Valuing Innovation: Accounting for intellectual property in today’s idea-driven economy

Mark Pineda

Mark Pineda

Co-Founder and Managing Member

Valuing Innovation: Accounting for intellectual property in today’s idea-driven economy

Recent decades have brought about a significant shift in the global economy. We’ve moved away from the factories and smokestacks of the past and towards an economy fueled by ideas. Where physical resources and manufacturing prowess were once the primary drivers of economic growth, today, knowledge, creativity, and innovation reign supreme.


Are you looking for Services that can solve your technical accounting challenges? Click here to visit our page!


Innovation has emerged as the cornerstone of economic competitiveness, driving advancements in technology, science, and business practices. At the heart of this transformation is the recognition that intellectual capital, rather than physical assets, holds the key to sustainable growth and prosperity in the modern world.


The modern economy revolves around two key concepts: innovation and intellectual property (“IP”). Innovation fuels progress by continually introducing new products, services, and technologies that respond to consumers’ dynamic needs. Intellectual property provides the essential legal framework to safeguard and incentivize this innovation. Innovation and IP form the bedrock of today’s thriving and dynamic economy.


What’s shaping today’s intellectual property landscape?

The emergence of a knowledge-based economy has reshaped how companies approach IP. With the rise of innovative technologies and the growing emphasis on automation and digitalization, businesses increasingly invest in developing valuable IP assets in-house. This encompasses creating proprietary software solutions tailored to automate processes, catering to the evolving needs of consumers and businesses.


These in-house innovations represent a significant departure from traditional IP acquisition models. The shift poses unique challenges in accounting, particularly in reconciling differences between accounting for acquired IP and internally generated IP.


Intellectual property in the accounting domain

The significant distinction between the accounting treatments for acquired and internally generated intellectual property (IP) lies in their initial recognition and measurement. While acquired IP is generally recognized at cost, internally generated IP is typically expensed unless specific criteria are met. However, once recognized, the subsequent accounting implications for both types of IP are generally similar, including amortization, impairment testing, and disclosure requirements.


Adherence to accounting standards like IAS 38 under the International Financial Reporting Standards (“IFRS”) and ASC 350 under U.S. Generally Accepted Accounting Principles (“US GAAP”) necessitates a thorough understanding of these nuances. While these standards often apply to for-profit entities, nonprofit financial reporting also demands clarity when recognizing and measuring internally generated intellectual property (IP), especially in research-driven organizations. This article aims to provide guidance on the proper recognition and initial measurement of internally generated IP, offering insights to appropriately account for their intellectual property assets in today’s era of innovation and knowledge-based economy.


The next section outlines the recognition criteria for internally generated intangibles under IFRS and U.S. GAAP.


Accounting for internally generated IP

Valuing Innovation Blog Graphics Graphs Charts 5.jpg e1727926005865 946x1024

Accounting for internally generated software under U.S. GAAP

The accounting treatment for software development costs can differ depending on the software’s intended purpose. This section specifically applies only to US GAAP.

Valuing Innovation Blog Graphics Graphs Charts 6.jpg e1727926055739 819x1024


New tax treatment of R&D expenses under the Tax Cuts and Jobs Act

The Tax Cuts and Jobs Act (TCJA) has significantly changed the tax treatment of research and development (R&D) expenses. Prior to the TCJA, businesses could generally deduct these expenses in the year they were incurred. However, for tax years beginning on or after January 1, 2022, the TCJA mandates that these costs, for tax purposes, be capitalized and amortized—spread out over five (5) years for domestic research or fifteen (15) years for international research. This guidance can be found under Section 174 of the Internal Revenue Code.


Another notable change under the TCJA is including software development costs within the definition of R&D expenses. This means software development costs are subject to the same capitalization and amortization requirements. It’s essential to note that this change impacts tax reporting only. The financial statement treatment of R&D expenses remains governed by accounting standards like Generally Accepted Accounting Principles (GAAP). While the tax rules have changed, companies must continue to follow their standard accounting practices for financial reporting purposes.


