Okay, guess we'll go ahead and get started. I am Julian Grisard. I'm a graduate student at Georgia Tech and studying computer security and today I'm going to give you a talk on search code recovery from current level root kit installations. And this is on Linux based systems. So first off the latest slides tools and you know our spine architecture work is available online. The links to this is on your CD and and So definitely download the latest mental eye changes. All right, so first off some background on root kits. What does a root kit do? So a root kit is a tool kit that a attacker will use to retain access to your system and hide activity that he's doing on your system. A root kit doesn't give you access to a system if you don't have prior access. You have to exploit the system by some known vulnerability or something you figured out or social engineering or whatever. And then you will a attacker will usually install a root kit in order to come back into the system at a later point in case the password changes or as vulnerabilities patched. So how many people have personally had experience with a root kit installed on a system they administered. We got some people, wow, we got lots of people out there. Interesting. And so what what is the recommended thing to do when you get a root kit installed on your system? That's right, format and reinstall. So I'm actually going against that grain, you know, I'm saying okay, maybe there's more efficient ways to recover from a root kit. I mean, what if you got a server that every minute of downtime costs millions of dollars? I mean, how can you format and reinstall that system? So we're gonna look at different ways to recover from a root kit.  So it's important to understand how an operating system works in order to understand the design of root kits. So this is a monolithic operating system.  This is Linux looks like this. Windows, all the windows look like this. Most systems look like this. So you've got two parts to an operating system. You've got the kernel space and this is the code that runs right on top of your hardware, controls all your devices, schedules your processes, does your file access, network stack, these kinds of things. And you have user space. User space is where the programs that you really care about run. So P1 could be your word processor, P2 could be a LS, Bash command, and so on and so forth. Now I want to give you a contrasted operating system design that I'll come back to you later. But I just want to give you a preview and compare and contrast to current OSes. This is the micro kernel operating system design. The difference here is you have a very thin layer for the kernel space. You have minimal, I mean, only code you have in the kernel is the minimum amount of code needed to guarantee isolation among processes and that kind of thing. All the drivers, video, disk, hardware, network, all this stuff is pushed into user space sitting alongside your user space processes. And each bubble here is actually guaranteed to be isolated by the micro kernel. So what guarantees this isolation? Well, on the Intel x86 architecture, a lot of you have probably heard of this ring architecture where you have level 0, 1, 2, 3. And it turns out modern operating systems only use two levels. They use level 0 for the kernel, which gives you unlimited access to the hardware. If you have a program running at level 0, you can do anything to any bit and any where in the computer. And the user space processes run at level 3, which is shown in yellow here. And if you want access, they don't have direct access to the hardware. If you want access to the hardware, you have to make a system call. Ask the kernel to do it for you. So I want to show you just real quick how this is implemented in the hardware. There's a 16-bit code segment register on Intel piniums and x86 processors. And the lower two bits of that register specify what privilege level you're running at, which ring you're in. And this is some test code to test and see which ring you're in. And so I'm going to demo this code running real quick, just a quick demo here. So I have a Linux box running over here to my right. I'm going to log into that. All right, so I have this Git CPL program that gets your current privilege level. And it returns 3 because I'm running a user space process forking off the command line. Now let's check out the kernel. All right, so I inserted a kernel module called, well, it's way too big on there. And I inserted a kernel module called Git CPL, which all it does is, right here, all it does is pops the CS register from into a variable and ends it with 3 to get the ring level. And if you look at the bar log syslog, you can see that, in fact, the kernel is running at ring 0. I'm going to get my next demo set up and we'll go back to the presentation. And so these slides here are just showing that as well. All right, so if you're looking at the operating system and you want to make a user level root kit, how do you do it? Well, you attack files on the hard disk shown in red here. And so you replace ps, netstat, ls, top, password. These kinds of files will, you replace those with malicious files that hide your activities. Hide files, hide network connections, these kinds of things. And so when you replace those files, they get loaded into your processes, the green bubbles up there. So that is pretty much the user level root kit. It's pretty easy to detect. You just run drip wire, check your system against your known good state. And it's not too difficult. We know how to do that. Definitely drip wire has its issues, but there's a way to deal with those. Now kernel level root kit attacks, they modify the running kernel code and the running data structures, which is this block shown here in red. So anything in there is suspect to being attacked by a kernel level root kit. And all kernel is, is a running program on your computer. So in essence, these kernel level root kits are modifying code on the fly and redirecting that code to malicious code. In particular, the system calls is the gateway from user space to kernel. And that's a good target and the virtual file system. And I'll go over those two examples. So first I want to go over a system call and why, you know, that is the most popular attack target for kernel level root kits. So it's important to understand how a system call works in order to, a, detect the system call has been tampered with and, b, recover from it. So what happens, what do you use a system call for? Okay, say you're a user process and you want to read files from a hard disk. Then you can't do that directly because you don't have access to the hardware. So you issue a system call to the kernel, to open, read the constants of those files and so on and so forth. So for instance, let's say we have a sys read system call. What happens? Well, the first thing that happens is your user space process issues an int 0x80 instruction, which says a software interrupt, which indexes into 0x80, 80th entry of the interrupt descriptor table. And that's shown right here. So as soon as you issue that interrupt, you go over to the kernel. The kernel looks up where the IDT is in memory, looks up that 0x80th entry and executes the code pointed to by that entry. The code pointed to by that entry is the system call handler. And the system call handler is responsible for setting up parameters of your system call, generic parameters. It works, that's the first thing that's called for any system call. And then it calls the system call you specifically requested. So you see this pointer coming out of the code in the system call handler, which points to the system call table. So it references, let's say for sys read, you look up this entry number three in the system call table over here. And that redirects you down here to the sys read system call. And the sys read then takes the parameters given to it by system call handler and executes your request. So what's the attack points here? Anything in this chain is an attack point. You could redirect the IDT entry, you could redirect the system call handler reference to the system call table. You could redirect individual system calls. You could overwrite the system call with jump instruction to go somewhere else. All these are susceptible. So how do you recover from this system call attack? Well, here's the algorithm. It's basically installing a new system call table into the running kernel. This is exactly what a root kit will do, in fact. But we're going to use a good system call table that has known good state. So the best place to get that is to keep a copy of your kernel on another disk on safe storage. And you can rip out these system calls using what I did with modified GDB to get that code out. And so you, it's pretty simple. You just, well, it's somewhat simple and it's kernel stuff. But basically you copy each system call into kernel memory and then you create a new system call table pointing to all those system calls. And then you can set the handler to point to that system call table. And there's, you can go full blown. You can, if I go back to this picture, you can set this pointer right here, which is on the left for you guys. And you can point that to a new system call handler if you want. And that way you'll know the whole chain is correct. Okay. So it's a little, just want to give you guys some details on, it's not quite that simple. You can't just copy stuff over. When you copy code around in memory, x86 code has these call instructions with relative offset parameters. So you have to adjust them, basically relink them into the kernel. So you could recompile the code if you know where it's going to be loaded. But I chose just to recompute those relative offsets as I was inserting each system call into memory. And you adjust the relative offset based on where it's placed in memory because you allocate dynamic memory for it. And you compare that to where it was originally in memory and you just subtract the difference. Of course it's a little bit more confusing with the way the Intel architecture works, but that's the gist of it. So another thing is there's multiple ways into the kernel. I'll just give you some background. This is another tidbit of kernel level rootkit stuff is you can insert a kernel module into the kernel and muck with a system call table. And that's one way to penetrate the kernel. Another way you can get into the kernel is through the dev kmem device file. This device file gives you access to the kernel memory as a file. So if you're a user space process, you can open that dev kmem like it's a regular file. You can seek to it and you pass it a kernel memory address and it seeks that memory and then you can read that data or write to it. Has anybody familiar with the socket rootkit from those people that have had installations on their computers? We got some people. So there's a few more. Okay, so if you want to install your rootkit from dev kmem without doing a kernel module, there's a couple of things that are tricky. First, how do you find the system call table? You don't have the symbols. And two, how do you allocate memory to insert new code into the kernel? All right, so first I'll just go over how you find the system call handler right quick. This is some code pulled out of socket. First thing you do is you pop the IDT register into memory. And what that is is that tells you the address. Let's go back a few slides real quick. That tells you where this table is in memory. All right, so now you know where that table is. So then you read the 0x 80th entry of that table. And you can compute where the system call handler is in memory. And then you can parse the system call handler to find out where the system call table is. All right, so how do you get dynamically allocated memory from the kernel from user space? If you write a kernel module, you just use kmalik. But you don't have access to that code from user space. Well, the way socket does it is sets up kmalik as a system call. So there's a number of unused system calls in the system call tabler. Suck it takes over one of those system calls and points it to kmalik. So now you can issue system call 180 or something like that and pass it a size memory allocation size and you'll get kernel memory returns. Okay, so now I want to do my next demo. So the scenario here is I've already got root access to this machine, so I'm wanting to install my root kit to retain access and to hide some files. And this folder right here, I have some bank accounts I want to store on this computer and don't worry, these are not legit, at least I hope not. Okay, so we've got this data that I don't want to store on my own computer, but I want to store it on this machine that I've compromised so I can trade it with somebody else. Something like that.  