• Skip to primary navigation
  • Skip to main content
Dean Dorton – CPAs and Advisors
  • Services
        • Audit & Assurance
          • Audits, Reviews & Compilations
          • ESG Programs & Reporting
          • Internal Audit
          • International Financial Reporting
          • Lease Accounting Managed Services
          • Peer Review Services
          • SOC Reporting
        • Family Office
        • Consulting & Advisory
          • Business Valuation Services
          • Forensic Accounting
          • Fractional CFO
          • Litigation Support
          • Matrimonial Dissolution
          • Merger & Acquisition
          • SEC Services
          • Succession Planning
          • Transaction Advisory Services
          • Whistleblower Hotline
        • Outsourced Accounting
        • Private Wealth
        • Healthcare Consulting
          • Finance
          • Health Systems Operational Transformation
          • Medical Billing and Credentialing
          • Risk Management & Compliance
          • Strategic Growth for Private Practices
          • Strategy and Strategy Implementation
          • Technology & Data Analytics
        • Tax
          • Business Tax
          • Cost Segregation Studies
          • Credits and Incentives
          • Estates and Trusts
          • Individual Tax
          • International Tax
          • SEC Provision and Compliance
          • State and Local Tax
        • Technology & Cybersecurity
          • Accounting Software
          • Cybersecurity
            • Cybersecurity Assessments
            • Cybersecurity Scorecard Assessment
            • Security Awareness Training
            • Virtual Information Security Office
          • Data Analytics & AI
          • IT Audit & Compliance
            • Cybersecurity Maturity Model Certification (CMMC)
            • Data Privacy Laws
            • SOC Reporting
          • IT Infrastructure & Cloud Solutions
            • Automation
            • Backup and Disaster Recovery
            • Cloud Strategy
            • Data Center
            • Enterprise Network
            • Network Security
            • Phone and Video Conferencing
            • User Identity Management Solutions
            • Webex
          • Managed IT Services
  • Industries
        • Construction
        • Distilleries and Craft Breweries
        • Energy and Natural Resources
        • Equine
        • Financial Institutions
        • Government
        • Healthcare
        • Higher Education
        • Life Sciences
        • Manufacturing and Distribution
        • Nonprofit
        • Real Estate
  • Insights
    • Articles
    • Guides
    • Case Studies
  • Events
  • Company
        • News
        • Our Team
        • Experiences
        • Careers
          • College Students
          • Experienced Professionals
        • Locations
        • Lexington, KY

          250 West Main Street
          Suite 1400
          Lexington, KY 40507
          859-255-2341

        • Louisville, KY

          435 North Whittington Parkway
          Suite 400
          Louisville, KY 40222
          502-589-6050

        • Louisville, KY

          700 North Hurstbourne Parkway
          Suite 115
          Louisville, KY 40222
          502-589-6050

        • Ft. Wright, KY

          810 Wright’s Summit Parkway
          Suite 300
          Fort Wright, KY 41011
          859-331-3300

        • Cincinnati, OH

          312 Walnut Street
          Suite 3330
          Cincinnati, OH 45202
          859-331-3300

        • Blue Ash, OH

          9987 Carver Rd
          Suite 120
          Blue Ash, OH 45242
          513-891-5911

        • West Chester, OH

          9025 Centre Pointe Drive
          Suite 310
          West Chester, OH 45069
          513-985-6240

        • Indianapolis, IN

          5975 Castle Crk Pkwy Dr N
          Suite 400
          Indianapolis, IN 46250
          317-469-0169

        • Raleigh, NC

          4130 Parklake Avenue
          Suite 400
          Raleigh, NC 27612
          919-782-9265

  • Contact Us

Construction

Article 03.15.2022 Dean Dorton

In 2016, the Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) 2016-02 changing the way companies account for leases.  In 2020, the FASB issued ASU 2020-05 that delayed the effective date of the new leasing standard.  As a result of this delay, most private companies will be implementing the new leasing standard starting with calendar 2022 year ends.  For many private companies, especially those within the construction industry, the new leasing standard will require significant analysis of operations and transactions to identify the agreements that will be classified as leases under the new standard.  Of particular interest is the impact that the standard has on related party leases.

