Topic: FINANCE & OPERATIONS

When we apply the principle of the feedback loop in the proper way, with purpose, it can be a powerful tool with limitless applications in this complex business we are in.

Nearshoring to Canada and partnering with PEOs offers U.S. companies a range of benefits, from lower healthcare costs and cultural alignment to advantageous time zones and currency savings. The combination of these factors creates a compelling case for considering Canada as a strategic expansion destination.

The many compliance obligations for a PEO require partnering with an external or third-party accounting firm. The question is what exactly should an external accountant be responsible for?

The benefits of EWA extend to both employees and employers in many ways. EWA provides employees with greater control over their finances, enabling them to access their earnings when needed most. This flexibility empowers individuals to navigate financial challenges with confidence, whether it’s covering unexpected expenses or managing cash flow between pay periods.

What is a SOC examination?

A System and Organization Controls (SOC) examination, is an audit of the controls and processes implemented by a service organization to ensure the security, availability, processing integrity, confidentiality, and privacy of the data it processes. These examinations are conducted by independent third-party auditors and are based on standards developed by the American Institute of Certified Public Accountants (AICPA). The results of SOC examinations are provided in a SOC report, which includes an independent opinion report, management’s assertions, a description of the system, testing procedures and the results of the testing.

There are three main types of SOC Examinations, each of which has a different focus:

A SOC 1 examination provides independent assurance about the effectiveness of a service organization’s internal controls relevant to financial reporting. SOC 1 examination reports are typically required by organizations that outsource key business processes to service providers, where those processes impact the financial statements of the client organization. These service providers are often referred to as “service organizations.” Typical industries that obtain SOC 1 Examinations are:
• Payroll processing providers.
• Financial transaction processors.
• Third-party administrators (TPAs).
• Employee benefit plan administrators.
• Data centers and cloud service providers.

A SOC 2 examination assesses a service organization’s controls related to the security, availability, processing integrity, confidentiality, and privacy of information. SOC 2 examination reports are typically by those vendors that handle sensitive information.
Typical industries that obtain SOC 2 Examinations are:
• Software-as-a-Service (SaaS), cloud service, and other technology solution providers.
• Data centers and hosting providers.
• Healthcare organizations
• Payment processors
• Legal and other professional service firms.

Both SOC 1 and SOC 2 examinations may be either a Type I or Type II report. Type I reports on the suitability of design of controls and Type II reports cover the operational effectiveness of controls.

SOC 3 examination provides a summary report that is used to communicate the organization’s commitment to information security and privacy to a broader audience. This type of report is generally used for marketing purposes.

For the purposes of this article, we’ll primarily focus on SOC 1 and SOC 2, due to the highly summarized nature of the SOC 3.

So, now that we’ve covered what SOC examinations are, how can a PEO benefit from undergoing one?

The nature of services a PEO provides involve handling sensitive, personal employee data, and financial data. A SOC examination can benefit a PEO in many ways. A few examples of these benefits are:

Client Assurance:
SOC 1 and SOC 2 examinations provide assurance to clients that the PEO has implemented and maintains effective controls over these processes, ensuring the accuracy and reliability of financial information.

Trust and Credibility:
A SOC 1 examination demonstrates the PEO’s commitment to maintaining strong internal controls, giving them confidence in the security and integrity of the PEO’s services.

Competitive Advantage:
SOC 1 and SOC 2 reports serve as a demonstration of the organization’s commitment to security and reliability, providing a competitive edge over other PEOs.

Risk Mitigation:
SOC examinations are geared toward identifying and assessing potential risks in the PEO’s processes related to financial reporting (SOC 1), and information security practices (SOC 2). By undergoing a SOC 1 examination, the PEO can mitigate the chance of errors, fraud, deficiencies, material weaknesses in internal control, and other issues that could materially impact financial information (SOC 1), and can mitigate the likelihood of data breaches, unauthorized access, and other security incidents (SOC 2).

Compliance Assurance:
A PEO may have attractive prospects in regulated industries that may require assurance that their service providers are in compliance with industry standards. A SOC 1 report provides documented evidence of the PEO’s commitment to and compliance with established controls, and opens doors to opportunities closed to other PEOs without SOC 1 reports.

Compliance Adherence:
For certain industries, SOC 2 compliance aligns with industry best practices and regulatory requirements related to data protection. Meeting these standards can help the PEO avoid legal complications and demonstrate compliance with applicable industry regulations.

Operational Efficiency:
SOC 1 and SOC 2 examinations can reveal opportunities to enhance and optimize its internal controls and processes. This can lead to improved operational efficiency, reduction of soft costs associated with inefficiency, and a reduction the risk of errors.

Client Attraction:
SOC 1 and SOC 2 reports can be a persuasive factor for attracting new clients who prioritize security and reliability in their HR and financial processes.

Enhanced Internal Controls:
The SOC 1 examination serves as a mechanism for the PEO to proactively assess and enhance its internal controls, leading to a more secure and resilient operational environment.

