April 24, 2018 By Christophe Veltsos 3 min read

In April 2018, the Center for Audit Quality (CAQ) released a document to help board directors fulfill their fiduciary duties regarding the oversight of cyber risks. Titled “Cybersecurity Risk Management Oversight: A Tool for Board Members,” this short, 10-page document consists of questions for boards members to ask top management and financial auditors to improve cyber risk management and increase overall engagement among business leaders.

Four Key Takeaways From the CAQ Guidance

The questions are organized into four main areas, including how auditors may or may not be considering cyber risks in their scope of work, the roles of management and auditors regarding cybersecurity disclosures, how business leaders approach their risk management responsibilities, and how CPA firms can help boards improve oversight of cyber risks. Let’s take a look at these four categories in more detail.

1. How Financial Statement Auditors Evaluate Cyber Risk

The first section of the CAQ guidance urges board directors to understand how financial auditors consider cyber risks. It asks directors to pay attention to the extent that the audit process itself addresses risk and whether the auditors’ procedures are sufficient to assess the effectiveness of security controls.

2. The Roles of Management and Auditors in Cybersecurity Disclosures

The next element concerns the organization’s responsibilities and handling of cybersecurity disclosures, and directly addresses the U.S. Securities and Exchange Commission (SEC)’s updated guidance on that topic. It advises organizations to implement appropriate policies and procedures to ensure accurate and timely disclosure of material cyber events, address and prevent insider trading before the news of a breach reaches the public, and involve representatives from top management and the board in the disclosure process.

3. Business Leaders’ Approach to Cybersecurity Risk Management

The CAQ document also stresses the importance of selecting the right cybersecurity framework and considering the best way to communicate information about the cyber risk program to other stakeholders within the organization. It also asks board directors to consider whether management has processes in place to evaluate the effectiveness of the risk management program and implies that controls should be regularly evaluated.

In addition, the guidance urges board members to determine whether the organization’s leadership has purchased sufficient cyber insurance, addressed third-party risks and developed mechanisms to cope with potential breaches involving outside vendors.

Finally, the third section of the document advises board directors to determine whether the organization has conducted a data breach simulation to gauge top leadership’s ability to respond to an incident, in terms of both the immediate post-breach response and the public disclosure.

4. How CPA Firms Can Help With Cyber Risks

The final section of the guidance explains that boards should explore opportunities to recruit additional help, whether from the organization’s current auditing partner or another firm, to navigate through the many challenges associated with cybersecurity. According to the document, an audit “cannot prevent or detect a cybersecurity threat or breach,” thus directors should ask, “What is the goal of the cybersecurity examination?” They should also determine what other types of engagements are feasible to help improve the organization’s handling of cyber risks.

Dovetailing With NACD and AICPA

The CAQ document also makes brief but significant references to the work of two other important entities. First it cites the American Institute of CPAs (AICPA)’s work to keep the auditing profession relevant, including the recent release of its cybersecurity risk management reporting framework. It then references the National Association of Corporate Directors (NACD)’s effort to improve board directors’ awareness and engagement around cyber risks. Of the 10 pages in the CAQ document, three are comprised of lists of questions extracted from the NACD’s “Director’s Handbook on Cyber-Risk Oversight,” which was published last year.

The Conspicuous Absence of Cyber Resilience

The CAQ oversight guidance is one of the most condensed publications I’ve seen to date that provides useful and actionable information to board directors about cyber risks. However, I can’t help but wonder why it failed to address cyber resilience altogether. This topic has gained a lot of attention in light of recent ransomware disruptions.

While it’s easy to assume that cyber resilience is included under the broader umbrella of cyber risk management, it’s time for top management and board directors to engage in efforts to improve the organization’s ability to respond to and recover from cyber incidents. That means putting the company’s capabilities to the test, either through penetration testing exercises or via crisis simulations.

Board directors should also pay close attention to whether the organization’s processes are maturing and improving. The CAQ document notes that business leaders might be able to leverage a CPA firm to help assess the organization’s cybersecurity maturity level.

Even with these minor shortcomings, the CAQ’s “Cybersecurity Risk Management Oversight” tool is a condensed, powerful set of guiding questions that should be on the desktop of every board director, CEO and CISO.

More from Risk Management

Digital solidarity vs. digital sovereignty: Which side are you on?

4 min read - The landscape of international cyber policy continues to evolve rapidly, reflecting the dynamic nature of technology and global geopolitics. Central to this evolution are two competing concepts: digital solidarity and digital sovereignty.The U.S. Department of State, through its newly released International Cyberspace and Digital Policy Strategy, has articulated a clear preference for digital solidarity, positioning it as a counterpoint to the protectionist approach of digital sovereignty.What are the main differences between these two concepts, and why does it matter? Let’s…

A decade of global cyberattacks, and where they left us

5 min read - The cyberattack landscape has seen monumental shifts and enormous growth in the past decade or so.I spoke to Michelle Alvarez, X-Force Strategic Threat Analysis Manager at IBM, who told me that the most visible change in cybersecurity can be summed up in one word: scale. A decade ago, “'mega-breaches' were relatively rare, but now feel like an everyday occurrence.”A summary of the past decade in global cyberattacksThe cybersecurity landscape has been impacted by major world events, especially in recent years.…

It all adds up: Pretexting in executive compromise

4 min read - Executives hold the keys to the corporate kingdom. If attackers can gain the trust of executives using layered social engineering techniques, they may be able to access sensitive corporate information such as intellectual property, financial data or administrative control logins and passwords.While phishing remains the primary pathway to executive compromise, increasing C-suite awareness of this risk requires a more in-depth approach from attackers: Pretexting.What is pretexting?Pretexting is the use of a fabricated story or narrative — a “pretext” — to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today