While Federal and New York state cybersecurity efforts have made huge strides over the past several years, a report issued by the New York State Comptroller last October indicated cyberattacks are continuing at alarming rates, with attacks on critical infrastructure in New York almost doubling in the first half of 2023.

There are numerous reasons why New York businesses, infrastructure, individuals, and government operations are so attractive to cyber criminals who are constantly evolving their tactics and prompting an all-hands-on-board mentality at the Federal and state levels. Here are highlights of strategies, resources, and initiatives to strengthen and leverage cybersecurity across the country and New York.

• New York’s Joint Security Operations Center opened in February of 2022 to provide a statewide view of threats and better coordinate threat intelligence and incident response. A few months later, New York named the state’s first Chief Cyber Officer – Colin Ahern — to oversee cyber threat assessment, mitigation, and response efforts.
• The White House released the country’s first National Cybersecurity Strategy in March of 2023.
• New York Governor Hochul released the New York State Cybersecurity Strategy in August of 2023.
• In October 2023, the Office of the New York State Comptroller issued a Cyber Profile Report focusing on NY local government and school cybersecurity, challenges, and resources.
• Earlier this year, Governor Hochul announced almost $6 million from the federal State and Local Cybersecurity Grant Program (SLCGP) will be used to support local governments by expanding access to cybersecurity information, tools, resources, and services. To help the local government build a baseline of security, the state will be offering shared services initiatives for multi-factor authentication (MFA); scholarships for cybersecurity certification; and employee cybersecurity awareness training. Eligible entities were invited to submit an interest form earlier this year and a Cybersecurity Grant Plan application is expected to be forthcoming.
• Last week, 68 of the worlds’ leading manufacturers of software committed to CISA’s Secure by Design Pledge to promote greater security built into products.
• On May 8, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States, providing an update and identifying five trends driving change: risks to critical infrastructure; the continuing ransomware threat; supply chain exploitation; a growing market for commercial spyware; and the evolution of artificial intelligence.

If you’re looking to bolster your municipality’s cyber awareness and defenses, the Cybersecurity & Infrastructure Security Agency (CISA), “offers a range of cyber and physical services to support the security and resilience of critical infrastructure owners and operators and state, local, tribal, and territorial partners.” You may also want to visit the NYS Office of Information Technology Services Local Government Cybersecurity webpage, which provides access to online training, information resources, cybersecurity awareness, and cybersecurity toolkits for local government.

If you need to free up time to focus on cybersecurity, RBT CPAs are available to support your accounting, audit, advisory, and tax needs. Let us know what you need so we can show you how we can be Remarkably Better Together.

RBT CPAs is proud to say 100% of its work is prepared in America. Our company does not offshore work, so you always know who is handling your confidential financial data.

In the blink of an eye, key State and Local Fiscal Recovery Fund (SLFRF) deadlines are approaching. SLFRF recipients have until December 2024 to obligate SLFRF allocations and until December 2026 (September 30, 2026 for Surface Transportation and Title 1 projects) to spend them. In the meantime, the annual reporting deadline of April 30 is approaching. With an Obligation Interim Final Rule; updated FAQs;  Compliance and Reporting Guidance; and a Project and Expenditure Report User Guide introduced in recent months, following is a quick review of some important highlights.

In November of 2023, the Treasury Department issued the “Obligation Interim Final Rule,” providing  clarifications and flexibilities related to the Treasury’s 2022 Final Rule. The Final Rule defined obligation as an “order placed for property and services and entry into contracts, subawards and similar transactions that require payment.” While the original definition stands, the U.S. Department of Treasury’s Obligation Interim Final Rule Webinar provided this summary of the Obligation IFR clarifications:

• Revision to the definition of “obligation” at 31 CFR 35.3
  – The definition if obligation is unchanged but a recipient is also considered to have incurred an obligation by December 31, 2024, when the recipient incurs costs related to the legal and administrative requirements of SLFRF award funds.
  – Recipient appropriation, budget or allocation processes do not provide a standard that could be applied consistently to the definition of obligation.
  – Recipients can continue charging indirect cost rates to the SLFRF throughout the period of performance.
• Application of the obligation deadline (December 31, 2024) to subrecipients. Subrecipients aren’t subject to the obligation deadline; it only applies to SLFRF recipients.
• Amending or replacing contracts and subawards after the obligation deadline. Generally, recipients cannot re-obligate funds or obligate additional funds after the obligation deadline. As noted on the Federal Register: “After December 31, a contract or subrecipient can only be replaced if it defaults; goes out of business or can’t carry out award terms; the SLFRF recipient and subrecipient agree to terminate the contract; or the if the initial reward was improperly made.”

