If your organization has not yet completed its annual filing, now is the time to act.

Understanding Pennsylvania’s Annual Reporting Requirement

In a previous article, our team discussed the Commonwealth of Pennsylvania’s new annual reporting requirement and the information organizations must provide each year. This filing is designed to help the Commonwealth maintain accurate and up-to-date records regarding entities operating within the state.

For nonprofit corporations, as well as limited partnerships and limited liability companies organized for nonprofit purposes, the filing fee is currently $0. Despite the lack of a filing fee, organizations are still required to submit the report annually.

The annual report generally includes basic information about the organization, such as:

• Legal name of the organization
• Registered office address
• Principal office address
• Name of at least one governor (director, member, partner, or equivalent)
• Other identifying information required by the Commonwealth

For nonprofit organizations, the filing deadline is June 30 each year.

While the filing process is relatively straightforward, many organizations have not yet complied with the requirement.

A Significant Compliance Gap

The Pennsylvania Association of Nonprofit Organizations (PANO) recently highlighted the extent of the compliance issue facing the nonprofit sector. According to PANO, as of May 2026, only approximately 11% of Pennsylvania nonprofits had completed their required annual report filing, meaning nearly 89% remain out of compliance.

This statistic is concerning because many nonprofit leaders may assume because the filing is new or because they have historically not filed an annual report with the Commonwealth that no action is required. Unfortunately, that assumption could create substantial administrative and operational challenges in the future.

Many nonprofit organizations are already managing numerous compliance requirements, including annual Form 990 filings, state charitable registrations, grant reporting, audits, board governance responsibilities, and donor communications. As a result, it is easy for a new filing requirement to be overlooked. However, organizations should treat this filing with the same importance as other annual compliance obligations.

What Happens if a Nonprofit Fails to File?

The most significant consequence of failing to file the annual report is the risk of administrative dissolution.

Administrative dissolution occurs when the Commonwealth determines that an organization has failed to meet required filing obligations and removes the organization’s active status. While dissolution may not happen immediately after missing a filing deadline, continued noncompliance can eventually lead to this outcome.

An administratively dissolved nonprofit may face several challenges, including:

• Inability to legally conduct certain business activities
• Delays or obstacles in closing real estate transactions
• Potential disruptions to funding sources
• Additional legal and administrative costs associated with reinstatement

If You Missed the 2025 Filing, Act Now

Organizations that did not complete their initial 2025 annual report filing should not assume it is too late. The best course of action is to file as soon as possible. Taking corrective action promptly can help minimize compliance issues and demonstrate a commitment to maintaining the organization’s good standing.

Nonprofit leaders should consider reviewing their organization’s status with the Commonwealth and confirming whether all required filings have been submitted. If there is uncertainty regarding compliance, one should consult legal counsel or the organization’s professional advisors for guidance.

Final Thoughts

The Pennsylvania annual report filing may seem like a minor administrative task, particularly because there is currently no filing fee for nonprofit organizations. However, the consequences of overlooking the requirement can be significant.

With PANO reporting that nearly 89% of Pennsylvania nonprofits remain out of compliance, now is an excellent time for organizations to review their filing status and take corrective action if needed. If your organization has not yet completed its required filing, submit it as soon as possible. If the filing has already been completed, take steps to ensure it becomes a routine part of your annual compliance process. A few minutes spent addressing this requirement today can help avoid costly administrative complications and protect your organization’s ability to continue serving its mission tomorrow.

If you have questions about the information outlined above, please contact us; our seasoned and experienced nonprofit professionals are here to help. You can also learn more about our nonprofit services by visiting our Nonprofit industry page.

The post Pennsylvania Nonprofits: Don’t Miss the June 30 Annual Report Filing Deadline appeared first on McKonly & Asbury.

An additional product on warehouse shelves often represents tied-up cash, rising carrying costs, shrinking margins, and increased operational risks. Over time, slow-moving inventory can impact profitability and strain working capital, making inventory management a critical concern, not just an operational one.

