GST decision time for Airbnb property managers: Are you in or are you out?

When you take a sip from a 330ml bottle of Speight’s Gold Medal Ale, you probably don’t consider the 47c in excise tax that was included in the price. And why would you? It would only take the fun out of having a nice cold beer. Unfortunately, if you run an alcohol business in New Zealand, you don’t have the luxury of forgetting about excise taxes. These have risen rapidly in recent years because they are benchmarked to consumer inflation. The rise over the last three years in the consumer price index to as high as 7%, has meant more than $94 million in additional excise tax for the alcohol industry. On top of that, the industry has had to absorb rising ingredient and packaging costs, skills shortages, falling sales and higher interest rates. It’s tough going for our alcohol manufacturers and distributors, many of whom are small privately owned and family businesses. While this is an area of tax legislation that might only affect a small number of businesses, it has a sizeable impact. It’s a challenge to be accurate and compliant, particularly for the smaller craft producers that make up around 10% of our local market. These inaccuracies are an under-recognised issue - get it wrong, and it can be extremely costly. Overpaying could lead to significant unnecessary costs Producers must record alcohol volumes accurately, have correct sales records, and lodge that data by the deadlines set by the New Zealand Customs Service. Because brewing is an art and a science, the level of accuracy required can be tricky to achieve. It’s not uncommon to see brewers make tiny errors that lead to big consequences, and the last thing anyone wants is to be facing thousands of dollars a month in unnecessary tax. It’s also easier to make errors at a smaller craft operation, because it’s less industrialised when compared to the big players like Speight’s or Heineken. Take, for example, a fictitious beer manufacturer – let’s call it Bottle Brewery. One of its best-selling beers is a light lager that should have 4% alcohol by volume (ABV). Unfortunately, the team at Bottle Brewery isn’t equipped to be 100% accurate with its calculation and processes. As a result, its light lager has been leaving the brewery with an ABV of 4.08%. That might sound like nothing more than a rounding error, but it’s just enough to increase the excise tax on the beer. The corresponding increase gets applied across the stock keeping unit (SKU) based on sales per month, and the light lager is selling well, shifting 100,000 units in a month. Applying the additional excise tax adds an extra $2,800 per month for that alcohol SKU alone. Plus, the Bottle Brewery team is a bit slow at filing its returns. With that late fine, and the extra excise tax, the company is unnecessarily paying $3,600 a month. Hopefully Botte Brewery has been more accurate with its other beers or its taxes could be really adding up. Underpaying can be a nasty shock When you’re underpaying tax, you run the risk of an unpleasant shock when you need to backpay the outstanding amounts. Customs carries out regular inspections of New Zealand’s alcohol businesses, walking through production facilities to see how you’re recording your alcohol volumes, checking your systems, and inspecting your reports and declarations. Inspectors will look at everything, even checking to see whether you have alcohol sitting in unlicenced areas of your property – you may need to pay excise tax on it if that’s the case. At a time when niche brewers have been struggling to stay afloat, investing in getting this right is well worth the effort – because the costs of getting it wrong can be disastrous. If Bottle Brewery has been paying its excise tax assuming its light lager is 4%, but Customs discovers it is actually 4.08%, the business may be on the hook for several months of backdated taxes. This could be a considerable cashflow blow for a small brewery that’s already feeling the headwinds of tough economic conditions. It may even face penalties for mistakes or omissions, on top of any tax owed. If Customs decides to do a full audit, that will also take up extra time and resources they can’t afford. Customs is very responsive and helpful, and they do have options under the legislation to remit penalties and offer time to pay arrangements. However, they don’t always have the ability or appetite to offer lenient repayment options, and outstanding excise tax and penalties may need to be paid. The right systems and processes can save you time and money Most breweries use spreadsheets to track their sales and alcohol volumes. Academic research has found that an estimated 94% of spreadsheets contain errors, which shouldn’t fill anyone with confidence. Breweries need to develop and maintain a laser focus on improving the quality of their data, and developing models that help them improve accuracy and file returns on time. Typically this investment quickly pays for itself, often simply by avoiding late filing fees. Improving systems and processes often leads to other increased efficiencies throughout the business, including better stock storage practices and more precise forecasting. When it comes to excise tax reporting, a millilitre of prevention is worth a fermenter full of cure.