These changes can significantly impact companies with substantial R&D expenses. Even if a company reports a financial loss on its books, the new rules could still lead to taxable income due to the capitalization of R&D costs, potentially increasing the company’s tax burden.


How Scrubbed can help

The diverse nature of intellectual property today can pose challenges in pinpointing the necessary and appropriate accounting guidance to apply, a task that is both crucial and complex. The Scrubbed Technical Accounting Group can assist you in evaluating specific scenarios related to intellectual property and intangibles (IAS 38 and ASC 350). Whether it’s analyzing complex accounting transactions, crafting comprehensive memos, and ensuring adherence to presentation and disclosure requirements under specific guidance, risk and SOX compliance, and regulatory mandates, our team is equipped to guide you.


Get in touch with Scrubbed to discover how our Technical Accounting Group can assist your business in navigating accounting complexities associated with intellectual property.

Related Content

Blogs

SESSION 1: Building Scalable Growth Through Strategic Fractional Partnership

SESSION 1: Building Scalable Growth Through Strategic Fractional Partnership

How Adapture Renewables Built Scalable Growth with Strategic Fractional PartnershipHow do you keep operations ongoing… while doing a deep audit endeavor?This was the critical question facing Ivan Kwan, VP of Corporate Finance at Adapture Renewables, as his company began to scale. It’s a classic high-growth dilemma: the core business is moving at top speed, but the finance team is stretched thin, facing strict deadlines and budgetary constraints. In our recent “The Future is Fractional” virtual conference, Ivan sat down for a candid fireside chat with Diana Peralta from Scrubbed to share his playbook for solving this exact problem. He detailed how he moved from handling the company’s first audit by himself to building a scalable, resilient finance function through a strategic fractional partnership with Scrubbed. If your business is struggling to balance growth and resources, here are the key highlights from his session.How Adapture Renewables Built Scalable Growth with Strategic Fractional PartnershipThis was the critical question facing Ivan Kwan, VP of Corporate Finance at Adapture Renewables, as his company began to scale. It’s a classic high-growth dilemma: the core business is moving at top speed, but the finance team is stretched thin, facing strict deadlines and budgetary constraints. In our recent “The Future is Fractional” virtual conference, Ivan sat down for a candid fireside chat with Diana Peralta from Scrubbed to share his playbook for solving this exact problem. He detailed how he moved from handling the company’s first audit by himself to building a scalable, resilient finance function through a strategic fractional partnership with Scrubbed. If your business is struggling to balance growth and resources, here are the key highlights from his session.Building Trust with an Incremental StrategyFor leaders worried about a “loss of control,” Ivan detailed his deliberate, incremental strategy for engaging a fractional team. Instead of going all-in, Adapture Renewables started with hiring people from Scrubbed for foundational tasks like bookkeeping (AP/AR). This allowed them to build confidence in the process and establish approval workflows that maintained control. This approach also opened the door to an unexpected benefit: the ability to “sample a buffet” of services. As Ivan explained, they could engage specialized expertise, like ESG reporting or technical tax, for a one-off engagement without having to hire a full-time, niche expert.Integration is a Mindset, Not a MemoI looked at the fractional staff as our staff, just housed elsewhere.The session’s most powerful insights centered on how to make a fractional partnership work. For Ivan, success came from a crucial mindset shift. Ivan warned against treating fractional teams like “a 1-800 number… a black box you call.” The key, he said, was a crucial mindset shift:This meant investing in integration through frequent communication and, most importantly, face-to-face time. Ivan admitted he didn’t visit the Scrubbed office until 2022, already four years into the partnership. When talking about his experience, he shared that “I would often tell that in that 10 days or so, I felt more connected with the team than in the prior four years combined”Achieving Flawless Compliance and Tech Adoption The move paid off. When asked about the measurable impact, Ivan pointed to two key outcomes:Flawless compliance:The session’s most powerful insights centered on how to make a fractional partnership work. For Ivan, success came from a crucial mindset shift. Ivan warned against treating fractional teams like “a 1-800 number… a black box you call.”The key, he said, was a crucial mindset shift:Tech adoption:The fractional team, already adept with tools like Zoom, Slack, and Asana, helped speed up Adapture’s own tech adoption. When the pandemic hit, it “was not adopting something new or novel,” Ivan explained. “It was just scaling up what we already had, the ecosystem we already had with the Scrubbed team.”Watch the Full Session Ivan’s story is a masterclass in how to strategically leverage fractional talent to not only manage growth but also to build a more resilient and efficient operation. To get all the insights, including Ivan’s advice on the single best role to start with and his hindsight on what he would do differently, you can watch the full session recording. GET YOUR ON-DEMAND ACCESS