Enhanced Data Security:
SOC 2 examination focuses on information security controls, helping the PEO strengthen its safeguards for sensitive data such as employee information, payroll data, and benefits details.

Enhanced Reputation:
SOC 2 certifications can enhance the reputation of a PEO within the industry. It signals to clients, partners, and stakeholders that the organization places a high priority on maintaining the confidentiality and integrity of sensitive data.

Global Market Access:
SOC 2 certification is globally recognized and can facilitate market access on an international scale. Many clients and partners, especially those in regulated industries, value the assurance provided by SOC 2 examinations.

See below to outline distinctions between SOC 1 and SOC 2 Examinations.

Criteria, SOC 1 Examination 

• Purpose: Financial reporting controls.
• Focus: Internal controls over financial reporting.
• Report Types: Type I (suitability of design) and Type II (operational effectiveness).
• Trust Service Criteria: No, focuses on financial reporting controls.
• Audience Accessibility: Typically restricted, shared with specific stakeholders.
• Level of Detail: Detailed report on controls.
• Regulatory Compliance: Addresses financial reporting controls.
• Common Users: Clients, management, external auditors.
• Global Recognition: Recognized but may be industry-specific.

Criteria, SOC 2 Examination

• Purpose:  Information security controls.
• Focus:  Information security controls and practices.
• Report Types:  Type I (suitability of design) and Type II (operational effectiveness).
• Trust Service Criteria:  Yes, includes security, availability, processing integrity, confidentiality, and privacy.
• Audience Accessibility: Typically restricted, shared with clients and partners.
• Level of Detail:  Detailed report on controls.
• Regulatory Compliance: Primarily addresses information security controls.
• Common Users: Clients, business partners, stakeholders.
• Global Recognition: Globally recognized for information security.

Currently there are no regulatory requirements for a PEO to have a SOC Examination. Obtaining a SOC certification is optional. While this is an optional certification, individual PEOs could experience significant benefits as previously described. The PEO industry, as a whole, would benefit by the quality, credibility, and further legitimization.

The side-ways movement of the PEO index likely reflects, not the veracity of the PEO model, but the underlying negativity of business. 

As a PEO operator, you will be a trusted advisor to small and mid-size businesses in areas such as payroll, HR, benefits, workers’ compensation, unemployment, technology, and many other areas. As you grow and win more customers, they will quickly become dependent on your processes. Implementing solid processes will aid you in staying efficient and compliant. Here are some critical steps you should consider as you move forward establishing your operations. Relying on and utilizing industry experts will help you succeed.  

A PEO CONSULTANT 

Value proposition and service offering. This is an important part of establishing your operations. It will be the initial step in determining your staffing needs and what will differentiate you from competitors. Some items you will need to consider are your benefits offering, master health, or individual plans. Do you require clients to enter their own time or use a time and attendance system? Do you require direct deposit/pay cards and charge if live checks are requested? What will be your administrative fee? In the areas you will be competing, can you charge a percentage of gross or per employee fee? These are just a few of the many items you will need to consider. 

Timeline. It is important to highlight start and end dates for items such as creating business processes, choosing HRIS and service vendors, purchasing insurance policies, staffing needs, and anything else critical to your success. Be sure to review this on a regular basis for visibility and to maintain accountability within your organization.  

Budget preparation. Create a detailed business plan outlining your projected growth, expenses, and revenue streams. It is particularly important to be aware of your projected costs for the first three to five years. This will provide you with an idea of the capital needed to secure adequate funding for staff and to operate properly. Too many start up PEOs think short-term and find themselves lacking the necessary capital after the first year or two. 

References. A good consultant has connections in the industry and can refer you to additional resources such as recruiters, attorneys, HRIS systems, etc. In addition to asking for referrals, it is wise to compare multiple options to ensure their product or service fits your specific organization’s needs. 

SOPs. Talk with your consultant about developing standard operating procedures. They are a critical piece of an efficient operation.  

FROS Survey. A great resource is NAPEO’s Financial Ratio & Operating Statistics survey. Each year, the survey collects a wealth of information from revenue earned, average number of WSEs, years in operations, average number of clients, internal staff sizes, and average pay of worksite employees. The FROS Survey is a great tool to familiarize yourself with and use as a guide as you make operational decisions. 

AN ATTORNEY
Licensing requirements. Depending on the state(s) where you will initially conduct business, it will be especially important to complete the registration and licensing requirements. A law firm knowledgeable in the PEO industry can assist you with the necessary steps. There are states that require licensing before you start conducting business and will impose fines if you start operating before becoming officially licensed. Some states may require the PEO to post a bond. 

Regulatory Database. NAPEO’s regulatory database contains a wealth of information on the federal, state, and local levels. A good suggestion is to provide all members of your organization with access to this database and incorporate it into your decision-making process. 