So now that directory that I was just showing you up here, this hidden info.sk12 is now hidden. The way this works is anything that ends in .sk12 will be hidden. For instance, if I touch a file called hide me, you can see that it's there. If I move hide me to hide me .sk12, it's gone. So now I'm the administrator of this computer and I believe I may have a root kit on my system. So what I'm going to do is try and install a new system call table to see if there's any differences in the file system. Okay, so this takes a little bit of time because it's not optimized. It's good for demo though because I can explain a few things. So what you see here is each little block of code, it's copying a system call into kernel memory. It issues a K malloc for each one of these, copies it in and then you see these asterisks, asterisks, asterisks found, dot, dot, dot. It's finding these call instructions and it's recomputing where they need to be relinked to and setting that. So right now we're at about 130 system calls that have been copied into memory. Turns out Linux has 255-ish system calls. And so we'll be through this here in a second. Does anybody have any questions so far? We've got a few more minutes. From what I've found, I mean, that's a possibility that they have absolute calls but you could relink those in as well. From what I've found, they don't have absolute calls. Excellent, excellent question. I will get to that very shortly. All right, so the new system call table has been installed. Now notice these hidden files come back up.  So we install a known good system call table into memory. All of a sudden these files come back up. Does anybody have any other questions while we've got a stopping point in the presentation? How does it catch it? Right, let's go back to that figure. So you're saying this code right here is being overwritten or something like that. Okay, so first off, the tools that I was just showing you do not do root kit detection. Well, some of them do but the recover root kit itself does not. I do have the ability to, you know, read any system calls or I could dump this code for sysread to a file and see if it's been overwritten. For instance, to answer your question, that would be the way to do it. It's changing memory. So the way the recovery tools work is right now it actually just replaces this pointer to a new system call table. And so that's going to shoot over here into memory somewhere. You've got a new system call table over here. You've got a new sysread over here. So even if this sysread right here was overwritten, that's not a problem because we aren't depending on that. That's a good question. Okay, so back to our gentleman over here's question. Okay, so it turns out if you use devkmem to modify the kernel as I do with my recovery tools or even if you use a kernel module to do the recovery, either one of these approaches relies on system calls to do the recovery. So there's an obvious problem here. If you've installed a root kit that's redirected system calls and you're depending on those system calls that's redirected, then you may be depending on a code that's going to prevent your recovery tools from working. Does that make sense to everybody? It's a little bit confusing. Okay, so how do we deal with this? Well, I propose we need a new system architecture and let me take a minute to explain the vision I have here which goes much beyond root kits and much beyond anything like that. I've got this vision of intrusion recovery system. So this is like, you know, you've got your intrusion detection system. You've got your intrusion prevention system. But bottom line is we still have compromises every day. It's still a problem for the foreseeable feature. So we need to think about ways to more quickly recover from compromises given that they're going to be a problem. Systems are so complex. So that's why I've come up with this notion of an intrusion recovery system which has a new system architecture that's not currently used in widely available OSs and it's capable of verifying the integrity of the running system and repairing that state if it has some problems.  So you have to have some kind of way to store a known good state for your system. Because if you store the known good state in your system that is accessible by route, then that can be changed. So this new architecture supports these kinds of things. It supports what I call a state hold which is kind of like a stronghold but it stores your state instead. And it does these other things. And I'll go over, this is my research right now so it's certainly in development and I'm looking for any kind of feedback you guys have. It's probably got some problems but I'll show you what I've got and we'll see what you say. So back to the beginning, I showed you, you've got the monolithic operating systems and you've got these microkernel operating systems. Well, I'm going to go back to this microkernel operating system. It turns out this looks really good for security applications. If you look at the microkernel, it has about 20,000 lines of code that run the kernel. Compare that to the Linux kernel which has on the order of 4 million. So we can hopefully better guess or better rely on the microkernel for correctness. Matter of fact, there's some research microkernels out there that try and formally prove that the microkernel is correct. These system calls to the microkernel, there's only, you know, 14 or so, just depends on the implementation, maybe on the order of 10. So you've got a small number of system calls that do basic stuff, you do IPCs, you do interprocess communication, you do thread management, that kind of thing, that's it actually. All the hardware access, these kinds of things are pushed to user level. So based on this microkernel design, I've laid out this spine architecture for the intrusion recovery system. At the base of the architecture, you have the microkernel which I'm using L4 fiasco implementation which is developed by a university in Dresden, Germany. And on top of that runs the guest kernel, the L4 Linux implementation runs on top of that. So you can run a full blown version of Linux on top of the microkernel. So you're probably more familiar with the term virtual machine than you are microkernel. Turns out these are very highly related topics. Essentially the microkernel does the same thing for us. And so we have this guest kernel which is L4 Linux running on top of it. At the next level, you've got your user processes and those run just like they do on Linux. You don't even have to modify them. And then over here on the first, you know, only fiasco runs in kernel mode. So only fiasco runs in that ring zero and everything else runs in ring three. That means even if you have root access on the kernel machine, you're not guaranteed access to all bits in the computer system. So on the right here, I have at each level a component of the intrusion recovery system. I call them L0, L1, L2, L3. And L0 is just the hardware. There's really no support for that right now, just accept the ring stuff. Turns out Intel and IBM, these kinds of companies, are very interested in hardware support for virtual machines. So in the future, this will definitely be huge. L1 is a component I have running at the microkernel. And the importance of this component is it's able to verify that the guest kernel and the L2 component are operating correctly. And similarly for L2 to L3. And why do I have these various levels in the system? Well, it turns out if you're looking at the entire Linux running system, the entire Linux operating system from L1, you're going to have a hard time interpreting all the data structures, interpreting what's good, what's bad. So it's much easier to run components in each level. In order to understand the semantics of that level. And the vertical hierarchy is a way of guaranteeing that those components are not chosen or stopped or bypassed, these kinds of things. So just, there's a lot more details here. I just want to give you a few. I'll just show you the memory real quick. How does the memory work, for instance? So down here at the bottom, you have the microkernel L1, which owns all the memory. And it can allocate some of the physical, by memory, I mean the RAM. It can allocate some of the RAM to the guest kernel, which is shown in red here. And you can see that portions of the memory are still owned by the microkernel. And the Linux guest kernel cannot touch that memory. And then in turn, the guest kernel, the Linux kernel, can map some of its memory to user space processes. All right, so this is the system. How do we attack it? So you can attack any of these things in user space. If you have read access, you have access to all of these components highlighted in red here. So again, the L2 and L3 components of the intrusion recovery system are suspect to attack. And that's why we need L1 to verify that they're operating correctly. So right now, I'm still working on algorithms to determine when L2 and L3 are operating correctly. So far, I only have monitoring the PC instruction counter and verifying the hash of the code at L2 to verify and check that the program kind of runs in that code periodically. If anybody's got some ideas on other ways to verify, I'd definitely like to talk to you. Okay, so now I want to look at another kernel-level rootkit target. So it turns out these same kernel-level rootkits will work on this new spine architecture. They will attack the guest kernel instead of the host kernel. So I want to go through another target to give you guys some more background on how kernel-level rootkits work. This target is the virtual file system.  And so you can insert your own virtual file systems. If you have an ext3-formatted partition, then you insert that in the VFS and you don't have to readjust your system calls to point to that. Everything goes through the virtual file system. Let me show you how it works. So first off, a system call is issued, let's say I'll go over the PROC file system in this example. Let me back up a minute. So you have lots of different file systems in Linux. You have your file system for your hard disk. You have remote disk storage stored on another network drive. You have the PROC file system, which is a file system built by the kernel and gives you information from the kernel, such as thread or task IDs, and so on and so forth. So if you want to... Remember, if you want to get access to the file system, any file system, you have to issue a system call. So in this example, I want to read the contents of the PROC directory to see what processes are running on my system. So first, my program will issue a sysreadder that sysreader indexes into the virtual file system, which then... And you've told it to open up this PROC, some directory in PROC. So the virtual file system knows, based on the path you gave it, where it needs to go to service your request. For PROC, that's a special file system. It indexes into its root structure. And there's a lot of pointers in that root structure. The f underscore op stands for file operations, I believe. And so for the PROC, you look up what are the file operations for that file system. And so there's a fop structure, which is standard. And for each file system, you have to implement a number of function pointers. In this case, readder is the one I'm going to highlight. So you've indexed all the way in here to readder. And finally, you get to the PROC readder code. And so that'll then return information back to your system call and then return that information back to your user program. Okay, so what's the attack points here? Again, it's the same basic idea. Any time you've got a function pointer, any time you've got a reference, any code along the path can be redirected. So what's the recovery algorithm for this? Well, now's when we sort of step back and make it more general. So generally, the recovery methods for kernel-level rootkits is consistency checking on the data structures in the kernel and the code running. And you can store a copy of this, what it should look like in your protected spine architecture. And you can use that to check and see if it's been modified in a manner that's against your policy and if so, then you repair it back to its known good state. And the IRS can do this automatically. And that's sort of the vision is you have this system that's constantly monitoring your computer for malicious root cancellations. If that happens, it undoes the damage from it and furthermore have longer term goals of, okay, so yeah, you've got rootkits installed, you undo this damage, the attackers still got in your system somehow. You also have to figure out how you got out, kick them out, you know, change passwords. It's more than just repairing the system. It's a lot more complicated. All right, so let's go for another demo. Now, for the purposes of this demo, I'm not using the automated repair of the system because you wouldn't be able to see that anything happened. But one thing I want to show you real quick is I am in fact running the spine architecture now. You can see them running the Linux 2.6.11-L4 kernel, which is the way it works for the Linux kernel is you port the Linux kernel to the L4 architecture as opposed to the i3886, the alpha, so on and so forth. So in fact, we can go in here and check out our getCPL again to see if our privilege levels have changed. And so the user process is still running at ring3, which is expected. And let's see what the kernel is now running at. And so can everybody see this in the background?  