Last fall, George Kurtz, the chief executive officer of CrowdStrike Holdings Inc., gave investors a quarterly financial update that sent shares soaring. Among the details Kurtz highlighted was a major deal to sell cybersecurity tools for use by the U.S. government.
“Identity threat protection wins in the quarter included an eight-figure total deal value win in the federal government,” Kurtz said on the earnings call after markets closed on Nov. 28, 2023.
Kurtz was referring to a $32 million order from Carahsoft Technology Corp., which serves as a middleman between technology companies and government agencies, that arrived on the last day of CrowdStrike’s fiscal third quarter. It was for identity threat protection software intended for the Internal Revenue Service, according to documents from both companies.
But the IRS never bought the software, according to records reviewed by Bloomberg News and people with knowledge of the situation.
Still, Carahsoft has been making on-time payments on the $32 million to CrowdStrike, according to the cybersecurity firm. When asked for comment by Bloomberg News, both companies explained that they had a “non-cancellable order” between them. They declined to say why that deal was struck without a purchase in place from the IRS.
Some legal and accounting experts, who reviewed the arrangement at Bloomberg’s request, said it raises red flags that merit scrutiny from regulators. The deal also raised concerns within CrowdStrike — according to people familiar with the matter and the company itself — and many specifics of the transaction remain unclear.
Depending on how CrowdStrike accounted for the deal in financial statements — the company didn’t explain those details — it was big enough that it could have made the difference between the company beating or missing Wall Street projections for the period. The day after CrowdStrike reported results for the record quarter, its shares rose 10%.
Jeremy Fielding, a spokesperson representing CrowdStrike, dismissed employees’ concerns as baseless and the order’s timing as insignificant. The Austin, Texas-based cybersecurity firm closes deals “throughout the quarter, starting the first day and often through the last day,” he said.
“The Carahsoft deal went through a separate and extensive review,” he said, adding that it “was given a clean bill of health.” Fielding characterized the experts’ comments as “inaccurately speculating about a transaction that CrowdStrike confirmed fully met” an accounting standard on revenue from contracts.
CrowdStrike “closed and recognized” the deal once Carahsoft placed the order, and its booking of the revenue is consistent with standard accounting principles, according to Thomas Clare and Elizabeth Locke, lawyers representing the cybersecurity company.
A representative of Carahsoft, Mary Lange, said in an email, “Carahsoft is a private company and we do not disclose financial information or customer details. That said, we placed a valid, non-cancellable order with CrowdStrike and stand by that transaction.” The company declined to answer any other questions.
The IRS didn’t answer detailed questions. The tax agency said in a statement that it doesn’t hold any contracts with CrowdStrike directly and, in keeping with federal procurement rules, acquires its software and services through third-party vendors.
No IRS contract or payments matching the deal appear in the public government spending database USASPENDING.gov. The database excludes some information — for instance, material that could compromise national security. But the tax agency’s purchases of CrowdStrike’s products through vendors total less than $10 million, according to a person familiar with the matter.
This story is based on records of the transaction and interviews with five people familiar with the matter, who requested that their names not be published because they aren’t authorized to discuss it.
“It raises an eyebrow,” said Lawrence Cunningham, director of the University of Delaware’s John L. Weinberg Center for Corporate Governance.
“It appears on its face to be uncompensated risk, and rational businesses don’t usually accept uncompensated risk,” Cunningham said, referring to Carahsoft’s payments to CrowdStrike.
Carahsoft declined to answer questions about whether it was taking a loss on the deal or if it found a way to recoup the money.
In recent months, separate issues at CrowdStrike and Carahsoft have drawn negative attention and government scrutiny.
CrowdStrike, with annual revenues of more than $3 billion, sells security software to thousands of businesses and government agencies globally. But in July, a flawed update from the firm knocked out millions of Windows computers around the world, disrupting air travel, medical care, banks and other businesses. Executives have apologized repeatedly, including before members of Congress; the company’s share price plummeted after the outage and hasn’t fully recovered.
