Charities can reclaim a portion of their VAT costs based on non-public funding ahead of the 30 June deadline. Liam Farrell explains how to do it Charities are entitled to claim a refund of a proportion of their VAT costs based on the level of non-public funding they receive, but the deadline to submit the application – 30 June – is fast approaching. Making a claim Where the total amount of eligible claims from all charities in each year exceeds the capped amount, claims will be paid on a pro-rata basis. The cap on this has increased to €10 million from 1 January 2024. To qualify for this scheme, a charity must, at the date of claim and at the time the qualifying expenditure was incurred: be registered with Revenue and hold a charitable tax exemption (CHY) under section 207 Taxes Consolidation Act (TCA) 1997; and be registered with the Charities Regulatory Authority (CRA). For a charity to submit a claim, they must have: a tax registration number issued by Revenue; bank account details; and a registered Charity Number (issued by the Charities Regulatory Authority). A claimant must also hold a current tax clearance certificate when making a claim. Claims for VAT compensation must be submitted through e-Repayments on Revenue’s Online System (ROS). These claims, along with any supporting documentation, must adhere to the required format and meet the deadlines specified by Revenue. Claims can be submitted annually between 1 January and 30 June for eligible VAT paid in the previous calendar year. Claimants may amend their claims until 30 June of the submission year, but not thereafter. The maximum claim amount is €1,000,000, the minimum claim amount is €500, and the minimum repayment is €5. Additionally, claimants must declare and certify that all information provided is correct. To support a claim, detailed documentation is required, including a breakdown of total income, qualifying income and qualifying expenditure. VAT records, such as invoices and receipts, must be retained by charities for six years. There must be evidence that the goods and services claimed were used for charitable purposes, that the VAT was paid in the relevant year, and that the income used for calculations was received in that year. The most recent set of audited accounts, corresponding to the financial year of the claim or the claim submission year, is also necessary. Furthermore, claimants must provide evidence that the charity was not entitled to a VAT deduction or refund under other legislation and must show compliance with the VAT Consolidation Act 2010, the Taxes Consolidation Act 1997, the Stamp Duties Consolidation Act 1999, and related secondary legislation. Qualifying income The proportion of a charity’s income that is privately funded is known as ‘qualifying income’. This excludes publicly funded income and income already excluded from the total income calculation. To calculate qualifying income, a charity should deduct from its total income for the year to which the claim relates all non-qualifying income. Some examples of non-qualifying income are Charitable Donations Scheme repayments, Charities VAT Compensation Schemes refunds, county council grants and charity shop income, among others. Qualifying expenditure Expenditure in respect of which a VAT refund may be sought under this scheme is described as “qualifying expenditure”. Conditions apply to the calculation of qualifying expenditure are as follows: compensation may be sought in respect of VAT which was paid in the State on certain expenditures and in the year to which the claim relates; that expenditure must have been for goods or services used by the charity only for its charitable purpose; and if a charity is entitled to receive any relief, refund, repayment or deductibility under any other scheme or legislation administered by Revenue, it may not include that amount in the calculation of a claim. What next? Applications under the scheme should be submitted by 30 June 2024 in respect of calendar year 2023. It is important to note that claims submitted after the 30 June deadline will not be accepted under any circumstances. Liam Farrell is Director of Accounts & Business Advisory Services at Azets

As entities prepare for the introduction of the Digital Operational Resilience Act, IT security and compliance will be front of mind for many, writes Jackie Hennessy With the Digital Operational Resilience Act (DORA) on the way, entities must move from preparation to implementation and take steps towards demonstrating how their practices comply. Financial entities will need to demonstrate appropriate security and resilience of critical information and communication technology (ICT) systems and applications to comply with DORA. The level of compliance efforts will vary depending on the size and complexity of your entity. A risk-based approach, appropriate security and resilience testing are necessary to address potential vulnerabilities and to prove compliance in meeting the evidence requirements of the European Supervisory Authorities. By focusing on long-term resilience, entities can establish a resilient foundation, which will aid them in their steps towards DORA compliance. Resilience means learning from the past, to improve the present, and to prepare for the future.  