It has become normal within the construction industry for the buildings, and even the equipment, used by the operating construction company to be held by a separate, related entity in order to mitigate risk and provide for certain tax strategies.  The use of these related real estate and equipment companies will likely result in significant lease transactions between them and the construction company being evaluated under the new leasing standard.  The recognition of lease liabilities and right-of-use assets on the balance sheet of the construction company, as a result of the new leasing standard, could have a significant financial impact, and may impact working capital ratios thereby impacting debt covenants and bonding capacity.

Key areas which need to be considered when performing the evaluation of leases under the new leasing standard include the following:

1. Use of written lease agreements – All lease agreements, including those with related parties, should be formalized with a written agreement between the lessor and lessee.  This will make determinations under the new leasing standard easier to perform.

2. Lease terms – The new leasing standard requires that a related-party lease be classified and accounted for based on its legally enforceable terms and conditions. In other words, the classification and accounting for a lease with a related-party lessor should be the same as what the classification and accounting would have been if that lease were with an unrelated lessor.

There are two critical areas that should be considered when it comes to the length of all leases, but especially a related party lease:

a. Understanding the legally enforceable terms and conditions – A lease will be recognized under the new leasing standard based upon its legally enforceable terms and conditions.  The lessee is required to consider whether there are any implicit legally enforceable terms and conditions in addition to the terms and conditions in the written agreement.

For example, if the construction company leases a facility to perform pre-fabrication work and the lease has a term of one year with no option to renew, but the construction company has incurred significant costs related to leasehold improvements that will retain significant value over their useful life of 20 years, consideration will need to be given to whether there are implicit legally enforceable terms and conditions that would cause the lease term to be evaluated as 20 years instead of one year.

Another example would be if the construction company leases construction equipment on a month-to-month basis from a related party and that equipment is going to be used throughout the period of construction of a project that is expected to take two years to complete, consideration should be given to whether there are implicit legally enforceable terms and conditions that would cause the lease term to be evaluated as two years instead of one month.

b. Impact on capitalized leasehold/tenant improvements – Leasehold/tenant improvements should be depreciated over the shorter of the useful life of the asset or the term of the lease.

For example, using the example in 2(a) above, if the construction company determines that the lease for the pre-fabrication workshop is truly a one year lease, then the leasehold improvements related to the workshop would have a maximum depreciable life of one year (i.e. the lease term of one year is shorter than the useful life of the assets).  The treatment of the lease as a one year lease would likely result in significant depreciation charges/write downs of the leasehold improvements.

This treatment could also flow through to any leasehold or tenant improvements within the lessor entity in any GAAP financial statements they issue. For example, if the lessor entity has capitalized improvements made on behalf of the construction company and those improvements are specific to the construction company and would likely be unwanted/useless to any alternative lessee (for example signage), there could be the need to recognize impairment charges on those improvements to write them off over the one year term of the lease.

3. Lease payments – Companies will need to analyze lease payments within the agreements to determine if they are fixed, in-substance fixed, variable based upon a rate or index or variable based upon other than a rate or index.  This analysis is critical in order to correctly identify the lease payments that are used in classifying the lease and measuring the related lease liability and right-of-use (ROU) asset.

a. Fixed lease payments – Fixed lease payments are included in the calculation of the ROU asset and lease liability.   Payments that vary solely based on the passage of time (e.g. escalating rents) are not considered variable lease payments, and would be included in the calculation of the ROU asset and lease liability.

Example: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are increased by 2% each year.

The amount of the lease payments that should be included in classifying the lease and measuring the related lease liability and ROU asset are $100,000 for year 1, $102,000 (i.e. $100,000 increased by 2%) for year 2 and $104,040 (i.e. $102,000 increased by a further 2%) for year 3.

b. In-substance fixed payments – A lease agreement may describe a payment as a variable payment, but upon closer look it is apparent there is an amount that must be paid (e.g. a minimum amount that cannot be avoided) or there is an amount that will be paid because the variability lacks economic substance. These types of variable lease payments are in-substance fixed payments and are treated as fixed payments when determining lease payments for the calculation of the lease liability and ROU asset.

