EY Assurance Campaign

ey_logo.png

EY_Desktop_v1_1.png

EY_Mobile_v1.png

EY_Desktop_v1.mp4

EY_Mobile_v1.mp4

In the Race to Transform, Is the C-Suite Doing Their Due Diligence?

EY_AIArticle_Quote_Desktop_v03.json

EY_AIArticle_Quote_Mobile_v01.json

EY_SectionDivider_01_Desktop_v03.json

EY_SectionDivider_01_Mobile_v01.json

EY_SectionDivider_02_Desktop_v02.json

EY_SectionDivider_02_Mobile_v01.json

“When a technology is no longer controlled by IT—which has policies and procedures in place—but is crowdsourced across an entire organization, internal risks start to emerge.”

D_Quote_01.jpg

M_Quote_01.jpg

EY_SectionDivider_03_Desktop_v04.json

EY_SectionDivider_03_Mobile_v01.json

“Very easily, you could find under-governed and under-monitored usage of AI across your organization. That’s really going to amplify the level of risk you may have across the business.” — Paul Goodhew, EY

D_Quote_02.jpg

M_Quote_02.jpg

EY_SectionDivider_04_Desktop_v02.json

EY_SectionDivider_04_Mobile_v01.json

“This new technology is coming at speed, and it’s very fluid, but what’s different about AI is it gives organizations the ability to build controls and governance at the first step of usage.” — Richard Jackson, EY

D_Quote_03.jpg

M_Quote_03.jpg

EY_SectionDivider_05_Desktop_v02.json

EY_SectionDivider_05_Mobile_v01.json

"Traditional auditing frameworks are actually pretty robust in terms of their ability to identify, understand and assess change." — Richard Jackson, EY

D_Quote_04.jpg

M_Quote_04.jpg

EY_SectionDivider_06_Desktop_v03.json

EY_SectionDivider_06_Mobile_v01.json

Shareholders have AI on the brain. This is clear from a recent Bloomberg News analysis of earnings calls from Nasdaq 100 companies, which found that mentions of AI increased 5x since 2021. 

EY_Article_Header_3.gif

Social_Media.jpg

ARTICLE_THUMB.jpg

What C-Suites and Boards Need to Know About AI

The cyber threat landscape has reached a new and dangerous stage in its evolution, bolstered by new technology.Generative artificial intelligence (AI) models are making it easier for hackers to write malicious code to target vulnerabilities, <a href="https://www.bloomberg.com/news/articles/2023-01-11/chatgpt-poses-propaganda-and-hacking-risks-researchers-say" target="_blank">according to Bloomberg</a>. Next-generation AI also helps hackers generate sophisticated deepfakes to falsify credentials and deceive customers and vendors to gain access to an unprecedented amount of data.The latest <a href="https://www.ey.com/en_gl/cybersecurity/cybersecurity-how-do-you-rise-above-the-waves-of-a-perfect-storm" target="_blank">EY Global Information Security Survey</a> (GISS) shows that 30% of senior cybersecurity leaders report that hackers are using new strategies that could potentially outsmart their defenses. But despite these risks, 35% of board directors polled in a <a href="https://www.ey.com/en_us/board-matters/how-cyber-governance-and-disclosures-are-closing-the-gaps-in-2022" target="_blank">recent EY analysis</a> say they lack an understanding of the AI-related risks their companies face.

Go beyond the numbers with insights from EY.