To make entities ready for DORA, there are five key actions to assist those in the preparation phase. These actions will enable entities to effectively manage their digital operational resilience. 1. Determine strategic priorities To enhance business practices, organisations must aim to achieve a transformation towards a resilient end-to-end IT and operations environment. To ensure strong risk management, a focus should be placed on achieving a broad agile transformation that takes into account risks associated with ICT suppliers and continuity measures. Additionally, it is necessary to aim to increase your organisation's agility in serving digital channels by implementing strong business continuity management (BCM) measures. 2. Implement resilience and incident management measures To ensure effective implementation of your DORA program, it is crucial to ensure leadership support, as well as translation of strategic and regulatory requirements into operational measures. It is essential to enable control owners and line management to manage compliance requirements in a risk-based way, including the automation of controls related to digital resilience, to manage the complexity of (compliance) requirements effectively. Think big and start small – for example, by organising a workshop with relevant middle-management players to align and agree on the implementation strategy of your DORA program. 3. Manage third-party risks To ensure effective management of ICT risk related to third-party providers, it is essential to conduct complete monitoring of all ICT-related third-party risks throughout all relationship phases. This involves the classification and analysis of providers and their management bodies, record-keeping of relevant information, managing proportionality, managing compliance and creating a third-party risk assessment process risk strategy. By undertaking these steps, comprehensive management of ICT risk in relation to third-party providers can be ensured. 4. Test digital operational resilience To ensure operational resilience, it is crucial to test critical functions more frequently than non-critical, at least once per year. The program for testing digital operational resilience must be based on relevant threat scenarios. Best practice is to implement an appropriate test set-up for each threat, to test the resilience effectively. Moreover, every three years, entities are required to perform threat-lead penetration testing that simulates a realistic and advanced cyber-attack. This simulation helps organisations to prepare and train for real cyber-attacks. 5. Implement measures for resilience and ICT incidents To establish strong operational resilience measures and incident management, it is essential to accomplish resilience testing from a wider perspective, which – beyond technical security testing – includes regular crisis simulations. It is important to improve business continuity plans and ICT crisis scenarios to ensure that uncontrolled disruptions are avoided due to slow and ineffective incident management. Moreover, accomplishing mature threat intelligence and assessing top continuity risk scenarios is crucial to enhancing resilience and preparedness in critical situations. By understanding these measures, strong operational resilience can be established, ensuring smooth and uninterrupted operations. Jackie Hennessy is a Partner at KPMG 

Scammers are targeting victims with new tactics, causing financial loss and mental distress. Ola Opoosun explains how organisations can protect themselves with the SCAM checklist From convincing phone calls and text messages requesting financial information to elaborate online scams, scammers are always looking for new ways to catch people off guard.   In 2023 alone, UK Finance reported that scammers stole £1.17 billion through unauthorised and authorised fraud. In fact, scammers target those who they perceive as more vulnerable, including the elderly, with data showing that an older person falls victim to fraud every 40 seconds.   While the financial impact of scams can be costly, they can also leave people feeling embarrassed and unsettled and can have a lasting impact on our confidence, especially in a workplace situation.  Three in ten (29%) say that being a victim of fraud has harmed their mental health, leading them to seek help with anxiety and depression.   How can organisations stay alert to scams and prevent them from happening to themselves and their clients? The golden rule of avoiding scams is to be vigilant.   Knowing what to look out for and feeling confident enough to check or challenge what you're being asked to do, especially where something doesn't feel quite right, is very important.    If you ever find yourself in a situation where you’re unsure what to do, our handy acronym “SCAM” can help you put together a quick checklist to help you work out if a request for financial and personal information is genuine or not.  S – Sender  If you receive a message out of the blue, ask yourself: is it a complicated email address, or one that's familiar yet not quite right? An unknown phone number?  Don’t assume that an email address, postal address, website or phone number is always authentic.   