Slow-Moving Inventory Defined

Slow-moving inventory refers to products or materials that remain in the warehouse longer than anticipated before being used within production or sold. These items may still have value, but these items are not generating revenue at the rate expected.

Several factors can contribute to excess or aging inventory, including inaccurate demand forecasting, aggressive purchasing strategies, seasonal fluctuations, or shifts in market demand. In some cases, businesses may intentionally increase inventory levels during a period of supply chain uncertainty and later discover demand has slowed or purchasing patterns have changed.

Due to the gradual onset of inventory accumulation, financial impact may not be obvious immediately; however, over time inventory can place pressure on cash flow and profitability.

How Excess Inventory Impacts Cash Flow

Inventory requires significant investment of working capital. Money placed within excess inventory is cash that cannot be used elsewhere in the business.

When inventory sits unsold for extended periods, companies may experience reduced liquidity and less financial flexibility. Cash tied up in inventory may limit a business’ ability to invest in employees, materials, or lower debt obligations.

It is not unusual for businesses to report strong sales or profitability while also facing cash flow challenges. This is due to a large portion of working capital sitting in inventory rather than being converted to cash.

Risks and Considerations

One of the largest risks associated with slow-moving inventory is obsolescence. Products may lose value due to technological advancements, changing customer preferences, updated product lines, or expiration concerns. Once inventory becomes obsolete, businesses are often forced to heavily discount products or write the items off completely. These write-downs can negatively impact margins, reduce profitability, and create volatility in financial reporting.

Excess inventory can also affect the accuracy of financial reporting. Inventory is recorded as an asset on the balance sheet, but aging inventory may not reflect its true recoverable value. Conducting routine inventory aging reviews and evaluating reserve policies can help businesses maintain more accurate financial reporting and better visibility into operational performance.

Strategies to Reduce Slow-Moving Inventory

Addressing excess inventory often requires collaboration between finance, operations, and purchasing teams. Businesses can improve inventory performance through strategies such as improving demand forecasting, reviewing purchasing practices, conducting cycle counts, identifying obsolete inventory earlier, and renegotiating suppler minimum order quantities.

In the current environment, inventory management plays a critical role in maintaining healthy cash flow and operational efficiency. While carrying additional inventory may provide short-term security against supply chain disruptions, excess and slow-moving inventory can create long-term financial strain if left unmanaged.

Please reach out to a member of our Manufacturing & Distribution team for more information on the topic outlined above. For more information regarding our Manufacturing & Distribution experience, visit our Manufacturing & Distribution industry page.

The post The Hidden Cash Flow Costs of Slow-Moving Inventory appeared first on McKonly & Asbury.

The SECURE 2.0 Act Requirement

The requirement, added by the SECURE 2.0 Act of 2022 (SECURE 2.0) for plan years beginning after December 31, 2025, stipulates that, unless an exception applies, plan administrators must deliver periodic benefit statements on paper at certain intervals, depending on the type of plan.

• Defined contribution (DC) plans – ERISA requires plan sponsors of participant-directed DC plans to provide quarterly statements, and sponsors of non-participant-directed DC plans to provide annual statements. SECURE 2.0 amended ERISA to require at least one paper benefit statement per calendar year.
• Defined benefit (DB) plans – ERISA requires plan sponsors of DB plans to provide a benefit statement to active participants with vested accrued benefits every three years. SECURE 2.0 generally requires this benefit statement to be provided on paper.

Note that the requirement to provide physical paper benefit statements does not apply if: 1) the retirement plan has only one participant, 2) the statements are sent digitally following the DOL’s 2002 electronic disclosure safe harbor, or 3) the participant explicitly requests to receive their statements electronically. However, all plans are required to provide paper statements upon request.

