How we help you
Cyber risk is evolving fast, and the cost of inaction is higher than ever. From 24/7 monitoring and data recovery to threat analysis and simulations, Wipfli’s holistic cybersecurity services can help proactively protect your business.
Develop a cybersecurity strategy that keeps pace with the latest cyberthreats.
Evaluate your program against security frameworks and compliance regulations.
Get managed security services for continuous, proactive defense.
Be better prepared to respond to and recover from incidents.
Test your defenses and identify vulnerabilities before attackers.
Fortify defenses and increase resilience
Whether it’s for strategy, testing or fully outsourced cyber services, our national cybersecurity team delivers up-to-date solutions scaled to meet your needs.
Explore our services
Understand your current risks related to external hacks, unauthorized access, ransomware, business interruption and data or money theft.
See how your cybersecurity matches up against security frameworks, such as NIST and CSF, as well as industry-specific best practices and compliance regulations.
Be proactive about responsible AI use with Wipfli’s support for assessing AI-related security risks. Our services include AI policy development, least privilege access reviews and cloud security reviews across platforms. We also provide AI training and help teams recognize and respond to AI-driven threats such as phishing, ransomware and deepfakes.
When you give our team access to your systems, cloud environments and applications, we help identify where you may be vulnerable to exploitation so that you can keep your data secure and access tightly controlled.
We simulate real-world attacks through tactics such as penetration testing and social engineering to evaluate the strength of your network, systems and web applications. Our services include external testing to identify vulnerabilities from outside threats, internal testing to assess vulnerabilities if a breach occurs and web or mobile app testing to uncover vulnerabilities in code or databases.
Strengthen defenses with a mix of security controls tailored to your risk profile. We help you leverage tools including authentication (MFA), advanced endpoint detection and response (EDR), immutable data backup and mobile device management (MDM) to protect data and support long-term resilience.
We help organizations strengthen their resilience to cyberattacks by developing actionable continuity and incident response programs. Our services include business impact analysis (BIA), recoverability assessments and tailored business impact planning. We also support ongoing plan maintenance.
Increase trust and meet regulatory requirements with a virtual chief information security officer (vCISO). Wipfli’s outsourced CISO services provide strategy, oversight and executive reporting on a fractional basis.
Combine the power of our 24/7 monitoring, detection and response support into a managed security services package that provides high-touch, fast-moving and budget-conscious protection. We also offer DNS filtering, security information and event management (SIEM), cloud security and dark web monitoring to help safeguard your environment and proactively defend against emerging threats.
Navigate regulatory requirements with confidence. We specialize in FFIEC, NAIC, CMMC, HIPAA and PCI, and can tailor our guidance to industries, including healthcare, manufacturing and financial institutions.
Attack simulations validate that your prevention, detection and response security controls are performing as intended and delivering an optimal return on investment. By emulating real-world malware, ransomware and financial threat actor activity, we help you identify security coverage gaps and assess if your internal and third-party security vendors are protecting your organization and delivering real-time value.
Secure your cloud environment by implementing tailored strategies that help protect sensitive data, maintain regulatory compliance and mitigate the risk of cyberthreats. Through our assessments, cloud architecture design and ongoing monitoring, we empower organizations to confidently operate in the cloud with resilience and trust.
