When it comes to business needs, securing financing is a top priority, particularly when starting out or for ongoing needs such as making payroll or paying for inventory. This financing could include a loan or securing an ongoing credit line, and businesses can do that through Off-Balance Sheet Financing (OBSF).
Defining OBSF
Off-Balance Sheet Financing is an accounting practice whereby businesses document liabilities or assets on their books but do not reflect them on their balance sheet. It’s important to note that while they’re not reflected on the business’ balance sheet, if their disclosure meets generally accepted accounting principles (GAAP), it’s legal. If select transactions aren’t on the company’s balance sheet, these transactions are generally found in a company’s financial statements via notes. If, however, company employees conceal material information from investors, then it becomes illegal. As the Federal Deposit Insurance Corporation (FDIC) and the U.S. Securities and Exchange Commission (SEC) lay out, financial statements also may contain references to lease expenses, rentals, or partnerships.
Why Companies Use OBSF
Businesses use this type of accounting to manage their debt usage. Along with reducing interest rates for commercial loans, businesses can lower their leverage and debt-to-equity ratios, reducing the chances of default and encouraging outside investment. This is even more advantageous to help companies obtain financing if they have debt covenants.
In reaction to the Financial Accounting Standards Board’s (FASB) discovery of operating leases regarding OBSF of more than $1.25 trillion for lease accounting, it changed the requirement for OBSF in February 2016 to mandate U.S. public companies to record “right-of-use assets and liabilities from leases on balance sheets” per 2016-02 ASC 842, coming into force in 2019. Based on the publication “Accounting Standards Update No 2016-02 Leases (Topic 842) p. 1,” footnotes were mandated for greater transparency.
How OBSF Works
OBSF moves select assets, liabilities, or transactions away from their balance sheets. It’s done to attract investors or when a company has a ton of debt yet needs to borrow additional capital to fund operations. This can provide companies with more favorable lending rates. Such transactions are either moved to subsidiaries or via special purpose vehicles. The questionable assets are still there but are simply listed on related monetary documentation.
Depending on how the company proceeds, it can include entities that the parent company has a minority ownership stake in. This may include special purpose vehicles (SPV) that take on assets and liabilities, along with other entities such as joint ventures and research and development (R&D) partnerships.
Conclusion
When it comes to R&D partnerships, since R&D is capital-intensive and requires a long time for completion, OBSF is financially advantageous. It permits a company to reduce its liability over the research time since there are no substantive assets to help even out the liability. Industries such as healthcare can see benefits.
Another advantage of OBSF is that when an operating lease is used, it can create liquidity since capital is not tied up in purchasing equipment, and rental expenses are the only financial outflows.
When done according to GAAP guidelines and state and federal laws, companies that use OBSF can maximize their financial landscape.
Alan F Burke CPA
Financing Via Off-Balance Sheet Options
November 1, 2025 · Accounting News, Blog
⏱ 3 min read
When it comes to business needs, securing financing is a top priority, particularly when starting out or for ongoing needs such as making payroll or paying for inventory. This financing could include a loan or securing an ongoing credit line, and businesses can do that through Off-Balance Sheet Financing (OBSF).
Defining OBSF
Off-Balance Sheet Financing is an accounting practice whereby businesses document liabilities or assets on their books but do not reflect them on their balance sheet. It’s important to note that while they’re not reflected on the business’ balance sheet, if their disclosure meets generally accepted accounting principles (GAAP), it’s legal. If select transactions aren’t on the company’s balance sheet, these transactions are generally found in a company’s financial statements via notes. If, however, company employees conceal material information from investors, then it becomes illegal. As the Federal Deposit Insurance Corporation (FDIC) and the U.S. Securities and Exchange Commission (SEC) lay out, financial statements also may contain references to lease expenses, rentals, or partnerships.
Why Companies Use OBSF
Businesses use this type of accounting to manage their debt usage. Along with reducing interest rates for commercial loans, businesses can lower their leverage and debt-to-equity ratios, reducing the chances of default and encouraging outside investment. This is even more advantageous to help companies obtain financing if they have debt covenants.
In reaction to the Financial Accounting Standards Board’s (FASB) discovery of operating leases regarding OBSF of more than $1.25 trillion for lease accounting, it changed the requirement for OBSF in February 2016 to mandate U.S. public companies to record “right-of-use assets and liabilities from leases on balance sheets” per 2016-02 ASC 842, coming into force in 2019. Based on the publication “Accounting Standards Update No 2016-02 Leases (Topic 842) p. 1,” footnotes were mandated for greater transparency.
