A new risk management tool, and PPP and tax deadline updates

Risk management has always been important, and it came to the forefront for many organizations in 2020. A new risk heat map tool from the Association of International Certified Professional Accountants can help measure and manage risks. Lori Sexton, CPA, CGMA, a senior technical manager for management accounting, explains some of the features of the tool and how those features can expand an organization’s risk management function.

What you’ll learn from this episode:

• Explanation of a heat map’s role in effective enterprise risk management.
• More on the risk heat map tool’s addition of a qualitative aspect for evaluating risk.
• Why simple awareness of a risk is not enough to manage it well.
• Highlights of the JofA’s coverage of the Paycheck Protection Program and a change in the filing deadline for individual income taxes.

Play the episode below or read the edited transcript:

To comment on this episode or to suggest an idea for another episode, contact Neil Amato, a JofA senior editor, at Neil.Amato@aicpa-cima.com.

Transcript:

Neil Amato: It’s safe to say everyone’s risk management plans were upended in a major way starting about a year ago with the COVID-19 pandemic. So today, we’re devoting time on the Journal of Accountancy podcast to talk about a new tool that can help on the risk management front.

I’m Neil Amato with the JofA, and on the podcast now is my colleague Lori Sexton, a CPA who holds the CGMA designation. Lori is a senior technical manager for management accounting, and in that role she’s in regular contact with businesses and government entities about topics that include risk management.

Lori, many listeners know what a business risk is, especially these days. But they may not know about a risk heat map. What is that exactly?

Lori Sexton: To me, Neil, a heat map is really three things. It’s visual. A picture is truly worth a thousand words. And instead of taking five minutes to read a page, you can glance at a graph in 30 seconds and see right where your risks lie. In our world of overload, we know pictures are extremely effective.

The second thing a heat map is to me is a method of explaining risk — the likelihood that an identified risk is going to occur, coupled with the suspected impact, whether it’s financial or not. Now, the heat map is useful to a foundational audience, for example, those who just got assigned to risk and know nothing about it, or to a board of directors who’ve had decades of experience and interaction with risk. The heat map is an easy-to-use and interpretive tool that just seems to make sense.

And lastly, because of that, it’s easy to communicate and understand, whether it’s a 3×3 grid, a 5×5 grid, or even a 10×10 grid, the stakeholders can take a look and see that the risks in the lower left corner, often colored in green, aren’t nearly as serious as the risks in the upper right corner, usually covered in red. And then, focus their mitigation on those that are in the high red spectrum.

Amato: So, heat maps are one tool an organization can use to assess risk. How is this updated version going to help organizations with enterprise risk management?

Sexton: As I think about your question, I’m going to tweak your term to use “expanded” instead of “updated.” As the risk environment continues to be a magnifying focus, as we’ve seen in the last 15 months, we’ve also expanded this to include qualitative tables as well as the standard quantitative table. Financial risks are often the initial risk assessment performed, but as the world has recently shown us and as our own risk processes mature, the nonfinancial risks are just as important. For example, let’s take reputational risks. It’s often very hard to quantify that in firm dollar amounts. Yes, we can get an estimate, but the effects on our reputation are beyond that and are very qualitative in nature. This table helps explain that.

Another expansion in this tool are additional questions and actions that are geared toward the performance and continuity of your business or entity. We’ve included considerations surrounding thresholds and monitoring. It’s no longer just an accepted practice to know if you have a risk or if you don’t, but what’s become increasingly important is to be able to see it coming and do some mitigation before it hits the red zone. That’s where the thresholds and monitoring come into play. Also, we’ve included more risks within our toolkit. Currently, you can find great resources on our websites, which I know you’re going to be talking about in a moment, Neil.

Amato: For those who want to learn more, what can they look for next?

Sexton: We have got some exciting — and I do say exciting, because I find risk to be a very exciting topic — some exciting resources and tools coming in the next couple quarters. We have got how to communicate a risk heat map. Though you can go through the current tool and understand it, this is going to help you communicate it not only to your staff but also to your executive stakeholders. We also have a tool designed to develop you as a risk leader. And, certainly, the focus on continuity continues, as we look for risks related to your business continuity.

Amato: Thank you, Lori. For the listeners, you can find the risk heat map on CGMA.org under Resources [and then Tools], or, and this link was created just for the listeners of the podcast so you have something easy to remember, you can also go to tinyurl.com/riskheatmap2021.

For those focused on April 15 as the date to file your 2020 taxes — well, you’ve been given extra time. The Department of the Treasury and the IRS announced on Wednesday that the deadline for filing income taxes is now May 17.

In other news, business groups along with the AICPA are supporting a bill that would delay the application deadline for Paycheck Protection Program loans by 60 days. The PPP Extension Act of 2021 calls for loan deadlines to move from March 31 to May 31. The AICPA said in a letter to the bill’s sponsors that CPAs are working diligently to assist as many clients as possible with applications and that more time is needed. A deadline extension, according to the letter, would give the U.S. Small Business Administration time to work out technical challenges and to provide more guidance. At this recording, the bill has passed the House of Representatives and is headed to the Senate.

In the first two months of the 2021 version of the PPP, the SBA said, it has approved 2.5 million loans worth a total of $168.5 billion.

Also, The AICPA has asked for IRS guidance on how S corporations and partnerships should treat tax-exempt income from PPP loan forgiveness. The AICPA’s Tax Executive Committee sent a letter to the IRS making recommendations on how to apply the CAA and specifically Section 276. That section of the act provides that expenses paid with forgiven PPP funds are deductible, that PPP borrowers are not to reduce any tax attributes, and that no basis increase shall be denied by reason of the exclusion of PPP forgiveness from gross income.

Also, the SBA said that business recipients of COVID-19 Economic Injury Disaster Loans won’t have to make payments on the loans until 2022 or later. The date the loan payments begin depends on whether the loan was made in 2020 or 2021. A loan made this year has a first payment due 18 months from the loan date. Loans granted in 2020 have a first payment due date 24 months from the loan date.

For more on these stories, visit journalofaccountancy.com. Thanks for listening to the JofA podcast.