Example: A lease requires a lessee to pay rent equal to 1% of its sales, subject to a minimum sales figure of $5 million. The in-substance fixed payment is the minimum amount the lessee will be required to pay of $50,000 ($5 million × 1%), which should be included in lease payments on the commencement date to calculate the ROU asset and lease liability. Any potential payments above the minimum amount are based on the lessee’s sales and should be accounted for as variable lease payments based on other than an index or rate (see below). Another way that this payment term could be worded in the lease agreement, but still result in the same outcome, would be if the lessee was required to make a payment of $50,000 or 1% of its sales, whichever is greater. In this situation, there is an in-substance fixed payment of $50,000 that will be required of the lessee.

c. Variable based upon a rate or index – Variable lease payments that depend on an index or rate are initially measured and included in lease payments by reference to the index or rate at the commencement date of the lease. Any additional lease costs arising from subsequent changes to the index or rate are recognized in the period those costs are incurred (i.e. similar to variable lease payments based on other than an index or rate as discussed below). Common examples of indexes and rates on which variable lease payments are based include: the Consumer price index (CPI), the prime or LIBOR interest rate, interest rates on direct Treasury obligations of the U.S. government (with or without a spread) and market rental rates.

Example 1: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are $100,000 adjusted for the cumulative increase in the Consumer Price Index (CPI) since January 1, 20X7. No refunds are provided if the CPI decreases.

There is a fixed lease payment of $100,000 per year paid in arrears. The amount of the variable lease payment that should be included in the lease payments used in classifying the lease and measuring the related lease liability and ROU asset should be determined initially by reference to the CPI at the commencement date, and assuming that it will not change over the term of the lease. Given that the variable lease payment is based on the increase in the CPI after January 1, 20X7, the variable lease payment on that date is zero. As such, the amount of lease payments used in the classification and measurement of the lease on January 1, 20X6 is $300,000 (annual payments of $100,000 over the lease term of three years).

Example 2: Lessee is a private company with a calendar year end. Lessee enters into a lease with Lessor on January 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. Lessee must pay Lessor $100,000 on January 1, 20X7. The lease payments on January 1, 20X8 and 20X9 are $100,000 increased each year by the 1-month LIBOR rate. At the commencement date of the lease the 1-month LIBOR rate is 2%.

The amount of the variable lease payment that should be included in the lease payments used in classifying the lease and measuring the related lease liability and ROU asset should be determined by reference to the 1-month LIBOR rate at the commencement date of the lease (and again assuming it will not change over the term of the lease). As the rate on January 1, 20X6 was 2%, then the lease payment for year 1 would be $100,000, for year 2 would be estimated as $102,000 (i.e. $100,000 increased by 2%) and for year 3 would be estimated as $104,040 (i.e. $102,000 increased by a further 2%) for the classification and measurement of the lease on January 1, 20X6. Any difference in the lease costs arising from differences between the actual LIBOR rate and 2% (the LIBOR rate at lease commencement) in years 2 and 3 are recognized in the period those costs are incurred (i.e. similar to variable lease payments based on other than an index or rate as discussed below).

d. Variable based upon other than a rate or index – Variable lease payments that vary after the commencement date for reasons other than an index or rate are not included in the lease payments used for classification or measurement purposes. When the only payments in a lease are variable based on other than an index or rate, there are no lease payments on which to base the recognition and measurement of a lease liability and ROU asset.  Therefore, there would be no recognition of a lease liability or ROU asset.

Example: Lessee is a private company with a calendar year end and has no interim financial reporting requirements. Lessee enters into a lease for the exclusive right to use a specifically identified production printer. Lessor does not have substantive substitution rights related to the production printer. The lease is entered into on July 1, 20X6, which is also the lease’s commencement date. The noncancellable term of the lease is three years. There are no purchase, renewal or termination options. On a monthly basis, Lessee must pay Lessor $0.10 per page printed by the production printer in the previous month. For example, in August 20X6, Lessee pays Lessor $0.10 per page printed by the production printer in July 20X6.

The only payments required under the lease are variable lease payments based on other than an index or rate. As a result, there are no lease payments that give rise to recognition of a lease liability or ROU asset. The variable lease payments are included in lease costs as the printer is used. For example, if Lessee used the production printer to print 2,720 pages in July 20X6, it should recognize lease expense of $272 for that month. This same example would apply for construction equipment being leased based upon an hourly usage rate.

Much like the previous changes to revenue recognition, the new leasing standard can be a complex accounting standard to navigate.

Learn about Construction Services

Simon Keemer, CPA, CGMA, ACA
Assurance Director
skeemer@deandorton.com • 502.566.1036

Filed Under: Audit and Assurance, Construction, Industries, Services Tagged With: asu, Construction, FASB, Lease accounting, leases, standard

Article 10.26.2021 Dean Dorton

Recent and highly visible ransomware attacks such as the one on Colonial Pipeline should serve as a wakeup call for organizations that do not see themselves as “typical” targets of cyber-attacks.