How OBSF Works
OBSF moves select assets, liabilities, or transactions away from their balance sheets. It’s done to attract investors or when a company has a ton of debt yet needs to borrow additional capital to fund operations. This can provide companies with more favorable lending rates. Such transactions are either moved to subsidiaries or via special purpose vehicles. The questionable assets are still there but are simply listed on related monetary documentation.
Depending on how the company proceeds, it can include entities that the parent company has a minority ownership stake in. This may include special purpose vehicles (SPV) that take on assets and liabilities, along with other entities such as joint ventures and research and development (R&D) partnerships.
Conclusion
When it comes to R&D partnerships, since R&D is capital-intensive and requires a long time for completion, OBSF is financially advantageous. It permits a company to reduce its liability over the research time since there are no substantive assets to help even out the liability. Industries such as healthcare can see benefits.
Another advantage of OBSF is that when an operating lease is used, it can create liquidity since capital is not tied up in purchasing equipment, and rental expenses are the only financial outflows.
When done according to GAAP guidelines and state and federal laws, companies that use OBSF can maximize their financial landscape.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
The rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.
For clarity: Non-spouses who inherited IRA assets after 2020 MUST take RMDs starting this year.
RMD Rules For Non-Spouses
For Traditional IRAs inherited after 2020, the first thing a non-spousal beneficiary must do is transfer the inherited assets into an inherited IRA under his own name. Note that RMDs are then required only if the original owner had reached their RMD age before dying. Under this scenario, the beneficiary must take required minimum distributions going forward, including any RMD not taken in the year the original IRA owner died. Over the next nine years, the new inherited IRA owner must take annual RMDs based on his own life expectancy and deplete the account within 10 years of the decedent’s death.
However, if the original account owner was NOT required to take minimum distributions as of the time he passed, the inherited IRA beneficiary is NOT required to take them – unless he reaches RMD age during the 10-year holding period(starting at age 73, or age 75 effective 2033). Either way, he still must empty the account and pay the requisite tax bill within 10 years of the original account owner’s death.
In addition to paying taxes owed on RMDs, inherited account owners are subject to a 25 percent penalty on any amount shy of that year’s required distribution. Should you miss an RMD, you may be able to reduce the penalty to 10 percent if the correct distribution is taken within two years.
RMD Rules For Spouse Beneficiaries
A spousal beneficiary of the original IRA owner has more options than a non-spouse. For starters, she can retain the original account under her own name. Similar to the non-spouse beneficiary, if the decedent spouse HAD reached his RMD age, the surviving spouse must take required minimum distributions as well, including any RMD not taken in the year the original owner died. However, RMDs thereafter will be calculated based on the surviving spouse’s life expectancy, and there is no requirement to deplete the account within 10 years.
If the original IRA owner had?NOT?started taking RMDs, then the spouse does not have to take RMDs until she reaches the age required to do so. At that point, the RMDs will be based on her own life expectancy.
A spousal beneficiary also has the option to transfer the inherited assets into her own IRA. Under this scenario, her RMD schedule is based on her own age. This option allows her to delay taking RMDs until she reaches RMD age, regardless of the RMD status of the deceased spouse. This strategy provides the opportunity for the inherited assets to grow longer, tax-deferred.
For clarity: the 10-year rule for full distribution does not apply to spouses.
Note that the rules discussed herein do not apply to Traditional IRAs inherited by Trusts or “Eligible Designated Beneficiaries” (EDBs), which refer to chronically ill or disabled beneficiaries, beneficiaries who are younger than the deceased account owner by 10 years or less, or minor children of the account owner.
It’s best to work with a financial advisor or IRA account custodian to choose the option best suited to your circumstances – and ensure you adhere to the appropriate rules.
Alan F Burke CPA
New Rules for Inherited Traditional IRA Distributions
November 1, 2025 · Blog, Financial Planning
⏱ 3 min read
The rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.
For clarity: Non-spouses who inherited IRA assets after 2020 MUST take RMDs starting this year.
RMD Rules For Non-Spouses
For Traditional IRAs inherited after 2020, the first thing a non-spousal beneficiary must do is transfer the inherited assets into an inherited IRA under his own name. Note that RMDs are then required only if the original owner had reached their RMD age before dying. Under this scenario, the beneficiary must take required minimum distributions going forward, including any RMD not taken in the year the original IRA owner died. Over the next nine years, the new inherited IRA owner must take annual RMDs based on his own life expectancy and deplete the account within 10 years of the decedent’s death.