Read More >
Blogs

Securing Your Web Applications: Understanding and Preventing Broken Access Control

Securing Your Web Applications: Understanding and Preventing Broken Access Control

Introduction Broken Access Control (BAC) might sound like a minor issue, something easily spotted, but it’s actually one of the most frequently overlooked security flaws. While many focus on threats like Remote Code Execution (RCE) or Cross-site Scripting (XSS), BAC silently allows unauthorized users to perform actions they shouldn’t, often without any complex attack. A simple forgotten backend check can lead to sensitive data exposure or elevated permissions, just by slightly modifying the target web address. In this post, we’ll walk through how you can test for Broken Access Control using Open Worldwide Application Security Project (OWASP) Juice Shop—an intentionally vulnerable web application that makes it easy (and safe) to demonstrate these issues in practice. Understanding Broken Access Control Access control directs who can do what in a system. When it’s broken, users can act outside their intended permissions. Users might be able to read other users’ data, modify other roles, or access administrative functionality without authorization. OWASP defines this category broadly and it includes: Vertical privilege escalation: Accessing higher privilege functions (e.g., a user accessing admin functions). Horizontal privilege escalation: Accessing same role resources (e.g., viewing another user’s order). IDOR (Insecure Direct Object Reference): Accessing data by manipulating object references like user IDs or filenames. Forced browsing: Accessing hidden resources or unlinked pages directly. While it might be hard to understand these concepts at first, Juice Shop does a great job showcasing these problems in a safe, intentionally vulnerable playground. Testing for Broken Access Control For this simulation, you will need to install Juice Shop in your local environment and use Burp Suite to capture traffic while interacting with it.Gaining Privileged Access Juice Shop is a deliberately vulnerable web application that exhibits the classic Forced Browsing and Vertical Privilege Escalation vulnerability. Imagine if someone could access admin functions by just visiting a URL; that would be a security nightmare. Fortunately, we can demonstrate this in Juice Shop without the risk. You can test this by attempting to access hidden resources or unlinked pages directly using keywords such as “admin,” “root,” or other common path names in the URL. In our case, the Administration page can be accessed by visiting the “/#/administration” path. This page was not linked anywhere in the standard UI, yet entering the URL directly allowed full access to the user listing and the ability to remove customer feedback.Note that this vulnerability is accessible if you are already logged in or tagged as an admin role user inside OWASP Juice Shop. However, given that this is hidden in the user interface even if you log in as an admin user, we can infer that it was not meant to be exposed to users (including admin users). In some real-world scenarios, some web applications allow access to the affected endpoint to all users as long as they enter the correct address. But you’re probably curious how we can access this page using a regular, low-privileged accountFirst, inspect how the authentication works. Upon logging in, a token will be sent to your browser and subsequently attached to every HTTP request made to Juice Shop.At this point, you will have to study JWT, but let’s assume that you already know it. What do you think would happen if we change the JWT role parameter or claim to something else, like “admin”?You guessed it right. Modifying the JWT and changing it to “admin” allowed us to access the “/#/administration” page while logged in as a regular user. All you need to do is use Burp Suite’s JWT Editor extension, modify the role parameter or JWT claim to “admin,” go to your browser’s local storage, and replace the token key with the modified JWT, and Voila! You now have access to the Administration page even as a regular user.Viewing and Tampering Another User’s Basket This is an example of Insecure Direct Object Reference (IDOR) and Horizontal Privilege Escalation. Imagine if you have an e-commerce site and anyone can add or delete items in another user’s shopping cart. That would leave your customers confused. To test this vulnerability, log in