The FAB Temporary Policy

As a follow up to the proposed regulations discussed above, on May 12, 2026, the DOL released Field Assistance Bulletin (FAB) No. 2026-02, which contains a temporary enforcement policy permitting plan sponsors to rely (in good faith) on either the proposed regulations or the current regulations until final regulations or other applicable administrative guidance are issued. This “relief” includes being able to rely on the current 2002 e-delivery safe harbor, which allows plan sponsors to provide ERISA disclosures electronically to current employees who are “wired at work” (i.e., those who can effectively access electronic documents at work and have access to the employer’s electronic information system as an integral part of their work duties).

This would essentially allow sponsors to avoid complying with the proposed changes to the safe harbor for employees who first become eligible to participate and beneficiaries who first become eligible for benefits, after December 31, 2025. Those changes would include furnishing a one-time initial notice on paper to the individuals before electronically delivering any benefit statements and giving the individuals the ability to opt out of electronic delivery of all required ERISA disclosures.

Interestingly, the FAB does not allow plan sponsors to continue relying on the previously established 2020 e-delivery safe harbor. For those plans, a paper benefit statement must be furnished, unless a participant affirmatively requests electronic delivery of the benefit statement. In addition, paper statements should be delivered without any fee or charge.

Preparation Plans for Plan Sponsors

Given the proposed regulations and the recently released FAB, and while they await further guidance from the DOL, plan sponsors should: 1) review their retirement plan disclosure practices (which may include working with legal counsel), 2) work closely with their TPAs and recordkeepers to ensure compliance, elect the form of delivery, etc., and 3) be cognizant of related regulatory developments, particularly a final ruling. It’s never too early to start planning for implementation.

Please contact us if you have questions about the information outlined above; our seasoned and experienced employee benefit plan professionals are here to help.  You can also learn more on our Employee Benefit Plan services page.

The post SECURE 2.0 – Paper Delivery of Retirement Plan Benefit Statements appeared first on McKonly & Asbury.

Individual Team Member Motivation

Impactful, high-performance leaders have considerable influence on the success of individual team members and the organization as a whole. Let’s take a look at some ways leaders can be more influential with those on their team.

Ask for What You Want

People often drastically underestimate the willingness of others to engage and help. People do want to be helpful. High-performance leaders can build trust by asking for specific help and then showing genuine appreciation for their team members when they show up for them. For this, it’s important to know how they like to be rewarded – see next bullet.

Ask a Lot of Questions

People support what they create. Ask what they want, how they’d like to work together, and what outcomes are important to them. When others see that their input and opinion is valued and truly considered, their commitment to the goal is positively impacted.

Be a Champion of People

Demonstrate sincere appreciation for others. When high-performance leaders show up and give genuine praise, respect, and appreciation to others, they stand out; it is very noticed and motivating. So, when a team member does their part to crush the goal, know how they like to be rewarded and deliver!

Be a Role Model

High-performance leaders should make sure they do what they say they are going to do – consistently and timely. Just do more; show the team the way.

Challenge People to Grow

Most people are reluctant to challenge others to get better. High performers embrace the challenge to motivate others to improve.

Influence Is the Way

Consistent, frequent messaging has impact on others. Teach team members to think of themselves as special, self-reliant, talented, and positive. Communicate the great opportunities and possibilities for the future often to those being led, such as far surpassing the annual team goals for 2026. You are halfway there!

A high-performance coach can help you be consistently influential and focused on pursuing your goals and dreams you envisioned for this year and beyond.

Please contact McKonly & Asbury’s high-performance coach, Gary Dubas, if you have questions about the information outlined above. You can also learn more about our services by visiting our High-Performance Coaching page.

The post How Can Leaders Create Successful Individual Team Members? – “I Am So Glad You Asked!” appeared first on McKonly & Asbury.

Update Financials

Maintaining an updated set of financials throughout the year is a great habit. By updating financials on a regular basis, it allows the business owner to have a better picture of the business’s finances. With a current Balance Sheet, the business owner can accurately see the current bank balances, open receivables, open payables, and net income, all of which provide a status of the financial health of the business. With an accurate set of financials as support, a business owner can make educated decisions.