Move it up. Sorry about that. Is that better? Thanks. Okay, so what I've just done, let me scroll back up for you guys then. So right here I just did the getCPL and it returned ring3, running in ring3. And I have just inserted the getCPL into the running kernel and you can tell the var log syslog and see that it was printed out as running in ring3 now. So now the kernel is running in ring3. If anybody's out there familiar with user mode Linux, it's a very similar concept to that, but it's much, much faster. In terms of performance, it'll take a slight venture. Just in case you guys are wondering, you figure about a 10% performance penalty for running in this architecture. So it runs about 90% the speed of Linux running directly on your hardware. Okay, so for the second demo, I'm going to install the Door Next Generation rootkit. And this rootkit works on the Linux 2.6 kernel. And what this rootkit does is exactly what I was just showing you with the virtual file system. It redirects the virtual file system to malicious structures so it can hide files and processes. Okay, so I've just loaded the rootkit. Notice first off that my DoorNG directory that was just in is now hidden. That's part of the configuration. It hides whatever your rootkit directory is. And then I'm going to launch this rootme binary, which doesn't really do anything, but it runs. And you can see right here in the process list that rootme is running. Now I've got to scroll back up here and see what my directory was. So I'm going to go back into the DoorNG directory. I'm tabbing over right now and that's another system call. It doesn't find that there's an DoorNG directory. So I have to type the full path. And there's a user-level utility to go with this DoorNG rootkit, which can hide processes for you. So I want to hide this process 644. So now rootme is gone. All right, so now I'm going to put on my system administrator hat again. And I suspect that a rootkit has been installed. This could be done automatically with the intrusion recovery system, but again for the purposes of this demo, I will do it manually. And so what I'm going to do is a similar algorithm to the system call table repair. I am going to, but this time I've made it a little bit simpler and I just fixed the pointers back to where they're supposed to be. Okay, so I've just repaired the proc file system. And now you can see the rootme file is back, our process is back. And you can see the DoorNG directory is back. So in fact we've been able to recover from these kernel-level rootkits. Okay, let's go back to wrap up things here. All right, so I've shown you the ability to recover from some kernel-level rootkits and presented you with an architecture that's perhaps more robust and you can somewhat rely on for this recovery. So I mean definitely there's some limitations to this system. I'm still developing it now, so any feedback you guys have would be great. Some of the limitations, you know, first off, how can you trust this microkernel? What if the attacker installs a rootkit into the microkernel? Well, you know, that's a hard question, but it's relying on the smallness of the microkernel to be correct to prevent that capability. You know, one of the things that some of you guys are probably thinking about already is what about direct memory access where you program a controller to overwrite the microkernel? Well, that's definitely a problem right now. That's the limitation. And future Intel architectures that support better isolation that hopefully will not be a problem. So, and finally, you know, just like everything else with security, there's no be-all and-all solution. However, I believe this IRS can make your systems more reliable and save us a lot more time and trouble. So thanks to a lot of people that have helped me out. You know, there's lots more people on here than I have listed. These people in particular have been helpful. I got some links for you guys if you want to find out some more information about what I've been talking about, various architectures, system projects here, you know, check root kit, our research. And this time, we've got a few starter questions if anybody wants to comment on. And if not, if you've got your own questions, that's fine. We've got about five minutes or so. And also, after the talk, I will be heading out that door over there. So if you guys want to catch me, definitely link up with me outside. So first off, let me just ask these three questions and I'll take either answer these comments to these questions or your own questions. So I already asked this question, how many people have personally dealt with the recovery of root kit? If anybody has a testimony, we might share that in a minute. Let me read all three of these and then I'll start calling on people. Secondly is I would definitely be interested to see if anybody's seen any root kits that use DMA, Direct Memory Access. I've seen a lot of talk about it. Maybe I just have not seen the public talk about it or public implementation. And finally, if anybody has not followed the conventional wisdom of wiping their system clean and reinstalling, I'd be interested to hear that. So this time I'll open it up for questions and comments over there. Okay, so the question was with the L4 architecture, can you run multiple instances of your kernel? And the answer is yes. The L4 architecture is in fact pretty much a virtual machine architecture so you can run multiple instances of Linux. System pipes and log files, I have not addressed that yet. Good question. Certainly, but I mean, so it's suspicious, but it's kind of like running a virtual machine, you know. You can tell when you're running on VMware. But legitimate systems run on there. So that definitely would be able to tell that it's not a normal system. Absolutely. Actually, a lot of the tools that I have written for the system call stuff gives you all kinds of information on the system call table. So for instance, you can check out each individual system call with these tools and that is much more surgical. Definitely. Good comment. Question here. So the question was, this system would be useful just for detection, correct? Absolutely. Why am I doing intrusion recovery system as well? Because I'm a research student and we've got to do new and exciting things. So absolutely, and lots of people have talked about using similar architectures for intrusion detection. That's an excellent idea. That'll be the way it works 10 years from now. We've got guys in the back, people over here. Oh yeah, absolutely. As a matter of fact, I was going to do a demo on that for this presentation but didn't have enough time. Recovery from user level root kits, I've done some work on that. It's pretty much tying a trip wire or aid kind of thing to a recovery program which just checks your file system periodically and replaces the binaries back to normal. That's absolutely a part of the system because you need the full system. We've got a question way back there in the back and I'll come back up here. That's an excellent question. So Zen is another very similar architecture. In fact, I've got a link to that in the slides. Zen is very hot right now. It's a virtual machine architecture open source. I believe it's England. People are doing that. And it's very fast. As a matter of fact, Zen and L4 compete. I am going to compare Zen to L4 and my thesis to see which one would be better. It's just an implementation difference. Either one is certainly suitable. I just chose L4. I've got a question up here and then I'll quit after this guy. The question is what's the more background on this microkernel? The reason I chose L4 fiasco implementation is basically it's one of the more mature L4 implementations developed by a university at Dresden. The team there has been really good at helping me out. Any kind of questions I've got. They've got a big team there. Lots of questions. They've got the mailing list and everything. Comparing it to other... There's also two or three other implementations I could have used. I happen to know the guys a little bit at Dresden. That's really the only reason. That's a good question. I'm going to wrap up and let the next speaker get in. I'll be out here in the hall if you guys have got any more questions.


Hikaru a nice win with the black pieces an attacking aggressive game seemed like very much your style your thoughts Yeah, it was an interesting game I think my opponent was a little bit too tentative. He wasn't sure what he was doing in the opening and He was completely fine, but I think he just optically thought he was getting into some trouble And once once he played this f4 move. I mean once I got this b5 and b6 I think positionally was just very very difficult from to play I think probably still had some resources, but he didn't find them in that moment I mean basically within like three moves. It just went from being like maybe slightly worse just being lost And I I'm sure he had better better options, but he couldn't find them over the board So the rest was pretty much a smooth sailing. So it's quite nice You were playing for over seven and a half hours yesterday against Valenzina Gunina. How do you? Recover after that What what is it that you did right after because you were both if you were here till 11 o'clock at night? Yeah, I mean fortunately I had some food in my room. So I was able to eat some dinner I mean, I think there's this other game in like Dortmund I think 2011 or something against Meyer, which was some insane like 140 move game as well Which went like eight hours the difference being that in that that game when I when I drew that came after eight hours I like I was able to or I was not able to get food I basically just went to my room and slept whereas last night at least I had some food So yeah, I mean it was a very interesting game I think the main takeaways that Rooks are just like terrible pieces because I had I had some other Rooks against Queen and game against Fabiana, which also I think the Rooks were supposed to be better And then Fabiana drew it very easily and yesterday as well Was was very long and probably I wasn't winning until the very end. So I mean it was just one of those days yesterday Three out of three Exactly what you were hoping for you couldn't be happier. Yeah, I think three out of three is good But again, there's seven more rounds. I think it's a long tournament I've already played one very long game and there are no rest days. So well, we'll see but Many more to go and of course, I haven't played any of the top top dogs yet So it's it's far from over a hundred percent score, but are you happy with the quality of the games? Pretty much. I mean yesterday was very up and down But but yeah, I think overall I've played pretty well. So it's it's a good start to the new year I'm pleased now you have been three times champion in a row at the Gibraltar Chess Festival Are you looking for your fourth title this time? Well, I think it's my fifth. I actually I won one another time Yeah, I know but I mean I've won this tournament four times because I won in 2000 and like eight or nine or whatever It was sometimes million years ago But yeah, I mean again, it's very strong tournaments very early and all three years that I won I think I was in a tie break or maybe the first year I wasn't but the last was in a tie break So again, you know, it's it's way too early to be thinking about winning the event Certainly three out of three is great But you know, I'm not even having any of those delusions of grandeur yet And you are taught on having another one of your colleagues love our onion playing here for the second time But the first time he played was in 2005 so after a big gap. Yeah, I mean, I think the funny thing is in 2005 We actually played here. I think we played this this Marshall gambit game which ended in a draw So I think every year there's someone different who comes I think last year it was Vichy Oh, sorry, Vichy was two years ago. Okay, I'm losing my mind Yeah, but it's always someone different every year So I think it's quite interesting to see how the other top guys do against against slightly weaker opponents in an open field I mean, it seems I guess the only guaranteed player here is Maxime. He seems to be here every year as well But certainly it's nice to see more of the top players coming and seeing a bit of variety as well Absolutely, and my last question is now when you play these top guys in a closed tournament The psychology is totally different. How is it in an open tournament if you play against Maxime or Lev? Let's say compared to if you play them in a GCT tournament, I don't think it makes a difference I mean, I think the I mean, what's what's the saying? It's like just win, baby I think that's basically all that matters. So you just have to win. All right. We love that attitude Thank you for taking our time and good luck. Thank you


Health Center and I think it's really important that everybody knows that we're still open for business. Thank you so much for joining us on our virtual 425k. Running slash biking for 25 days. Hi UVM, I'm Elise Morgan-Steef first. Hey people, my name is Tyler Doggett. I am quarantined at home and watching the news and trying not to watch the news every minute. To be quiet around here but we're really looking forward to having the students and faculty come back.


