#risk-management
Strategies for identifying and mitigating business risks including insurance
A practical guide to building a Written Information Security Plan that satisfies the FTC Safeguards Rule and IRS Publication 5708 — covering the nine required elements, technical controls like MFA and encryption, penalty exposure up to $46,517 per violation per day, and a six-week roadmap for tax preparers, CPAs, and bookkeepers.
ASC 326's Current Expected Credit Loss model requires private companies, community banks, and credit unions to book lifetime expected losses on receivables and loans from day one. This guide covers estimation methods (loss-rate, WARM, vintage, migration, DCF), pool segmentation, reversion approaches, and the July 2025 ASU 2025-05 practical expedient that lets entities skip forward-looking forecasts for current trade receivables.
CMMC 2.0 took effect November 10, 2025, and Level 2 third-party assessments begin November 10, 2026. A practical guide to scope, cost ($80K–$250K over three years), the 14 control families, the POA&M rule, and a 90-day path for small DoD contractors.
Calculate customer revenue shares with a six-customer example, understand the 10% disclosure threshold, and keep receivables concentration separate.
ERISA Section 409 imposes personal liability on 401(k) plan fiduciaries, and the corporate veil does not shield small business owners. This guide explains the prudent-expert standard, the Tibble v. Edison duty to monitor, and how hiring a Section 3(38) investment manager shifts investment discretion — and most related liability — away from the plan sponsor.
A practitioner's guide to representations and warranties insurance (RWI) for middle-market M&A in 2026 — how buy-side and sell-side policies work, premiums around 2.5–3% of limit with retentions near 0.5%, the top breach categories driving claims, and when traditional escrow still wins.
A first SOC 2 Type II audit takes a minimum three-month observation window — six months for most enterprise buyers — and runs $45,000 to $150,000 all-in for a sub-fifty-person SaaS startup. Here is what the Trust Services Criteria cover, how to scope the engagement, and the six preparation mistakes that derail first examinations.
How the federal WARN Act triggers a 60-day notice clock at 100 employees, the three narrow exceptions, the back-pay and $500-per-day penalties, and the state mini-WARN laws (NY, NJ, CA) that quietly raise the bar to 90 days, 25 employees, or mandatory severance.
California SB 253 and SB 261 require companies with $500M+ revenue doing business in California to disclose Scope 1, 2, and 3 emissions and publish TCFD-aligned climate risk reports. The first SB 253 emissions report is due August 10, 2026 — here is who is in scope, what to file, and how to prepare.
D&O insurance for startups in 2026 typically runs $3,500–$10,000 per year for $1M–$3M of coverage; Series A term sheets routinely require $3M–$5M within 60–90 days of close. The most common claims at sub-100-person companies come from employment disputes, not securities allegations.
Employment Practices Liability Insurance costs small businesses roughly $800 to $3,000 a year, but a single uncovered discrimination, harassment, or wrongful termination claim averages $80,000 in defense costs—here is what EPLI covers, how carriers price it, and how to buy it without overpaying.
How the 10-digit Harmonized Tariff Schedule, Chapter 99 add-ons, and Section 301 layers assign legal duty liability to the importer of record—not the broker—and how a prior disclosure under 19 U.S.C. § 1592(c)(4) can cap penalties at interest if you find errors before CBP audits.