Always stop and check the sender’s address or number to make sure it’s legit. C – Chasing  If you get a call out from someone requesting sensitive or urgent information relating to their account, it could be a scam. Time pressure can be an obvious red flag as scammers might use tactics to convince you to make a hasty decision without thinking things through. However, a trusted organisation would never rush you into make an important decision such as transferring money or sharing credit card numbers.   Remember to stop and take the time to think through your decision and question if it seems like suspicious activity.   A – Action  An online, phone or email scammer will likely try one of a number of ways to get you to send money or personal information but it’s important to remember that a genuine organisation would never ask you for security details, especially out of the blue.   M – Mistakes  Scammers impersonate trusted companies, organisations and even people. If you receive an email or text with spelling errors or strange wording, these are tell-tale signs that can be a big giveaway that it’s a scam.  Scammers are hoping that people will overlook typos. You should carry out an online search of the number or email address to see if it's legitimate before replying to the message.   Falling victim to a scam  It’s important to remember that anyone can fall victim to a scam. Falling victim to a scam is nothing to be embarrassed about.   If you’re worried that you have been scammed online or through another method, your organisation’s financial security has been compromised, or you spot any fraudulent activity on accounts, involve your leadership team as soon as possible so they can contact the proper authorities and minimise risk to the company. With scams becoming increasingly sophisticated, it’s important to be more vigilant and feel confident to check or challenge what you're being asked to do.   Trust your instincts and remember “SCAM” to protect yourself and your organisation.   Ola Opoosun is Head of Support Services at caba

As businesses navigate technological disruptions, economic fluctuations and global crises, leaders must prioritise investing in resilience, writes Neil Hughes Resilience is defined as the ability to adapt to change positively, recover from difficulties and persist in facing challenges. The pace of change in business today is relentless, and for business leaders, resilience is a more crucial attribute than ever. Organisations need leaders capable of staying focused, being consistent and remaining inclusive under pressure. Building a resilient workforce can help organisations to navigate change more effectively, sustaining competitive advantage, growth and long-term success. Best practice suggests several key areas of focus for leaders and organisations to consider. Prioritising wellbeing and mental health According to a 2023 survey by the Chartered Institute of Personnel and Development, 76 percent of UK employees reported that mental health support at work directly contributes to their overall job satisfaction. Mental health is foundational to resilience. Business leaders should strive to create a supportive environment that prioritises mental health through comprehensive wellness programmes. This includes providing access to mental health professionals and resilience tools to support employees in managing stress and adapting to change. Encouraging open conversations about mental health can foster a culture where employees feel safe and supported. Fostering a resilient and inclusive team culture Resilience should be embedded within the organisational culture. Leaders must foster a workplace culture that encourages collaboration, open communication and psychological safety, where small wins are recognised, feedback is encouraged and acted on and failures are seen as learning opportunities rather than setbacks. Creating an inclusive culture where diverse perspectives are valued can enhance problem-solving and innovation. Regular team-building activities, training focused on resilience, and creating a safe space for employees to voice their concerns can significantly boost team morale and cohesion. Investing in continuous learning and development Continuous learning is critical to building a resilient workforce. By investing in ongoing training and development programmes, leaders can equip employees with the skills needed to adapt to new challenges. Offering opportunities for professional growth helps employees stay current and confident in their roles. Encouraging a growth mindset, where challenges are seen as opportunities for learning, can foster resilience and innovation. Role modelling resilience and self-care To lead effectively, business leaders need to invest in their own wellbeing and resilience. Resilient leaders are those who continuously learn, adapt, and maintain their physical and mental health. This involves regular training, seeking coaching or mentorship, and embracing a growth mindset. Leaders who prioritise self-care practices such as regular exercise, adequate sleep, and mindfulness activities can manage stress more effectively, maintaining mental agility. . Leaders play a critical role in modelling resilience and those leaders who prioritise resilience not only enhance their capacity to grow and move forward in the face of adversity but also inspire their teams to do the same. Whilst building resilience involves effort, commitment and time, it can be the protective layer required to equip leaders, their teams and organisations to face the challenges of the ever-changing landscape of work. Neil Hughes is a Director in People and Change Consulting at Grant Thornton Northern Ireland

