How we help you
Wipfli’s technology risk advisory services can help your organization stay innovative while mitigating the risks that come from implementing AI, migrating to cloud-based systems or navigating new cybersecurity threats.
Protect critical data and strengthen data privacy compliance.
Access actionable feedback from IT audits and reviews, not just findings.
Navigate fraud investigations with comprehensive digital forensics support.
Strengthen your AI and cyber risk management.
Help ensure digital tools are safely driving growth
In a rapidly changing technology and compliance environment, Wipfli brings multidisciplinary experience to help ensure your solutions can make the right impact.
Explore our technology risk services
Wipfli helps your organization assess cyber risk and implement an effective cybersecurity risk management strategy. We work closely with you to understand your operations and processes so that you’re not just monitoring and using the right tools but also embedding security into your operations.
Our services include:
- Cyber risk management
- Cybersecurity health checks
- Managed security services
- Attack simulation
- Vulnerability assessments
- Business continuity/incident response
- vCISO services
- Cybersecurity compliance
New risks and evolving regulations mean organizations need a data privacy plan that scales as they grow and adapts quickly.
Our comprehensive support can also be customized to the unique privacy challenges of your industry and organization, including:
CPPA compliance
Wipfli leverages our extensive experience with privacy regulations to help surface gaps and strengthen your CPPA compliance. We help you identify vulnerabilities in your existing security program and implement controls to improve compliance while minimizing disruption to your daily operations. Our services include support for privacy notices, data processing, privacy impact assessments, opt-out management, privacy by design and data minimization.
Cookie management
Wipfli’s team helps you reduce regulatory risk with cookie management services, including support for properly categorizing cookies and tags, tag and consent-management software configuration, privacy control interface design and privacy notice development. We work with you to build a service package that fits your needs and high-priority tasks.
Data management services
We also provide data management services, supporting your organization with:
- Cloud data management
- Data warehouse
- Data integration
- Data governance (master data management, metadata management)
- Enterprise information management
Wipfli’s national digital forensic services support your organization in all aspects of an investigation, including testimony, acquisitions, archiving and preservation. We can also provide forensic readiness assessments so you can be confident that your digital evidence will be ready if an incident occurs.
Wipfli’s experienced auditors are ready to collaborate with you on a range of examinations, Including SOC for service organizations, SOC for cybersecurity and SOC for supply chain. We work closely with your organization to help you assess and strengthen your processes and controls.
An IT controls review with Wipfli doesn’t stop at identifying your risks and evaluating the quality of your controls. We go further by providing you with actionable feedback and best practices for improving your controls moving forward. We also offer attestation for your SEO services provider to help ensure that your website and content are working effectively.
Wipfli helps you integrate AI into your organization more safely. Our team helps you understand and manage risks like shadow AI, bias, inaccurate outputs and data privacy threats by identifying risk areas and establishing effective governance, monitoring and controls.