as a regular user and inspect HTTP requests and responses related to user basket actions. In Burp Suite, notice that visiting your own basket generates a “GET /rest/basket/6” request to Juice Shop. Immediately, you can see from that request that our basket has an ID of “6.” Out of curiosity, if we change the basket ID to another number, will we be able to access other users’ baskets? It turns out we can. There are a couple of ways to test this, but by going to the browser’s Developer Tools > Storage > Session Storage, we can see a “bid” parameter. Modifying it to another number, in our case “3,” and refreshing the page would let us access basket #3—with no ownership check, just the data. This is an example of a horizontal IDOR vulnerability, where users at the same privilege level can access each other’s data by simply modifying object references.Alternatively, the details for basket #3 can also be accessed by repeating the original HTTP request in Burp Suite and modifying the ID to “3”.We were able to see the details of the other user’s basket, but how do we tamper with it? Let’s go back to Burp Suite and study the HTTP request and response flow. Notice that, besides viewing your own basket, adding items to our basket requires a “BasketId” parameter. This is the key to the attack. What if we modify the “BasketId” before sending the request? Will we be able to modify another user’s basket successfully? The short answer is yes, but it is not as easy as it sounds. But before we do the attack, we have the following in basket #3. Remember, our basket is basket #6.Now, let’s modify the “add to basket” request and change the “BasketId” to a different number. However, you will notice that trying to change it won’t modify the basket content of our target.So, what should we do? There are many things you can try, but to cut a long story short, you might discover that adding a second “BasketId” would push the request and modify our target’s basket as well.This tells us that if the backend interprets the requests, and if it finds another “basketID,” it will apply the same action to it. Do you see where I’m going with this? Perhaps adding more “basketID” values would enable a multi-basket attack, but I will leave that for you to try. This means that ignoring access control measures can lead to numerous issues in your web application, potentially affecting multiple accounts by disclosing sensitive information or, as in our case, the contents of a user’s basket. Forged user reviews In Juice Shop, as with almost every e-commerce site, users are allowed to write and submit reviews. This generally benefits both the store owner and enhances the overall user experience. But what if someone could forge a user review? What if a customer review was written and attributed to someone else, perhaps a high-profile user of the site? That would greatly affect the product’s performance, right? This is what we wanted to achieve here: post a user review and attribute it to a different user. Now, you’ll notice that whenever you write and submit a product review, this PUT request is sent.Remember our previous attack that affected another user’s basket? How about the attack where we found the admin email address (see Gaining Privileged Access)? Let’s test that. What would happen if we modify the author before sending it to the endpoint? Would that change the author itself? Let’s see.And what do you know, we were able to post a review using a different user! And we can confirm that by browsing the exact product in the web application.So, the lesson here? Yes, broken access control also helps attackers forge account actions. Directory enumeration and restricted file download One common pitfall of improperly implemented access control is that restricted directories and their included files become accessible for download. This vulnerability is often found in applications rushed to production or those that don’t undergo regular security testing. While this may be harder to find in the real world today, this vulnerability still exists in some web applications. But fret not, Juice Shop exhibits this weakness. If you’ve explored Juice Shop before, you might have stumbled upon various directories, including the `/ftp/` directory. You’ll notice that accessing this directory reveals a number of files without requiring any additional authentication. You can even access some of the files enumerated.Clearly, some of these files are not intended to be