(The webinar provides a lot of details and includes case studies. If you haven’t watched it, now may be a good time.)

While the big focus is on the December 31 obligation deadline, there’s an earlier one to keep in mind. If a recipient plans on using funds beyond December 31, 2024 for reporting and compliance; single audit costs; record retention and internal control requirements; property standards; environmental compliance requirements; or civil rights and nondiscrimination requirements, it must submit a report to the Treasury by April 30, 2024.

As noted on the Federal Register: “To take advantage of this additional flexibility, recipients must (1) determine the amount of SLFRF funds the recipient estimates it will use to cover such expenditures, (2) document a reasonable justification for this estimate, (3) report that amount to Treasury by April 30, 2024, with an explanation of how the amount was determined, and (4) report at award closeout the final amount expended for these costs.”

RBT CPAs’ Audit professionals can provide estimates for audits and internal control requirements to help you meet the April 30^th reporting requirement.

Remember, funds not obligated by December 31, 2024 and any estimated amount not expended by December 31, 2026 must be returned to Treasury. No doubt, there’s more information to come.

In the meantime, if you’re looking for SLFRF information, refer to the U.S. Department of Treasury SLFRF website. For compliance and reporting information, visit the US Department of Treasury Compliance and Reporting Responsibilities webpage. Information specific to NEUs can be found here. Finally, the NYS Open Budget Website provides an overview of the SLFRF in New York.

Also, if you need estimates for the single audit and reporting control requirement expenses for the April 30 report, email smannese@rbtcpas.com for more information.

RBT CPAs is also available to meet all of your accounting, tax, audit, or advisory needs. We’ve been proudly serving municipalities, businesses, non-profits, and individuals in the Hudson Valley for over 50 years. Please don’t hesitate to give us a call and find out how we can be Remarkably Better Together.

RBT CPAs is proud to say 100% of its work is prepared in America. Our company does not offshore work, so you always know who is handling your confidential financial data.

Note: RBT CPAs is not a law firm. For legal advice, contact your legal counsel.

When the 2024-2025 budget season gets underway, be sure to account for increases in New York State and Local Retirement System (NYSLRS) employer contribution rates.

The NYSLRS is made up of the Employees’ Retirement System (ERS) and the Police and Fire Retirement System (PFRS). The two systems pay retirement and disability benefits for state and local public employees, as well as death benefits to survivors. With a funding ratio of 90.3%, the NYSLRS is ranked among the best funded retirement systems.

On August 31, NYS Comptroller Thomas P DiNapoli announced increases to employer contribution rates for the 2024-2025 State Fiscal Year. For the ERS, average employer contribution rates will increase from 13.1% to 15.2% of payroll, adding about $350 million to 2024 pension costs. For the PFRS, average employer contribution rates will increase from 27.8% to 31.2%, its highest level since 1981.

The increases are attributable to investment performance, higher salaries, and inflation. The impact by employer varies, depending on the types of retirement benefit plans adopted, salaries paid, and distribution of employees among six membership tiers.

According to the Empire Center for Public Policy, Inc., an independent, non-partisan, non-profit think tank based in Albany, New York, “The combined ERS and PFRS rate increases will cost the state government about $500 million, most of which is already covered by pension estimates in Governor Hochul’s Enacted Budget Financial Plan.”

For additional information and insights into defined benefit funding and budgeting:

• The GFOA offers advice in its Sustainable Funding Practices for Defined Benefit Pensions.
• The RAND Corporation offers a roadmap in its Steps for Effectively Addressing State and Local Pension Crisis.

Simultaneously, accounting for expected 6.5% increases in average health care premiums increases for active and retiree populations will no doubt add to budget challenges. See Governing.com’s discussion about it here.

