one. This guide covers estimation methods (loss-rate, WARM, vintage, migration, DCF), pool segmentation, reversion approaches, and the July 2025 ASU 2025-05 practical expedient that lets entities skip forward-looking forecasts for current trade receivables.
CMMC 2.0 took effect November 10, 2025, and Level 2 third-party assessments begin November 10, 2026. A practical guide to scope, cost ($80K–$250K over three years), the 14 control families, the POA&M rule, and a 90-day path for small DoD contractors.
Customer concentration above 10% triggers GAAP disclosure and can cut business valuation by 20–35%.
ERISA Section 409 imposes personal liability on 401(k) plan fiduciaries, and the corporate veil does not shield small business owners. This guide explains the prudent-expert standard, the Tibble v. Edison duty to monitor, and how hiring a Section 3(38) investment manager shifts investment discretion — and most related liability — away from the plan sponsor.