Review Accounts Receivable

Review Accounts Receivable balances on a regular basis to make sure the business is receiving payments for services. Keep invoicing up-to-date so that customers can pay their invoices timely. Use invoicing solutions, such as QuickBooks Online invoicing, to send invoices electronically with the option to pay online as well. This can help receive payments faster. Send monthly or quarterly statements for past due balances. Keep good recordkeeping of checks received. This is especially important for nonprofits to keep support for audits. However, it is also helpful for any business to have copies or scans of deposit data in case a payment was misapplied, typed incorrectly, or a vendor inquires about their payment status.

Review Accounts Payable

It is also important to review Accounts Payable balances regularly. By keeping track of invoices and paying them on time, it keeps a business in good graces with vendors. Keep invoice copies stored for recordkeeping for support for inquiries. There are times when a review is needed to compare a vendor’s records to a business’s records, and good support makes for an accurate comparison. Keeping good records of invoices paid throughout the year is also helpful if the accountant needs support for particular purchases. A final good Accounts Payable habit is requesting and receiving W9s from vendors before payments are processed.

Communicate Early and Often

Be proactive. When making large purchases, starting construction projects, opening new loans, or making other major changes, keep the accountant in the loop. If an accountant is only used at the end of the year towards tax time, notifying them of changes earlier than year-end provides them with ample notice. It allows them to review the transactions, offer advice, and obtain necessary information when the event happened rather than months later.

Provide the accountant with access. Work with the bank to set up controlled access for the accountant. This allows them to pull bank statements, transaction details, check images, and other documents to assist with keeping files updated. It prevents the extra step of the accountant contacting the business owner for bank codes or requests for statements and other information. This allows the accountant to do their job while the business owner can focus on other tasks.

Maintain Tax Payments

Keep up-to-date with tax payments. If estimated tax payments were calculated, pay them throughout the year. Consider a fall financial review to ensure the tax estimates are still accurate or to receive updated tax estimates. A fall financial review is also a good time to meet with an accountant to discuss recommendations for year-end planning.

Assess Current Technology

Be aware of and open to new technology. Technology is constantly changing, and it can be a good change to embrace some technology. Wariness is not a bad thing, as it is important to make sure that the technology is safe and secure with information. Technology can improve efficiencies, and it can provide solutions for tasks, such as mileage tracking, receipt collection for reimbursements, and invoice payments.

Forming new accounting habits or improving current ones can not only make the next tax season even easier than this past season, as well as improve the success of the business. To learn more about accounting habits for success, or for assistance with getting started, please contact a member of the EAS team.

The post After Tax Season: Financial Habits That Set You Up for a Stronger Year appeared first on McKonly & Asbury.

However, the Uniform Guidance does allow an alternative in certain circumstances: a program-specific audit. Understanding when this option is available, and whether it makes sense for an organization, can help nonprofits manage compliance while balancing cost and administrative burden.

Overview of Uniform Guidance Audit Requirements

Under the Uniform Guidance, a nonprofit organization that expends $1,000,000 or more in federal awards in a fiscal year must undergo one of the following:

1. A single audit, or
2. A program-specific audit (if certain conditions are met)

The single audit is the default requirement and the most common approach. A program-specific audit is permitted only when an organization meets specific criteria.

What Is a Single Audit?

A single audit is a comprehensive audit that includes:

• An audit of the nonprofit organization’s financial statements
• Testing of internal controls over compliance
• Compliance testing for major federal programs
• Reporting on compliance with federal regulations

The auditor determines which federal programs are major programs based on risk and expenditure thresholds and performs detailed compliance testing on those programs.

Single audits are designed to provide federal agencies and pass-through entities with assurance that federal funds are used appropriately.

What Is a Program-Specific Audit?

A program-specific audit focuses solely on one federal program rather than the nonprofit organization as a whole.

Under Uniform Guidance, this option is only available when:

• The nonprofit organization expends federal awards under only one federal program, and
• The program’s statutes, regulations, or terms and conditions do not require a financial statement audit.

In this case, the audit focuses only on the compliance requirements of that single program rather than the nonprofit organization’s overall financial statements.

