As Seen in CFO Studio Magazine Q1 2017 Issue

STIMULATING FINANCIAL GROWTH IN THE FACE OF ECONOMIC UNKNOWNS IS THE KEY TO SUCCESS

Most executives would agree: In order to stay in business and outpace competitors, companies need to grow and expand, regardless of what is going on in the world market, or their own backyard. How that’s accomplished, however, is a “challenge and a good question that may not have one definitive answer,” according to Jason Mulliner, CFO of Edmund Optics, a supplier of optics, imaging, and optomechanical components, based in Barrington, NJ.

Mr. Mulliner spoke on “Driving Domestic and Global Growth Despite Currency Swings and Economic Uncertainty” at an invitation-only dinner discussion attended by CFOs from middle-market companies in the Philadelphia and New Jersey areas. The event was held recently at Morton’s The Steakhouse in Philadelphia and is part of CFO Studio’s Executive Dinner Series.

Mr. Mulliner began the discussion by acknowledging how “economic uncertainty can be very much domestic in nature.” For companies based in the U.S., he said, “there are so many things that can create uncertainty — like what’s going to be the gross domestic product growth for the upcoming year, and what might the Fed do with interest rates?” He continued: “How about the unemployment rate and its effect on the cost of employees?” And, naturally, he didn’t stop short of mentioning the veil of ambiguity that typically surrounds a new president in the Oval Office.

With those questions dangling in the room, Mr. Mulliner then posed the most important one to his fellow financial executives in attendance: “How do you budget and plan for the upcoming year in the shadow of so much uncertainty?” That question was answered with more questions, and an observation agreed upon by all: “It’s a considerable, yet exciting challenge.”

Most companies, Mr. Mulliner noted, begin budgeting for the next year in September, with such calculations continuing until December. Any good plan, he said, “probably needs to be amended every three or four months anyway, which is a good thing when so much is up in the air.”

At a time like this, Mr. Mulliner suggested “rolling forecasting” could be considered a best practice: “You always have a 12-month plan ahead of you, as opposed to working with a plan that is very calendar-year focused,” which forces everyone to be constantly thinking ahead.

While it sounds positive, he called the process of creating a rolling forecast an “arduous, but important task” that takes a huge amount of time and resources, as “every organization within the company has to sit down about once a month to think through the plan and project out.” A fair deal of grumbling is often the result of such “reforecasting,” but Mr. Mulliner opined that “only good can come from repeatedly going back to the drawing board during unclear periods.”

Michael Muccio, Partner at CFGI, a finance and accounting consulting firm with offices in Boston, New York, and Philadelphia, and a CFO Studio Business Development Partner, discussed his dilemma over whether or not to slow hiring in the New York market or change the strategic direction. “Our New York office is experiencing rapid growth, including an increase of more than 200 percent in head count over the last 18 months.” Mr. Muccio said that while there is concern about the growth trajectory of this market, “it’s difficult to pump the brakes and pass up good talent.”

Responsible for growing CFGI’s New York office, Mr. Muccio admitted his nerves were calmed by the overall sense of optimism in the room for sustained growth: “CFOs in attendance felt an economic slowdown or significant change were not likely on the horizon even with a new president, and more of the status quo is expected.”

Globally Speaking

Mr. Mulliner moved the discussion to a global focus. “It’s been a very interesting time, as the U.S. dollar has had one of its largest moves ever in terms of strengthening against all currencies.” However, for global companies based in the U.S., “this has added incredible volatility to their financial statements.”

He explained: “As you’re selling in other countries in different currencies other than the U.S. dollar, you’re basically getting fewer dollars for every foreign currency that you sell, so on your financial statement it looks like you’re selling less or contracting as a company, but that may not be the case at all.”

For companies with both sales and expenses (manufacturing, salaries, etc.) overseas, a shift in the currency can also “artificially take away growth” on their financial statements. Mr. Mulliner said financial instruments like forward hedging contracts can help preserve natural growth, and can remove volatility from the reports. “Such agreements allow businesses to purchase a foreign currency at a pre-established and fixed rate based on the current market.” He continued, “So if the currency moves during the prescribed period in the hedging contract, the hedge will mitigate the actual financial gain or loss occurring in the company resulting from the currency move.” This will decrease volatility in the company’s financial statements, he said, “which is typically a good thing.”

The Bottom Line

In the end, the group agreed with Mr. Mulliner that “if you want to grow, despite currency swings and economic uncertainty, you have to fund growth.” To do this, he said, “Companies typically need banks.”

Elaine Cheong, Senior Vice President and Senior Relationship Manager at Bank of America Merrill Lynch, and a CFO Studio Business Development Partner, offered: “Part of a company’s risk-management strategy should be negotiating with their lenders realistic covenants that reflect earnings fluctuations due to cyclicality of business conditions.”

In terms of a budget plan, Mr. Mulliner said the banks understand that it’s just a plan and it will change, but “they like to see that some rigor, thought, and strategy have been put into it, and that it’s consistent with past performance and you’re not just making things up.”

And he added: “Don’t surprise your banker.” Constant communication and “a good relationship with your banker can help a business weather most any kind of storm.” Whether you know one is coming or not.