If this leaves you thinking: “There has to be a better way,” check out the GFOA’s Rethinking Initiatives, especially when it comes to Rethinking Budgeting.

Finally, if all of this is just too much, we want to make sure you know RBT CPAs is available to advise on budgeting, while also handing your municipality’s accounting, audit, and tax needs. To learn more, give us a call today.

RBT CPAs do not outsource work to any other country. All of our work is prepared in the U.S.A.

Well, I don’t think we have to take up time convincing anyone that cybercrime is increasing and municipalities are attractive targets (after healthcare and education, local government is the most frequent target for cybercriminals, according to KnowBe4.com). What is mind-boggling is that the threats have morphed from being attributable to a lone computer genius in a back room somewhere into international gangs with names like Clop, Cuba, Royal, REvil, Evil Corp, and DarkSide. I mean, when all of this started, who would have thought that someone in a U.S. town or school office could be targeted by a Russian gang in cyberspace?! Well, they can.

All of this has spurred a more coordinated and collaborative approach to addressing cybersecurity at the federal, state, and local government levels, alongside private enterprise. At the end of last year, the 2023 omnibus spending agreement included $2.9 billion for the Cybersecurity and Infrastructure Security Agency (CISA), as well as $1.6 billion for the National Institute of Standards and Technology (NIST). What’s more, the federal Joint Ransomware Task Force (JRTF) was formed to combat the growing and ongoing threat of ransomware attacks.

We entered 2023 with $35.2 million in new funding to support New York’s statewide cybersecurity and use of shared services to identify potential security gaps (that’s in addition to the $61.9 million allocated for cybersecurity in the 2023 state budget). The State Division of Homeland Security and Emergency Services began creating a first-of-a-kind specialized industrial control system (ICS) assessment team to boost the security and resilience of critical infrastructure and manufacturing systems against cyberattacks.

With small businesses and municipalities at a disadvantage when it comes to standing up to cyber criminals, in March, the White House introduced the National Cybersecurity Strategy with an emphasis on the importance of industry and government cooperation. It notes:

“Malicious cyber activity has evolved from nuisance defacement to espionage and intellectual property theft, to damaging attacks against critical infrastructure, to ransomware attacks and cyber-enabled influence campaigns designed to undermine public trust in the foundation of our democracy.

Once available only to a small number of well-resourced countries, offensive hacking tools, and services, including foreign commercial spyware, are now widely accessible. These tools and services empower countries that previously lacked the ability to harm U.S. interests in cyberspace and enable a growing threat from organized criminal syndicates…Together, industry and government must drive effective and equitable collaboration to correct market failures, minimize the harms from cyber incidents to society’s most vulnerable, and defend our shared digital ecosystem.”

I’d say perhaps the author was watching a little too much Star Wars or Star Trek when that was written but, unfortunately, the situation really is that dire. Just consider what happened in Dallas, Oregon, and Oakland earlier this year.

IBM Security’s 2023 Cost of a Data Breach Report analyzed 552 data breaches across 17 industries and 16 countries and found phishing remains the top form of cybercrime, occurring 16% of the time. Compromised credentials came in a close second at 15% and cloud misconfiguration led to 11% of breaches. Data stored in public, private, or hybrid cloud environments were connected to 82% of breaches. Each public sector breach costs an average of $2.6 million. (Teale, Chris. “Public Sector Slow to Respond to Cyberattacks, Report Finds.” July 25, 2023. Route-fifty.com.)

According to Route-fifty.com, “IBM found that 19% of public sector agencies make ‘extensive use’ of security driven by artificial intelligence and automation, which can reduce staff workload, increase efficiency and save money. The company found that the approaches could save organizations in the public or private sectors around $1.7 million in data breach costs and 108 days in time identifying and containing a breach.’

“In addition to investing in automated security tools, IBM urged organizations across all sectors to build security into every stage of software development and deployment, modernize their data protection practices across the hybrid cloud, and understand their attack surface so they can be better prepared.”