Insights and Resources
EVENT | January 19, 2027
January 2027 Uniform Guidance regulation training
Join us for a practical and engaging virtual training of the Office of Management and Budget’s (OMB) Uniform Guidance (2 CFR Part 200) — the cornerstone of federal grant compliance. This training is designed to help nonprofit and government professionals understand federal grant regulations and how to apply them effectively and avoid common pitfalls in managing federal awards. Led by experienced trainers with years of auditing and consulting expertise, this session blends regulatory review with real-world examples and actionable insights. Whether you’re new to federal
ARTICLE
Participation loans: protect your position
Participation loans for financial institutions offer a way to generate commercial lending income without creating a new borrower relationship from scratch. But acting as the participant in these loans comes with risks. Financial institution CEOs and CLOs need to be sure safeguards are in place to avoid ending up on the wrong side of a regulatory exam and to reduce the risk of losing money on a participant loan. Keep reading to learn about three actions participants should take to protect themselves. What is a participation loan? Financial institutions operate under legal lending limits that cap how much they can lend to any single borrower. Many also maintain internal lending limits that sit below the legal threshold. When a commercial borrower needs more money than one institution can lend, or more than it is comfortable lending due to other risks such as collateral concentrations, the initial institution can bring in another institution to share the loan. This is a participation loan. The originator of the loan is the lead. The institution brought on board to carry the remaining portion of the loan is the participant. In some cases, there may be more than one participant. The lead manages the borrower relationship and services the debt. The participant purchases a percentage of the loan and receives a proportionate share of payments and absorbs a proportionate share of any loss. If your institution owns 50% of the participation, 50% of the payments come to you. And if there’s a loss, you will absorb 50% of that as well. These arrangements allow credit unions to deploy capital for commercial lending without having to establish new relationships with borrowers. But there are risks the participants need to be aware of. Participation lending is available only for commercial loans, not for consumer lending or residential mortgages. These are business loans to commercial borrowers that can be complex. Three things every participant institution must do If your financial institution is considering being a participant in a loan, here are three actions that will help mitigate the risks of losing money and of regulatory violations: 1. Conduct an independent credit evaluation When you agree to be a participant, the lead institution sends you their underwriting file, which should include financial statements, borrower background, collateral analysis and its risk conclusions. That information is a good starting point, but you need to do your own evaluation. Independent credit evaluation for loan participation means applying your institution’s established credit policies to the borrower, as if they had approached you directly for a loan. You can’t simply review the lead’s package and mark it as approved. That’s not an independent evaluation. Regulators have become increasingly direct on this point. Institutions that can’t show their own analysis that’s independent of the lead’s underwriting are creating meaningful examination exposure. Be prepared to answer these questions: What did your credit analysis independently conclude? How did you apply your own underwriting criteria? Where’s your work? Simply put, if the participation opportunity doesn’t meet your standards for a loan someone applied for at your institution, you should pass. 2. Negotiate a clear participation agreement The participation agreement is the contract that establishes the roles and responsibilities for the lead and participant institutions. Treating it as a formality is a mistake. Dedicate time to negotiating terms that protect your interests. Don’t make the mistake of assuming the lead’s standard form covers everything you need. A well-structured agreement for a participation loan should define: The lead institution’s responsibilities for obtaining updated borrower information. Specific timelines for delivering that information to the participant. How loan payments are received and remitted, including any netting arrangements. Interest income based on ownership percentage. How problem credits are managed and who makes decisions. Actions the lead can take unilaterally vs. those requiring participant consent. The absence of clear terms can leave participant financial institutions without the information they need to properly monitor the loan and have no contractual leverage to demand it. Negotiate the agreement before you sign it, not after something goes wrong. 3. Keep your books current As the participant, ongoing monitoring of the loan is your responsibility. You can’t just forget about it and assume the lead will tell you if something changes. Each year, participants should complete a formal internal evaluation that includes reviewing current borrower information, updating the risk rating and assessing whether the borrower remains capable of servicing the debt. The evaluation must be based on current data. The lead institution needs to provide you with updated information. Your agreement should define when that information is due, and you should hold the lead on it. Don’t assume that because the lead hasn’t raised a concern, there aren’t any. You must do your own analysis. When doing your annual review, the key information to gather, assess and document includes: Current financial statements or business tax returns for operating companies. Rent rolls, lease schedules and operating statements for non-owner-occupied commercial real estate. Evidence of consistent cash flow sufficient to service debt over at least the next 12 months. Any material changes to the borrower’s business, ownership or collateral position. Read more How financial institutions can verify their CECL compliance Avoiding adjustable-rate mortgage loan compliance challenges Regulation E error resolution misconceptions and common errors