However, if the original account owner was NOT required to take minimum distributions as of the time he passed, the inherited IRA beneficiary is NOT required to take them – unless he reaches RMD age during the 10-year holding period(starting at age 73, or age 75 effective 2033). Either way, he still must empty the account and pay the requisite tax bill within 10 years of the original account owner’s death.
In addition to paying taxes owed on RMDs, inherited account owners are subject to a 25 percent penalty on any amount shy of that year’s required distribution. Should you miss an RMD, you may be able to reduce the penalty to 10 percent if the correct distribution is taken within two years.
RMD Rules For Spouse Beneficiaries
A spousal beneficiary of the original IRA owner has more options than a non-spouse. For starters, she can retain the original account under her own name. Similar to the non-spouse beneficiary, if the decedent spouse HAD reached his RMD age, the surviving spouse must take required minimum distributions as well, including any RMD not taken in the year the original owner died. However, RMDs thereafter will be calculated based on the surviving spouse’s life expectancy, and there is no requirement to deplete the account within 10 years.
If the original IRA owner had?NOT?started taking RMDs, then the spouse does not have to take RMDs until she reaches the age required to do so. At that point, the RMDs will be based on her own life expectancy.
A spousal beneficiary also has the option to transfer the inherited assets into her own IRA. Under this scenario, her RMD schedule is based on her own age. This option allows her to delay taking RMDs until she reaches RMD age, regardless of the RMD status of the deceased spouse. This strategy provides the opportunity for the inherited assets to grow longer, tax-deferred.
For clarity: the 10-year rule for full distribution does not apply to spouses.
Note that the rules discussed herein do not apply to Traditional IRAs inherited by Trusts or “Eligible Designated Beneficiaries” (EDBs), which refer to chronically ill or disabled beneficiaries, beneficiaries who are younger than the deceased account owner by 10 years or less, or minor children of the account owner.
It’s best to work with a financial advisor or IRA account custodian to choose the option best suited to your circumstances – and ensure you adhere to the appropriate rules.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
Despite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.
This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.
According to insights from the SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.
What is Authorization Sprawl?
Authorization sprawl occurs when access permissions multiply uncontrollably across systems, users, and applications. Every time a team or department adds a new SaaS integration, service account, or API key, another layer of permission is introduced.
In an attempt to make access to multiple applications easy, users also have single sign-on (SSO), designed to help log in once and access multiple applications securely. Here, users are granted access to several connected systems through SSO, adding to the authorization sprawl problem.
Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.
Unlike authentication, which verifies who someone is, authorization determines what one can do. When permissions expand without review, attackers take advantage of forgotten tokens, dormant accounts, or outdated roles to move freely inside systems.
Why Traditional Defenses Miss It
Most defenses focus on identity verification, such as MFA, conditional access, and endpoint protection. But once a user is authenticated, there is no monitoring. This is the blind spot that attackers exploit. Instead of breaking in, they log in using legitimate session tokens, application programming interface (API) keys, or open authorization (OAuth) grants.
The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.
A recent incident involving Salesloft’s Drift application highlights how damaging authorization sprawl can be. Drift, an AI chatbot often integrated with Salesforce, was exploited after attackers gained access to Salesloft’s GitHub account and later its AWS environment. From there, they stole OAuth tokens and authentication credentials, exposing Salesforce data from potentially hundreds of organizations. This incident is an example of how interconnected SaaS systems and unchecked authorization links can create a cascading breach effect, where one weak point leads to multiple breaches across services.
The Business Impact of Authorization Sprawl
Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.
Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.
How to Fix Authorization Sprawl
Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.
Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.
Conclusion
As cloud ecosystems, APIs, and integrations continue to multiply, authorization complexity will grow exponentially. Businesses that invest in mapping and controlling authorization sprawl will stay ahead of both attackers and regulators. In cybersecurity, visibility equals control, and this begins with knowing exactly who can do what.
Alan F Burke CPA
Why Authorization Sprawl Is the Next Big Security Blind Spot and How to Fix It
November 1, 2025 · Blog, What's New in Technology
⏱ 4 min read
Despite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.
This growing challenge is known as authorization sprawl, and it is becoming one of the most dangerous and least visible threats in modern enterprise security.
According to insights from the SANS keynote at the RSAC 2025 Conference, attackers are increasingly exploiting this sprawl to gain legitimate, persistent access that bypasses multifactor authentication (MFA), security information and event management (SIEM) alerts, and endpoint detection and response (EDR) visibility altogether.
What is Authorization Sprawl?