Insights and Resources
ARTICLE
AI in senior living: How organizations can use AI to scale smarter
AI is changing how businesses and organizations operate across sectors — and healthcare is no different. But while senior living leaders are curious about AI’s potential, many are unsure of how to use its capabilities to drive growth and help their organization scale. However, the biggest roadblock to AI-driven growth isn’t the technology itself, but mindset. Keep reading to learn more about how to solve that, plus how you can get more effective AI adoption within your senior living organization. What are the challenges keeping senior living organizations from embracing AI? Faced with challenges like rising costs and Medicaid cuts that are already taking effect, many senior living organizations could benefit from finding efficiencies through AI. But this has proven easier said than done, in part because embracing AI demands a mindset shift. AI is a change management problem While integrating AI into your senior living organization does require implementing new tools and upskilling your team, it’s also largely an exercise in change management. Your team is used to operating one way, which can make building and sustaining the momentum you need to rebuild your systems or processes to take advantage of AI or automation tools feel a little bit like pushing a boulder up a hill. According to a survey of Wipfli clients, 91% of businesses or organizations report that non-technical obstacles are the biggest blockers to better leveraging new technologies like AI. Meanwhile, only 19% of executives actually feel comfortable leading an AI-transformation effort. In other words, because AI is still such a new and rapidly developing technology, organizations and leaders don’t feel comfortable with it. And that discomfort can make it harder to create results. Haphazard AI use can actually slow adoption and create chaos Is your senior living organization currently using AI? If your first instinct is to answer no, there’s a very good chance you’re wrong, because some of your individual team members are almost certainly using AI tools, regardless of whether they have buy-in from leadership. However, this risks creating a wild west scenario, where AI gets implemented piecemeal or haphazardly and without any overarching AI strategy. In this situation, you won’t have any governance standards, policies or processes to help ensure consistency and can even risk HIPAA violations by exposing PHI to AI tools that don’t meet compliance requirements. Plus, such haphazard efforts will often flounder, blunting momentum for a more organized AI implementation plan. How can AI help senior living organizations scale and grow? AI can accelerate workflows and enable better decision-making through improved data analytics . Examples of how it can help your senior living organization scale and grow include: Reduced administrative burden and improved staff efficiency Many organizations have worker shortages, creating large workloads for the staff they do have. AI solutions for senior living centers can automate repetitive administrative activities such as scheduling, documentation, billing support and referral management, allowing employees to spend more time focused on residents and higher-value work. Generate better insights from organizational data Senior living organizations have large amounts of operational, financial and clinical data. AI can help analyze that information to identify trends, reveal inefficiencies and provide leaders with insights to make more informed decisions about future investments that can spur growth. Enhanced resident experiences AI can help organizations better analyze resident preferences, behaviors and care needs. These insights can result in more personalized services and higher-quality resident experiences. The happier your residents and their families are, the more your reputation will benefit and the easier it will be to differentiate yourself in a competitive market. What are the risks of using AI in senior living? While AI can deliver meaningful benefits, it does come with the following risks: Data privacy and compliance risks Senior living organizations manage sensitive resident information, making data protection a critical concern. If employees use AI tools without proper safeguards, protected health information (PHI) could be compromised, jeopardizing your organization’s HIPAA compliance. Inaccurate or misleading outputs AI systems can produce inaccurate or incomplete information. While AI can be a valuable support tool, organizations should establish processes for human review and oversight, particularly when outputs could influence resident care, operational decisions or regulatory compliance. Inconsistent usage across the organization Without a coordinated strategy, employees will likely use different AI tools for different reasons. This can create inconsistencies in workflows, increase security risks and make it difficult to measure the effectiveness of AI initiatives across the organization. Lack of governance Even promising AI initiatives can struggle if organizations fail to establish clear policies, training programs and accountability measures. Effective governance helps ensure AI is used responsibly, consistently and in ways that support organizational goals. How can senior living organizations implement AI responsibly? For senior living leaders looking to develop an effective, organization-wide approach to AI, the process matters. Specifically, you want to determine where you want to go, how you’re going to get there and what tools you’ll need to succeed. 1. Establish direction by identifying specific problems you want to solve A good AI strategy doesn’t mean buying your team a ChatGPT Pro subscription. Instead, identify specific problems within your organization where AI could make a difference. For example, if your organization is struggling to find skilled healthcare workers to fill key roles, consider whether AI could allow you to deploy your existing team more effectively by automating certain lower-level tasks so your staff can focus on more patient-centric work. Or can AI analyze data from your EHR to identify patient health trends you can use to improve care? Here, it can be good to lean on an advisory firm to help assess your current systems and processes and find gaps that AI could fill. You can also do this entirely in-house, so long as you keep the focus on looking for problems to solve. 