The size and industry of the organization often does not matter for cyber criminals who are always looking for opportunities.

According to the 2020 Verizon Data Breach Investigations Report (*), 67% of all breaches come from three attack types: credential theft, errors, and social attacks. The average cost for a data breach is $2.64 million for organizations under 500 employees. Phishing and ransomware remain two of the top Cyber risks for most industries, including the Construction industry.

The first thing that organizations can do is to perform a Security Assessment to ensure that they understand where their vulnerabilities are and to assess their resilience against cyber attacks.

Key controls to consider are:

  • Multifactor authentication (MFA) – for all remote access to systems and information (including emails) to mitigate credential theft attacks.
  • Strong password policy – making sure weak passwords cannot be used and that users cannot reuse passwords.
  • Endpoint security – many cyber attacks start with a user clicking on a bad link from their devices. Having a strong endpoint detection and response software on all endpoints is critical.
  • Vulnerability management – the “cyclical (never-ending) practice of identifying, classifying, prioritizing, remediating, and mitigating” software vulnerabilities.
  • Logging monitoring – this detective control can allow organizations to quickly react to suspicious activities and can provide information after an attack to determine what was accessed by the threat actors.
  • Security Awareness – employees and business partners need to understand how to identify and report potential security issues. Security Awareness is especially important if you are working with a workforce that might not be totally comfortable with computers.
  • Resilient backup – employ a “3-2-1 strategy” which means having at least three total copies of your data, two of which are local but on different mediums (or devices), and at least one copy off-site.
  • Incident Response and Business Continuity Plans – contain specific information and playbooks on how to react when an incident occurs and how to quickly resume operations.

Having cyber insurance coverage is critical, but this is becoming more complex: organizations have to be careful to make sure that they have the appropriate coverage for common attacks scenarios. We often see sublimit in coverages specific to ransomware and even no at all coverage for email frauds. Insurance companies are also asking for more assurance that security controls to be in place during the underwriting process.

Many organizations have transitioned to a hybrid remote work since the pandemic started and the security controls need to be reviewed and tested for this new environment.

Of course, these measures should apply to contractors and subcontractors working with organizations. If their companies do not have the level of sophistication needed to mitigate these risks, they put their customers and partners at risk.

Construction organizations must improve their security posture and implement measures to mitigate cyber risks.

Gui Cozzi | Cybersecurity Practice Lead
gcozzi@ddaftech.com
859.425.7649

Filed Under: Construction, Cybersecurity, Industries, Services, Technology Tagged With: attacks, Construction, Cyber, Cybersecurity, data breach, industry

Article 10.13.2021 Dean Dorton

Construction projects are complex. The groups of stakeholders and specialty skills involved in a project from start to finish can be overwhelming. Trying to keep supporting information and processes organized, secured, and accessible by the right players during the lifecycle of a construction project is critical to reaching success.

Content, processes, and analytics work together to support success. 

Content
The information needed to start, deliver, and complete a construction project varies depending on the type of work. A common theme across all types of projects is a need to provide the correct information to the correct team, in an efficient manner. This is especially true with construction projects. Contractors need access to the bid requirements, engineers and architects need details of the property layout, a project manager needs to know what tasks are scheduled for the day, finance needs to know which payments are due next week, and the list keeps going. Delays in finding or having access to this type of information will cause frustration and increase costs. A plan for organizing information and ensuring the correct stakeholders have access is important for ongoing success. 

Process
Physical construction processes executed correctly are paramount to the success of a project. A poorly installed building foundation can have catastrophic implications; an improperly sloped drainage zone can lead to damage and possible liability; poor materials can lead to shortened lifespan of constructed features. The same is true of the business processes: slow or erroneous business processes cause issues and can delay progress or increase costs. Processes that involve duplicate data entry, printing of materials, or tabulation/collation of data may all be areas prone to error and delays.  

Business processes can be large or small. For example, the management of the lien waiver process with contractors is a simple, yet cumbersome process. If done incorrectly, it can leave a property at risk. An additional example is the sign-off on building plans, floor plans, and estimates. Delays on these approvals can slow the project progress until agreement is reached. 

Analytics 
Business processes and various tools generate a lot of data. Taking this data and molding it into something useful is the job of analytics. Good analytics will help you answer the questions that are most important to your construction project. Analytics sourced from a single data source, a construction project management tool for example, can be manageable. However, when that data needs to be combined with the financial accounting for the project to determine current and forecasted profitability of the project, it can become more complicated.