accessed, which in itself indicates an access control violation. If you further explore the directory, you’ll discover that attempting to access files with extensions other than “.md” or “.pdf” results in a restriction notification. As curious individuals, we’ll want to bypass this. Fortunately, Juice Shop is vulnerable to null-byte injection.Null-byte injection is essentially an implementation-related vulnerability stemming from a weakness in the framework, underlying library, logic, or a combination of all these three. To perform a null-byte injection, we need to append a null-byte (`%00`) to the filename, hoping that the application won’t sanitize our request.Initially, adding `%00` to the end of the URL might not yield results, perhaps because the server expects a valid file extension. To address this, let’s append a `.pdf` extension.Still not working, right? Perhaps something is blocking our request. Let’s see if encoding will help us get through. Let us encode % and see what happens.Well, what do you know, it works! Now we can access the restricted file and see its content. Clearly this is a violation of access controls. How to Prevent Broken Access Control? If you’re building or maintaining web applications, Broken Access Control (BAC) is one of the most important risks to address. Here’s what you can do to avoid the issues above: Enforce Access Controls on the Server Side Don’t rely on client-side code or hidden links. Every sensitive operation should include server-side checks against the user’s authenticated identity and role. Use Context-Aware Authorization and Centralize Access Control Logic Implement logic that not only checks the user’s role but also whether the user owns the resource in the specific transaction context. For example, confirm “user.id == order.ownerId” before returning order data. Centralize your authorization logic into a single reusable library or service. This ensures that robust authorization rules are applied consistently. This also simplifies maintenance.Adopt a “Deny by Default” and Least Privilege Principle Don’t assign admin rights unless explicitly needed. Make roles granular and restrictive by default. Implement Indirect and Unpredictable Resource Identifiers Use randomly generated identifiers like UUIDs/GUIDs. Implement an indirect reference map that translates a public identifier to a real database ID only after the authorization check has passed. Apply Rate Limiting and Throttling Apply rate limiting to endpoints, especially to sensitive ones such as authentication and data access, to slow down attackers trying to bruteforce identifiers Block IPs or users that exhibit anomalous behavior or exceed reasonable request thresholds Implement a Secure Development Lifecycle (SDLC) Include security unit tests and access control checks as part of your CI/CD pipeline. Use test accounts with varying roles to test for both vertical and horizontal privilege escalation. Monitor and Log Access Violations Set up alerts for unusual access patterns or repeated unauthorized attempts. Log every access control failure, including the user, IP address, and specific resource they are trying to access. Perform regular security assessments Perform regular Web Application Penetration Tests (VAPT) against your web applications. Engage qualified professionals to perform penetration testing at least annually or after any significant changes to the environment. Final Thoughts Broken Access Control topped the OWASP Top 10 list for a reason: it’s one of the most common and dangerous issues that plague web applications. While OWASP Juice Shop is intentionally vulnerable, the lessons it teaches are very real. If you are a developer, product owner, or cybersecurity professional, the insights from Juice Shop offer a humbling reminder of why access controls must be built defensively and verified thoroughly. Looking for support to assess your web applications? If your goal is to get a real-world, adversarial assessment of your security posture, including your access controls, Scrubbed can help you perform Web Application Penetration Testing. We can test Broken Access Controls and other vulnerabilities to help you secure your applications. Not your cup of tea? We also offer other information security related services such as IT audit, Security Awareness Training, and SOC assessment support. Get started in securing your organization. Contact us at https://content.scrubbed.net/contact-us/ (Risk Advisory).