2. Design your AI implementation strategy Once you’ve identified how you want to use AI to help grow your organization, you need to build a framework for implementation. This means designing an organization-wide AI strategy to help put new solutions into place. This includes laying out specific steps in the implementation process, identifying leaders or change champions to actually spearhead the rollout and establishing KPIs. It’s also essential to evaluate your existing data sources and prepare them for use by AI tools, a process that can include establishing a centralized data repository or warehouse. During this effort, you’ll need to consistently communicate with your whole team about why change is happening here and how they can help, as well as consider what training or upskilling opportunities you’ll need to provide. 3. Deliver by implementing specific tools that fit your strategy At this point, you can start implementing AI tools to address growth objectives you’ve chosen to target. However, this isn’t just a one-and-done event but an ongoing process that involves both choosing the right tools and embracing the human, change-management side of the equation. Your advisor can help you decide which AI solutions make sense for your needs, as the market has brought forth a dizzying array of options. Within your organization, communication remains essential, as you need to not just establish momentum, but maintain it. How can leaders prepare for AI? An effective AI strategy typically starts at the top, with commitment from leadership. So how should leaders prepare to oversee this effort with an eye towards more effective change management? Here are key leadership pillars to consider: Self-awareness: Before you ask your team to change by implementing AI, are you prepared to do the same? AI literacy: Your leadership team and organization need a shared understanding of what AI actually is and how you’ll be using it. Change leadership: Don’t just throw change at your team, but implement thoughtfully through planning, clear communication and celebrating wins or milestones. Effective use of resources: Throughout your AI implementation process, consider what work is being done, who will perform it, when it should happen and why it matters. Coaching and upskilling: Create training or coaching opportunities for your whole team to adapt to the changes within your organization. How Wipfli can help We advise senior living organizations on how to strengthen performance, deliver a high-quality experience, navigate change and grow. Let’s talk about your goals and explore how innovative solutions like AI can help you reach them. Start a conversation or listen to a podcast interview with the authors of this article to learn more about AI for senior living. Let’s strengthen your organization Read more How independent life plan communities can thrive while maintaining their independence Senior living providers are missing out on valuable revenue opportunities. Here’s how to change that. How financial and demographic shifts are impacting the senior living industry
ARTICLE
Capital allocation strategy: A guide to help CFOs establish funding priorities
For many businesses, capital allocation strategy is no longer just about where the organization wants to grow. It’s increasingly about whether the business has the cash flow visibility, operational readiness and execution capacity required to support growth effectively. That shift is changing how finance leaders approach capital allocation planning, investment sequencing and long-term financial performance heading into the next fiscal year. Keep reading to learn more. What is capital allocation strategy? Capital allocation strategy is the process of deciding how to best deploy your business’s financial resources to achieve growth and profitability. This involves reviewing your business’s strategic goals and deciding when and where to spend money to achieve them. Capital allocation strategy is led at the C-suite level, often with input from the board. CEOs, CFOs and other top executives are typically part of capital allocation conversations. Why does capital allocation strategy matter? Capital allocation strategy matters because effectively deploying your business’s financial resources is essential to growth and profitability. Even the most successful businesses can’t afford to burn through capital aimlessly, so implementing a focused capital strategy that aligns with your strategic goals helps ensure that your spending drives those goals forward. Capital allocation strategy is changing as decisions become more operationally connected In many organizations, challenges or pressures first appear operationally long before financial reporting clearly reflects the issue. In response, leaders are taking a more adaptive, flexible approach to allocating capital. Finance leaders are now basing capital allocation on a broader set of criteria Historically, capital allocation processes often focused heavily on projected return, growth potential and budget availability. Today, finance leaders are evaluating a broader set of operational and financial questions that help determine whether investments can realistically deliver long-term ROI. Does this investment strengthen the organization’s core business strengths or competitive position? Will this investment improve operational efficiency or execution capacity? Will it reduce friction or introduce additional complexity? Does the organization have the capacity to support implementation successfully? Will it improve measurable financial outcomes such as EBITDA, cash flow or margin performance? Does leadership have sufficient visibility to evaluate performance and ROI effectively? Why CFOs are prioritizing visibility, scalability and cash flow management In many organizations, growth initiatives expanded faster