Good analytics allows for decisions to be made with facts instead of perception. 

Depending on an organization’s size and maturity, analytics may be used in any of these 4 areas: 

  • Descriptive (simple) – this is a view into what has happened or is currently happening (how many labor hours have been used this week?) 
  • Diagnostic (moderate) – providing insights into why a particular thing is happening (why is my flooring expense exceeding estimates)? 
  • Predictive (complex) – what is likely to happen in the future (based on the current burn rate, when will my labor budget be exceeded?)  
  • Prescriptive (more complex) – what should be done to reach an outcome (how can I deliver in a shorter timeframe?) 

Dean Dorton’s Collaboration and Data Analytics practices can build a strategy and roadmap to help your organization get the most out of its processes and data. If you would like to meet for a free initial consultation, please contact us here: Lets Connect

Filed Under: Construction, Data Analytics & AI, Industries Tagged With: Analytics, collaboration, Construction, Data

Article 10.7.2019 Dean Dorton

For small businesses, the result of a cyber incident can be disastrous. While larger organizations and enterprises may be able to absorb the monetary costs and reputational damage that is caused by a cyber incident, most smaller businesses are unable.

“The National Cyber Security Alliance has recently released statistics that show 20% of small businesses experience such an attack every year, and that 60% of these businesses were forced to close within six months of being hacked.”1

Cybersecurity risks are constantly evolving as organizations adopt new technology (such as cloud services) and cyber criminals adopt new tactics, techniques, and procedures (TTPs). The construction industry doesn’t have the same regulatory and compliance requirements pertaining to cybersecurity that other industries—such as the financial and healthcare sectors—have, yet they face the same threats. For this reason, it is imperative for the construction industry to focus on cybersecurity risks to avoid becoming the next victim of cybercrime.

How a Cybersecurity Attack Can Impact Construction Companies

Today, construction companies transmit and store the kinds of sensitive data that cyber criminals target most. Employee and project information, contracts, financial data, and planning tools are all at risk — yet the industry remains behind the curve in bolstering cyber security measures compared to other industries. 

What’s more, the move to an increasingly remote workforce with more devices in play has exposed gaps in networks that cyber criminals are all too happy to exploit. And as the industry continues to embrace the Internet of Things (IoT) and leverage artificial intelligence technologies, their potential attack surface also continues to expand.

Cyber criminals most often seek financial gain from an attack via ransomware. But there are additional, deeper impacts of a cyber attack as well:

  • Down time: Deadlines aren’t made to be broken. An interruption in business due to a technology disruption can cost a company days or even weeks it can’t afford in reduced or even lost productivity.
  • Breach of project IP: Loss of privileged contracts, proprietary designs, schematics, and confidential blueprints can not only lead to huge financial losses. It could also result in irreparable damage to reputation.
  • Loss of bid information: Forfeiting leverage in the upfront process can result in losing competitive advantage, as well as the job itself.
  • Equipment damage: It’s a concern for equipment off and on site. Servers, devices, and key computing hardware are costly to repair or replace. And compromised on-site equipment can lead to significant physical damage to nearby structures and the equipment itself.
  • Workforce injuries: Protecting the most valuable asset is paramount. A security breach or system failure that allows autonomous equipment to be compromised puts the safety of workers — and civilians — at significant risk.  

There are many ways that cybercriminals (also known as threat actors) can compromise confidential information in an organization. Below, we’ll address three of the most common vectors for a successful cyber attack.

Common Cybersecurity Threats for Construction Companies:

Spear Phishing

One of the most common techniques, “spear phishing is an email targeted at a specific individual or department within an organization that appears to be from a trusted source. It’s actually cybercriminals attempting to steal confidential information. A whopping 91% of cyberattacks and the resulting data breach begin with a spear phishing email, according to research from security software firm Trend Micro. This conclusively shows that users really are the weak link in IT security.”2

Often, threat actors will employ the use of malicious file attachments when conducting these types of attacks. “There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary’s payload exploits a vulnerability or directly executes on the user’s system. The text of the spear phishing email usually tries to give a plausible reason to open the file, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.”3

Password Spraying

This technique “uses one password (e.g. Password01), or a small list of passwords, that matches the complexity policy of the domain and may be a commonly used password. Logins are attempted with that password and many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.” For instance, from September 2018 through February 2019, Proofpoint conducted a six-month study that analyzed over 100,000 unauthorized logins across millions of monitored cloud user-accounts.”4

