How we help you
Wipfli’s fraud investigation and litigation support helps you prevent, identify and address fraud with proactive support for meeting increasing threats and operational complexity.
Identify and mitigate critical fraud risks.
Minimize loss and maximize recovery.
Stay ahead of evolving risks across your operations.
Prevent, detect and investigate fraud and misconduct
Wipfli has developed a multidisciplinary team with strong experience in financial forensics, digital forensics, litigation support, economic damages and IT controls.
Explore our fraud investigation and litigation support services
Wipfli can help your organization identify, quantify and mitigate fraud risks, costs and effects. We provide support in performing assessments, investigations proactive examinations and designing antifraud programs and controls.
We can also help you address:
- Anti-bribery
- Corruption
- Contract compliance
- Corporate intelligence
- E-discovery
- Financial crimes
- Fraud and misconduct
Wipfli’s litigation and dispute advisory team can help you minimize your risk of loss and maximize the opportunity for recovery. Depending on your needs, we offer a comprehensive range of litigation support consulting, from pre-litigation strategy up to and including expert witness testimony at trial.
We can also support your organization with:
- Calculation of lost profits and other economic damages.
- Financial matters consultation with attorneys.
- Lifestyle analyses (financial statement analysis, daily living expenses reconstruction, cash-flow reporting, income tax return analysis, marital lifestyle and post-separation analysis).
- Information gathering, evaluation and formal reporting.
- Preparation for and participation in depositions.
Insights and Resources
EVENT | January 19, 2027
January 2027 Uniform Guidance regulation training
Join us for a practical and engaging virtual training of the Office of Management and Budget’s (OMB) Uniform Guidance (2 CFR Part 200) — the cornerstone of federal grant compliance. This training is designed to help nonprofit and government professionals understand federal grant regulations and how to apply them effectively and avoid common pitfalls in managing federal awards. Led by experienced trainers with years of auditing and consulting expertise, this session blends regulatory review with real-world examples and actionable insights. Whether you’re new to federal
ARTICLE
What’s new with ISO 9001:2026
ISO 9001, the highly regarded quality management framework, has been updated for the first time in more than 10 years. In September 2026, the International Organization for Standardization published ISO 9001:2026 , replacing ISO 9001:2015. If your organization already has a mature quality management system (QMS), you will not need to overhaul your program to maintain certification. Instead, you will need to adapt to some revised requirements. Keep reading to learn what’s new in ISO 9001:2026 and the steps your organization should take to achieve compliance with the updated standard. What is ISO 9001? ISO 9001 is an internationally recognized standard for quality management systems. The framework was designed to help organizations deliver consistent products and services and improve overall efficiency. Businesses and organizations in any industry can find ISO 9001 beneficial. It is most commonly used by: Manufacturers Service providers Healthcare organizations Educational institutions Construction companies Technology companies Public organizations ISO 9001 is voluntary, but certification can be a business driver since many organizations prefer their partners to be certified. What’s new in ISO 9001:2026? ISO 9001 was updated to the 2026 version to reflect modern business realities, such as advanced technologies, complex global supply chains and evolving corporate governance expectations. Below are the key changes that will directly impact your operations and upcoming audits: 1. Moving from compliance to quality culture and ethics What’s new: Under clauses 5.1 and 7.3, leadership accountability has been significantly sharpened. It is no longer enough to mandate quality policies from the top down. Top management must now actively foster, measure and demonstrate a shared, proactive quality culture alongside ethical behavior across all levels of the workforce. 2. Clearer distinction: Managing risks versus capitalizing on opportunities What’s new: Clause 6.1 moves away from the broader concept of generalized risk-based thinking. The new 2026 framework strictly separates actions to mitigate operational risks (such as cyberthreats and logistical disruptions) from proactive initiatives aimed at pursuing strategic business opportunities. 3. Formal integration of technology, AI and data integrity What’s new: The standard modernizes how organizational knowledge and infrastructure are managed. Clauses 7 and 8 have been updated to explicitly cover digital workflows, automation, data handling and AI knowledge systems. Organizations must ensure their teams possess the necessary digital competencies and have protocols in place to validate data integrity in automated or paperless environments. 4. Sustainability and climate change mandates What’s new: The climate change considerations previously introduced in the 2024 amendments to clauses 4.1 and 4.2 are now fully incorporated into the fabric of ISO 9001:2026. Businesses must evaluate whether climate-related issues or broader sustainability (ESG) factors affect their strategic direction and quality objectives. Timeline: What is the ISO 9001:2026 transition period? With a September 2029 deadline, organizations have three years to transition from ISO 9001:2015 to the 2026 version. Do not wait until the final year. The initial phases of this rollout will require internal gap assessments, training updates for your staff and scheduling audits with accredited bodies. What should businesses do to transition to ISO 9001:2026? Here are some steps your organization can take to help ensure it’s ready for certification under the new ISO 9001:2026 standard by the 2029 deadline: Review the changes in the 2026 version and identify the areas most relevant to your organization. Conduct a comprehensive gap analysis that identifies which parts of your current QMS meet the ISO 