than the surrounding processes, capacity, reporting structures and operational workflows could mature around them. Over time, that creates fragmented reporting, inconsistent visibility and growing execution pressure across finance and operations teams. As a result, CFOs are placing greater emphasis on capital allocation planning tied directly to: Working capital visibility Forecasting accuracy Operational scalability (link to strategy and operations consulting) Cash flow management Margin improvement Technology utilization Workforce flexibility Measurable EBITDA levers That shift is making capital allocation strategy far more operationally integrated than in previous planning cycles. Why leaders should reevaluate spending that creates drag Many organizations are reevaluating investments that increase activity without improving visibility, decision-making or long-term operational performance. Here are key actions: Reassess certain expenditures that may be unnecessary Consider whether all your current expenditures are still necessary. We frequently see leadership teams reassessing: Underutilized technology platforms Duplicate systems and vendors Manual reporting processes Initiatives with unclear ownership Investments that expand staffing pressure without improving scalability Programs that continue simply because they already exist Individually, these issues may appear manageable. Collectively, they create operational drag and bottlenecks that limit flexibility and consume leadership attention. Ask hard questions to determine whether spending is necessary Overcoming operational drag is one reason capital allocation strategy conversations are increasingly tied to operational efficiency and performance improvement efforts across the organization. In pursuit of that effort, finance leaders are asking harder questions about: Where investment should continue When to continue investing — and when to divest, consolidate or exit Which initiatives should pause or be moved to long-term Where outside expertise may improve flexibility Which operational burdens can be outsourced Consider whether some finance infrastructure may be unnecessary Many organizations are also reevaluating whether existing finance infrastructure is creating unnecessary complexity. In some cases, disparate systems and inconsistent reporting environments make it difficult for leadership teams to evaluate performance confidently or prioritize investments effectively. That’s driving increased focus on forecasting visibility, reporting modernization and financial planning and analysis capabilities that improve decision-making across the business. Visibility is becoming more valuable than speed Many leadership teams still want to move quickly. But increasingly, CFOs are recognizing that accelerating decisions without improving visibility often creates more operational strain later. And many leadership teams are recognizing that faster decisions are not helpful if the underlying reporting environment is inconsistent or difficult to trust. That’s driving greater investment in: Financial planning and analysis Forecasting and reporting modernization Scenario planning capabilities Cash flow visibility ERP optimization Working capital management Operational reporting consistency Without strong visibility, organizations often struggle to identify: Where cash flow pressure may already be building Which initiatives are improving financial performance Where profitability trends may be deteriorating Which investments should accelerate Which initiatives should pause or consolidate And where operational bottlenecks may limit future growth This is especially important as organizations face increasing pressure to justify capital allocation decisions with measurable operational and financial outcomes. Selective investment is replacing broad expansion Many organizations are still investing confidently. But increasingly, leaders are prioritizing investments tied to measurable operational value, stronger forecasting visibility and improved execution capacity. Key CFO capital allocation priorities We continue to see organizations prioritize: Automation tied to measurable efficiency gains Strategic outsourcing to increase scalability Financial visibility and forecasting improvements Working capital optimization Margin improvement initiatives Tax strategies that improve after-tax performance Selective modernization with clear operational outcomes Targeted acquisitions aligned to execution capacity Where CFOs are reining in spending At the same time, many are slowing or reevaluating initiatives that: Add operational complexity without improving visibility Require significant organizational change without clear ownership Create unclear or difficult-to-measure returns Expand strain across already overloaded teams That shift reflects a broader evolution in how finance leaders approach capital allocation and long-term planning. Growth remains a priority. But increasingly, leadership teams are evaluating whether the organization can realistically absorb additional complexity before accelerating investment further. Why an effective capital allocation strategy requires operational clarity The strongest capital allocation strategies are no longer driven solely by projected growth opportunities. They are increasingly shaped by cash flow visibility, operational readiness and execution capacity across the business. That’s changing how leadership teams approach: Investment prioritization Financial scenario planning Working capital management EBITDA improvement Technology modernization Workforce planning Long-term operational scalability Organizations navigating this environment most effectively are not necessarily the ones moving the fastest. They are the ones creating the clearest connection between financial performance, operational execution and long-term value creation. Capital allocation best practices As you develop your capital allocation strategy, keep certain best practices in mind. These include: Balance growth and operational capability: Capital should drive growth but be sure to invest in the operational infrastructure needed to support that growth as well. Reevaluate existing spending: Consider whether your current investments still align with or support your strategic goals. Prioritize visibility: Financial and operational visibility is essential to determining whether your investments are paying off or should be reconsidered. Avoid unnecessary complexity: Unfocused or unnecessarily complex systems, processes or initiatives create drag on your business as a whole. Read more AI ROI: How to get more business value from your AI spending When to hire a fractional CFO: Key signs your business is ready for strategic financial leadership Strategic management vs. strategic planning: a short guide