Program-specific audits must still follow Uniform Guidance requirements and utilize the applicable Compliance Supplement guidance for that program.

When Is a Program-Specific Audit Appropriate?

A nonprofit organization may consider a program-specific audit when:

• All federal expenditures relate to one federal program
• The nonprofit organization does not receive multiple federal programs
• The federal program’s requirements do not mandate a full single audit
• The nonprofit organization seeks a more focused and potentially lower-cost audit approach

Common examples may include nonprofit organizations receiving funding under a single federal grant program, such as a public health initiative or a housing program funded through a single federal source.

However, if a nonprofit organization receives multiple federal programs, even if administered by the same federal agency, it typically must undergo a Single Audit.

Advantages and Disadvantages of a Single Audit

Advantages and Disadvantages of a Program-Specific Audit

Key Questions to Consider

Before choosing between a program-specific audit and a single audit, leadership should consider:

• How many federal programs does the nonprofit organization receive funding from?
• Do any grant agreements require a single audit?
• Do lenders, boards, or funders expect audited financial statements?
• What are the cost implications of each option?
• Is the nonprofit organization likely to receive additional federal funding in the near future?

Consulting with an audit advisor can help determine the most appropriate approach based on one’s nonprofit organization’s funding structure and compliance requirements.

Final Thoughts

The program-specific audit option under Uniform Guidance can be a useful alternative for nonprofit organizations that receive funding from only one federal program. It allows nonprofit organizations to focus audit efforts directly on compliance with that program while potentially reducing cost and administrative burden.

However, because of its limited applicability and narrower scope, many nonprofit organizations ultimately rely on single audits to meet federal compliance expectations and provide broader assurance to stakeholders.

Understanding these options helps leaders make informed decisions about audit requirements and ensure continued compliance with federal funding regulations.

If you have questions about the information outlined above, please contact us; our seasoned and experienced nonprofit professionals are here to help. You can also learn more about our nonprofit services by visiting our Nonprofit industry page.

The post Understanding Your Options: Single Audits and Program-Specific Audits for Nonprofits appeared first on McKonly & Asbury.

How Does an Organized Workspace Affect Productivity and Stress Levels?

If you’re like the average person, you could be spending 4.3 hours every week digging through those piles to find the papers you need. That cuts into the other important tasks of your day, which impedes your productivity.

Clutter can also be damaging in other ways. It’s often emotionally draining and could cause you to procrastinate in making decisions. That can decrease your productivity even more while leaving you feeling stressed and exhausted. Procrastination also forces you to make up for lost time to get back on track, which can be stressful.

What is it about a cluttered desk that causes these negative feelings? Piles of items on your desk can cause visual clutter, which is often overwhelming and distracting. When you clean up your desk, you take control of your physical environment and remove those distractions. That can help empower you and give you the mental clarity you need to excel.

What Are the Steps to Decluttering a Messy Desk?

You’ve determined your desk clutter is hurting your productivity. But you also need those files, office supplies, and tools to get the job done. Learning how to manage the items and implement organization tools can help. Follow these steps to declutter your messy desk:

1. Get rid of anything obvious that doesn’t belong. That might be trash, broken items, or work tools you never use.
2. Go through everything else critically. Just because something didn’t get tossed automatically doesn’t mean it should stay. Make sure you only keep items you truly need and use in your office. 
3. Assess what’s left. Decide if it needs to stay on top of your desk or if there’s a better home for it. Consider other storage and organizational areas within your office, such as storage cabinets, filing cabinets, or cork boards. 
4. Sort items into different piles based on where you plan to store them. That helps you visualize where the items will be. If you’re not sure where to put certain items, consider how, when, and where you use them. Find a spot that makes them convenient in those situations. 
5. Add organizational tools as necessary. File organizers, extra storage drawers, desk drawer dividers, and other tools can help you sort the items that stay in your desk.

