Compliance April 30, 2015

ESOP Bill Introduced in U.S. House

U.S. Representatives Dave Reichert (R-Washington) and Ron Kind (D-Wisconsin) introduced a bill to encourage the creation of S Corporation Employee Stock Ownership Plans (S ESOPs).
Reported by

The Promotion and Expansion of Private Employee Ownership Act of 2015 (H.R. 2096) includes provisions to encourage owners of S Corporations to sell their stock to an ESOP, expand financing opportunities for S Corporation ESOPs, provide technical assistance for companies that may be interested in forming an S Corporation ESOP, and ensure that small businesses that become ESOPs retain their Small Business Association certification. Similar legislation has been introduced in the past.

“This legislation is critical to giving employees ownership over their work and retirement in a time when many people are concerned about their retirement savings,” says Reichert.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

“By making it easier for companies to become employee-owned, this legislation will not only grow the number of employee owned businesses, it will provide retirement security to more Americans,” Kind adds. “Employee-owned companies perform better – not just for themselves but for every one of their employees as well.”

A recent report from Ernst & Young revealed S corporation ESOPs outperformed the S&P 500 total return index in terms of total return per participant by 62% from 2002 to 2012.  

“We need policies to encourage employee stock ownership, and the proposed policies in H.R. 2096, should address core social issues such as adequate retirement security and making sure working Americans have an ownership stake in our capitalistic system,” said ESOP Association President, J. Michael Keeling, in a statement.

Compliance April 30, 2015

Three Steps to Address Cyber Attacks

The cybersecurity of registered investment advisers (RIAs) is an important issue, says the Securities and Exchange Commission (SEC) in a guidance update.
Reported by

Adviser use of technology to conduct business activities is on the rise, and so is the need to protect confidential and sensitive information from third parties, including information about clients, the SEC says. Underscoring the need for firms to review their cyber-security measures: a number of recent high-profile cyber-attacks on firms, from JP Morgan to the health insurer Anthem.

In February, the SEC determined that few written policies and procedures directly address how firms determine whether they are responsible for client losses associated with cyber-incidents. Lack of a specific process can prove problematic for advisers and broker/dealers accused of leaving client data or funds exposed to cyber-risks. The 2015 exam priorities, though streamlined from the previous year, will still focus on cybersecurity compliance and controls.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

Advisers should consider several measures when addressing cybersecurity risk. The guidance update from the SEC’s Investment Management unit offers three steps for addressing cybersecurity.

First, conduct a periodic assessment of the nature, sensitivity and location of information that the firm collects, processes and stores, and its technology systems. Assess internal and external cybersecurity threats to and vulnerabilities of the firms information and technology systems. Diagnose the effectiveness of the governance structure for the management of cybersecurity risk. An effective assessment would help identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate risk.

Questions to ask:

  • What are the security controls and processes currently in place?
  • What would the impact be, should the information or technology systems become compromised?  

Next, create a strategy to prevent, detect and respond to cybersecurity threats. Firms might want to consider implementing tiered access to sensitive information and network resources, network segregation, and system hardening; and using data encryption. To guard against the loss or exfiltration of sensitive data, consider restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events. Develop an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.

Questions to ask:

  • Who has access to various systems and data?
  • Should the firm adopt user credentials, authentication and authorization methods?
  • Is there a firewall or are there perimeter defenses in place?
  • What is the process for data backup and retrieval?

Finally, implement the strategy with written policies, procedures and training to provide guidance to officers and employees. Detail applicable threats and describe the measures that will prevent, detect and respond to such threats.

Questions to ask:

  • Does the firm want to educate investors and clients about how to reduce their exposure to cyber security threats?
  • Does the staff understand the policies and procedures to help monitor compliance?

The Investment Management Division recommends that advisers identify their compliance obligations under the federal securities laws and take them into account when assessing how they can prevent, detect and respond to cyber attacks. Advisers can also mitigate exposure to any compliance risk associated with cyber threats through compliance policies and procedures that are reasonably designed to prevent violations of the federal securities laws.

More information about the guidance update is on the SEC’s website.

«