“The company found that 60% of Microsoft Office 365 and G Suite tenants were targeted with IMAP-based password-spraying attacks, while 25 percent were successfully breached in this manner. Proofpoint noted that the number of IMAP-based password-spraying attacks jumped up following the December 2018 publishing of the Collection #1 data dump that exposed nearly 773 million unique emails and 21 million unique passwords.”5

Exploiting Vulnerabilities in Unpatched Software

“Earlier this year, the National Security Agency urged organizations to ensure that they are using patched and updated systems in the face of growing threats. The vulnerability is present in Windows 7, Windows XP, Server 2003 and 2008, and although Microsoft has issued a patch, potentially millions of machines are still vulnerable.”6

How Construction Companies Can Mitigate Cybersecurity Risks

Dean Dorton recommends that organizations consider the following to identify their risks and enhance their cybersecurity preparedness:

  • Identify where your valuable information is stored (on your internal network and the cloud)
  • Develop policies, procedures, and standards pertaining to cybersecurity
  • Adopt a cybersecurity control framework
  • Develop a cybersecurity incident response plan
  • Secure your backups; also, test your backups to ensure they work correctly upon use
  • Disable legacy authentication protocols (such as IMAP)
  • Enforce two-factor authentication (2FA), also referred to as multi-factor authentication (MFA)
  • Update and patch your computers. Vulnerable operating systems and third-party applications are often targeted by threat actors. You should ensure that your operating systems and third-party applications are updated with the latest updates.
  • Train your organization. “Organizations should ensure that they provide cybersecurity awareness training to their personnel. Ideally, organizations will have regular, mandatory cybersecurity awareness training sessions to ensure their personnel are informed about current cybersecurity threats and threat actor techniques. To improve workforce awareness, organizations can test their personnel with phishing assessments that simulate real-world phishing emails.”7
  • Perform regular cybersecurity assessment and penetration tests against the network—no less than once a year. Ideally, run these as often as possible and practical. Dean Dorton can perform these tests for you.

Dean Dorton’s Information Security Office (ISO) provides a team of experienced information security professionals who can augment your organization’s information security team or take the lead in designing, implementing, and maintaining a strong information security program on your behalf.

1https://www.csoonline.com/article/3437777/how-a-small-business-should-respond-to-a-hack.html
2https://www.knowbe4.com/spear-phishing/
3https://attack.mitre.org/techniques/T1193/
4https://attack.mitre.org/techniques/T1110/
5https://www.scmagazine.com/home/security-news/password-spraying-attacks-abuse-imap-to-break-into-targets-cloud-accounts/
6 https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
7 https://www.us-cert.gov/ncas/tips/ST19-001

Filed Under: Construction, Cybersecurity, Industries, Services, Technology Tagged With: Construction, cyber attack, Cybersecurity, phishing, Technology

Article 01.5.2017 Dean Dorton

The use of prospective financial statements continues to grow as companies require their use to obtain financing and raise capital. Now more than ever, sophisticated investors and bankers want to know what “will” rather than what “did” happen.

Due to the need for more “forward-looking” information, the American Institute of Certified Public Accountants Codification of Statements on Standards for Attestation Engagements officially codified Financial Forecasts and Projections in January 1989, giving accountants standards to follow when preparing forecasts and projection reports.

Why does the matter to me? For any businesses, prospective financial statements may be needed for a number of reasons including:

  1. Obtain bank financing
  2. Private or public placement
  3. Internal management decisions

Dean Dorton performs forecasts and projections for many scenarios including closely-held businesses’ internal use only and third-party use examination engagements for boards and banks.

In recent years, Dean Dorton has provided forecasts and projections related to the United States Department of Agriculture’s (USDA) Rural Development programing. Most of the USDA related projects require an examination report from an independent accountant on the project’s feasibility. As per the USDA’s Fiscal Year 2015 Rural Development Progress Report, the USDA invested $29.75 billion in nearly 171,000 projects across the nation. Many of those projects have been in Kentucky and Southern Indiana.

Some of our other recent forecasts and projection projects:

  • A new hospital patient tower
  • New hospital construction to move to all single-occupancy rooms
  • New building construction or expansion for college and universities
  • Improved debt service requirements with debt restructurings and refinancing

To learn more, contact your Dean Dorton advisor or David Richard at drichard@deandorton.com.