ARTICLE
UDS reporting: Turn compliance into strategic value
For federally qualified health centers (FQHCs), the Uniform Data System (UDS) can be a cumbersome burden — a backward-facing, compliance-driven reporting task that ties up critical assets every year between New Year’s and Valentine’s Day, costing personnel hours and operational efficiency. But for health centers interested in a data-driven future, UDS reporting can present a unique opportunity to modernize and even gain critical insights. A smarter approach to UDS reporting leads to enhanced federal compliance for FQHCs, plus improved behind-the-scenes efficiency and improved patient outcomes. What is UDS reporting in healthcare and how is it used? UDS is an annual reporting system through which FQHCs report their clinical and financial data to federal regulators, enabling authorities to monitor healthcare trends, allocate resources effectively and further data-driven decision-making about community needs. Federal UDS reporting is often contemporaneous with analogous reporting to state agencies, on similar or complimentary benchmarks. UDS data is also used to evaluate the performance of health centers, improve standards of care and identify centers of excellence. By providing insights into disease patterns, treatment costs and patient demographics, UDS serves as a vital tool for managing and tracking critical data from healthcare access points nationwide. Traditionally, UDS data has been used primarily for monitoring purposes, with limited direct consequences for inaccuracies or deviations from the norm. However, the landscape is shifting, and there are now more reasons than ever for FQHCs to insist on accurate data, both from an accountability perspective and because of the potential high value of the insights offered through the data. During the COVID-19 crisis, certain grant awards were directly tied to the total number of patients served, as reported through UDS. This allocation method may continue into the future, underscoring the importance of accurate and comprehensive data reporting for FQHCs seeking to secure vital funding and resources. Today, UDS is commonly used to compare and contrast health centers, particularly along the lines of staffing ratios, quality scores, and financial efficiency. It’s become more common for lenders, funders, and regulators to consult UDS data as a way to benchmark FQHCs against one another. Additionally, savvy Boards of Directors often consult their health center’s public data, monitor year-to-date reporting, and seek to engage executives to understand how (and why) data is trending. The challenges behind meeting the data reporting requirements With a strict reporting deadline of February 15, many FQHCs rush at the beginning of the year to allocate resources to collect the necessary data and organize the reporting. If centers haven’t been checking data quality and outcomes throughout the year, it can make for a stressful Valentine’s Day. To effectively address the challenges associated with UDS reporting, it is crucial to first identify the specific pain points within an FQHC’s data collection and management operations. Common hurdles include: Lack of dedicated resources: Many FQHCs don’t have the resources to dedicate personnel to the UDS reporting process. Often, data entry and reporting responsibilities are assigned to staff members whose training is in other areas, leading to potential oversights or inaccuracies. Data silos and fragmentation: In some cases, data may be scattered across multiple systems or departments within an FQHC, preventing a comprehensive view of the organization’s operations and patient population. Technical complexities: Navigating the intricacies of EHR systems, financial software and the UDS reporting platform itself can pose significant technical challenges in getting systems to generate the correct data sets, particularly for organizations with limited IT resources or expertise. Manual data entry and error-prone processes: Reliance on manual data entry and lack of automated processes is a time-consuming process, tying up valuable resources on tedious work that can also introduce human error, compromising the accuracy and integrity of the reported data. Lack of staff training and engagement: Inadequate training and limited staff engagement can lead to misunderstandings or misinterpretations of data collection and reporting requirements, resulting in inaccurate submissions that don’t capture the full quality of an FQHC’s services. Changing requirements: UDS regulations change every year, meaning FQHCs need to annually invest additional resources into keeping up with the latest updates. Identifying these pain points can help FQHCs develop targeted strategies and leverage available resources to address the specific challenges they face, paving the way for more efficient and accurate UDS reporting and a greater benefit for the FQHCs themselves. Building a more effective UDS reporting process How can FQHCs ease the burden of UDS reporting? And what modifications can be put into place to turn the onerous process of data collection and management into a source of added value for the organization? FQHCs can simplify the UDS reporting process and position themselves for success in an increasingly data-driven marketplace by focusing on five critical areas for improvement: Creating a data governance committee: Establish a cross-functional data governance committee that brings together stakeholders from various departments, including clinical, operational, financial and quality teams. This committee should be responsible for overseeing how data is coded, collected and managed, identifying areas for improvement and driving