The future of spirituality will circumvent enlightenment. It will simply move directly into Self-realization. So the child is born, experiences Self-realization, loses it through the socialization and conditioning, and then regains it by being present and moving, cleaving its way back to Source.


it's a little ice cream for Michael what do you think hey boys how about we go spend some of this prize money what do you say Joseph what do you want what do you want to go get I think I know ice cream let's do this ice cream ice cream really we had a little prize money from yesterday let's go get some ice cream yeah we keep saying ice cream but we're actually meeting custard that's right and these frozen custard it's just amazing amazing custard I should say good job all right bye big bye boom thank you true love for the salad she's keeping me on on course let's see but salad after dessert after the custard and after the long run today's long run was 20 miles 730 pace I was planning to go about 750 to 8 minute pace but about mile 12 to mile 18 I had to outrun a pretty torrential rainstorm slash a little bit of lightning so I was booking it I dropped it down to probably like 630 pace so anyway legs are definitely feeling the race yesterday but they're not totally trashed and I would not typically do a run that long the day after a race don't go do that but remember I am on a very condensed timeline when it comes to this mini training block leading up to Pike's Peak because of the injury and the phantom pain and I had to be patient in late June I wanted to start running in well really early June to mid June but it ended up being late June early July so I'm condensing everything and thankfully crazy enough the the taper starts tomorrow Monday when you're watching this like I'll begin to reduce the volume of training just a little bit this upcoming week well I shouldn't say just a little bit about 15% of my total volume and then it'll go down by about 40% the following week and then even more the next week the actual week of the race so anyway that's what's going on I'm eating salad trying to enjoy the goods of life the custard and the salad I must say this is delicious though the custard is good but this is good too and yes we're going to open up that box that arrived here in a little bit I think you're gonna be excited about that the watch and ask keyword is gonna be watch and the question of the day what type of running watch do you own that's right and why and I know we've dabbled in this topic two or three weeks ago because I was researching I've made the plunge into the new rock new watch world and I'll be curious to hear what you're actually using out there for your running watches and who knows you might just run with a time max and that's good to you might not run with a watch and that's good to whatever works to help keep you happy healthy and running you know it's like just keep moving forward and you know we don't need to overload ourselves with too much data but a little bit is good to have so it's a balance it's a balance in this world just a little little back patio dinner chicken salad mac and cheese little pesto you guys want to go to Jackson Hole next year and watch the rendezvous mountain hill climb then you guys can take a big tram to the top of the mountain that's a huge huge gondola yeah it takes you up the mountain probably about as big as our carport Jeff I see a couple more noodles in your bowl you put your fault you sure remember you there you go here we go we got this little box not a shoe box we'll open this up in one minute first I just want to run you through the rendezvous mountain hill climb and some stats from the race that I ran yesterday in case you didn't know that I ran a race in Wyoming a tune-up race for the pike speak ascent and ended up winning it felt good about that so here were my splits first mile 915 second mile 1003 third mile 1019 fourth mile 1212 and then fifth mile 1044 and then the last point 6.7 so I think it was a little under 6 miles was 13 basically 25 pace because at the top it really turned into some pretty much scrambling like you were still running but you were definitely using your hands to negotiate the boulders and so the total elevation gain was 4100 and at least my watch says 4126 feet of elevation gain so with about a 1052 average mile pace so a very solid effort I would say considering I haven't done any speed work yet so I have so it's crazy but when you're watching I have 19 days to sharpen which really isn't that much time but I think it's I'm gonna be fine with it but I guess okay I take that back I just remembered I did that one little speed session on the top of Mount Brass last week but other than that I haven't really done speed work so we're working on a limited time but a time crunch here as I already mentioned and I will I'll get up high at least six more times before the race and I'll mix in probably three speed sessions in the next 19 days and then the rest will just be rest and recovery and as far as the rendezvous a mountain hill climb how did it go for me mentally you never know at the starting line who's gonna be there who's gonna show up I was in so the gun goes off I take off I'm in immediately in fifth place and then in fourth place by about the half mile and then in third place by maybe the three-quarter mile and then basically took over first place at a mile and a half maybe but between a mile and a half and two miles and I just knew like I just based on how so I can really tell watching other people how they are gonna perform in the race and that's what I I'm very observant as I'm racing like I watch people's cadence I watch their form I listen to their breathing and I just knew like I was gonna track down first place I knew it so I was just I wasn't I actually wasn't really that patient I just I went he went out fast and I just tracked him down by a mile and a half and then started to put the pedal down from there on out like I wanted to make sure he didn't come knocking on the door again because whenever you pass someone especially toward the top like you don't want to go backward again you don't want because if somebody catches you if you after you pass them oh man there's a good chance they're gonna blow by you because it's either you went out your move was too aggressive or they were just chilling just enough that they were able to hold the pace and then pick up a pace so I pressed hard and basically mentally I was visualizing the Pikes Peak ascent during the rendezvous mountain hill climb just so you know the obvious the terrain was actually this race the little steeper than the Pikes Peak ascent the ascent is steep in certain sections but it's 7500 feet of vertical gain over 13 miles versus 4100 feet of vertical gain over 6 miles so this was definitely steeper but I was I was visualizing Pikes Peak and thinking about other runners that I know will be at Pikes Peak and just visualizing pumping the arms keeping my form trying to float the mountain and not fight the mountain okay I'll talk more about that at some point but trying to float it rather than fight it so that's that's a little bit of my mental strategy for uphill running and then topped out on top win in the race felt good second W for 2019 two races two W's we will take it and so thanks for all the kudos on Strava and everywhere else it's just like I'm just grateful I'm considering a month ago I was dealing with phantom pain so it's insane okay let's open this bad boy up now I thank you again for your patience I know many of you came here just for this so let's see oh man and just so everybody knows this knife is very dull so I'm not worried about cutting myself at all just want you to be aware of that oh my goodness all right so this is my next running watch and you know my background when it comes to technology like it's a little up in the air but uh all right are you ready okay one two three was it gonna be on the Sun 2 5 can you see it there the Sun 2 5 I went with Sun 2 again so my old running watch is a Sun 2 watch that's one of the box the Sun 2 5 oh so my old watch is the Sun 2 Avid peak 3 you see it on your screen there bought it off of craigslist for I think I paid a hundred dollars but that was three years ago and it was still a solid watch three years ago but I decided it was time to upgrade to a better technology even though I am not a very tech savvy guy and away we go all right we're opening this up alive for you right now I have not seen this watch ever in person so and I'll just mention the weight real quick I don't have the weight memorized that's why I'm glancing at my phone so we're looking at 66 grams or 2.33 ounces and I'm gonna weigh here in a second my ambit peak 3 because this is a little on the heavy side and it doesn't make a huge difference but maybe a little bit in your arm swing just a little bit so anyway all right here we go what a whoa there it is oh my goodness okay all black that's right I went with the all black and oh that's nice okay I don't quite know what to do this is the studio this is not the the watch you so all right so it's not gonna turn on quite yet because I got to charge it but just so everyone knows I'm not a big data guy and I was looking for a watch that was lightweight light much lighter than my ambit peak 3 and I'm gonna weigh this again in a minute but I didn't need like the huge bells and whistles of the Sun 2 9 which I think is around I think it's a lot of money like $900 this guy's coming in at 330 which is not cheap but that's a pre compared to all the other products out there on the market that's a pretty good deal for what you get a lot of you ask for my opinion or sorry you ask for my heart rate on my training runs and I was always taught and trained and coached to run by feel over heart rate because there's so many other variables when running even if it's just simply like today on today's 20 mile run my legs were a little tired from the race yesterday so if I would have just been focused strictly on my heart rate and not taking in all the sensory data of my entire body I may have been running too fast or too slow so I actually don't track my heart rate and I go by feel so but but supposedly this Sun 2 5 can track my heart rate I must say though I'm probably gonna turn the feature off or just ignore it because once again I go by feel and I go by feel I don't know what else to tell you like I've just been running for 21 22 years and it's just like I just love going by feel whether it's an easy day 9 minute 9 30 pace or a harder days and I'll commit to you right now that in a month from now I will do my first ever GPS watch review for the Sun 2 5 I again this is not my wheelhouse but I'll do my best in about a month from now so thanks for watching thanks for being here again watch is the keyword question of the day what is your running watch and maybe you don't even run with a watch that's cool too maybe you just use your phone I'll be curious to hear how many people just carry their phone that's becoming more and more popular and it'll be even more fascinating to see how Apple watches or Android watches continue to make inroads because I think it's happening as we continue to simplify the technology where you can just walk around you'll go for your run and then scan your watch at the grocery store to pay for you know a sandwich and a drink after your run or something so it's it's continuing to happen so it'll be it'll be interesting to see how the technology evolves alright here's a couple more blogs on the end screen some blogs in the last two weeks that really jumped out at me and are getting great views from all of you so here's a couple blogs for you to watch and again thank you for being here seek beauty work hard and love each other we got a good week coming up good week see you tomorrow


