Connect with us

Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website. .

Top Stories

NO TRANSLATION NECESSARY: DEVISING A COMMON LANGUAGE FOR CYBER RISK REPORTING

NO TRANSLATION NECESSARY: DEVISING A COMMON LANGUAGE FOR CYBER RISK REPORTING

By Susan S. Coffey, CPA, CGMA

Last year was the worst year ever for data breaches and cyber-attacks, with 159,700 total incidents worldwide, according to a recent survey by the Online Trust Alliance. Research by the Ponemon Institute found the average cost of cybercrime last year in the United Kingdom was $8.74 million, a 21 percent increase from 2016. And costs are escalating even faster in Germany (up 42 percent), Australia (up 26 percent) and Japan (up 25 percent). This is a global problem that demands global tools to solve it.

In the board room the message is being heard loud and clear. High-profile incidents involving Equifax, PCI, Yahoo! and Wonga, have put intense pressure on corporate manages to establish effective cyber security risk management programs – and to clearly communicate the steps they’ve taken to address cyber risks to their board members, investors, regulators and the public.

Despite the seriousness of the issue, companies face challenges in meeting the problem effectively. A lack of uniformity has made it difficult to describe risk mitigation strategies for cyber attacks in common terms that permit apples-to-apples comparisons and industry benchmarking. The quality of information provided to boards appears to be growing: some 31 percent of the U.K.’s FSTE 350 said they received detailed reports from management on cyber risk, up from 21 percent the previous year, according to a 2017 survey by the U.K. government. Yet most companies say they receive lesser updates with either “some information” (53 percent) or “very little insight” (7 percent).

A lack of defined, widely understood terminology and processes can lead to ad-hoc approaches to cyber risk reporting. In a recent webcast hosted by the Association of Certified Professional Accountants (the unified voice of the AICPA and CIMA),security firm founder Robert Herjavec said board members who oversee cybersecurity initiatives have often approached risk mitigation like “people building houses, but not knowing what they want the house to look like until it’s built.”

What’s needed is a blueprint. And that’s what we had in mind when we developed a cybersecurity risk management reporting framework last year. It offers a common language to describe the extent and effectiveness of a company’s cybersecurity efforts, and it’s flexible enough to apply to any type of organisation in any part of the world.

Our cybersecurity risk management reporting framework is designed to create uniformity with criteria that supports a standard way of doing things. This means an organisation’s management can use the criteria to describe its cyber risk program to stakeholders, including detailed information about the nature of the business, data that might be at potential risk, cybersecurity objectives, and details about risk governance and risk assessment.

The second aspect is to develop control criteria. Management can use the criteria to evaluate whether the organisation is effectively meeting its cybersecurity objectives. Public accountants, meanwhile, can use the control criteria when engaged to provide advisory services involving cybersecurity or to perform a System and Organization Controls (SOC) for Cybersecurity examination engagement.

Voluntary and market-driven, the framework is designed to help all organisations build a more coherent approach to cybersecurity risk management and to communicate those activities clearly to stakeholders. This information, combined with the public accountant’s opinion on the effectiveness of management’s efforts, will increase those stakeholders’ confidence in the organisation’s due care and diligence in managing cyber risk.

As cyber-attacks continue to rise in the coming years – in the UK and around the world, the accountancy profession can play a key role in building trust, order and assurance into cyber risk reporting. The framework can be a critical tool in that process.

Susan S. Coffey, CPA, CGMA, is executive vice president for public practice at the Association for International Certified Professional Accountants. For more information about the cybersecurity framework, visit the Association’s SOC for Cybersecurity page.

Global Banking & Finance Review

 

Why waste money on news and opinions when you can access them for free?

Take advantage of our newsletter subscription and stay informed on the go!


By submitting this form, you are consenting to receive marketing emails from: Global Banking & Finance Review │ Banking │ Finance │ Technology. You can revoke your consent to receive emails at any time by using the SafeUnsubscribe® link, found at the bottom of every email. Emails are serviced by Constant Contact

Recent Post