Customer Service Agreement (CSA). Your attorney will review the states you are going to be operating in and if their statutes are based on the NAPEO Model Act or not.  Some states have PEO statutes that can predate the NAPEO Model Act, which will then require specific issues to be included in your CSA. Work with your attorney to ensure you have the necessary safeguards in place. As your PEO grows and enters additional states, it will be necessary to regularly revisit your CSA to remain compliant.
 

AN INSURANCE BROKER 

It is necessary to obtain insurance coverage such as workers’ compensation, general Liability, directors and officers (D&O), errors and omissions (E&O), and employment practices liability insurance (EPLI). Workers’ compensation policies can be challenging for new PEOs and may require additional capital until you establish a good history with the carrier. As mentioned earlier, depending on the states you are or will be operating in, a bond may be required. Choose a broker who will take the time to understand your business and explain all your options for your organization. 

A RECRUITER 

Seek out one who is active in the industry. PEO knowledgeable recruiters have a good understanding of their candidates’ skillsets/work history. This will aid you in your search for qualified candidates. Poor hiring choices cost businesses critical time and money which can cause you to miss important deadlines. In most cases, a start-up’s first hire will be an experienced operations leader, familiar with the PEO industry, and can take the lead in establishing the groundwork for your operations. 

Let’s face it, it will take time and money until you have a full staff for each department. What areas of the operations can you outsource in the initial stages? Take the time to review industry vendors and inquire if their services can augment your operations. Can your benefits third party administrator (TPA) offer additional services until you have a full benefits department? Would it be cost effective to outsource the handling of your unemployment administration? 

Refer to your timeline and budget to determine when you need to hire additional staff. In some scenarios, a startup will hire PEO professionals who have experience in more than area of the business. For example, they may bring on a tax specialist who can also process initial payrolls, giving you breathing room to onboard your first couple clients. It is not a recommended long-term solution, so you will want to monitor your timelines and hire additional staff as soon as possible. This will allow you to build your foundation and develop the necessary processes.
 

AN IT VENDOR 

Establishing proper cybersecurity protocols is critical as threats are even more prominent than ever. You need an IT vendor who can maintain your IT infrastructure and be responsive to your needs. Here are a few suggestions to implement to protect your data: Phishing simulations and security monitoring; Email Encryption and SharePoint/File DLP Policies; Cloud Check Printing; and, HIPPA and SOC2 Compliance Assistance. Regular meetings with your IT firm will help to ensure you are protecting your data from current threats. A suggestion is to include your IT vendor in your security discussions with your HRIS vendor.
 

CHOOSE YOUR HRIS SOFTWARE 

Your HRIS software will be the core of your operations, and it is important to carefully vet your choices. Prepare a checklist with questions and have the software vendor respond in writing to your questions. 

Schedule multiple demonstrations in each area to get a complete understanding of the software’s capabilities and processes. Some capabilities you should review are: New Client Implementation; Employee Portal/Mobile App; Employee Onboarding; Electronic Benefits Enrollment; Benefits Administration and Reconciliation; Payroll Processing and Multi-state Tax Handling; Reporting and Data Export; and Importing Capabilities.  

Also, be sure to ask for references for current and past customers. Other points about an HRIS to consider are:  

Pricing/Modules: How does the pricing scale as you grow? Are there modules not included in the base pricing and if so, what are they? Negotiate a cap on price increases if possible. 

Service Agreements: Be sure you fully understand the terms of the contract. Ask legal to review and outline any concerns. 

Third Party Vendors and APIs: How easy it is to integrate with other vendors and what are the costs? 

Implementation Process: Ask for an implementation timeline and be sure to establish a realistic date you will be “live” on the system. How many hours are included and what are all the costs, what options do you offer around training new employees as your organization grows? 

Support: How do you contact their support – via email, chat, phone, and/or support cases?  What is their Service-Level Agreement (SLAs)? Can your business operate efficiently with the proposed SLAs? What is their process for high priority cases? 

Data: In the event of a termination of service, will you receive your data in a readable format, and will there be a fee? 

Customer Service: Who will be available for questions outside of regular support? Will you have a CSM assigned to your account? 

Take the information you receive from each software vendor and consolidate it into one document. Hold internal meetings to review the information collected. Software implementations are a large undertaking for a PEO and it is best to choose a system that best suits your specific business model and service offerings. 

Once you are up and running, remember that setting up a PEO is extraordinarily complex, and growth brings additional complexities. Continuing to stay up to date with changes in laws, regulations, and compliance will be particularly important, as well as continuously improving your services. Choosing partners who best suit your business, providing top-notch customer service, and developing strong processes will be critical to your overall success.  

Lastly, the PEO industry is like one big family so ask for help if you have questions. If you are not sure who to contact, reach out to NAPEO and they will gladly connect you with the best resource.   

This article is designed to give general and timely information about the subjects covered. It is not intended as legal advice or assistance with individual problems. Readers should consult competent counsel of their own choosing about how the matters relate to their own affairs.