If you only make one security tweak to your business, it should be this: turn on multifactor or two factor authentication. Multifactor authentication (MFA) is a simple change that can massively improve data protection. Without it enabled, your business or Not for Profit organisation could be in breach of the Privacy Act depending on the type of information you hold. What is multifactor authentication? Multifactor authentication means accessing a particular app or system requires more than one method of identification. Without MFA, you log on via one device, with a single set of credentials. MFA requires more from users based on three factors: Something you have, like a smartphone or a secure USB key Something you are, like a fingerprint or facial recognition. Something you know, like a password or PIN. For example, to log into Xero online, you enter your email and password. With MFA, you then need to confirm your identity another way – such as on your phone via the Xero app. If MFA is enabled for Microsoft Outlook and you log on using a device that isn’t trusted, you will also need to enter a security code that has been sent to a trusted email account or phone number. Whether it’s a text code, a fingerprint or a phone confirmation, MFA ensures more than one ID method is required to get into your important data. Most platforms and applications give you the option to switch it on through your security settings. It seems inconvenient – why would you bother? Single-factor authentication can make it much easier for a cybercriminal to compromise your bank accounts, accounting software, or business systems from anywhere in the world. All they need is your email address and password, which might have been stolen or leaked, or gained through phishing. With two-factor authentication, it becomes exponentially more difficult for malicious users to get access to your systems. According to Microsoft, there are more than 300 million fraudulent sign-in attempts on its cloud services daily: “All it takes is one compromised credential or one legacy application to cause a data breach.” It estimates that MFA can block more than 99.9% of account compromise attacks. If that seems too high, perhaps it is, but MFA is still highly effective; Google says its implementation of MFA halved the number of account compromises. When you have MFA enabled, it’s less concerning if your password is leaked or compromised. That alone won’t be enough to allow a hacker to gain access. Without MFA, you’re probably in breach of the Privacy Act The Office of the Privacy Commissioner recommends all organisations, regardless of their size to introduce MFA. When a breach occurs, one question often asked is whether an organisation has taken reasonable steps to protect the data they hold. If it is deemed the organisation did not take reasonable steps to protect its data, this could result in a breach of the Privacy Act. What’s reasonable depends on the size of the organisation breached and the scale and sensitivity of data it holds. No matter how small your business or charity might be, it almost certainly holds some personal information. It might be as basic as a list of members’ names, phone numbers and email addresses. Or perhaps it’s a more complex customer management system that includes payment details, health information or biometric data. As such, implementing the MFA is no brainer. Under the Privacy Act, every organisation or individual that holds data must collect it appropriately, keep it safe and allow the people it concerns to be able to access it (for more details, read the Privacy Principles). The Office of the Privacy Commissioner describes two-factor authentication as a bare minimum for small businesses or organisations that hold digital information. Without MFA in place, if someone unauthorised accesses your business data, you are likely to be in breach of the Privacy Act. This could lead to a penalty under the Act starting from $10,000; the most ever awarded is just over $168,000. The risks of a data breach go far beyond penalties, though. Your organisation may also experience potentially huge financial losses, reputational damage, and be forced to shut down. We know of one instance where a small online business experienced a data breach, and the cost of remediation and compliance was so high that dissolving the business was the best outcome. Cyber incursions are such a significant risk it’s hard to overstate their potential impact – yet many organisations are unaware of their responsibilities and risks. It’s all part of everyday risk management Cyber security can feel like a particularly thorny specialist topic that sits outside business as usual. But there’s a better way to think about it – cyber security is simply another risk management activity. It’s not separate or unique or different to other risks in your business, so managing it should equally be an everyday task. This means switching on MFA and getting everybody using it automatically, as well as keeping up to date with software patches and managing passwords effectively. Simple steps like these go a long way to protecting your organisation from breaches. In some cases, you might need to switch platforms to be able to access MFA for your organisation. We also occasionally see small regional organisations in areas that are digitally excluded, which can make this tricky. There may be workarounds available, or alternative platforms that can help. Create awareness and provide training We know that it can feel inconvenient to add MFA to apps you use frequently. If those who use your systems don’t understand the importance of using MFA, they may find this extra effort irritating, or try to switch it off. It’s essential to have all users on board. Education is the key – you need to explain to everyone why MFA is vital and why it is well worth the additional effort. You need to create awareness and provide training. According to research by Verizon, 82% of all cyber attacks “involved a human element”, and phishing scams still dominate social engineering attacks. We know that many small and medium enterprises and Not for Profits, don’t have in house IT and cyber expertise, however, being small or local doesn’t exempt you from the Privacy Act, so you still need to make the effort to not only enable MFA, but to understand your obligations under the Act, establish cyber security policies, and incorporate MFA into your overall approach to risk management.