9001:2026 requirements and which parts fall short. Make the necessary changes to processes, documentation and governance. Use this time to simplify, streamline or improve how the system supports the business. Communicate the changes to leaders, managers and employees to help them understand their role in making the QMS effective. Work with your certification body to finalize an audit plan. ISO 9001 requirements ISO 9001 follows the standard ISO structure, with clauses and Annex A. Clauses 4-10 are required, while Annex A provides guidance. The controls in clauses 4-10 can be tailored to address your organization’s operations and risk profile. If there is a control that does not apply to your organization, you may skip it with a documented, justifiable reason. To secure certification, your organization will need to undergo an audit conducted by an ISO-accredited certification body. Here’s a breakdown of ISO 9001 clauses 4-10: Clause 4: Context of the organization (plan): Analyzes internal and external issues and stakeholder needs. Examples of common clause 4 controls include: Annual SWOT or business environment assessment to identify internal and external issues. Stakeholder analysis identifying customer, regulatory, supplier and employee requirements. Documented scope statement defining what parts of the organization are included in the QMS. Clause 5: Leadership (plan): Focuses on management commitment, policies and assigned roles. Common controls include: Approved quality policy communicated to all employees. Defined organizational chart with assigned QMS roles and responsibilities. Management review meetings where leadership evaluates QMS performance and commitment. Clause 6: Planning (plan): Addresses risks, opportunities and quality objectives. Common controls include: Risk and opportunity register with assigned owners and mitigation actions. Documented quality objectives with measurable targets (examples include 98% on-time delivery, <1% defect rate). Change management process to assess impacts before implementing significant operational changes. Clause 7: Support (do): Manages resources, competence, awareness, communication and documentation. Common controls include: Employee training and competency records for required job roles. Document control procedures ensuring only current versions of policies and procedures are used. Internal communication processes such as quality meetings, newsletters or dashboards. Clause 8: Operation (do): Controls product and service creation and delivery. Common controls include: Standard operating procedures (SOPs) and work instructions for production or service delivery. Supplier qualification and evaluation process for critical vendors. Inspection, testing or quality review checkpoints before release of products or services. Clause 9: Performance evaluation (check): Monitors, measures, audits and reviews QMS performance. Common controls include: Internal audit program with scheduled audits and corrective action tracking. KPI monitoring for metrics such as customer satisfaction, defects, rework or on-time delivery. Formal management reviews of audit results, KPIs, risks and improvement opportunities. Clause 10: Improvement (act): Handles nonconformities, corrective actions and continual improvement. Common controls include: Corrective action process for investigating root causes of nonconformities. Continuous improvement program using employee suggestions, Lean or Six Sigma initiatives. Lessons learned reviews and effectiveness checks to verify that corrective actions resolved the issue. Read more Which AI risk framework is right for your organization? A SOC 2 report can be a launching pad for FedRAMP certification From compliance to confidence: Mastering the new CMMC 2.0 requirements
ARTICLE
How to prepare for CMMC readiness requirements
Many contractors and third-party vendors who work with the Department of Defense (DoD) must comply with Cybersecurity Maturity Model Certification (CMMC) readiness requirements. This set of processes and practices is designed to strengthen organizations connected to the DoD (sometimes informally called the Department of War) against cybersecurity threats by protecting controlled unclassified information (CUI) and federal contract information (FCI). CMMC is currently undergoing a major review, as some key third-party assessment requirements were recently paused by the DoD. However, CMMC rules remain largely in effect and continue to be included in DoD contracts. Here’s what you need to know from a readiness standpoint. What are the CMMC 2.0 requirements? The CMMC 2.0 framework requires that DoD contractors — officially any organization that’s part of the defense industrial base (DIB) — meet certain cybersecurity standards. If you want to do business with the DoD, you’ll need to be CMMC compliant . Maintaining compliance includes identifying whether your company meets one of three CMMC levels based on your degree of exposure to CUI, implementing relevant controls and safeguards and passing regular assessments. Here are the three CMMC levels: Level 1: Foundational cybersecurity for any federal contractors who handle FCI. Level 2: More advanced security standards for organizations that also deal with CUI. Level 3: The highest level of CMMC, meant to protect CUI from advanced threats. Why do you need to achieve CMMC compliance? CMMC exists largely to protect a category of data called CUI. Broadly speaking, CUI is unclassified information that is still sensitive and should be protected for security reasons. All CUI is created by or on behalf of the DoD and is technical information with military or space applications. Where can I find CUI in my organization? Most businesses in the DIB encounter CUI at some point in their work. It can come in many forms like contract documentation, blueprints, schematics, tax information and even some communications. Here are some questions to help you consider where you should look for CUI within your organization: How did we receive the CUI? Who needs to access it in their day-to-day work? Who did we send it to? Where do we store DoD working files and program files? Do we keep hard copies of any documentation for DoD clients or prime contractors? What is the CMMC Phase II pause? CMMC requirements were originally scheduled to be implemented in phases between November 2025 and November 2028. Phase II, which was scheduled to begin in November 2026, would have required that many contractors complete a third-party assessment by a C3PAO (certified third-party assessor organization) to demonstrate Level 2 CMMC compliance to bid on DoD contracts. On July 13, 2026, the DoD announced it was pausing Phase II requirements pending an internal review. That review was scheduled to last for 60 days. However, the pause has continued even after that 60-day period expired in September. For now, other CMMC requirements remain in effect, but DoD contracts cannot require third-party compliance assessments. This leaves self-assessment as the only way to demonstrate compliance. How do you prepare for CMMC compliance? Achieving and maintaining CMMC compliance is a process. Here’s how to get started. 