New nonprofit auditing requirements SAS145 now include IT and cybersecurity compliance. Are you ready?

In 2022 the AICPA Auditing Standards Board (ASB) issued Statement on Auditing Standards (SAS) No. 145,Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement. The new standard became effective for audits of financial statements for periods ending on or after Dec. 15, 2023. For more on SAS 145 changes, read this article in the Journal of Accountancy.

For the first time, SAS No. 145 now provides explicit definitions for the terms general information technology (IT) controls, IT environment, and information-processing controls. In addition, as IT utilization brings additional risk, the new guidance expressly defines risks arising from the use of IT.

As audits proceed with the new guidelines, we expect a learning period for auditors, IT professionals, and nonprofit leaders. If you have questions about what the new requirements entail, you are not alone. Community IT has begun to field questions from our clients and their auditors about IT systems and cybersecurity controls. We will continue to share our insights and advice with our community as audits evolve to incorporate IT security.

Listen to CEO Johan Hammerstrom explain the changes to the guidelines in SAS145 that you will need to know whether you are in nonprofit IT, financial, or leadership roles, or an auditor looking for insights into the IT management side of the new requirements.

Since the new nonprofit auditing requirements SAS145 impact everyone in nonprofits, please contact us if you have more questions we can help with.

_______________________________
Start a conversation :)

• Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/
• email Carolyn at cwoodard@communityit.com
• on LinkedIn

Thanks for listening.

It won’t be a surprise that AI is on everyone’s mind. Matt also shared some thoughts on some year end cybersecurity tips and maintenance to ensure your cybersecurity practices – and permissions – are up to date.

Nonprofit Cybersecurity expert and Community IT CTO Matt Eshleman offered these year-end cybersecurity tips.

• Do a permissions audit at the enterprise level – what are your defaults for sharing, and how are you training your staff to log in to various tools and subscriptions that can access your data?
• At a personal level, what are the safest ways to log on to your accounts? How should you be storing passwords? How are you setting your personal sharing and log in permissions?
• Reviewing these policies and practices – and actually going in to your systems and checking – is a good end-of-year cybersecurity task.
• Consumer Reports has good tools for people who want to reduce their data footprint.

Matt also reported back from the NGOISAC Conference on the trends that the community is seeing. For more information on the NGOISAC cybersecurity community for NGOs and Nonprofits, use this link.

• AI companies are not spending nearly enough on safety as they rush to market their products. That puts it on consumers and organizations to know how to protect themselves.
• AI is increasing the ability of hackers, and in the arms race with protectors, a corresponding use of AI to block phishing and other hacks is playing catch up.
• Nonprofits are going to need to understand our new environment where not just emails will seem realistic but where voice and video fakes will be put in use. Finding old fashioned ways to verify that the person you are interacting with is a person will become more important as AI powers grow.

_______________________________
Start a conversation :)

• Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/
• email Carolyn at cwoodard@communityit.com
• on LinkedIn

Thanks for listening.

If you find yourself with a little downtime, what should you work on?

The Gala is back! If your nonprofit is focused on an end of the year fundraising event, you may find yourself and your IT team with a little extra time on your hands this December as the rest of your staff are pulled away from their desks and are calling the help desk less frequently. Carolyn Woodard reviewed our recent webinars and podcasts for advice on what projects you might want to start now to be ready to hit the ground running in the new year.

Our list of 6 tips for nonprofit IT in December:

1. Do you have an IT Roadmap? This is one of the most important planning documents you can have as a nonprofit IT professional and leader. We have resources on our site to help you get started.

2. Think about policies and governance. This doesn’t mean you have to write them yourself before January. But if you have an hour free, you can go through our checklists of the most important policies to have, and review your existing documents, and be ready to meet with your leadership team in the new year with advice and priorities ready to go.

3. What is your AI policy? We created a policy template specific to nonprofits that you can download and adapt to your own organization’s values and needs. As AI tools and issues come at our organizations faster and faster, make sure you are setting the policy rather than just accepting whatever happens.

4. Map your data. The more AI tools come into use within our organizations, the more important permissions are going to become as those tools interact with our data. Not just with databases, but also with files, AI is going to find whatever it can find. Think about permissions, and training your staff, and how valuable your data is to you and to hackers.

5. A fifth project we recommend is tracking your inventory, subscriptions and licenses. Once you have an inventory system in place – and maybe have discovered you can do a better job of tracking onboarding and off boarding, or where you can be saving money with an enterprise license rather than individual licenses – it gets easier from there.

6. If you still have any time during your down time – we recommend you block off some time to take some tutorials. Did you know that learning a new skill and improving your confidence in new tools can actually lower your stress levels as an IT professional? If you haven’t been making time for learning, and you have a little down time this December, why don’t you see if you can get in the habit?

During the regular hustle and bustle of your IT job you may not feel you have time to get started on any of these important projects, so make time when you have down time to think about what you are missing and where to start. Setting priorities is important too, and being realistic. Maybe one of these projects is plenty! Don’t think you are going to finish any of these projects this December, or that you have to do them entirely on your own. But putting a little prep work in now can help you get them off the ground in the new year, with specific questions for your colleagues and specific goals and strategies.

And won’t that be a great feeling to greet the new year with!

_______________________________
Start a conversation :)

• Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/
• email Carolyn at cwoodard@communityit.com
• on LinkedIn

Thanks for listening.