Sandra Healy explains the importance of a strong organisational culture and how it can lead to satisfied and long-term employees Organisational culture is the personality of the organisation, shaping how employees interact with each other, management and customers. A strong organisational culture can have a significant impact on employee retention because it creates a sense of belonging and purpose. When employees feel that they are part of a community that shares their values and goals, they are more likely to stay with the company for the long term.  A positive organisational culture can also lead to greater employee engagement. When employees feel that their work is meaningful and that they are making a difference, they are more likely to be motivated and productive. This can lead to better business outcomes, such as increased revenue and customer satisfaction.  On the other hand, a negative organisational culture can have the opposite effect. If employees feel that they are not valued or that their contributions are not recognised, they may become disengaged and demotivated leading to high turnover rates.  Organisational culture can impact employee retention in other ways, as well. A strong culture of work-life balance can help employees feel that they are able to maintain a healthy balance between their personal and professional lives. Similarly, a culture of learning and development can help employees feel that they are growing and developing professionally.  Key components to a good organisational culture  A strong organisational culture is built on a foundation of shared values and beliefs that guide the behaviour of employees. These values and beliefs are communicated through various channels, such as company mission statements, vision statements, and core values. When employees understand and embrace these values, they are more likely to feel a sense of belonging and purpose within the organisation.  Another key component of a strong organisational culture is effective communication. Leaders who communicate regularly and transparently with their employees can help to build trust and foster a sense of community within the organisation. Employee recognition and appreciation are also important components of a strong organisational culture. When employees feel that their contributions are valued and recognised, they are more likely to feel motivated and engaged in their work. Finally, a strong organisational culture is one that promotes work-life balance and employee well-being. When employees feel that their personal needs and well-being are valued by the organisation, they are more likely to feel satisfied and committed to their work. Measuring organisational culture Measuring the current organisational culture can be done through various methods: Surveys can be distributed to employees to gather their opinions on the company's values, communication, leadership, and overall culture. Interviews with key personnel such as managers and executives can provide insight into the company's goals and how they align with the culture. Focus groups can also be conducted to gather opinions from a diverse group of employees. These methods can help identify areas where the company's culture is strong and where it needs improvement.  Another way to measure the organisational culture is to look at employee turnover rates. High turnover rates can indicate a negative or toxic culture, while low turnover rates can indicate a positive and supportive culture. Exit interviews can also provide valuable feedback on why employees are leaving and what can be improved to retain them.  Once the current organisational culture has been measured, the company can identify areas for improvement by analysing the data collected from surveys, interviews, focus groups, employee turnover and exit interviews, then create an action plan to address the areas that need improvement. Improving the organisational culture is an ongoing process. The company should regularly measure the culture and make adjustments as needed. This will help ensure that the culture remains strong and supportive, leading to greater employee engagement and retention.  Best practice One of the best practices for building a positive and inclusive organisational culture is to establish a clear set of values and principles that guide the organisation's actions and decisions and then communicated to all employees and integrated into all aspects of the company's operations. Organisations must also encourage open communication and collaboration among employees by engaging everyone in regular team-building activities, open-door policies, and opportunities for feedback and input. When employees feel that their voices are heard and their contributions are valued, they are more likely to feel invested in the success of the organisation and less likely to seek opportunities elsewhere.  Creating a supportive and inclusive work environment is also crucial for building a positive organisational culture. This means promoting diversity and inclusivity in all aspects of the workplace, from hiring practices to daily interactions among employees. Finally, it is important to create formal recognition programs, such as employee of the month awards or performance bonuses, as well as through informal gestures such as thank-you notes or public praise. When employees feel that their hard work and dedication are appreciated, they are more likely to feel motivated and committed to the organisation over the long term.  Sandra Healy is Founder of Inclusio