Tips for Organizing Your Workspace

No two desks will look exactly the same after the decluttering and organizing process. What works for your cubicle neighbor might leave you feeling stressed or constantly searching for what you need. Use these tips to customize your organization:

• Think about how you work. Maybe color coding is effective for you. Some people like to have essential tools out in the open, while others want everything hidden. Use what you know about your work habits and preferences to organize your space.
• Give everything a spot. Regardless of where you store an item, give it a designated spot so you’re more likely to put it away. A pegboard for office supplies is an example. The empty pegs remind you to put those items back in place when you’re done. It’s also easier to go right where the item lives when you need it, so you don’t waste time searching.
• Reduce paper clutter when necessary. Going paperless when possible helps reduce clutter and keep your space organized. Just make sure you use effective file organization for those digital documents so you can still find them easily.
• Touch it up every day. Even with organizers in place, it’s still possible for items to get misplaced or left out when you’re in the middle of a busy project. Set aside a little time at the end of each day to tidy up so your desk is ready for the next day.
• Change organizational methods if necessary. Sometimes you won’t know what will work best for you until you’ve worked in the space for a while. While you should give your methods a chance, you don’t need to force yourself to continue with an organization method that doesn’t fit your style. Adjust areas that aren’t effective for you as you go.

Add in some “deskercises” you can do daily and you’ll be on your way to higher productivity and lower stress levels.

Explore Learning Opportunities

Creating a productive work environment is one way to strengthen your career momentum. You can build on that foundation by exploring professional development training opportunities that help you target the skills and behaviors most aligned with your goals.

As an owner of the Dale Carnegie Mid-Atlantic franchise, McKonly & Asbury is able to offer an extension of services to our clients and friends of the firm, expanding our expertise in the areas of leadership, team building, and people development as Dale Carnegie offers programs in leadership, management development, customer engagement, service, sales, communication, and more.

The post Eliminate Mess for Success: Organizing Your Workspace for Efficiency appeared first on McKonly & Asbury.

• Indirect Costs Must Be Allocated to Long-Term Contracts: Construction contractors are required under IRC Section 460 to allocate indirect costs to contracts in the same manner as direct costs.
• Percentage-of-Completion Is the Default Tax Method: Most long-term construction contracts should use the percentage-of-completion method (PCM) for tax reporting, unless the contractor qualifies for specific exemptions.
• Indirect Cost Allocation Can Defer or Accelerate Taxable Income: Allocating current and future indirect costs changes the timing of income recognition for tax purposes, creating opportunities for strategic tax planning.
• Certain Costs Are Excluded From Allocation Rules: Expenses related to research and development, unsuccessful bids, and marketing or advertising are specifically excluded from indirect cost allocation requirements under IRC Section 460.

As a construction contractor, WIP schedules likely allocate direct costs, such as field salaries, equipment rent, overhead, etc. But some might be surprised to find out that IRC Section 460 requires indirect costs to be allocated to contracts in the same manner. These would include office salaries, employee benefits, office rent, etc. So, how are those costs allocated? Let’s find out!

What Is Considered a Long-Term Contract?

IRC Section 460 refers to a contract for the manufacture, building, installation, or construction of property that is not completed within the taxable year in which it is entered. So, if a taxpayer is a calendar-year filer and the contract starts in December and ends in January, they have a long-term contract.

It’s a Long-Term Contract. What Method Should Be Used for Income Recognition?

The default here is percentage-of-completion, or PCM. Exemptions would include the Small Contractor Exemption and home construction contracts, which open up more options such as Completed Contract Method.

How Are Costs Allocated?

Now the fun begins! For tax purposes, indirect costs are allocated in the same manner as direct costs and are capitalized to property under IRC 263A. This is essentially “UNICAP” for construction contractors, if one is familiar with the UNICAP rules for manufacturing companies. To allocate indirect costs, typically the taxpayer goes through all indirect costs and applies a percentage to each category of how much should be allocated to contracts. There is also an estimate of future indirect costs taken into account.

