The steady stream of headlines about data breaches has the business community and regulators on high alert with regard to cybersecurity.
A PwC online survey of global executives and IT directors conducted early in 2013 found that detected cybersecurity incidents rose 25% over the previous year. And 31% of executives responding to EY’s Global Information Security Survey for 2013 said the number of cybersecurity incidents at their organization grew at least 5% over the previous year.
In recognition of these trends, the Center for Audit Quality (CAQ) released an alert to its nearly 600 public company audit firm members that summarizes external auditors’ duties with respect to cybersecurity. The alert is available at tinyurl.com/l297bkm. The CAQ is affiliated with the AICPA.
“Cybersecurity is one of the most complex and evolving issues facing public companies,” CAQ Executive Director Cindy Fornelli said in a news release. “All players in the financial reporting supply chain, including of course independent auditors, have an important role to play.”
External auditors’ duties, according to the alert, include:
- Understanding how the company uses IT and its impact on the financial statements.
- Understanding the extent of the company’s automated controls as they relate to financial reporting. This should include an understanding of IT general controls that affect the automated controls, and the reliability of data and reports used in the audit that were produced by the company.
- Taking into account the understanding of IT systems and controls in assessing the risks of material misstatement to the financial statements, including IT risks resulting from unauthorized access.