Read More >
Blogs

The Ink is Final: Why Technical Accounting Can’t Wait Until the Deal is Done

The Ink is Final: Why Technical Accounting Can’t Wait Until the Deal is Done

At A Glance Technical accounting review shouldn’t be a post-mortem. Whether it’s a financing round, a complex revenue contract, a licensing agreement, or other significant contracts, the accounting outcome is locked the moment the agreements are signed. A single clause on down-round protection, redemption, or variable share settlement can reclassify a capital injection as a liability under ASC 480 or ASC 815. For SEC-listed companies relying on those proceeds to meet equity thresholds, review timing determines the outcome. In SEC reporting and technical accounting, there is a distinct line between what we can advise on and what we simply have to record. That line is a signature. A few years ago, we were working with a publicly listed client in the life sciences sector. Like many companies in this industry, their core challenge was capital. They were deep into Research & Development, which meant they were pre-revenue but burning through cash. To fuel their operations, they were actively engaging in complex financing transactions. But as a publicly traded company on the US SEC, their pressure was both operational and regulatory. To maintain their listing, they were required to meet the equity threshold requirement. This is where the issue became clear. The Risks of Addressing Accounting After the Deal The client was finalizing their financing contracts, signing on the dotted line, and then handing the agreements over to our technical accounting team to record. Under US GAAP, financing transactions are not always classified as equity. Depending on the nuance of specific clauses, such as down-round protections, redemption features, or settlement in a variable number of shares, a capital injection intended to bolster the balance sheet can inadvertently trigger classification as mezzanine equity or a liability under ASC 480 or ASC 815. By the time the contracts reached my desk, the agreements had already been finalized. If the legal terms dictated a liability classification, the accounting treatment was path-dependent, meaning the legal form had already dictated the financial substance. For a company relying on that specific transaction to boost its equity and maintain its SEC listing, an unexpected liability classification poses a significant financial and regulatory risk. They were risking delisting not due to a lack of capital, but due to the specific syntax of their contracts. The issue wasn’t the accounting itself, but when the accounting was being applied: they were bringing us in too late in the process. Related: How Biotech Firms Prepare Financials for IPO Shifting Accounting Earlier in the Process We raised this issue with the management team and suggested a fundamental change to the workflow: shifting our involvement to before the contracts were finalized. By reviewing the agreements while they were still in draft form, we transformed our role from reactive reporters to proactive advisors. Instead of assessing the impact after the fact, we identified the exact triggers, the “indexation” or “settlement” traps, that would dictate equity vs. liability treatment. This allowed their leadership team to make an informed, strategic judgment. They could choose to tweak the key terms of their agreements to ensure the final contracts aligned with their financial goals and regulatory compliance. Of course, moving up the timeline introduced a new pressure: speed. Draft contracts in the middle of a financing round require immediate turnarounds. But because we had been working with this client since 2020, originally helping them remediate material weaknesses and control deficiencies reported by their auditors, we knew their business inside and out. We understood their historical transactions, their operational goals, and the specific mechanics of their industry. That deep familiarity allowed us to execute complex technical assessments rapidly, without slowing down their deal momentum. Designing the Future, Not Recording the Past Today, that client remains successfully listed. The control deficiencies that plagued their early audits are a thing of the past, and their Internal Controls over Financial Reporting are clean. When I look back on the evolution of this engagement, it reinforces a fundamental truth about our profession. Trust is not built by simply fulfilling the scope of work. It’s built by identifying the root cause of a client’s anxiety and taking ownership of the outcome. When a client views you as an outsourced vendor, you are just there to record their history. But when you operate as an integrated partner, you help them design their future. Compliance and technical accounting are most effective when addressed early in the process. When positioned correctly, they are the architectural foundation that keeps a growing business secure. Related: Scaling Financial Operations in Life Sciences and Biotech with Fractional Teams Key Takeaways Financing transactions are not automatically equity. Specific clauses such as down-round protections, redemption features, or variable share settlement can trigger liability classification under ASC 480 or ASC 815.For SEC-listed companies, an unexpected liability classification can put exchange listing requirements at risk. The exposure comes not from a lack of capital but from the syntax of the contracts.Once contracts are signed, technical accounting becomes path-dependent. The legal form has already dictated the financial substance. Reviewing agreements in draft form lets leadership adjust key provisions before execution, aligning the final contract with financial goals and regulatory requirements. The earlier technical accounting enters the process, the more strategic its value. Late involvement records history. Early involvement shapes the future.

Read More >

Links

Contact Information

SF Bay Area Headquarter
111 Anza Boulevard, Suite 320, Burlingame, CA 94010, United States

Phone: (800)837-5160
Email: [email protected]

"Scrubbed" is the brand name under which Scrubbed Advisory, LLC and Scrubbed Assurance LLP provide professional services. Scrubbed Advisory, LLC and Scrubbed Assurance LLP practice in an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable law, regulations, and professional standards. Scrubbed Assurance LLP is a licensed independent CPA firm that provides attest services to its clients, and Scrubbed Advisory, LLC provides tax, finance, and support services to its clients. Scrubbed Advisory, LLC is not a licensed CPA firm.

Copyright © Scrubbed. All rights reserved.