My name is John Taylorson, and today it's my pleasure to facilitate this webinar, which is not just about resilience, it's also about tax, it's about VAT. But it's going to be a lot more interesting than that might give you the impression. So Hugh, Thomas from Puffin, some of you will remember from previous webinars. Phil, you might remember from one of the webinars, and Andrea has joined us today, and she's from Centurion VAT. So I'm going to pass over to Hugh for a moment to just introduce us all properly. And then I will take over again and we'll spend the next 45 minutes to an hour chatting through tax and VAT and excise and management information systems and the like. Hugh, over to you please. John, it is a short introduction from me, you know, I've got a role on the the Welsh Food and Food and Drink Industry Board. And one of the work packages that we developed a number of years ago was the Investor Ready programme and Building Business Resilience, which BIC and I are delivering on behalf of the Welsh Government and the Food and Drink Board. You know, and this is a series of seminars, I think, you know, hopefully most of the people listening in have already perhaps been on one or two of them.  Brilliant. Thank you, Hugh. OK, so this year you may have noticed we've had a bit of a crisis and that's really tested companies both in terms of some of the subjects we've covered in terms of planning, risk mitigation, trade credits. But very often corporate structure and taxes come through, not least because that has stopped some people being able to access some of the assistance that might otherwise have been able to get. OK, we're going to talk through some of those issues. As we do that, we're going to have, we've got a chat function so that you can ask questions or make points as we go along and we'll try and answer those as we go. For my part, being a previously food and drink business, I too have struggled with the AT and tax and the like, not just understanding it but also the administration behind it.  We actually reclaim the VAT and we don't have to charge it on a lot of our outputs. But knowing when to charge for VAT, of course, is extremely important and what is recoverable. I mean, tax needn't be taxing, but it is a worry. And of course, HMRC are renowned for not having a sense of humour if you get it wrong. So today, one of some of the areas we want to cover are how you avoid getting it wrong. We're not going to get into individual tax advice. That's not really for today. But hopefully you'll go away with an idea about what you should worry about, when you should worry about and who you should go and worry about it with. So, without further ado, I'm going to turn to fill in the first instance and let's just talk about it right at the start. Corporate structure and tax. What should we be and when should we be paying for it? Phil? Phil, thanks. I changed the name of that a little bit. I once tried to do a webinar on corporate structures and nobody signed up for it. So I suppose in that sense, this is a good start. We've got 17 participants. But I think nobody turned up because it wasn't terribly exciting. I'd pitch that as setting your business up to succeed. And there is a bit of understanding of the outset around what that means. I guess broadly speaking, we encounter three structures and I will keep this brief. Lots of people will start out as a sole trader. So they get going, they start selling some stuff. And at the end of the year, they try and work out how much stuff they sold, how much it costs them, and ultimately feed a sort of profit number into a self assessment tax return. So that feeds into income tax. Many businesses have kind of grown up and particularly in the rural community as partnerships where broadly speaking, you get together with some other people, run a business. Again, go through the same process of working out what you sold, what it costs you. And again, coming out with a figure that's split in line with perhaps a partnership agreement if we've gone that formal, but more often than not, in line with, I guess, an idea that the partners have got. And that number goes on a self assessment tax return. So back to income tax. Finally, and very commonly, of course, the limited company structure, which is slightly different, limited by its nature is a limited liability, which deviates from the structures that we just talked about the partnerships where there is liability the owners or the sole trader.  And that's kind of broken with personal guarantees. So a bit of a word of caution before everybody says that there's a there's a kind of catch all that personal guarantees to the bank are exactly that they are personal so with your limited or not. And companies pay corporation tax. And on the salary that they'll pay to directors and shareholders and the director and shareholder will pay income tax. And they will also pay income tax on any dividends received from the company. So broadly speaking, most businesses will contend straight off the bat with either just income tax on any profits that they're generating to them personally, or in a company structure, some income tax and some company tax. So we're already up to two taxes and anybody that's got ambitions to or is likely to or is selling more than 85,000 pounds worth of stuff is also going to be contending with VAT. And John put it kind of simply and said, Well, look in the food industry, aren't we all kind of the beneficiaries of the kind of VAT game and actually, it's just not that simple. And which it won't surprise you to learn because you've got a whole load of people in the food chain that absolutely are the beneficiaries from the from the VAT. And they can reclaim the costs of their inputs, their capital expenditure. And that's great news. And they charge VAT or at least they charge it at 0%. And right at the end of the food chain, the restaurants that you go and visit, and actors, tax collectors, because they do charge VAT at 20%. And whilst they can reclaim it, and they usually net losers in that game. So it's too simple to say that the VAT market will kind of lead food and drink businesses to be in one area or another. And Andrea will no doubt touch more on that. And, but why would I be any of these particular structures when I touched on limited liability of a company structure. And so, fundamentally, the most ambitious businesses are seen as limited companies. And so for those that have got a growth ambition beyond the kind of small business around the around the family house, the family home, and you are likely to see a limited company structure, and you are likely to see a VAT registration. And in time, and as you grow, and people start to look at credit, they start to look at the health of your company, and they expect to see that you're in that business. And you might well say at what point do I become a limited company. And, and actually, that's a discussion that you need to work through with somebody that understands the wise and where for us, but from a kind of purely tax perspective. So if you're anticipating, or anticipating, kind of pulling out something in the order of 100,000 pounds, and then I'd start to be thinking about whether you're a limited company structure. And one other quick word on structures, and we will, I'm sure touch on it, and at some stage in the course of this webinar, and many of you will have come across R&D tax credits. R&D tax credits are a great thing for the food and drink industry, because as the name suggests, if you're doing some sort of R&D, you may be able to claim me credit or pay less tax. Great news. They only apply to limited companies. So it's just worth having that in your mind. If you're at the startup phase, and you think I'm not quite big enough to be a limited company, but I've got all of this research and equipment that I've got to go into to get my new product launched, R&D will only apply to you as a limited company. That's great, Phil. Well, you haven't touched on exercise and I know some of the alcohol and cider makers and what have you had that little worry. And also, we've already had one question, which you've already touched on a little bit is, particularly for those people who are starting a food and drink business, maybe in conjunction with their existing work. Maybe better off, you know, with the, particularly if they're a high rate taxpayer, you know, dividends, corporation tax, often as well, of course, they put their own money in and they've got a director's loan account. Does that all get a little bit confusing for people as to what's the most advantageous way from a tax point of view? Yeah, thanks. I'll come back to that. I'll touch briefly on the exercise point. And it's a really interesting point and nobody is happy. I can tell you in the game of what duty that they're going to pay. So the small brewers want a different regime. The cider makers feel like they fall off a cliff because duty kicks in when they go beyond 7000 litres.  There is nobody that feels terribly happy about the duty regime that they're in. And everybody watches the budget very closely because it will affect the profitability or otherwise of your business overnight in many instances. I suppose what I'd say about that is you've got to be aware that if you're in that regime that that is something you've got to be considering. And to be understanding the implications of how, when you're going to to settle up for that duty. And actually, you know, dare I say it, to understand what sort of business you think you can be running based on that. And a big example would be the cider maker that, for example, you know, might sell 7000 litres of cider reasonably profitably. And I've seen businesses jump to selling 40,000 as they move into the, into the duty regime and actually be no better off. And so you've really got to understand the maths, the mechanics behind it, the finances behind it and whether it's worth it. You know, more often than not, you'd say for a cider maker, maybe you've got to get to 80,000 litres of sales before actually you kind of make that leap. So that's a neat example. And if I'm paying 40% taxes, it better to take income out as a dividend or taxable pay or a combination of both.  