With those numbers, the percentage-of-completion is recalculated for tax purposes. When thinking about the future indirect costs, taking the position that 100% of indirect costs is often an aggressive tax strategy, but allocating 0% of future indirect costs is often too conservative. In practice, the allocation of future indirect costs generally falls in the 10-20% range but would of course depend on each individual business’ situation.

This allocation of indirect costs is a timing difference for tax purposes. Meaning, over the life of the contract, the same amount of income will be recognized for both book and tax purposes. However, throughout the life of the contract, income is either being accelerated or deferred for tax based on this indirect cost allocation.

Are Indirect Costs Required to Be Allocated?

If a taxpayer does not meet the small contractor exemption or the home builder exception, then yes!

Are Any Indirect Costs Excluded from Indirect Cost Allocation?

Yes – IRC Section 460 (c)(4) specifically excludes the following costs from the allocable-cost rules:

• Independent research and development costs
• Unsuccessful bid and proposal costs
• Marketing, selling, and advertising expenses

The allocation of indirect costs can sometimes be a hidden tax strategy for businesses. Not only is it generally required by the Internal Revenue Code, but taxpayers could be leaving money on the table by not taking advantage of deferring revenue, when applicable.

For more information about McKonly & Asbury’s Architecture, Engineering, and Construction (AEC) experience, visit the AEC Industry Page and don’t hesitate to contact a member of the AEC team.

The post Indirect Cost Allocation: The Construction Tax Issue Hiding in Plain Sight appeared first on McKonly & Asbury.

• Global Admin Access = Total Exposure: Compromising a single Global Administrator account gave attackers unrestricted control, allowing them to create new admin accounts, execute commands, and wipe thousands of devices.
• Phishing & Credential Stuffing Are Highly Effective: The breach highlights how social engineering and reused credentials remain major vulnerabilities, especially when tied to high-privilege accounts.
• MFA Is Critical – But Must Be Phishing-Resistant: Basic MFA isn’t enough; organizations need stronger, phishing-resistant MFA and tighter privileged access controls to prevent unauthorized admin access.
• Least Privilege & Multi-Approval Reduce Risk: Limiting user permissions and requiring multiple admin approvals for critical actions can significantly contain damage and help detect malicious activity early.

On March 11^th, 2026, Stryker, a global medical technology firm, experienced a Microsoft related incident that led to (allegedly) 200,000 devices being compromised; this included servers, work computers, corporate phones, and even personal devices that were enrolled in the company portal. Over 59,000 people and (allegedly) 50 Terabytes (TB) of data were exfiltrated from Stryker across 79 countries. A hacktivist group linked to Iran’s Ministry of Intelligence, Handala, has claimed responsibility for the hack.

How Did It Happen?

Within Microsoft In-Tune, Microsoft’s cloud-based endpoint management tool, there are a plethora of different roles, privileges, or permissions. But the role with the function of doing anything and everything, Global Administrator, was compromised. Using phishing and stuffing scams to gain access to an existing Global Administrator account, the attackers were able to create their own Global Administrator account.

Phishing is a type of social engineering cyberattack where scammers deceive individuals into revealing sensitive information or installing malware by pretending to be a trusted source – often by sending malicious links for users to visit or download from. Whereas stuffing is an automated cyberattack that inserts stolen usernames and passwords into the login fields to gain access to an account for malicious activity. This information is usually obtained via the dark web from previous data breaches – and assumes that individuals re-use the same login across multiple websites (which is why the name of the family dog is not a good password).

Once the group created their own Global Administrator account, the possibilities were endless (and unrestricted). With Global Administrator privileges, the group was able to run default commands configured by In-Tune – in this case, built-in wipe all commands. At Stryker, a Mobile Device Management (MDM) policy is configured. This is essentially a set of security rules, functions, and configurations enforced on corporate or personal devices (phones, laptops, tablets). This includes employees enrolled in Bring Your Own Device (BYOD) policies. BYOD allows employees to use select company programs and apps on their personal phones. All devices linked to In-Tune and MDM policy were remotely wiped and factory reset.