Too few New Zealand businesses are making good use of advisory boards. Used effectively and with the right people involved, an advisory board can solve problems, fill knowledge gaps and help to maximise growth and profits. In a complex and volatile business environment, advisory boards can help steer your business through choppy waters. Executive teams are increasingly faced with problems that fall outside their day-to-day areas of expertise, and advisory boards provide independent advice about how to navigate tricky times. What makes an advisory board unique? Many large businesses have a full constitutional board, which has decision-making power for the company. The members of a traditional constitutional board have fiduciary responsibilities, and their role tends to focus on compliance, risk management, and monitoring business performance. If they work on problem solving or growth strategies, it’s typically from a top-level strategic perspective. Risk minimisation is a priority. In contrast, an advisory board has no decision-making power and the members don’t have the same duties as the full board members. Its focus tends to be on maximising profits and growth, solving problems, and acting as a sounding board – sometimes down to quite detailed levels of execution. Advisory board members often identify market opportunities and provide network links that can support the company’s expansion. The priority is capitalising on opportunities and how to iron out problems. An advisory board provides suggestions, observations and ideas to those making the day-to-day decisions about the company. Those decision-makers can then decide whether or not to act on that advice. The advisory board is both an alternative to the traditional constitutional board and a complement, so you can have one without the other or both. We know advisory boards can be effective Research about advisory boards demonstrates their effectiveness: A survey of businesses leaders found 95.7% believed their advisory board added “real value” to their business, according to The Alternative Board. Advisory boards help businesses avoid costly mistakes; broaden knowledge and skills; and provide a sounding board; among other benefits, according to research by the Business Development Bank of Canada. A Columbia University study revealed advisory boards help organisations “remain innovative and at the forefront of their industry”, and found although board members’ experiences of past failures didn’t prevent all failures, it did minimise the probability of failure. Another US study found an inter-professional advisory board can broaden perspectives within an organisation and lead to new insights. Does your company need an advisory board? An advisory board certainly isn’t a requirement for every business. First, the company needs to have reached a certain size. Beyond that, your business could benefit from an advisory board if: your it is growing or looking to grow you want to raise funds you’re aiming to build strategic partnerships the business is facing a major change of direction, with new products or expansion into new markets the owners of the business are in the process of succession planning the business is, or soon will be, for sale. An advisory board will raise the level of strategic conversation, and it can be the difference between business as usual and an extremely valuable, highly saleable organisation. Building an advisory board You don’t need to launch an advisory board in a single push. It can begin with a single advisor – perhaps your lawyer or accountant. Alternatively it might be someone who knows the market you’re considering moving into for instance, or a person who understands the specific staffing challenges you’re facing. From there, you can build an alternative advisory board. It might include a key person from within the business, possibly the managing director, chief executive or owner. Ideally you want an independent chair with two or three external advisors. Members of your advisory board should be carefully selected to ensure they have the right skills. Identify areas where your company lacks knowledge – for example, it might be insights into a particular country, marketing campaigns, or recruitment. As the company grows, the informal advisory board can move to a more formal set-up. This means having a board charter, rules for the board members and a code of conduct. It’s vital members clearly understand their own role, and everyone else’s roles on the board and within the business. Ultimately, depending on the size and complexity of the business, you may need to establish a constitutional board in time, to ensure the company meets its regulatory and compliance requirements. Even then, having an advisory board means you can continue to have those valuable conversations about how to grow the business and solve thorny issues. Advisory boards are an investment in your company Maintaining an advisory board isn’t free, but it’s a genuine investment in the business. With independent advice, the leadership team can gain a different perspective on an issue. For example, one of our clients owned a company that had been highly successful and grown rapidly, before hitting head winds. It was clear some difficult decisions had to be made but downsizing can feel like you are failing. The process was nerve-wracking for the owners. It was with the support of the advisory board the client was able to make a long-term plan, put the downsizing into perspective, and make the tough choices. Now the business is well set up to survive the tough times and will be ready to grow again when the market picks up. Usually, though, it’s not during a quantum shift that an advisory board proves its worth. It’s an accumulation of small changes. One client is currently leveraging their advisory board to help develop their management team’s effectiveness; to clarify their purpose and vision; and to identify strengths within the business. An advisory board is the ideal forum to explore opportunities, problem solve, and seek counsel. It’s a way for a business to invest in its future and improve accountability of the management team.. It can bring in knowledge, experience and capability where and when it’s needed. In a time of high volatility, an advisory board has never been more valuable. This is an ideal time to establish an effective advisory board to help you navigate your business through these uncertain times and into a successful future.