All of this feels like we’re moving in the right direction. Still, just last week, Smartcitiesdive.com shared a warning from NY state officials that cyber threats to critical infrastructure are growing. So, this story will definitely be continued. In the meantime, an abundance of resources is available to support and guide New York municipalities’ cybersecurity efforts:

• Stop Ransomware Guide discusses how to prevent, protect, and respond to a ransomware attack.
• Cybersecurity Best Practices for Smart Cities highlights proactive opportunities to mitigate potential threats.
• Other CISA resources: 2023-2025 Strategic Plan, Shields Up Guidance For Organizations, and list of free tools and services.
• New York Joint Security Operations Center and Endpoint Detection and Response (EDR) Shared Services.
• New York Office of Information Technology Services Breach Notification and Incident Reporting.

While you focus your resources and time on cybersecurity, you can trust RBT CPAs to handle your accounting, audit, tax, and advisory service needs. To learn more, give us a call today.

RBT CPAs does not outsource work to any other country. All of our work is prepared in the U.S.A. 

New York has a 2024 Fiscal Year Budget! It comes to $229 billion, a $7 billion increase over last year. After scouring numerous articles to learn more, the main things I walked away with are that there will be a minimum wage increase; no new personal income taxes; no gas hookups in future construction; judges will have a little more flexibility; a handful of inactive charter schools will be reactivated; more people will be eligible for childcare support; the cigarette tax will go up $1; and there are some changes to the MTA. However, it felt like for $229 billion something was missing, so I decided to take a closer look.

I started with New York’s five-year financial plan.  The Executive Summary reviews the state’s economic strength pre-COVID, briefly mentions the pause that occurred on many levels during COVID, and then notes that “States finances, however, have fared better than expected.”

From FY 2020 to FY 2021 – the acute phase of COVID, tax collections declined .6%. By the following FY (2022), tax collections grew by 27% (“equal to about seven years of typical tax receipts growth compressed into a single year”). This year, tax collections are expected to increase by almost $115 billion or almost 10%. There will be a General Fund surplus of $8.7 billion.

The summary notes, “The surplus is used to strengthen the State’s capacity to weather the economic downturn on the horizon.” Some of that money is going into reserves for the future. Some of it is prepaying Retirement Health Trust Fund benefits. Some is for debt recapitalization. The balance is for “prepaying expenses and managing budget gaps.”

So, we will end the FY with a cushion of about $19.5 billion and will have prepaid over $10 billion in future debt service costs from 2024 to 2027. Tax receipts are still coming in strong, but there’s an expected “mild national recession” in 2023.

Financial challenges are expected in 2024 to 2027. Wage growth is expected to slow, decreasing from 3.3% and 4.3% in the May 2022 forecast to 2.8% in FY 2023 and 2.3% in FY 2024. Bonus income will take a big hit, declining 27% in FY 2024 from FY 2022. General Fund tax receipts before the actions in the recently approved budget are reduced by $2.1 billion in FY 2024; $7.4 billion in FY 2025; $7.8 billion in 2026 and $5.2 billion in 2027. Still, it sounds like we’ll be in a good position to “weather the storm.”

Moving onto the Financial Plan Overview, it says the budget addresses three of the most pressing issues facing the state at the start of 2023. Can you guess what they are? Basing my guesses on the Governor’s playbook and media coverage of the budget, I was way off base. The three most pressing issues: the Metropolitan Transportation Authority’s solvency; the State’s health care system; and caring for asylum seekers coming to the State. I’m pretty sure I would’ve noticed those if they had been part of any of the media stories I scoured.

The overview goes on to state there’s a “comprehensive financial plan to put the MTA on stable financial footing”; “substantial new capital and operating aid for healthcare” and a commission looking at how to improve quality while reducing costs; and “extraordinary funding to local governments that are providing services and assisting with the resettlement process for asylum seekers.” There’s also funding for State of the State priorities like mental health, housing, public safety, and SUNY. The overview ends talking about significant projected budget gaps for 2025, 2026 and 2027 due to reduced tax receipts and without using any reserves.