ARTICLE
Simplify FFHS grant compliance with a compliance calendar
For federally funded human services (FFHS) organizations, federal funding helps sustain programs and services that communities rely on. But that money does not come without strings attached. It introduces a significant set of 2 CFR Part 200 compliance and audit responsibilities. Compliance with federal grant requirements is a year-round responsibility. For many FFHS organizations operating with lean administrative teams, balancing program delivery with documentation, monitoring and reporting obligations can be challenging. Without a structured approach, compliance activities often compete with mission-focused work for limited staff time. To manage these obligations more effectively, many organizations are adopting compliance calendars that help transform regulatory requirements into a structured workflow. Keep reading to learn how your organization can use a compliance calendar to organize grant compliance requirements and reduce audit surprises. What are the 2 CFR Part 200 compliance and audit requirements? Federal grant recipients and subrecipients must comply with 2 CFR Part 200, commonly known as the Uniform Guidance. These regulations establish rules for managing federal funds, maintaining accountability, demonstrating compliance throughout the grant life cycle, and meeting federal audit requirements. Core 2 CFR Part 200 compliance obligations Federal grant recipients and subrecipients must establish processes to demonstrate that funds are being spent in accordance with award requirements. Key obligations include: Written policies: Maintain documented policies governing procurement, financial management, travel, cost allowability and other grant-related activities. Internal controls: Establish controls that help safeguard federal funds, detect issues early and support ongoing monitoring. Cost principles: Ensure all expenses charged to a grant are allowable, allocable and reasonable under federal requirements and award terms. Subrecipient monitoring: If applicable, assess subrecipient risk, monitor performance and verify that downstream subrecipients comply with applicable requirements. Record retention: Retain financial records, supporting documentation and other records required by federal award terms for at least three years from the date of submission of the final financial report, unless a longer retention period applies. Uniform Guidance audit obligations Uniform Guidance also establishes the following audit requirements: Single audit threshold: Organizations that expend $1,000,000 or more in federal awards during their fiscal year must undergo a single audit or a qualifying program-specific audit. Program-specific audit: Under certain conditions, organizations may be eligible for a program-specific audit. Auditor independence: Organizations must hire an independent auditor to conduct a single audit. The auditor must be independent and comply with the ethical and independence requirements of the Generally Accepted Government Auditing Standards (GAGAS). Data collection and submission: The reporting package and data collection form must be submitted to the Federal Audit Clearinghouse within 30 calendar days of receiving the auditor’s report, or within nine months after the end of the audit period, whichever is earlier. Resolution and corrective action: Organizations must address audit findings and implement corrective actions when deficiencies are identified. Compliance needs to be continuous, not an annual event Many organizations still think about compliance as an annual event. They will wait to gather documentation and records until an audit is about to begin. Under 2 CFR Part 200, compliance activities occur throughout the grant life cycle, requiring ongoing monitoring, documentation and oversight. Internal controls, spending reviews and program performance requirements need to be ongoing between audits. If your organization focuses only on compliance in preparation for an annual audit, you are more likely to have issues with missing documentation, delayed reports or unresolved control issues. The challenge for many FFHS organizations is not understanding the requirements. It is keeping track of hundreds of tasks, deadlines and reviews across multiple programs. That is where a compliance calendar can help. What is a compliance calendar? A compliance calendar is a centralized tool that tracks grant deadlines, reporting requirements, monitoring activities, documentation reviews and other compliance tasks. In practice, a compliance calendar functions as a project management tool specifically designed for grant compliance. Rather than simply listing reporting due dates, an effective compliance calendar breaks each obligation into its required actions. It identifies who is responsible, establishes milestone deadlines and provides reminders before key deliverables are due. This approach helps transform compliance from a series of deadlines into a repeatable process. A compliance calendar will: Notify staff of upcoming due dates Compliance calendars can assign tasks to specific roles and generate reminders before deadlines arrive. Program staff, finance teams, grant managers and leadership can all receive notifications when action is required. Increased visibility into grant responsibilities helps ensure they do not slip through the cracks and reduces the risk of missed deliverables. Create a single source of truth A significant advantage of a compliance calendar is centralization. Instead