Carahsoft is a dominant player among resellers and distributors that help technology companies navigate the complexities of selling to government agencies. In September, agents from the FBI and the Department of Defense searched the company’s Reston, Virginia, headquarters. Lange, the Carahsoft spokesperson, previously said the company was cooperating with the FBI probe and that it involved “an investigation into a company with which Carahsoft has done business in the past.”
The Justice Department is also conducting a civil probe of Carahsoft and software giant SAP SE for potential price fixing on government contracts. The German firm is cooperating with the civil probe, a spokesperson said. SAP chief financial officer Dominik Asam told Bloomberg News that SAP had “gotten written assurance from Carahsoft” that the FBI search was “entirely unrelated” to SAP and a U.S. subsidiary.
There’s no known link between CrowdStrike and either the civil investigation or search of Carahsoft’s office. Fielding, the CrowdStrike representative, said neither investigation is connected to the cybersecurity company.
A potential deal for the IRS dates to early 2023, when CrowdStrike sales representatives began talking with agency officials about buying an identity verification tool to help prevent fraud in a new program that lets people file their taxes directly with the government, according to three people familiar with the matter.
Work continued on a potential deal in the following months, but by mid-October it had become clear to at least some CrowdStrike staff that the IRS wouldn’t order the software before the company’s quarter closed at the end of the month, the people said.
Nevertheless, on Halloween, Carahsoft ordered $32.25 million worth of subscription access to CrowdStrike’s “Government National Identity Threat Protection” service for as many as 40 million users, according to records and two of the people. The order split the purchase into four $8 million payments, with the final payment due at the end of this October. The order indicates that Carahsoft should be billed for the CrowdStrike software and that it should be shipped to the IRS’s Washington headquarters.
That day, CrowdStrike sent an automated email to dozens of staff, saying, “Opportunity has been Closed Won for Internal Revenue Service (IRS).”
The closing of the deal and Kurtz referring to it on the earnings call alarmed some staff who raised internal concerns that CrowdStrike was “pre-booking” a transaction that they viewed as incomplete because it was unclear whether the IRS would ever make the large purchase, according to three of the people. U.S. regulators have in some cases sued and fined companies over alleged pre-booking, also known as channel stuffing, claiming they misled investors by improperly recognizing revenue to inflate their financial figures.
Fielding said it was “demonstrably false” that there was any pre-booking.
That quarter, $32 million was enough to make the difference between CrowdStrike beating analysts’ expectations on two key financial metrics — annual recurring revenue and net new annual recurring revenue — or falling short of them. CrowdStrike highlighted both metrics in the earnings announcement for the quarter, but the company declined to answer questions about whether the deal was recorded under them.
Annual recurring revenue is widely used by software companies to track income from subscriptions. CrowdStrike has consistently emphasized it with investors, writing in a 2019 regulatory filing that it “is a key metric to measure our business.”
Theresa Gabaldon, a professor at the George Washington University Law School, said that for CrowdStrike to appropriately book the deal as revenue it would need to have not only received payment but also delivered the product. Neither CrowdStrike nor Carahsoft answered questions about what became of the subscription software.
“I characterize it as raising red flags,” Gabaldon, who teaches securities regulation, law and accounting, said of the deal.
Whatever happened, Carahsoft was among the companies that CrowdStrike feted at a June “partner symposium.” There, Kurtz and other CrowdStrike staff mingled with guests at a luxury resort on the southern California coast. A video shows attendees enjoying drinks and live string music on a bluff overlooking the Pacific Ocean and getting sushi-making lessons from a celebrity chef.
At the event, CrowdStrike named Carahsoft “Distributor of the Year.”
The Financial Accounting Standards Board issued an invitation to comment Thursday requesting input on financial key performance indicators such as EBITDA and free cash flow and how they should be treated.
FASB is defining a financial KPI as a financial measure that is calculated or derived from the financial statements and/or underlying accounting records that is not presented in the GAAP financial statements. That includes measures that come from amounts presented in the financial statements, measures derived from adjusting amounts presented in the financial statements, and measures derived from or calculations based on other information included in the financial statements or other financial records.
