alt=""/> Generally, a taxpayer, including a tax-exempt entity, will recognize a positive section 481(a) adjustment (such as, an increase to income) ratably over 4 tax years and will recognize a negative section 481(a) adjustment in full in the year of change. See Rev. Proc. 2015-13, or its successor.
Business Activity Codes
The codes listed in this section are a selection from the North American Industry Classification System (NAICS) that should be used in completing Form 990, Part VIII, lines 2 and 11. If you don't see a code for the activity you are trying to categorize, select the appropriate code from the NAICS website at 2017 NAICS Census. Select the most specific six-digit code available that describes the activity producing the income being reported. Note that most codes describe more than one type of activity. Avoid using codes that describe the organization rather than the income-producing activity.
Glossary
The glossary has over 65 pages that include tax, accounting, titles and terms on the tax forms, and an amazing long list of items mentioned in the extensive instructions that themselves total 100 pages.
Before diving into new developments to pages of the sixth edition of Tax Compliance for Tax-Exempt Organizations, I'll share an excellent list of suggestions for protecting your data and computer from cyber terrorists.
The following tips were written by AICPA's Not-for-Profit Section:
9 cybersecurity tips for small not-for-profit organizations
Numerous studies have shown that over 90 percent of corporate breaches start with a phishing email. But don't let that statistic lead you to believe that you can strengthen your controls over email and be safe. Recent reports are indicating that fraudsters are now successfully using voice-generating artificial intelligence software to impersonate executives when perpetrating these crimes.
Unfortunately, far too many nonprofits do not have or know of a policy that identifies how their organization handles cybersecurity risk, equipment usage, and data privacy. Cybersecurity is a real concern that all types of organizations, including all types and sizes of not-for-profits, must address.
This article offers tips and best practices related to both the personal and the technical aspects of cybersecurity that even the smallest nonprofits can employ.
Promote organization-wide awareness
It is increasingly important for organizations and users to understand that the cybersecurity adversaries, also known as “bad actors,” are after people. Bruce Schneier, a seasoned cybersecurity professional, said, “Amateurs hack systems, professionals hack people.” Take spear phishing, for example, where bad actors send emails ostensibly from a trusted sender to get recipients to reveal confidential information.
Every member of an organization is responsible for security. Take the time to educate users on this fact and make security part of your culture:
Provide continual training.
Hold lunch and learns.
Post signs in the break room.
Cover a security topic during team meetings.
There are limitless examples of cyber breaches on the Internet that you can discuss. It takes little effort to talk about security and doing so will save headaches in the long run.
Understand the latest social engineering techniques
Bad actors are getting better and better at using social engineering to get us to provide information or click on links to download malware. Phishing is by far the most common method, followed by email, text, and phone. The days of offering money from a bank in Nigeria are over. Bad actors are getting more sophisticated. They prey on human emotions and personalize messages to make them seem real.
Ask yourself if a request makes sense. If it doesn't, don't act on it. Ask someone's opinion (e.g., your IT service provider). Be especially careful on phones. It is difficult to decipher real-versus-fake on small screens. Links are also harder to verify on mobile devices, because they may not be fully visible without clicking on them.
Amp up your passwords and use multi-factor authentication
Have a unique, complex password for every system you use. If a bad actor cracks one username and password, they are likely to try other systems to see if they can get in with the same credentials and they can do this with amazing ease and speed. If you have trouble remembering multiple passwords, use a password manager to store them in a secure manner. NEVER store them in an Excel or Word file on your computer.
Use multi-factor authentication (MFA) as a second layer of defense whenever it is offered. MFA is when the application you are signing into texts you a code or asks you to log in to an app on your phone to get the most recent code to authenticate. This functionality has saved people from breaches many times, yet only 21 percent of nonprofits have their employees using MFA.
Important note: If you receive a request to enter a code and you aren't trying to log in, do not use it and change your password on that application immediately.
Make sure you install—and update—anti-virus software
At the bare minimum, have anti-virus software installed on every machine within the organization and keep it up to date. While this is not foolproof, updated anti-virus software can help prevent malware from infecting your machine or network if a user clicks on an infected link. Malware changes constantly, so be sure to install anti-virus software updates as soon as the provider releases new virus signatures.
Install a SPAM and virus email filter
If you have a local email server, look into a SPAM and virus filter to prevent infected emails from getting to your users. If you subscribe to a cloud-based email service, see if they offer this as an add-on. This service will actively scan incoming emails and filter out the ones that are suspicious.
Install a firewall
The term “firewall” sounds expensive, but it doesn't have to be:
