Published : 7 years ago, on 23/03/2018

By Susan S. Coffey, CPA, CGMA

Last year was the worst year ever for data breaches and cyber-attacks, with 159,700 total incidents worldwide, according to a recent survey by the Online Trust Alliance. Research by the Ponemon Institute found the average cost of cybercrime last year in the United Kingdom was $8.74 million, a 21 percent increase from 2016. And costs are escalating even faster in Germany (up 42 percent), Australia (up 26 percent) and Japan (up 25 percent). This is a global problem that demands global tools to solve it.

In the board room the message is being heard loud and clear. High-profile incidents involving Equifax, PCI, Yahoo! and Wonga, have put intense pressure on corporate manages to establish effective cyber security risk management programs – and to clearly communicate the steps they’ve taken to address cyber risks to their board members, investors, regulators and the public.

Despite the seriousness of the issue, companies face challenges in meeting the problem effectively. A lack of uniformity has made it difficult to describe risk mitigation strategies for cyber attacks in common terms that permit apples-to-apples comparisons and industry benchmarking. The quality of information provided to boards appears to be growing: some 31 percent of the U.K.’s FSTE 350 said they received detailed reports from management on cyber risk, up from 21 percent the previous year, according to a 2017 survey by the U.K. government. Yet most companies say they receive lesser updates with either “some information” (53 percent) or “very little insight” (7 percent).

A lack of defined, widely understood terminology and processes can lead to ad-hoc approaches to cyber risk reporting. In a recent webcast hosted by the Association of Certified Professional Accountants (the unified voice of the AICPA and CIMA),security firm founder Robert Herjavec said board members who oversee cybersecurity initiatives have often approached risk mitigation like “people building houses, but not knowing what they want the house to look like until it’s built.”

What’s needed is a blueprint. And that’s what we had in mind when we developed a cybersecurity risk management reporting framework last year. It offers a common language to describe the extent and effectiveness of a company’s cybersecurity efforts, and it’s flexible enough to apply to any type of organisation in any part of the world.

Our cybersecurity risk management reporting framework is designed to create uniformity with criteria that supports a standard way of doing things. This means an organisation’s management can use the criteria to describe its cyber risk program to stakeholders, including detailed information about the nature of the business, data that might be at potential risk, cybersecurity objectives, and details about risk governance and risk assessment.

The second aspect is to develop control criteria. Management can use the criteria to evaluate whether the organisation is effectively meeting its cybersecurity objectives. Public accountants, meanwhile, can use the control criteria when engaged to provide advisory services involving cybersecurity or to perform a System and Organization Controls (SOC) for Cybersecurity examination engagement.

Voluntary and market-driven, the framework is designed to help all organisations build a more coherent approach to cybersecurity risk management and to communicate those activities clearly to stakeholders. This information, combined with the public accountant’s opinion on the effectiveness of management’s efforts, will increase those stakeholders’ confidence in the organisation’s due care and diligence in managing cyber risk.

As cyber-attacks continue to rise in the coming years – in the UK and around the world, the accountancy profession can play a key role in building trust, order and assurance into cyber risk reporting. The framework can be a critical tool in that process.

Susan S. Coffey, CPA, CGMA, is executive vice president for public practice at the Association for International Certified Professional Accountants. For more information about the cybersecurity framework, visit the Association’s SOC for Cybersecurity page.