As Seen in CFO Studio Magazine Q4 2016 Issue

No longer just the responsibility of IT professionals, the threat posed by cyber attacks is in the CFO’s bailiwick

The issue of cybersecurity has become a matter for entire organizations, from the IT department through all of its layers. “It’s now discussed upstairs at the Board level. It’s that serious,” said Paul Mallen, CFO of Amalgamated Life Insurance Company, as he talked about “CFO Perspectives in Managing Cyber Risks” at a Middle Market Companies CFO Dinner, part of CFO Studio’s Executive Dinner Series, held recently at Blue Morel in Morristown, NJ. CFOs from select New Jersey–area companies attended the invitation-only dinner discussion.

“Detection,” Mr. Mallen pointed out, “is just as important as prevention.” He cited an intrusion at an insurance provider in the Pacific Northwest that made headlines last year. “Hackers were in the system for several months before anyone knew it, accessing an estimated 11 million customers’ personal, financial, and medical records.”

In terms of how to detect such a breach, Mr. Mallen said, “There’s really no silver bullet. And the hackers are typically one step ahead of the rest of us. Multiple layers of technology and processes are necessary.” Still, from what he called “a low-hanging fruit perspective,” there are a few hot-button items to consider when attempting to defend against a cyber attack. “Only allow approved software to run on employees’ computers, and minimize administrative privileges by preventing individuals, except those authorized, from making changes in the system.” In addition, he advised keeping applications, plug-ins, and software up-to-date and operating systems current with the latest patches and updates.

The CFO’s Role

Increasingly, CFOs are paying more attention to such measures and controls because, as Mr. Mallen stated, “Typically, our job is to manage corporate resources and risk. …CFOs think in terms of risk vs. return, but when it comes to the issue of cybersecurity, you can’t quantify the return. And the risk could be reputational, financial, and/or customer losses.”

To begin laying the groundwork for a more secure computing environment, Mr. Mallen suggested attendees ask themselves a couple of critical questions: “Where is your data? What data are you trying to protect? Who has access to it, and should everyone in a department have access to the same data?” Once answers to these questions are reached, he said, it’s an opportune time to conduct a risk assessment and a gap analysis. “Then you can methodically approach where your gaps are and attempt to [protect the assets] cost-effectively.”

From a finance perspective, Mr. Mallen said CFOs should determine the amount of money that can be allocated to cybersecurity efforts. “You have to spend your funds appropriately; you can’t allocate capital to all IT requests.” In addition, “As middle market CFOs, we have a unique challenge in the areas of managing capital, and finding and retaining top talent,” he said. He pointed out that it can be difficult for mid-sized companies to hire all the knowledge workers necessary to deal with cybersecurity, due to the many and varied systems most enterprises use and competition for resources from big-name firms.

As a result of this predicament, Mr. Mallen noted that many companies are outsourcing a number of their IT functions as well as turning to cloud computing, which brings along its own set of issues. To that point, he cautioned: “Before picking a vendor to store your invaluable data, attempt to determine if that company is taking all the right measures to secure it.” He recommended compiling an “appropriate and comprehensive questionnaire” in order to glean an understanding of the vendor’s overall security system. “Some of those inquiries should include: How do they segregate data? Who has access to the data? And what are all of their security controls?”

In terms of managing third-party vendors, he added, be sure to get the appropriate reports. “Many CFOs receive a Service Organization Controls report, or SOC 1 report, from a vendor and think that it’s adequate in this area, but it’s not,” as it mainly focuses on financial reporting controls. Mr. Mallen advised requesting a SOC 2 report, which is centered around a business’s other controls as they relate to security, confidentiality, and privacy.

Risk Prevention

The issue of USB drives, or so-called “thumb drives,” came up at the dinner and, as Mr. Mallen pointed out, there is a “ton of risk” associated with these handy little gadgets. “An employee can inadvertently unleash a virus onto the organization’s network by plugging in a thumb drive that is, unbeknownst to them, infected.” In addition, an employee could download sensitive information onto a thumb drive and then leave the company, or simply lose it.

One way to mitigate this kind of risk, Mr. Mallen said, is to use encrypted thumb drives. A more aggressive approach would be to “lock down your computers so they don’t accept outside drives,” only those that have been issued by the company. To take it a step farther, “Provide thumb drives only to employees that department managers approve” to receive them. In this vein, he said, “You begin to minimize and narrow down your areas of risk.”

From a non-gadget standpoint, Mr. Mallen said, “One of the most important things you can do that is not technology related is to make sure your staff is continuously trained and educated on phishing emails and websites. Links in emails and websites are one way that hackers install malicious software on a computer, which then allows the hackers access to systems and data. Mr. Mallen also recommended that staff be expected to adhere to all prudent cybersecurity policies and protocols.

Mr. Mallen acknowledged that cybersecurity adds complexity to the system, and “if you make it too complex, there’s more chance for human error or misconfigurations.” In addition, he advised the attendees to “build cybersecurity into new systems that are being put into place, so that it’s already a part of the process for your business units.” You don’t want to create changes in the workflow, he said, nor do you want to make it harder to operate your business. The hackers have that angle covered for us already.