Businesses need clever strategies to counter the cyber security challenges arising from the emergence of artificial intelligence, writes Puneet Kukreja The enormous power of generative artificial intelligence (GenAI) and large language models (LLMs) is just beginning to be understood. Its capacity to automate and accelerate business processes is only starting to be explored fully. As is the case with the deployment of any new technology, however, GenAI brings with it new cyber vulnerabilities. Cyber security matters are emerging as a key concern for technology leaders in Ireland amid the surge of AI-enabled cyber attacks. According to the EY Ireland Tech Leaders Outlook Survey 2024, the percentage of respondents who identified elevated cyber risks and the management of data protection and data flows as critical challenges has risen to 61 percent, up from 53 percent in 2023. Like the move to the cloud over a decade ago, the technology will create new cyber exposures and increase the attack surface for cyber criminals. For example, consideration needs to be given to securing the LLMs that gather and analyse data from various departments within the organisation. Ensuring the secure collection and transmission of this data is paramount, as is the fortification and security of the model itself. Monitoring emerging vulnerabilities closely This is not a reason to shy away from the technology. It is simply a reminder that it must be treated in the same way as any new IT investment from a cyber security point of view. Few organisations would risk connecting an unsecured PC or laptop to their network and the same approach should apply to AI. AI in cyber security is a double-edged sword. Where it empowers organisations with enhanced security capabilities, it also equips cyber criminals with similar tools by enabling individuals lacking advanced coding skills to leverage GenAI and create malicious code efficiently. With just a few prompts, GenAI can quickly generate code to identify and exploit vulnerabilities within an organisation's network, a task achievable within minutes. Change approach, not budget The good news for organisations and for Chief Information Security Officers (CISOs) is that they do not necessarily have to make significant new cyber security investments to restore the balance. The first step is to focus on what you already have. It is not a question of a new investment in cyber security, rather a new approach. In the same way as the cloud changed the shape of organisations’ networks and cyber defences had to be extended to cover the new expanded perimeter, existing defence systems will need modification to bring GenAI models within their orbit. Stolen credentials present a grave peril to organisations. To bolster security beyond passwords and multi-factor authentication (MFA), organisations can deploy AI-driven solutions that monitor user behaviour for unusual login patterns or atypical actions. These systems scrutinise user interactions with critical infrastructure and can swiftly detect unauthorised access attempts or transactions. Adopting this strategy enhances cyber security defences by integrating AI technology that can strengthen existing measures and counter new threats with speed and efficacy. Procurement processes will also play an important role. Organisations must ensure that they are not buying trouble when they invest in GenAI. They need to interrogate vendors very closely to ensure that the systems they are acquiring are secure and do not bring increased vulnerabilities with them. Of course, organisations will need to invest in upgrades to guard against the AI-driven increased sophistication of phishing and other cyberattacks, but this can be accommodated within normal cyber budgets. Finally, it cannot be emphasised enough that GenAI will not offer a silver bullet to organisations seeking to bolster their cyber defences. Humans: the last line of defence While organisations exploit the potential of advanced AI, they need to be mindful of the advent of new cyber vulnerabilities. Using existing cyber security measures to protect AI systems and applying rigorous due diligence to the purchase of such systems will help deal with the heightened threat, as will increased awareness of the new environment. While it undoubtedly offers the ability to further automate certain elements of cyber defence and to enhance threat detection, this will not replace any of the existing cyber security systems in place or the human as the last line of defence. Puneet Kukreja is Cyber Security Leader at EY