I’m still stuck on what some could perceive to be mixed messages. So, I went to the Executive Budget Highlights and decided to do some math. Based on investments from largest to smallest, here’s where the spending priorities appear to be:

1. Students and schools: $34.5 billion
2. Public transportation: $450 million plus $17.7 billion (Note: These numbers do not include $400 million in operating efficiencies expected from the MTA; generate an additional $800 million by increasing the top rate of the Payroll Mobility Tax; and increase NYC’s share of funding to $500 million; share in licensing fees and annual revenue from three possible casinos)
3. Childcare: $7.6 billion over four years plus $418.8 million in targeted investments
4. Climate crisis: $5.5 billion plus 2022 Environmental Bond Act spending of $1.5 billion
5. Healthcare: $2.34 billion
6. Assistance to asylum seekers: $1.1 billion
7. Mental health care: $1 billion multi-year plan
8. Gun violence & public safety: $787.9 million
9. Economy: $610 million
10. Housing: $378.8 million

Then I turned to the 2024 Budget Executive Briefing. Page 15 defines three key initiatives as mental health, affordable housing, and public safety. Okay, I had heard those being among priorities. Then I turned to page 31 talking about ongoing infrastructure investments and see that there’s a $52.1 billion capital program for the MTA from 2020 to 2024. I think that may mean that public transportation bumps students and schools from the #1 spot above.

I decide to go back to where I started, skimming the five-year plan and slow down when I come to the section on local assistance, which indicates two-thirds of state spending goes toward local programs (see pages 46 and 47) where the priorities again appear to be education, healthcare, mental health, transportation, and social services.

So, I hoped my article helped clarify things. Just kidding – it looks like you have your hands full. If you need some extra time to get your arms around the budget and what it means to your municipality, RBT CPAs is here to help. Let our accounting, audit, tax, and financial advisory service professionals assist you so you can focus on other priorities. To find out what we can do for you, give us a call.

After working with multiple New York-based municipalities year after year to close their books and prepare for what’s next, RBT CPA experts have identified seven key questions you should answer to help ensure a smooth process.

1. Does your interfund activity agree? Interfund activity is the financial interaction between a government’s funds. How activity is treated impacts a financial statement’s accuracy. As noted on the NYS Comptroller Website for Financial Reporting:

• • Interfund Transactions – Quasi-External. Treated and accounted for as revenues, expenditures, or expenses when involving organizations outside of New York. For example: A state agency’s payment to the Office of General Services and Centralized Services for billings.
  • Interfund Transaction – Reimbursement. Recorded as expenditures or expenses of the reimbursing fund and reductions of expenditures or expenses of the fund reimbursed. This excludes interfund receivables or payables that have been set up.
  • Interfund Transfer – Residual Equity Transfer. Nonrecurring or non-routine transfer of equity between funds should be reported as additions to or deductions from the starting Governmental Funds balance; additions to or deductions from contributed capital; or as deductions from Proprietary Funds’ retained earnings. For example: transfer of a discontinued fund’s residual balance to the General Fund or Debt Service Fund.
  • Interfund Transfer – Operating Transfers From/To Other Funds. This includes all other interfund transfers. For example: legally authorized transfers from a fund receiving revenues to the fund expending resources. Loans or advances are not included.

2. Did you have any new bonding for the year? Be sure to have copies of bonding documents and the amortization schedule available for review.
3. Have you updated fixed assets for current year additions and deletions? As noted in the NYS Comptroller’s Local Government Management Guide, “Every local government should have a complete up-to-date inventory of capital assets to ensure that both physical control and accountability are maintained over all assets, including lower-cost assets that aren’t reported in financial statements. Some local governments use perpetual inventory records to maintain control over their capital assets. Perpetual inventory records are detailed records that are continually updated as items are added or removed from supply. This inventory system provides officials with direct access to reliable information on current capital assets throughout the year.”
4. Have you completed all bank reconciliations? Making sure bank statements match your accounting records is not only critical to financial statement accuracy, but also helps detect fraud and/or theft, as well as data entry errors (i.e., wrong amount or duplicate entries). Failure to reconcile accounts is often the subject of audit findings.
5. Have you reviewed prior year audit entries and proactively entered them for this year?
6. Are items recorded to accounts receivable (AR) last year, if annual, recorded to AR this year?
7. Are all bills applicable to prior year recorded to accounts payable (AP)?