Authorization sprawl occurs when access permissions multiply uncontrollably across systems, users, and applications. Every time a team or department adds a new SaaS integration, service account, or API key, another layer of permission is introduced.
In an attempt to make access to multiple applications easy, users also have single sign-on (SSO), designed to help log in once and access multiple applications securely. Here, users are granted access to several connected systems through SSO, adding to the authorization sprawl problem.
Over time, all these factors create a complex ecosystem that even security teams have a hard time tracing who can access what.
Unlike authentication, which verifies who someone is, authorization determines what one can do. When permissions expand without review, attackers take advantage of forgotten tokens, dormant accounts, or outdated roles to move freely inside systems.
Why Traditional Defenses Miss It
Most defenses focus on identity verification, such as MFA, conditional access, and endpoint protection. But once a user is authenticated, there is no monitoring. This is the blind spot that attackers exploit. Instead of breaking in, they log in using legitimate session tokens, application programming interface (API) keys, or open authorization (OAuth) grants.
The misuse of valid credentials or access tokens enables cloud-related breaches. These attacks bypass traditional detection tools because they appear to be normal activity by authorized users.
A recent incident involving Salesloft’s Drift application highlights how damaging authorization sprawl can be. Drift, an AI chatbot often integrated with Salesforce, was exploited after attackers gained access to Salesloft’s GitHub account and later its AWS environment. From there, they stole OAuth tokens and authentication credentials, exposing Salesforce data from potentially hundreds of organizations. This incident is an example of how interconnected SaaS systems and unchecked authorization links can create a cascading breach effect, where one weak point leads to multiple breaches across services.
The Business Impact of Authorization Sprawl
Aside from increasing technical risk, authorization sprawl erodes compliance, governance, and trust.
Regulatory Exposure – Frameworks like GDPR, SOC 2, and HIPAA require strict access control and auditability. Untracked permissions make demonstrating compliance nearly impossible.
Operational Risk – An overprivileged account can unintentionally leak data, delete configurations, or expose APIs.
False Sense of Security – Zero Trust frameworks often stop at identity verification. Failing to continuously validate authorization is equivalent to protecting the front door while leaving internal doors wide open.
How to Fix Authorization Sprawl
Luckily, solving this problem does not require removing existing security controls but rather extending visibility and discipline into authorization.
Conduct Regular Access Audits – Map users, roles, and permissions across your environment. Be sure to look for redundant privileges, dormant accounts, and orphaned API keys. Use tools that help visualize hidden paths and privilege escalation routes.
Implement Structured Access Control – Use frameworks like role-based access control (RBAC) or attribute-based access control (ABAC). Standardizing roles ensures fewer exceptions and easier auditing.
Automate Reviews and Revocations – Integrate identity and access management (IAM) with HR systems so access automatically changes when employees leave or change roles. This helps eliminate the temporary access that never gets removed.
Shorten Token Lifetimes and Rotate Credentials – Session tokens and personal access tokens (PATs) should have an expiration period, such as 30 to 90 days. Using automated key rotation policies will help prevent long-lived access tokens from becoming backdoors.
Enforce the Principle of Least Privilege – Grant users and systems only the minimum access needed.
Extend Zero Trust to Authorization – Verification shouldn’t end with login. Apply continuous authorization checks.
Conclusion
As cloud ecosystems, APIs, and integrations continue to multiply, authorization complexity will grow exponentially. Businesses that invest in mapping and controlling authorization sprawl will stay ahead of both attackers and regulators. In cybersecurity, visibility equals control, and this begins with knowing exactly who can do what.
Disclaimer
These articles provide general information on tax, accounting, and financial topics for small businesses and individuals. They are educational in nature and are not specific legal, accounting, financial, tax, or other professional advice, and should not be relied upon as such. This content was prepared by Service2Client and may have been reviewed or edited by the website owner for accuracy and compliance. Look for a trust mark below for verification details. No representation is made that any approach described will achieve a particular result, and no regulatory or professional body has reviewed or endorsed this content. Because each situation is different, readers should consult a qualified professional about their specific circumstances before acting. Images accompanying these articles are protected by copyright and may not be copied or reused.
When it comes to business needs, securing financing is a top priority, particularly when starting out or for ongoing needs such as making payroll or paying for inventory. This financing could include a loan or securing an ongoing credit line, and businesses can do that through Off-Balance Sheet Financing (OBSF).
The rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.
Despite major investments in cybersecurity, organizations continue to face breaches. Most security mechanisms implemented guard against threats such as password theft. However, there is a growing concern with the unchecked expansion of user access, permissions, and tokens across apps, clouds, and systems.