Three IT risk factors that can impact financial reporting

With the global cost of cybercrimes running into the billions, an SEC investigative report on cyber-related frauds from October 2018 presented a clear warning to public companies: revisit the effectiveness of your IT internal controls to guard against business email compromises (BECs) and other emerging cyberthreats.

Below, we outline three risk factors impacting financial reporting and five steps your organization can take to counter them.

SEC regulatory history overview

The SEC requires issuers to keep accurate books, records, and accounts, as well as maintain a system of internal controls and compliance procedures to ensure investors can make informed decisions.

The SEC has long held an interest in the books and records provisions of bills Congress passes including the 1934 Exchange Act, the 1977 Foreign Corrupt Practices Act (FCPA), and more recently, the Sarbanes-Oxley (SOX 404) Act of 2002.

The SEC linked accurate books and records to international bribery with the FCPA and internal controls over financial reporting (ICFR) with SOX 404. In its October 2018 report, the SEC linked the books and records to mutating cyberattacks. This, however, is new.

Takeaways from SEC report on cyber-related frauds

In its 2018 report, the SEC described the increase in cyber-related attacks targeting public companies and the role internal control requirements played in the success or failure of those attacks. The SEC cited BECs as the fastest growing attack vector.

Losses from BECs in 2019 exceeded $26 billion, and they’re increasing at a rate of more than 200% per year.

While the exponential increase in BECs is a new data point, the SEC’s expectations remain the same as it relates to evolving threats: organizations should regularly review and update controls to address changing risks.

The SEC communicated that it expects issuers to include cyberthreats in their SOX risk assessments.

The exponential increase in BECs and other cyberbreaches described in its 2018 report prompted the SEC to again consider increasing enforcement activity for the books and records provision because of the overlap between IT controls and financial reporting.