For additional information, refer to the training resources available through the NYS Comptroller’s website, as well as the NYS Financial Toolkit for Local Officials.

As always, RBT CPA accounting, tax, audit and advisory professionals are available to answer your questions to ensure your municipality is on the best track for financial reporting and accuracy. Click here to contact us today.

Marijuana Struggling to Sow Roots In New York Amid Hazy Conditions

On March 31, 2021, the Marijuana Regulation and Taxation Act (MRTA) legalized adult-use cannabis in New York. What has happened since then?

By year-end 2021, 90% of New York municipalities agreed to issue dispensary licenses and/or onsite consumption licenses. Most of the remaining 600 municipalities opted to forgo offering both licenses (at least for now; they can opt in in the future). A high number of opt outs were in Dutchess, Jefferson, Nassau, Orange, Steuben, Suffolk, and Westchester counties. Leaders attributed their opt out decision to a lack of comfort with certain parts of the law (i.e., onsite consumption) and lack of regulations issued by New York’s Cannabis Control Board.

By the middle of 2022, the Board issued 162 recreational cultivation licenses. Just this month, 36 retail dispensary licenses were issued. The application process is onerous and some requirements (like having been arrested in New York in the past for a marijuana offense) are being challenged in court.

While the state gets its ducks in a row, New York City has seen an upsurge in sales from trucks, sidewalks, and bodegas – none of which are legal. Still, it’s hard to justify pursuing legal action when one of the requirements for opening a legal cannabis business is a past offense involving marijuana. So, what many have coined “a gray market” has emerged, raising concerns that legitimate cannabis businesses will be at risk before they ever open their doors.

Another concern relates to taxes. Sources estimate the cost for cannabis from legitimate sources will be two times more than what it costs in the gray market, thanks to several taxes.

Excise Taxes

As of April 1, 2022, Article 20-C of the New York State Tax Law imposed a THC potency excise tax – the first in the nation. The excise tax is an amount a retailer pays to a distributor. It equals: $0.005/mg of THC for cannabis flower, $0.008/mg of THC for concentrates, and $0.03/mg of THC for consumables.  In addition, there’s an adult-use excise tax of 13% paid by retailers. Of amounts collected, 9% goes to the state. Of the remaining 4%, 1% goes to the county where the sale took place and 3% is split between the cities, towns, and villages in the county that opted in based on respective cannabis sales.

IRC 280E & 471

For Federal income taxes, IRC 280E governs what expenses are deductible and credits are allowable, while IRC 471 governs inventory rules. To offset IRC 280E, New York’s Governor Hochul enacted Senate Bill S8009 when she signed the 2022-2023 budget into law. As a result, starting January 1, 2023, state cannabis taxpayers will be allowed standard business deductions and credits on state returns (even though IRC 280E bans them on Federal returns).

Franchise Tax

New York businesses are required to pay the highest of business income tax (6.5% to 7.25% or 0 for qualified manufacturers); business capital tax (0.1875% of business capital allocated to New York or 0 for qualified manufacturers); or fixed dollar minimum tax (ranging from $25 to $200,000 or $19 to $3,740 for qualified manufacturers). Note: There are some benefits to being treated as a qualified manufacturer.

Sales Tax

While New York businesses will not collect sales tax on cannabis, sales tax will apply to related products like rolling paper, pipes, and other paraphernalia.

(Some of the taxes referenced in this article may work differently in New York City.)

Beyond taxes, audit expectations are high. As noted in an article published by the New York State Society of Public CPAs (Klimek, Jason. Cannabis Taxes in New York State – How High Is Too High. April 1, 2022), “All of this adds up to a high likelihood of an IRS audit. In 2013, with solely medical cannabis legalized in a few states, the IRS determined that the average per hour recovery for IRS work in mainstream businesses was $493. For cannabis business, the average per hour recovery was $1,375.”

No doubt, 2023 will be a big year for legitimate cannabis businesses in New York. If you need assistance with related accounting, taxes, or audits, please let us know. RBT CPAs is one of the largest firms in the Hudson Valley. We believe we succeed when we help you succeed. Give us a call to learn more about what we can do for you.