Filed Under: Accounting & Tax, Healthcare, Higher Education, Industries Tagged With: Agriculture, AICPA, Building, Construction, David, Fiscal, Forecast, Hospital, Projection, Richard, USDA

Article 12.17.2015 Dean Dorton

Construction and capital improvement projects can be complex financial expenditures for an organization, and present significant risks to the organization’s goals and objectives. Generally, organizations do not have construction cost experts on staff when they embark upon a major construction project. Frequently, this gap in internal knowledge is “patched” through the use of a construction management firm.

However, while a construction management firm can help with the logistics of a construction project, such as coordination of bidding, ensuring that construction is performed timely and safely, and that the specifications of the project are adhered to, a construction management firm rarely provides significant help in ensuring that the financials of the construction project are appropriate.

The risk undertaken by the owner organization during a construction project is heavily influenced by the type of contract that is used for the project. There are generally three types of contract used:

  1. Fixed price contract – Fixed price, or lump sum, contracts are most frequently used, especially on large projects. A fixed price contract transfers most, but not all, of the financial risk to the construction company. The owner of the project retains some financial risk through the change order process. As the number and value of change orders increases, so the risk that the original contract price was underbid increases, and may indicate that the construction company is attempting to pass the financial risk back to the owner. Management of change orders is essential in managing the project, and frequently the owner’s staff are not knowledgeable enough to provide effective financial oversight. Additionally, with a fixed price contract any cost savings accrue solely to the construction company.
  2. Guaranteed maximum price contract – A GMP contract is in essence a time and materials contract with a maximum price that will not be exceeded (unless it is increased through change orders). A GMP contract results in a sharing of financial risk between the construction company and the owner. Additionally, any cost savings identified during the project will generally accrue to both the construction company and the owner.
  3. Time and materials contract – Under a time and materials (or T&M) contract, the financial risk is almost entirely retained by the owner of the project. The construction company may retain some financial risk through warranties or similar contract provisions.

With a GMP or T&M contract, it is essential for the owner to ensure that costs being applied to the contract are appropriate and reasonable. An owner does not want to pay billings for costs unrelated to their project. Some costs can be easy to monitor, such as materials and labor allocated to the job, as the owner can monitor the materials delivered to the site and the construction personnel physically working on the project. However, many owners fail to perform any procedures to ensure that the amounts billed match the amounts delivered to the jobsite or the personnel that were observed working on the project. Additionally, there are other more ambiguous costs, such as insurance charges, maximums placed on rental charges, overhead and home office allocations, et cetera, that are frequently applied to contracts that an owner has little ability to fact check or verify.

It is essential for the organization to have construction financial experts available to perform procedures on billings received from construction companies to ensure that billings include only those costs allowed under the contract and that relate to the project.

If you are considering undertaking a construction or capital improvement project, or are currently going through a construction or capital improvement project, Dean Dorton professionals can work with you to enhance your existing controls and provide added value to your organization. Our comprehensive, customizable range of services can help you protect your financial interest in construction and capital improvement projects.

Contact Simon Keemer, Adam Shewmaker, or your Dean Dorton advisor for more information on how we can help you.

Simon Keemer
502-566-1036
skeemer@deandorton.com

View Simon Keemer’s Bio

Adam Shewmaker
502-566-1054
ashewmaker@deandorton.com

View Adam Shewmaker’s Bio

Filed Under: Construction, Healthcare, Industries Tagged With: adam shewmaker, Construction, Contract, GMP, Material, Project, Simon Keemer, T&M

  • « Go to Previous Page
  • Page 1
  • Page 2
  • Page 3
  • Go to Next Page »
  • Services
    • Outsourced Accounting
    • Audit & Assurance
    • Tax
    • Consulting & Advisory
    • Technology & Cybersecurity
    • Family Office
    • Wealth Management
  • Industries
  • Company
  • Locations
  • Careers
  • Insights
  • Events
  • Contact Us
facebook Dean Dorton - CPAs And Advisors On Facebook twitter twitter linkedin Dean Dorton - CPAs And Advisors On LinkedIn youtube Dean Dorton - CPAs And Advisors On YouTube

The matters discussed on this website provide general information only. The information is neither tax nor legal advice. You should consult with a qualified professional advisor about your specific situation before undertaking any action.

© 2026 Dean Dorton Allen Ford, PLLC. All Rights Reserved