And that means, I suppose, broadly speaking, that your earnings are in excess of 50,000 pounds. And actually, what will happen is you could take it out as a dividend. But if you want the same money, you're going to pay higher rate tax on the dividend. So at a basic rate, a dividend is taxed at 7.5%. At a higher rate is 32.5%. Sounds like dividends are better. Well, it's not that simple. The same thresholds for basic rate and higher rate are at 20% and 40% for a salary. But you've got national insurance on top. Well, hang on a second Phil, doesn't that all sound a lot worse? Yeah, perhaps. But actually the salary will attract a corporation tax deduction, which the dividend will not. You might want a combination of both because an amount of salary relevant to qualify for your national insurance contributions would make sense, perhaps. And I guess there is a marginal tax efficiency on taking most of the rest out as dividends. But again, there are wider considerations. Has the business generated enough profit to be able to allow you to take a dividend? Because in company law, they can only be paid from retained profits. So if you don't have any, they're not an option anyway. Like John mentioned, a director's loan account, many directors will have placed a large sum of money into their business that they are owed back to them effectively. And because it was your money, your taxed income in the first place that you invested into the business, it is absolutely your right to be able to pull that money back out and you don't pay any tax on it. But actually, people don't often lend others money for free. So you could take that a stage further and say, well, shouldn't I be getting some interest from the director's loan that I've put in. And it's kind of part of a bigger remuneration package. You might include a bit of interest that comes to you. You may or may not have cropped the interest, a certain amount of interest each year is actually tax free. So you could be making that loan account work even harder for you by charging your company interest. There's some form feeling that goes with all of that and some administration, but understanding all of that in the round is going to be really important. Tax shield, effectively. Yeah. Okay, that's what the point is, if you're a food and drink company and you're in that position, it's worth having the conversation with your accountant about tax shields and what are we borrowing and the level of borrowing and how it affects our corporation tax. Can we get into our favorite subject of VAT and I use the term VAT because normally it has a doing word in front of it whenever I speak to people in the food and drink industry. So, obviously, it is, as I was like to say, somebody explained VAT on food and drink to you and you've understood it, they haven't explained it properly. So without getting into digestive biscuits, jaffa cakes and the like. The principle these days I'm guessing is is that first of all, you need to ensure that you understand what you're producing and what its VAT status might be. Andrea, how do we go about doing that? Well, food VAT liability is, you know, it can be an absolute minefield you mentioned the cakes versus biscuit argument is there's lots and lots of examples of things that you might think is zero rated but a standard rated. But there is within within the UK VAT law, there is a schedule for which lists what's zero rated so sort of basic food food stuffs. And within that schedule as well as it telling you what is zero rated, you know that there's a whole raft of exceptions that are standard rated as well. So really important if you're starting out particularly to make sure you understand where you sit within the liabilities. I think that actually to be fair to customs that there is a good public notice on food as well which has, you know, it's quite a hefty notice and includes a lot of information on food as well on related goods, connected goods. Just to clarify that, I mean, what you're talking about is going on the HMRC website and having a look at the various VAT notices and I can recommend if we have a second lockdown and we're all playing parlor games on Zoom. If you want to play the game of standard rated, reduced rated, zero rated, exempt or outside on food and drink, it's hours of fun trying to guess. But that HMRC website, when you do go on there, that's still not always entirely clear Andrea. No, I mean, I wouldn't always recommend looking at customs notices. For a start, they are customs interpretation of the rules. It's not always the case that they're correct. But in the case of food, I think if you're starting out then definitely should have a read of that particular one. It's a good starting point. But then I would also say if you've got any doubts when you've looked at the rules, you should always, you know, obviously I would say this, but you should always seek some advice to make sure that you're doing the right things and that you've interpreted it correctly. That's where professional advice is a lot better than, I mean, I've always avoided and I've always said to everybody else, don't ring HMRC up and ask them a question you don't already know the answer to. Definitely. And also on these days, so I started off in customs and exercises of that inspector in the 80s, which is a bit scary. And in those days, if you wrote in and asked a question, I would write back and try and give you the answer, try to be helpful. Customs make it very clear these days that if you shouldn't really bother them, unless you're absolutely certain that what you're asking is not covered in their notices. And if you do ask them, their first pushback is usually that it is covered in their notices. So, yeah, customs are not particularly not as, I don't think quite as helpful as they used to be and they're probably more challenging than they used to be. So, you know, if you've got any doubts, I would say seek professional advice before you go to customs. And that professional professional advice needs to come from people who understand food and drink as in rather than just generalist. Yeah. Yeah, definitely. I mean, we work as VAT consultants. We don't do VAT returns. So the sort of work that we get involved with is complicated stuff that, you know, perhaps a general accountant wouldn't be able to help you with. So in relation to food, go to a food specialist. Go to a VAT specialist. Don't, don't assume that, you know, your, your, your day to day accountant knows the answers to everything because, you know, perhaps they don't, they, you know, they're generalists in that in a lot of cases. So go to somebody who knows food. Talking of which, Phil, you know about food. I mean, we can sit here and play parlor games, all the anecdotes about where VAT goes wrong on food and drink, but there is a serious point to it that it does go wrong for food and drink. I think, you know, particularly those people who've got slightly more complicated or vertically integrated businesses and haven't understood and plowed on regardless. Yeah, it can go wrong. It can go wrong very badly and very quickly, actually. It can also go right. If you understand what's going on and what you're doing. So a couple of them, a couple of tales, I suppose. Two years ago I took, took a lady on. And she said, I'm a bit concerned because I've been working with an accountant and I'm not sure that we've got this or that set up correctly. And we had a bit of a look beneath the covers and the truth was she didn't. And she ended up with a 27,000 pound VAT liability that she didn't have any money to pay. And that was actually because she misunderstood her VAT situation, her input and her output VAT and had accumulated this liability completely unknowingly from her perspective. She had to help her to work out how she was going to deal with that and then ultimately to kind of restart and to go again. And in doing so to help her with getting the system set up to be able to record things the right way in the first place. And so that she knew what was coming, setting aside some money for the inevitable VAT bill at the end of the quarter and recognizing that it wasn't all hers. So that's how badly it can go wrong. I suppose there are some, some better tales for those that have understood exactly what's going on up front. And I've got a really nice story at the moment with a client that I work with that. And as many businesses did in a restaurant and he clocked the through lockdown, he was going to have to do something to adapt here to shut the doors. He was going to need to keep trading in some way. And I suppose unlike many businesses, what he didn't do was just package up everything that he'd normally do in the restaurant and sell it on. So we had a look, we'd had a chat, and it worked out, we'd worked out that if he could sell cold takeaway food in a different way, and then he could sell it at 0% that. And so instead of handing 20% of whatever he was taking over in the restaurant to the Batman, each and for all of the sales each quarter. He could actually end up with money coming back in for the fact that he paid on the packaging to put the goods there for the advertising or whatever it was. And actually not have to pay any vast over for the sales that he'd made. And for the first time ever from his point of view, he's had a quarter now where he's, he's been in a repayment position. Now that won't keep going in perpetuity, but I suppose others sort of missed the trick with that where they continued to sell the same food that they'd always sold, but got it delivered as a kind of takeaway. So yeah, understanding exactly what it is that you've got going on is is of critical importance. And when you're in those sort of situations that you're relying on, first of all, the professional advice to make sure you understand the tax codes. But then obviously you need the systems set up properly. Now, I know we're all advocates here of the likes of zero. And of course you have to have that set up properly in the first place and tax codes change and there's our new VAT notice and what have you. Two elements to that really one, how do you make sure you're set up correctly to how do you remain set up correctly? How do you make sure you're in an informed position to know that something's changed? Phil, perhaps. So for me, I think this is where my view of this is that the role of an accountant has changed. And we've moved from being a group of people that you dropped a brown paper bag off to some time after the end of your year that produced a kind of set of accounts that told you how you did nine months ago. And I think it's important for you to needing to be relevant for today's businesses and by that I mean that actually the engagement is throughout the year and actually always in advance of year end and not after year end. And what does that mean? Well, it means that there's a more regular dialogue. It means that yes, we can get you set up at the outset on a zero. But because we're in close contact, because we're working with you on a regular basis, we're able to spot and advise and discuss and challenge and look at the changes that are coming. And they're not just VAT changes, frankly. They might be changes that are coming out of an awesome statement. They might be changes that we see coming around the corner for pensions, for capital gains, for whatever it is. The structure of the company might need to change to take advantage of new notices and the light that come out. But for those people who don't have Phil and are smallish businesses and don't feel that they ought to be able to rely on their existing accountant, where else should they be looking? Or what else should they be using as reference material to make sure they at least know there's something they don't know? I think Phil's exactly right. In the way things are these days, you really shouldn't leave your accounts to the year end. You should, you know, it's critical to know what's going on on an ongoing basis. And I would say, particularly, you know, that's true if you're in the catering restaurant takeaway sort of business. Because, you know, that's always been a really, you know, it's a big favourite of customs to look at.  