Some examples of financial KPIs include earnings before interest, taxes, depreciation and amortization (EBITDA); free cash flow (FCF); organic sales growth; and adjusted net income.
“Whether they’re concerned about them and which ones they are and aren’t, I’ll leave to them,” said Jones. “We have heard from some stakeholders that we should be considering whether there are certain financial KPIs that should be brought into the financial statements. Now, what does that mean? For some that might mean, are there some financial KPIs that could benefit with a standardized definition, say a single definition of EBITDA, and what goes into that? For others, it may simply mean, what industries does it make sense to provide a KPI in the financial statements? Alternatively, some look at it and say, ‘Well, maybe there are KPIs that the company’s already using. Is there a way under a management type approach to bring them into the financial statements, or should potentially, they not be included in the financials?’ So it’s really us getting input on all those issues. Depending on what we hear from that ITC, we’ll bring that back to our board, and our board will be able to make decisions on [whether] there’s a need for standard-setting in this area.”.
FASB is issuing the invitation to comment as part of a research project on financial key performance indicators for business entities. An ITC is a staff document prepared at the direction of the FASB chair in which the board does not express any preliminary views. Responses to the questions in the ITC will help inform FASB as it considers whether to add a project on financial KPIs to its technical agenda and, if it’s added, to determine the objective and scope of the project.
During previous outreach, including a 2021 agenda consultation, FASB heard feedback from constituents that a project on financial KPIs should be considered. But they expressed different views about the nature and extent of the perceived issues, whether the board should add a project to its technical agenda, and, if a project is actually added, what the objective of the project should be.
FASB staff issued the ITC to hear more feedback on potential standard setting for financial KPIs, including whether financial KPIs should be standardized and, if so, which ones? Another question is :Should financial KPIs be required or permitted to be disclosed in an entity’s GAAP financial statements and, if so, when and for what types of entities?
FASB is asking for comments on the ITC by April 30, 2025.
Everything must go; have con, will travel;gold rush;and other highlights of recent tax cases.
Deltona, Florida: Business owner David Albert Fletcher has pleaded guilty to evading payment of more than $1.7 million he owed for tax years 2004 through 2014.
Fletcher owned and operated several furniture liquidation businesses and for 2004 through 2013 did not timely file his federal income tax returns or pay taxes. After an audit, the IRS assessed $1.7 million in taxes, interest and penalties.
To evade collection, Fletcher concealed his income and assets from the IRS, including by using nominees to hide his purchases of luxury vehicles. He also filed returns that understated his income, and when interviewed by an IRS special agent lied about how much he earned.
Fletcher faces up to five years in prison.
Chatham, New Jersey: John Goggins, former senior vice president and general counsel for a large public corporation, has been sentenced to eight months in prison for willfully failing to file federal income tax returns.
Goggins, who previously pleaded guilty to a four-count information charging him with willfully failing to file federal income tax returns for 2018 through 2021, earned total gross income in those years of $54 million from wages, restricted stock awards, the exercise of annual nonqualified stock options, interest, dividends and gains from stock sales.
Goggins was also sentenced to a year of supervised release and was ordered to pay $3.11 million in restitution to the IRS (which has already been paid) and was fined $40,000.
Indianapolis: A U.S. district court has permanently enjoined tax preparer Juan Santiago and his company from preparing federal returns for others and from owning or operating tax prep businesses in the future.
Santiago failed to respond to the civil complaint filed against him, so the court entered the permanent injunction by default.
Santiago resides in Lakeland, Florida, but travels to Indianapolis for tax season to operate Madison Solutions LLC. The complaint alleges that he and Madison Solutions used a variety of schemes to improperly reduce clients’ tax liabilities or to obtain undeserved refunds, including by repeatedly placing false or incorrect items, deductions, exemptions or statuses on clients’ returns without their knowledge.
For example, the complaint alleges that Santiago routinely elected head of household status and Child Tax Credits for clients when they were otherwise not qualified for such status or credits. The complaint also alleges that Santiago reported fictitious businesses on returns and fabricated business expenses and income to fraudulently reduce taxable income.