organizational alignment. Technical enhancementsto the system: Conduct a comprehensive analysis of data workflows and map the journey of data from its point of capture to its ultimate destination within the reporting systems. This exercise can help identify system limitations, bottlenecks, redundancies and opportunities to streamline processes. Monthly data analysis: Pull and discuss data every month in order to identify issues and squash them early. Data can be compared against prior-year trends and, in the case of variance, can be tracked and analyzed to determine why the variance is occurring. It’s much easier to proactively address issues than to try troubleshooting late in the year with the February 15 deadline fast approaching. Data quality audits: Implement regular data quality audits to validate the accuracy and completeness of the data being collected and reported. These audits can involve sampling techniques, cross-referencing multiple data sources and leveraging data analytics tools to identify discrepancies or anomalies. Staff training and engagement: Invest in ongoing staff training and engagement initiatives to ensure that all stakeholders understand the importance of accurate data collection and reporting. Additionally, by identifying early in the process who is responsible for what, more tasks can be managed in a timely fashion, and everyone will be working from the same playbook from the start. By addressing these key issues, organizations can begin to transform their once-dreaded UDS workload into a valuable chance for growth and operational improvement. Use UDS data reporting to spark growth Follow these steps so your FQHC can successfully harness data to its strategic advantage. Make UDS a monthly priority by reviewing it regularly with leadership and the board. Include UDS in routine reporting alongside financial and clinical metrics. Benchmark against peers to identify unusual trends or potential issues. Compare UDS data to internal reports and clinician insights to uncover discrepancies. Establish clear data governance by defining a source of truth for different needs across competing systems such as UDS, EHR, payroll, accounting and Population Health System. Treat UDS as an ongoing process rather than a once-a-year burden to drive operational improvements, efficiency and growth opportunities. Turning UDS reporting into value UDS can provide more than just peace of mind for your organization. By shifting to a value-producing approach rather than a compliance-only focus, your organization can derive significant benefits from the annual exercise. Automating and integrating data to improve operational efficiency Manually pulling data together is a time-intensive process that ties up key resources just to meet regulatory deadlines. But shifting to an automated data collection system and implementing integration tools that can pull data from all of your systems can minimize data handling while improving accuracy. This provides value by reducing preparation time and staff costs , while also freeing up resources to focus on patient care or operational improvements. Additionally, real-time access to your data can be used to monitor performance on an ongoing basis, not just during UDS prep time. Turning UDS preparation into a continuous quality improvement cycle UDS preparation at many health centers is reactive, with efforts focused merely on submitting a complete product or on avoiding UDS quality-control questions in a rush to get the process done. But by using the process as a catalyst for ongoing quality improvement, you can have regular visibility into actionable data to monitor improvement in clinical care, financial reporting and operational processes, leading to better outcomes for your organization. Using UDS data to enhance patient care with higher-quality reporting Your data can help create actionable insights that can improve the quality of the care you provide. Your preparations already include reporting on standard clinical quality measures, which matter to funders, your community and — most of all — your patients. UDS provides a valuable opportunity for leadership to monitor these quality measures on an ongoing basis and take steps to improve them before undesirable trends become entrenched. Don’t just consider these isolated reporting activities — this data can be used to make real-time decisions. Improving quality metrics is often tied to reimbursement under value-based care models, and may generate quality incentive payments from payers, so your bottom line benefits as well. Improving staff efficiency and engagement through process standardization UDS preparation can overburden staff, leading to burnout, inefficiency and potential reporting errors. But a standardized process with streamlined workflows for data collection, review and submission can help ensure smoother operations, reduced redundancy and less stressed-out staff. Involve clinical staff in audit readiness programs so they can grasp the link between checking boxes in the EHR, day-to-day care delivery and quality metrics that are ultimately reported publicly. This also leads to a more proactive quality-first culture, decreasing the need for a last-minute scramble to gather and process relevant data come February. Ultimately, UDS offers your health center a wealth of opportunities. It’s up to your organization to determine what that might mean for your operations. How much of a role UDS plays in your day-to-day may differ among organizations, but whatever your desired level of involvement is, it’s important to choose a vision, document it and work toward implementation. Read more 4 workforce strategies for FQHC financial health Improving rural healthcare RCM with data analytics The tech infrastructure that can drive your rural health transformation
Reach out to our team
Talk to our technology risk specialists to see how you can balance innovation, security and regulatory compliance.
LET'S CONNECT
See how Wipfli can help you implement risk management that supports compliance, productivity and long-term success.