And I think, you know, if a business is doing its accounts more regularly and not waiting to the year end, then, you know, it's in a position where it can see if things are going wrong, you know, if its margins are not right, etc. And, you know, a lot of these assessments that we see, you know, they're not, I mean, half of them are not really correct at all. But, you know, it's not always the assumption that, you know, the owner of the business as perhaps suppressed takings. It can be that, you know, you've got the wrong staff or money is going out of the business that you don't know about in some way. And keeping your accounts up today is, I think, really important to sort of, to protect yourself against that sort of thing. I mean, a lot of people, some of the people on this call and others, I know, I can imagine we've got people say, for example, a coffee roasting business, it's got a manufacturing business at the back that's producing food and drink for selling online, for selling wholesale, but also at the front of the place, they've got a retail coffee outlet and an EPOS system. So that EPOS system has got to be set up, right? It's also got to talk to the rest of the business in terms of the information, the various revenue streams that are going out of the business. Who should, how should people be going about that and thinking about making sure that EPOS system is set up right? Well, setting it up at the beginning correctly is very important. Phil mentioned that 27,000 pound assessment somebody had, and probably that was from a misunderstanding at the beginning about fat liabilities. In terms of EPOS systems, customs are much better trained at interrogating those than they once were. For a start, if you must set up the codes correctly, if you've got a list of products that have different liabilities, you need to make absolutely certain that that's right, because it's a basic check if HMRC come in on a fat inspection. A good one would ask to see that information and to review it. So really, really important, essential that you get that right. And together with that, to make sure your staff realize why they have to do things in a certain way. Again, I've seen a lot of problems where staff have perhaps somebody selling hot takeaway food and cold takeaway food and stuff. They've just said to the staff, this is what you do. But perhaps they need to understand better that it actually is a cost to the business if you don't do it right. If you start the wrong button on the till, you're actually breaking the tax. So disaster. Phil, for those people who've got EPOS systems and getting those to feed back into zero, just a sort of the finishing point on this is how do you help make sure those people are bringing that stuff in right? And it's coded up in zero or whatever the right way, because you've got these various categories. And I must admit when I go into zero and raise an invoice, I'm not entirely clear which code I'm putting this stuff under between exempt and outside and zero and reduced. Yeah, I think it's really interesting. And there's a couple of things on system. I think they're brilliant. Systems are brilliant for helping to drive efficiency. And what they won't help you to do is understand what should be going on in the first place. And you've got to do a couple of things you've got to understand what it is that should happen. And if you can't understand it, then make sure that somebody can educate you will help you to understand and get it set up in the right way. The system can then do its bit and whether that's an EPOS system, whether you don't have an EPOS system because you don't have a kind of retail bit. You've just got a zero. You've got an output from that system and you can do some work in understanding that. And again, if you can't understand what the output is, then get somebody to help you.  I think you can also spend a whole load of time trying to get a system set up to support your business that actually becomes a kind of false economy. And I had a client before that was trying to get this ERP system set up an enterprise resource planning system. It was all singing and all dancing and it looked at all elements of production and sales and human resources and whatever the business just wasn't big enough to warrant that set up and that system. And it wasn't quite right because he spent he spent two years trying to get the system to do the right thing. And that was two years he could have been focused on the business with a simpler system and understanding what was going in and what was coming out. I think it's reasonably simple. Make sure you get it set up at the start. Make sure you understand why it sets up that way as Andrea said, and make sure that you do something with it out the back. And because if you don't, then you might as well not have it. And the beauty of a system like zero. I'm not an accountant. Obviously I've got a finance background, but I'm not an accountant, but we as a business use zero as well. And I think it's very intuitive how it works. I don't think you need to be an accountant to to use it well.  But, you know, if that is a really useful system, I mean, I understand this designed by someone who's not an accountant as well isn't it so it's all helpful stuff. And for us, what I like about it is it's simple. It doesn't over complicate. You know, it gives us what we need. It doesn't, you know, do anything doesn't require us to do more than we need. So yeah. And you can track you can track with these systems who's done what as well can't you so if there is something to unravel. It's at least you can see what it is rather than people paying cash out of the tilt of suppliers and not keeping the paperwork straight. And just just on that, particularly on the people who are in hospitality and retail, we've had a question in from Joe Smith for takeaway food about cold about buffets and as that's cold, would that not incur VAT. And whilst we're not here to answer individual tax questions is that principle in that. How do you go about thinking about a question like that when you're in business and you need to make a decision on the day. Yeah, you need to be just on on that type of thing. You need to, and, you know, as you say we're not answering specific questions but the issues that you need to think about there are. Are you telling cold takeaway food, or which is zero rated, or are you in fact providing catering, which is not, which is not zero rated it's it's standard rated. So, you know, if you're if you're providing cold buffets for events. You need to consider the rules there are lots of, you know, quirks around it lots of conditions to be met so. So if you are doing that sort of thing, you need to think. I need some advice here I need to look at it before I start doing it. Yeah, and just just on that I mean I've in the past I've had the 18 voices come into me from large food and drink businesses, and they've just whacked that on Phil when when I didn't think that was was liable so I pushed back and they said, what does matter you can reclaim it anyway, but it's not as simple as that is it. It's not as simple as that.  And but actually, you know, it's a really interesting point john because I think that speaks to the way that you kind of want to work with your supply chain. And actually come into some, you know, a common understanding. And but actually we've got we've got a kind of duty to get it right for one another, because it matters for one another. And you don't want your, your business to be doing something that's not right because somebody else hadn't got their end quite right. You want to be working in partnership with the people that you've got to work with. And, and I think that's more important in this, this kind of moment with covid than it ever has been before and actually we're seeing sort of a closer kind of between agencies and alliances with with people looking at kind of strategic integration, looking at joint ventures. And, but, but, you know, that to me is a kind of, it's a compliance issue go and get it right and get the right, get the right advice and work with your supply chain in the right way. Sorry, HMRC on that as well. Technically, that is only reclaimable as input tax if it was properly charged. So you could have the situation where customs would deny you that that reclaim rather than going back to be nice and going back to the supplier and they would just deny you the the reclaim. Well, I mean, you say going back to them and being nice. I mean, it was, I don't think I was nice on the occasion because of course you don't want to be paying that on Sunday you don't need to pay that on and doing the paperwork. Yeah, no, I meant HMRC, you know, in the old days they would have said that, oh, we'll go back to the supplier and unravel it from that. Yeah. No, technically that they could say no, you can't have that VAT. It's always the worry, which is always the word. Hence why if you don't think it's right push back. Definitely, definitely. Yeah. Bigger organizations like Puffin Hue, obviously you've got, you've got those systems, you've got those ERP systems and the like, but what point do you decide that you need to invest in those systems?  Well, what I was saying on the ERP systems, Jon, is there's a kind of, there's a whole track record of disasters in our sectors of people I know of trying to implement very complex ERP systems as Phil says that, you know, they've ended up paying software companies huge amounts of money and it's added no value to the business whatsoever. So we've got a very different system here, which is we run SAGE as our main accounting system, but then we've got what we call a manufacturing execution system and MES system that churns out kind of raw data that we suck out of SQL databases using Excel. And, you know, we then work on that for our management account and control, you know, so we've got a bit of a hybrid system that works very well.  I think, you know, we've got a bit of a, as I say, a bit of a hybrid system that works really well for us, you know, what that benefit that manufacturing execution system and it also then runs traceability in the factory and it controls all the machines and you've integrated several functions within the business. Yeah, it leads to the PLP, to start machines and control tricks that, you know, does that, you know, which if you try to add the finance function on top of that would have just made it, you know, a complete dog's breakfast, but you see it, you know, works very well with how we run it. Yeah, well, I can't speak highly enough of ERP systems when I've been involved in businesses where they've been implemented, so hours of fun. Phil, but the fundamental part of that is the functionality within Xero, as Andrew was saying, it does a lot of good stuff very easily and you've got, you know, almost an ecosystem of apps that can sit on top of that. So for many food and drink businesses, I know you get warnings or you get advice notes come up on Xero anyway, don't you, for things that you should be worrying about, particularly with HR elements. What size do you need to be before you start investing in, say migrating from Xero to Sage systems?  Yeah, I don't think there's a one size fits all kind of answer to that. And what I'd say is, actually, there's a probably more fundamental kind of guiding principle, which is that you've got to have a finance system set up that helps you to understand what is going on with the business. And you could turn over, you know, 100 million and still be using Xero, if it was, if it could handle the number of transactions, there is a sort of finite number of transactions that it likes to live with. But if, assuming it could handle those and you could still get the data out that you wanted to run the business, then I don't think that you look at needing to change, you might have other bolt-ons that deal with inventory or deal with whatever other bits and pieces you might need. And so, for me, that's, it's about what it's able to deliver. And, you know, I sat in a meeting yesterday with a client that I've got, he's very profitable and has been for many years, which is great. And I've been saying to him, do you understand what's going on?  Yeah, yeah, I absolutely do. I've got all my margins up here and I know what's going on in the, from a cash perspective.  