CISA’s Call to Action for Companies Using In-Tune

Following the attack, Cybersecurity & Infrastructure Security Agency (CISA), released a critical alert for companies using In-Tune or any other endpoint management software.

1. Use principles of least privilege when designing administrative roles.
   • Essentially, assign the minimum needed privileges for a user to complete their daily job functions.
2. Enforce phishing-resistant multi-factor authentication (MFA) and privileged access hygiene.
   • Configure endpoint management software to block unauthorized access to privileged functions, like passkeys.
3. Configure access policies to require Multi Admin Approval.
   • We get it, another push notification is tedious – but, an added layer that requires another “admin” approval ensures that malicious activity like this will be caught and flagged.

McKonly & Asbury can assist your company in managing cybersecurity threats by performing a SOC for Cybersecurity engagement to identify whether effective processes and controls are in place as well as provide you with recommendations to detect, respond to, and mitigate and recover from breaches and other cybersecurity events. For more information on these services and more, be sure to visit our SOC services page, as well as our Cybersecurity services page, and don’t hesitate to reach out to contact us with any questions.

The post Stryker Security Breach – How Important Is MFA? appeared first on McKonly & Asbury.

Key Mandate Details

From a timing perspective, the final regulations are effective January 1, 2027. However, for 2026, a reasonable, good faith interpretation standard applies regarding the administration and operation of the new requirement. Below are several key details of the mandate.

Types of Retirement Plans Impacted

• 401(k) or similar workplace retirement plans that permit participants who have attained age 50 and above to make catch-up contributions.
• Does not apply to SARSEP, SIMPLE IRA, Starter K, or Safe Harbor 403(b) plans.
• Does not apply to the special catch-up contribution rules applicable to 403(b) and 457(b) plans (e.g., for 403(b) plans, the catch-up is available to long-term employees with at least 15 years of service).

Employees Impacted

• Higher Wage Earners – Employees 50 years of age or older with FICA wages from the employer sponsoring the plan greater than $150,000 (indexed annually) in the preceding year. Note that there is no requirement to do a “lookback” for a new employee.

What Is the Mandate?

• Catch-up contributions for higher wage earners, as defined above, must be made as Roth contributions.

Does the Mandate Require a Plan to Permit Roth Contributions?

• No – however, in the case of a plan that does not permit Roth contributions, higher wage earners will not be permitted to make catch-up contributions. To prevent this, the plan would require an amendment to allow for Roth contributions.

Can a Plan Be Amended to Require All Catch-up Contributions to Be Made as Roth?

• No – employees that are not classified as higher wage earners must have the opportunity to make catch-up contributions on a pre-tax basis.

What If a Higher Compensated Participant Elects to Make Pre-Tax Deferrals and Catch-up Contributions?

• The catch-up portion does not start until the pre-tax deferral limit is met.
  • The IRS does not require an affected participant to elect to make their catch-up contributions as Roth. However, any contributions beyond the regular contribution limits must be classified as Roth by the plan sponsor.
  • If the catch-up contributions are contributed as pre-tax deferrals instead of Roth as required, and the error is found before the W-2 is issued, the excess pre-tax deferrals will be transferred to the Roth account. If the error is found after the W-2 is issued, the correction will be processed as an in-plan Roth conversion, and a 1099-R will be issued.

The above is just a high-level glimpse into the new mandate. The final regulations also address “super catch-up” contributions that may be offered to employees ages 60 through 63 beginning in 2025. This was an optional provision of the SECURE 2.0 Act that applies to all participants making catch-up contributions, not just higher wage earners.

It’s important that plan sponsors begin preparing now for operational and document compliance. This includes coordination with recordkeepers, payroll providers, and third-party administrators, as well as communications with employees. Proper planning will help prevent errors and corrections and will ensure an uncompromised participant experience.

Please contact us if you have questions about the information outlined above; our seasoned and experienced employee benefit plan professionals are here to help.  You can also learn more on our Employee Benefit Plan services page.

The post SECURE 2.0 – Mandatory Roth Catch-up Contributions appeared first on McKonly & Asbury.