of scattered spreadsheets, emails and personal reminders, organizations can maintain a single source of truth for grant requirements and upcoming tasks. This improves visibility across departments and makes it easier to coordinate activities. What should be included in a compliance calendar? An effective compliance calendar translates regulatory requirements into specific scheduled activities. Rather than tracking only final due dates, it breaks compliance obligations into the tasks that need to occur beforehand. For each grant, consider including: Financial and programmatic reporting activities: Key reports and the steps required to prepare them, such as budget-to-actual reviews, reconciliation of grant expenditures, collection of program performance data, management review and final report approval. Monitoring and internal control activities: Periodic reviews designed to identify issues early, including transaction testing, review of supporting documentation, segregation of duties assessments, cash management reviews and follow-up on previously identified concerns. Subrecipient oversight activities (if applicable): Risk assessments, monitoring visits, review of required reports, documentation of follow-up actions and verification that corrective actions have been implemented. Grant administration requirements: Budget modification deadlines, equipment inventories, policy and procedure reviews, staff training requirements and grant closeout activities. Each activity should identify a responsible person, target completion date, required documentation and any review or approval steps needed before the task is considered complete. For example, if a quarterly federal financial report is due October 30, the compliance calendar might schedule expenditure reconciliations by October 10, supporting documentation reviews by October 15, management review by October 20 and final approval before submission. By assigning responsibilities and deadlines to each step, organizations can reduce the risk of incomplete reports, missing documentation or last-minute corrections. How does a compliance calendar reduce audit findings? A compliance calendar helps organizations identify and correct issues before they become audit or monitoring findings. The calendar helps staff establish a regular cadence for performing monitoring activities and documentation reviews throughout the year. If a compliance issue emerges, it can be investigated and corrected before an audit or monitoring visit. For example, your compliance calendar can notify a staff member that it is time to review grant-related transactions. During that review, it is discovered that an invoice, approval form or other required record is missing. Thanks to the early discovery, they can locate the documentation and resolve the problem before an audit or monitoring event occurs. If the same issue is discovered by auditors or monitors and supporting evidence cannot be produced, the expense may be questioned or disallowed, even if the expenditure was legitimate. Every grant needs its own calendar Each federal award has its own timeline for compliance obligations. Track every grant individually while maintaining a centralized view of all grant activity. A compliance calendar should follow each grant from award through closeout, accounting for reporting and budget deadlines, monitoring activities and renewal requirements. How can compliance calendars reduce staff burnout? Compliance calendars help organizations plan compliance activities in advance rather than relying on reactive efforts near reporting deadlines or audit fieldwork. When staff can see upcoming deadlines weeks or months in advance, they can schedule tasks as needed, coordinate across departments and avoid emergency requests. Rather than relying on personal reminders and spreadsheets to remember due dates and monitoring requirements, employees can rely on a structured system to keep tasks organized. This structured approach is especially valuable for FFHS organizations that operate with minimal staff. People choose to work at an FFHS because they want to serve community needs, not perform administrative tasks. A compliance calendar can help organizations manage compliance demands more predictably, reducing disruptions to program operations. Compliance calendars can be used for more than grants While grant compliance may be a top priority, the same approach can support other organizational requirements. Examples include: Cybersecurity regulations and frameworks: Track risk assessments, training activities, policy reviews and security testing schedules. Procurement compliance: Monitor purchasing requirements, bid deadlines, contract renewals and procurement reviews. Internal compliance programs: Manage policy updates, board reporting requirements and other governance activities. How to get started with compliance calendars The first step in implementing a compliance calendar is to assess whether the software you already have meets your needs. Do your current tools allow you to: Clearly assign compliance responsibilities Send automated reminders to staff Consistently track reporting deadlines Provide program and finance teams access to the same information View all active grants For smaller organizations that only need to manage a handful of grants, the calendar tools in Microsoft Outlook may be sufficient. Larger organizations managing more grants will likely need a more robust tool like Microsoft D365 or Sage Intacct , which has grant management capabilities, including task tracking and checklist functionality. Read more As nonprofit funding tightens again, can clearer insights help you make more of what you do have? What potential Form 990 changes could mean to tax-exempt organizations Compensation strategies for nonprofits competing in tight labor markets
Reach out to our team
Ready to take a proactive approach to cybersecurity? Our team can help you assess vulnerabilities and keep critical systems secure.
LET'S CONNECT
Discover how Wipfli goes beyond implementation to help you fully leverage the solutions you need to increase efficiency and insights, reduce costs and sustain success.