Wilmington, Delaware: Business owner Robert Higgins, of West Chester, Pennsylvania, has been convicted on charges of mail, wire and tax fraud.
He owned and operated First State Depository, a precious metals depository that held more than $100 million in customer assets, primarily in the form of gold and silver bars and coins. Higgins diverted customer assets to pay debts and finance his personal life, including two timeshares in Hawaii and luxury vacations. First State’s records indicated that at least $58 million worth of customer assets had been misappropriated; industry sources generally agree that this is the largest theft from a precious metals depository in U.S. history.
Higgins faces up to 20 years on the wire and mail fraud charges and five years on each tax fraud charge.
Ft. Worth, Texas: John Anthony Castro, 40, owner of the virtual tax prep business Castro & Co. who falsely inflated dozens of client returns, has been sentenced to more than 15 years (188 months) in prison for tax fraud.
Castro — who had graduated law school but repeatedly failed the bar exam — held himself out as an “international tax expert” and “federal practitioner” and falsely claimed to be a graduate of West Point.
He successfully marketed to clients around the world, claiming to be an expert on certain tax issues related to Australian expats, among other things. Between 2017 and 2019, he filed more than 1,900 returns on behalf of individuals worldwide. Castro promised his clients a significantly higher refund than they would receive from other preparers, claiming he knew how to identify and claim deductions that others did not. He added that there was no risk, as he split the additional refund amount with clients for his fee.
He did not share the return with clients before filing but instead informed them of the amount of the anticipated refund. On many occasions, Castro filed returns on behalf of clients without their permission or knowledge.
In other instances, he claimed deductions that had no basis in fact. Castro claimed deductions based on extreme and unsupported legal theories, including saying that deductions for any expense related to preventing an illness qualified as an “impairment related work expense;” expenses related to commuting to and from work; and the full value of one’s mortgage and utilities as long as the taxpayer had some Schedule C business to claim, among others.
When the victim-taxpayers learned what Castro had done, many demanded copies of their returns. Castro refused to engage in conversation and even delayed providing returns for months; he often acted in a highly vindictive manner when questioned or challenged by clients or others, berating individuals in emails, threatening legal actions or by filing amended returns, without clients’ permission or knowledge, that removed all deductions. Many of the victims have since been audited or filed amended returns.
Castro was also ordered to pay $277,243 in restitution.
Thornton, Colorado: Tax preparer Lance McCuistion, 56, has been sentenced to 52 months in prison after pleading guilty to preparing false returns for clients.
In July 2014, McCuistion pleaded guilty to preparing false returns in a prior investigation and was sentenced to probation. As a result of that offense, McCuistion was unable to obtain a PTIN. From around April 2018 through April 2022, McCuistion used PTINs in the names of three associates to prepare returns for clients.
These returns claimed items for which McCuistion knew the taxpayers were not eligible, with the aim of increasing refunds or reducing taxes.
Independence, Missouri: Business owner Richard Dean Schiele Jr., 51, has pleaded guilty to filing a false claim as part of a scheme to fraudulently receive nearly $1.4 million in federal COVID-19 relief money.
Schiele admitted he filed nine employer’s quarterly returns with the IRS on April 22, 2023, for a company he formed the same month called Schiele Family Own Distribution. The returns made a total of $1,392,716 in claims for pandemic-era credits against the company’s ostensible employment taxes. Schiele later admitted that the company had no employees in 2020 through 2022.
The IRS issued checks totaling $478,890 to Schiele; the Treasury recovered $348,764.91 from Schiele’s bank account.
The Public Company Accounting Oversight Board adopted a rule amendment Thursday that enables the PCAOB to address situations in which a registered firm has ceased to exist, is nonoperational or no longer wishes to remain registered.
It would apply when firms fail to file annual reports on PCAOB Form 2 and pay annual fees for at least two consecutive reporting years. Via Form 2, registered auditing firms give the PCAOB important information such as each audit client for which that firm issued any audit reports during a reporting period.