1. Find an advisor to guide you through the process A third-party advisor can help you understand and implement CMMC requirements. This will make the process significantly easier and more successful than trying to do everything internally. Look for an advisor with cybersecurity and compliance experience that’s also a Registered Provider Organization (RPO). An RPO has been security vetted and has also demonstrated a comprehensive understanding of CMMC 2.0 requirements. 2. Conduct a CMMC readiness assessment Next, work with your advisor to assess your organization’s existing cybersecurity preparedness through the lens of CMMC 2.0 compliance. What are you doing right and where are the gaps in your current safeguards or controls? Part of this assessment will be determining how much CUI your organization has in its possession. This understanding will allow you to define your organization’s scope, supporting eventual representations to the government that no CUI data exists outside of it. 3. Implement additional governance structures, controls and safeguards to meet CMMC 2.0 standards Depending on the results of your CMMC readiness assessment, you’ll likely need to make internal changes within your organization to meet new compliance requirements. Your advisor can help you determine specific changes and recommend strategies, processes or systems to implement. 4. Undergo regular assessments You’ll also likely need to undergo regular CMMC assessments in order to maintain compliance and remain eligible to bid on DoD contracts. However, these are self-assessments, as third-party assessment requirements are currently affected by the Phase II pause. Continue to engage with your advisor to make sure you’re prepared for your CMMC assessments so you don’t experience any unexpected surprises that limit your ability to bid on DoD contracts. What else should you know about CMMC readiness? Here’s what else businesses need to know to prepare for CMMC and meet cybersecurity readiness requirements: What is the latest DoD guidance on CMMC? The government’s guidance on CMMC continues to evolve, with the Phase II pause in July 2026 representing the latest significant shift in policy. Your advisor can help you stay on top of any new developments and adapt as needed. Does the commercial item exception apply to my products? Some organizations may benefit from an exception stating that providers of commercial items only need to achieve level one CMMC certification. An RPO can help you determine if this applies to you and help to build your organization’s commercial item representation. What processes or tools do you need to comply with CMMC? CMMC requirements change depending on which of the three levels your business falls under. Before you can determine which processes you need, you’ll first need to determine your level within the CMMC framework. How long does it take to become CMMC compliant? Depending on your CMMC level, achieving compliance will take anywhere from several months to well over a year. The specifics depend on your current cybersecurity readiness, the size and capabilities of your organization, your degree of advisory support and the particular requirements you aim to meet, with Level 3 compliance estimated to take as long as 18 months. Can businesses self-assess CMMC compliance? The Phase II pause means that self-assessment is currently the only option for businesses to demonstrate CMMC compliance. CMMC assessment rules originally required third-party assessments in certain circumstances, including a Level 2 third-party assessment by a C3PAO and a Level 3 third-party assessment by the Defense Contract Management Agency’s (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). However, these requirements are currently paused and under review. Do organizations also need to be compliant with DFARS 252.204-7012 and 7019? The DoD assumes that organizations who are now starting to prepare for CMMC have already achieved compliance with DFARS 252.204-7012 and 7019. If your organization hasn’t done this yet, you’ll need to catch up to where the DoD expects you to be prior to starting your preparations for CMMC. How much does CMMC cost? The DoD has established a rough order of magnitude (ROM) of how much it is expected to cost organizations to achieve CMMC, broken down by size of business and shown as a percentage of annual income. You can find this assessment within the Federal Register Notice for Defense Federal Acquisition Regulation Supplement (DFARS) Case 2019-D041 . Note, this ROM assumes the organization is already compliant with DFARS 252.204-7012 and has all the required NIST SP 800-171 controls in place. Are CMMC costs allowable? The DoD understands that organizations will incur costs in preparing for and sustaining CMMC. Fortunately, the DoD has also determined that some of these costs are allowable indirect costs. An RPO can help you understand which costs are allowable and which are unallowable. Read more From compliance to confidence: Mastering the new CMMC requirements The 3 pillars of smarter cybersecurity program management The right cybersecurity framework boosts a business’s value
Reach out to our team
Connect with our team for experienced support in identifying, investigating and mitigating your fraud risk.
LET'S CONNECT
See how Wipfli can help you implement risk management that supports compliance, productivity and long-term success.