And he wasn't interested really in sort of hearing it. Now, in the last year, he's implemented a new system. And he said, and in the course of implementing this new system, we've actually identified that some of our margins weren't quite right. And instead of running at 21%, which he's done for the last few years, which is actually, you know, kind of by luck, perhaps, rather than judgment resulted in quite good sort of result from his perspective. He's run the first part of this year at 25% with his new system. And what that's meant is that this year looks a lot similar to last year, despite the fact that he lost three months trading. That's a big difference. That's a very big difference. That's a very big difference. And so, you know, that is about the system being kind of fit for purpose, not about the size or scale of the business and delivering the information that you need to go and run that business. But what you're effectively saying is having is not just the tax codes right in the system, it's ledger codes, it's being able to identify the cost of sale for the particular either channel or product that you're producing. That's absolutely right. And it is unbelievable, the number of businesses that we might come across that you could identify a loss making product that actually has been masked by the performance of the wider kind of suite of Yeah, so some where some people say well, that doesn't matter because we've got to sell that product anyway to have those customers. You can't manage the profitability if you can't attribute the right cost of sale to either the product or the channel of distribution. Absolutely right. And don't get me wrong, there are strategic decisions you might take to go and sell a product that either generates a lower margin or perhaps just breaks even. And because as part of your lineup of products, it's important. I'm led to believe, for example that wicks sell cement close to a loss.  And actually while you're there, you'll also go and pick up the pack of screws rather than heading off to screw fix because although you could buy it cheaper, you happen to be in the shop. And, you know, if you've got a strategic decision, that's fine. What you don't want is to end up selling loss making products without a knowledge that that's where they are. I think in the world of on online where you have potentially products that you might have to sell, either on van sales or delivered services, things like potatoes may not make much money on them, but you have to have them on there. You know, because you won't, you won't sell the other stuff. So I think it's very, very common within food and drink that we have products that we sell because we have to sell them rather than making money on them. It's knowing it's knowing how much you're not making on them, I guess is the key thing, which brings us nicely to the future. And first of all, you mentioned it at the start and it did so we'd come back to it. It's tax credits. Everybody's talking about them. But of course, there's one of those things that we should be making more effort with, shouldn't we, Phil? Yeah, absolutely. So for those that don't know, an R&D tax credit is really useful. It's like it sounds is related to research and development. It means that you either get some tax back, pay less tax, or, or in fact that you can kind of surrender it for some cash coming into your business, which would be pretty welcome for a lot of people. And that applies to making the key point there, Phil, is you don't actually have to be making money to benefit from R&D tax credits? No, absolutely. So if you are loss making, then you can elect to surrender the loss that the tax credit has generated for cash coming into your business. Broadly speaking, they work by saying, what are the expenses that we've incurred on research and development? One of the costs of the people, of the product development, of the wasted products, the attempts that we made, and it's in areas where you couldn't go out and find a commercial solution of the shelf. Okay. And that doesn't mean that somebody else hasn't done it. Somebody else might well have done it, but they're not going to tell you what the answer is, because it's commercially sensitive information.  You work out what it costs you to do it, and you effectively sort of multiply the cost of that up, which makes it look like it costs more and therefore you pay less tax. But that's a really important point as well about R&D tax, because a lot of people I think have the misconception that if somebody else has already done it, it's not R&D. It's peculiar to your business and whether you have done it or not before, isn't it? Yeah, that's exactly right because somebody is not going to tell you, they're not going to give you the recipe for Coca-Cola. So if you want to go and make it, you're going to have to try and try a few things and you'll get some of it wrong. And it will be rubbish and you'll throw it in the bin and there will be a cost of the materials and there will be a cost of the time for the people that are working on that recipe and the development. I suppose, you know, what could it be? Well, it could be that you want a cheese with a certain texture profile. You want the calcium lactate crystals that are in there that give it the crunch. You want a product that has got reduced sugar is going to need to travel in a certain type of packaging because actually you don't want it, you don't want to sell it in plastic, but you don't want it interacting with the alternative packaging. And you can't quite get it right. You want to... I suppose it even goes as far as software and Hugh was talking there about the systems that he's got and the fact that it's not a whole ERP system, he's got bits that will sort of bolt together. Well, if there is kind of bespoke and it's a more contentious area with HMRC and it needs proper review and proper advice, but even if it comes to working out how to integrate systems to do something that people haven't thought you could do or kind of works for you, there is potentially R&D that's going on in that space. And the conversation you and I have had in the past is that because of course I'm duty ban to say that Bic has got a app that works on both iOS and Android, where you can record against individual projects the time you spend within the business on these so that your accountant can have a really printed out CSV file as often as they'd like to record all this. The advantage being Phil. Well, we know that when you record R&D as you go, your claim is typically larger than if you give somebody a brain dump at the end of the year and guess what you think you might have done for the R&D. So it's constantly at the forefront of your mind and you're recording it as you're going along, you're going to end up with a bigger, better claim. Yeah, yeah, for the record account and stone guess if you don't record it, you're potentially missing out on it. Okay, so we're nearly at the end. Thank you very much indeed. Can I both as Andrea, we were going to have a prediction and a top tip from you if we made please. Right. I top tip. I would say get on board with Brexit. If you're an importer and exporter, there are going to be changes. And I would definitely recommend that you use you start addressing them and receiving updates from. I mean, we do them but updates from anywhere and everywhere to make sure you know what's going on there and how that's going to affect you. So that would be my top tip. Are you issuing updates, Andrea? Can people access that for you? Yeah, we, if you, we send them out to our clients regularly. I've got a lot of experience in international trade. We're running training sessions. But yeah, if anyone would like to go on our website, which is centurionback.com. There's this facility to sign up for newsletters, news bites. There's no obligation whatsoever. We won't pester you. But it's one way to keep on top of what's going on. Because, you know, there will be changes that affect you, even if your business is just involved with zero rated stuff, if you import an export. And in terms of predictions, when we leave the EU, we could, it would then allow the government to mess about with, with that rate. So that could be in a positive or a negative way. You know, they might decide that they want to help the restaurant industry more by keeping a reduced rate in place, for example. And the other thing, which is not really, it is a prediction, but it's probably also going to be a fact is related to making that digital. Anyone who's about registered will know that, you know, that regime has started submitting your back returns digitally. There will be a day where you're also expected by or required by HMRC to upload your data as well. So that's my not particularly pleasant prediction. Thank you, Andrea. Phil, top tip and prediction. Well, my prediction is that a bit like Andrea, that we're going to see an increasingly kind of digital world. And that's going to mean that actually corporation tax starts to get paid quarterly, maybe monthly. And I see get access to all of that data. And it's also going to rather sadly do accountants out of a revenue stream that they've employed for the past 250 years. Which is the idea that we can pull some of these accounts together at the year end. So that's my prediction systems will do that. And therefore, actually, it doesn't mean that I think I'm going to be kind of wholly redundant. I think that actually what it will mean is the relationship with accountants changes so that you need to talk to an accountant throughout the year about what's going on and the planning that's going on. And you either need a finance team like Hughes talked about that's got the in-house capability to go and do it. Or you need an accountant that is going to be on the phone to you and talking to you, you know, once a month say about what's going on. And so my kind of top tip is that actually if you feel like you've got that relationship with your accountant, great. If not, make sure that you can find somebody that you can get that with because you should be talking to somebody once a month in the climate. Hughes, after on reflection, top tip and a prediction. I think, you know, top tip is to get people around you that you trust and will provide you the right advice, John, isn't it? You know, it's, it's interesting to talk about R&D tax credits. A number of years ago and four or five years ago, we had one of these kind of off the shelf companies came in to give us some advice on this. And we felt as a body was far too edgy. If you know what I mean, I think, but we took some lessons from that and went back to people that we trust more and, you know, found a kind of equilibrium and, you know, a long term position on what we do in that area. You know, we've got, we've got tax advice specialists and, you know, we've got our in-house team here, and I trust all of those implicitly. You know, I'm the MD of a business, I know very little about the detail, to be honest, John, but, you know, we know we've got team members who know what they're doing, you know, so seek the right advice is my top tip. Any prediction? It's going to be time to change.  Yeah. Okay, thank you here. Well, I think, I think just to summarise them, getting your business structure right from the word go and planning for growth seems to be older the day. Tax codes plainly, both in EPOS systems and in your accounting system and that comes back to ledger codes as well to make sure that you know what the cost of sale really is for a product or a market that you're serving. Professional advice, don't be ringing up HMRC with questions that you could get an answer from from R&D, plainly that's a rich vein and if anybody's interested in that we can help them with a little app that will help them do that. I'm due to be able to say that we've got another these webinars on the 29th of September at 930 in the morning. This one your love it's other people's money, which is actually I think it'd be pretty relevant because of course, if you've run out of means of raising debt then you might be tempted to look at the equity sources. Hence the title other people's money. I was particularly pleased with that one as you can tell. I have to thank Hugh, Andrea, Phil and Linda for keeping me honest in the background. I have to thank everybody else who got up this time of the day and hopefully you're still there on the other side and we'll look forward to seeing you all and more on the 29th. Thank you. Thank you.