“Firm registration is a cornerstone of the PCAOB’s operations,” said PCAOB chair Erica Williams in a statement at the PCAOB’s meeting Thursday. “Firms are required by the Sarbanes-Oxley Act to register with the PCAOB in order to perform audits of publicly traded companies and SEC-registered broker-dealers or to play a substantial role in those audits. In addition to registering, filing an annual report through what’s called Form 2, allows the PCAOB to keep track of the firms who are eligible to perform those audits and to understand which audits, if any, they are performing. In turn, the PCAOB then uses that information for many purposes, including planning its inspections program, which inspects over 800 issuer audits in more than 30 jurisdictions around the world each year.”
The PCAOB noted that as of Aug. 31, 2024, 80 registered firms have not filed annual reports and have not paid annual fees for both the 2022 and 2023 reporting years.
“These firms include, for example, sole proprietorships that remain registered even though the sole proprietor has died; firms that registered with the board years ago but now appear to be defunct; and small firms, often in foreign countries, that cannot be reached through the primary contact person designated by the firm,” said Williams.
Those delinquencies obstruct the PCAOB’s ability to maintain an accurate list of registered firms that wish to maintain their registrations; ensure that Form 2 information is being reported to the public; collect mandatory annual fees; and use PCAOB staff time and resources efficiently.
“The amendment adopted today will not only make registration information more useful for investors, audit committees and other stakeholders, it will also improve the efficiency and effectiveness of our organization,” Williams stated.
The rule amendment would treat a PCAOB-registered firm’s failures both to file annual reports with the PCAOB and to pay annual fees to the PCAOB for at least two consecutive reporting years as a constructive request for leave to withdraw from PCAOB registration; and deem the firm’s registration withdrawn.
After the PCAOB issued the proposal in February of this year that included the amendment, the board received feedback from various commenters. While those commenters were generally supportive of the proposed amendment, the PCAOB also made changes to address stakeholder feedback. For example, the February proposal originally included a 30-day period for firms to send an email to the PCAOB’s Registration staff to stop the withdrawal process. In response to stakeholder input, the 30-day period was extended to 60 days. The February proposal also included a proposed new Rule 2400 regarding false or misleading statements concerning PCAOB registration and oversight. The PCAOB said it’s continuing to consider next steps regarding proposed Rule 2400.
PCAOB board member Christina Ho said during the meeting she had originally supported the proposal, but now has reservations about the timing.
‘Notwithstanding my support today for this ‘good housekeeping’ rule, I am deeply concerned about the possibility of the PCAOB adopting in the weeks ahead a series of ‘midnight regulations’ that could overwhelm the institutional review process, both here and at the Securities and Exchange Commission, that helps ensure that regulations have been carefully considered, are based on sound evidence, and can justify their costs,” she stated. “Moreover, correspondence from at least one member of a relevant committee of Congress has called on the federal financial regulatory agencies to suspend the proposal or promulgation of any regulations before the end of the current Administration. Modernizing our standards and rules is important, but if we rush to get things done before any changes in the composition of the Commission, we could end up wasting taxpayer dollars by adopting ill-considered rules and running our professional staff ragged while at the same time undermining the democratic process.”
Another PCAOB board member, George Botic, expressed his support for the rule amendment. “One area of focus for me over the past year has been the need for increased transparency,” he stated. “I believe that improved transparency and accessibility of PCAOB oversight activities on our website, in particular registration and inspection information, will help to better inform and equip investors, audit committee members, academics, and other stakeholders to not only understand our work but also to make better informed decisions. While I am hopeful for more efforts in this regard, I have been pleased with our work to date. Hand in hand with promoting transparency comes the responsibility to do our best to ensure that the information on the PCAOB’s website is not only accurate, but also useful and informative to a wide variety of stakeholders.”
The amendment is subject to approval by the Securities and Exchange Commission. If it’s approved by the SEC, the amended rule will take effect initially for annual reports and annual fees that are due in 2025, so a registered firm that doesn’t file an annual report and doesn’t pay an annual fee for both the 2025 and 2026 reporting years could be deemed withdrawn from registration under Rule 2107(h) starting in the fall of 2026.