New Path for CPAs in Cyber Risk Management: AICPA Proposals Would Guide Companies in Designing and Describing Cybersecurity Risk Management Programs and Create a 'Cybersecurity Examination' Engagement
[ILLUSTRATION OMITTED] Management and public accounting firms can find new guidance on designing and evaluating cybersecurity risk management programs in proposals issued by the AICPA Assurance Services Executive Committee (ASEC). The evolution of technology and the sophistication of hackers have made cybersecurity one of the most important areas of risk management for businesses. More than 95% of CGMA designation holders participating in a 2015 survey said their companies are concerned with the threat of database breaches, distributed denial of service (DDoS) attacks, phishing scams, and other cyberattacks. ASEC issued two exposure drafts that are designed to lead to: * A common set of criteria for management to use to design and describe their cybersecurity risk management programs and to assess the effectiveness of the controls included in the cybersecurity risk management program. * The introduction of a new engagement that CPAs would be able to use to serve boards of directors, senior management, and others as they evaluate the effectiveness of an organization's cybersecurity risk management program. The engagement would be known as a "cybersecurity examination." The first ED, Proposed Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program, proposes a framework that company management would be able to use to design and describe their cybersecurity risk management program. The proposed framework also would be used by public accounting firms to report on management's description using the new cybersecurity examination engagements. The second ED, Proposed Revision of Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, proposes revising AICPA trust services criteria used by public accounting firms that provide advisory or attestation services to evaluate the controls within an entity's cyber risk management program--or SOC 2 engagements. Management may use the trust services criteria to evaluate the suitability of design and operating effectiveness of controls. The proposed frameworks represent an effort by the auditing profession and the AICPA to develop a common foundation for CPAs' services in response to the growing market demand for information about the effectiveness of cybersecurity risk management programs. "Our primary objective is to propose a reporting framework through which organizations can communicate useful information regarding their cybersecurity risk management programs to stakeholders," said Sue Coffey, CPA, CGMA, AICPA executive vice president-Public Practice. Under the proposals, management would be responsible for developing and presenting in a cybersecurity report a description of the entity's cybersecurity risk management program. Management also would choose the description criteria and the control criteria that would be used by a public accounting firm in a cybersecurity examination. …