- news
Audit committee cybersecurity disclosures on the rise
Please note: This item is from our archives and was published in 2021. It is provided for historical reference. The content may be out of date and links may no longer function.
Related
New: Digital assets practice aid addresses auditing of lending, borrowing
PCAOB postpones effective date for new quality control system
A&A Focus recap: M&A trends, non-GAAP frameworks, and how quality management and peer review intersect
TOPICS
Although public company audit committee disclosures on cybersecurity continue to increase significantly, other disclosures by audit committees increased just slightly or stagnated in 2021 compared with 2020, according to a Center for Audit Quality (CAQ) report issued Wednesday.
For the eighth straight year, the CAQ’s Audit Committee Transparency Barometer measured disclosures by audit committees of S&P 500, S&P MidCap, and S&P SmallCap companies. The CAQ encourages thorough disclosures by audit committees in proxy statements to promote high-quality performance by auditors and investor trust in the audit committee’s oversight role.
This year’s study shows that cybersecurity disclosures by audit committees continue to climb and are dramatically more common than they were even just a few years ago. For example, 46% of S&P 500 companies in 2021 disclosed the audit committee’s responsibilities for cybersecurity risk oversight. That’s up from 39% a year earlier and just 11% as recently as 2016. The results for S&P MidCap and S&P SmallCap companies showed similar trends.
In addition, 34% of S&P 500 companies disclosed in 2021 whether the board included a cybersecurity expert (up from 28% last year and 7% in 2016).
The percentage of audit committees making other disclosures was largely unchanged compared with 2020. The most common disclosures reported in the survey were:
- Discussion of how nonaudit services may affect independence. This disclosure was made by 83% of S&P 500 companies, 80% of S&P MidCap companies, and 76% of S&P SmallCap companies.
- Disclosure of the length of time the auditor has been engaged (70% S&P 500, 59% S&P MidCap, and 54% S&P SmallCap).
- Discussion of criteria considered when evaluating the audit firm (52% S&P 500, 39% S&P MidCap, and 35% S&P SmallCap).
- Explicit statement that the audit committee is involved in the selection of the audit engagement partner (50% S&P 500, 22% S&P MidCap, and 12% S&P SmallCap).
— Ken Tysiac (Kenneth.Tysiac@aicpa-cima.com) is the JofA‘s editorial director.