State_01.jpg

M_Hero_01.jpg

EY_Article_desktop_v9.json

EY_QS_Article_Mobile_v2.json

A lot of factors contribute to the cost of a cyber incident: how long it takes to identify a breach, where in the network the attack took place, and the type of data targeted. When customer data is compromised, for example, lawsuits can create additional financial risks. Other costs, like the reputational damage a firm may suffer after experiencing a breach, are hard to quantify but are no less substantial. Corporate espionage, which costs US companies between $225 billion and $600 billion annually, according to the Federal Bureau of Investigation, is also on the rise, says Robyn Bew, US-West Region leader for the EY Center for Board Matters.“Cyber espionage is a kind of a silent-but-deadly attack, where bad guys just come in and quietly steal intellectual property,” she says.The cyber attack surface can include every vendor in a company’s supply chain, making organizations more vulnerable than ever in an age of digitalization. According to EY research, only 31% of senior cybersecurity leaders are confident of their ability to keep their supply chains secure.With the SEC expected to finalize new rules for cybersecurity disclosures —including mandating more company transparency in cyber incident reporting, requiring disclosure about director expertise and establishing cybersecurity risk oversight practices — cyber-risk oversight continues to be a top priority on boardroom agendas, and specifically for audit committees, which oversee cybersecurity matters on 70% of Fortune 100 boards, according to EY research.

The first step an audit committee can take to assess management’s performance in mitigating the company’s cyber risk is to ask for a baseline report that includes identification of “crown jewels,” aka, the highest-risk digital assets.“The audit committee isn’t management; they’re not there day to day. To get an understanding of how effectively the management team is addressing cybersecurity risks, they can request a third-party assessment of the cyber-risk management program from their external audit firm or another independent advisor,” says Bew.Next, boards need to make sure companies develop a robust plan for how the company will respond in the event of a cyber incident. That plan needs to include roles and responsibilities of senior management, the IT and legal teams, and criteria for when and how information will be escalated to the audit committee or board. The playbook then needs to be regularly stress-tested via cyber attack simulations.Should an event take place, company leaders should understand how to quickly gather the required information for law enforcement and to comply with the upcoming SEC rules. Leaders should also be able to communicate quickly about the incident and the company’s response to customers, as well as the impact on employees and business processes.According to Jaime Kipnes, EY Americas Cybersecurity Integration Leader, although 86% of directors polled said their board had not performed a simulation in the last 12 months, it’s advisable that they do so.“The more your organization has performed incident response simulations, the more effective and resilient it will be when you’re in the heat of battle,” she says.

The Cost of Cyber Attacks Is Rising. How Can Finance Leaders Prepare?

When it comes to environmental, social and governance (ESG) issues, finance leaders and investors may have different priorities.&nbsp;The majority of investors recently surveyed say they want evidence that companies are taking their ESG commitments seriously, seeing it as a sign that finance leaders are thinking with long-term growth in mind. Surveyed finance leaders who face short-term earnings pressure from investors say the long-term sustainability efforts they do make go unrecognized.The latest <a href="https://www.ey.com/en_us/assurance/how-can-corporate-reporting-bridge-the-esg-trust-gap" target="_blank">EY Global Corporate Reporting and Institutional Investor Survey</a> highlights the need for companies to rethink how they engage with investors on topics around sustainability. Case in point: 80% of investors surveyed expressed that many companies don’t properly articulate the rationale for long-term investments in sustainability, making it difficult for them to evaluate these investments. And while 78% of investors surveyed think companies should make investments that address ESG issues relevant to the business, even if it reduces profits in the short term, only 55% of surveyed finance leaders responded the same way.&nbsp;

Desktop_Hero_80pc.jpg

EY_QS_Article_Desktop_30fps_v5.json

EY_QS_Article_Mobile_30fps_v7.json

ESG isn’t just a compliance and reporting exercise; it’s an opportunity for finance leaders and boards to go beyond the numbers and clearly articulate their long-term thinking. “If an investor is deciding between two peer companies, and one company is doing a great job of articulating their long-term vision and business strategy, that company is much more likely to get the investing dollar than the company that’s just focused on the next 13 weeks,” says Dana Bober, EY Americas Financial Accounting and Advisory Services Leader. But even CFOs and boards who place a high value on ESG face another challenge: a reporting infrastructure that is not fit for purpose for ESG. “The infrastructure that exists for finance leaders was built for financial reporting, not sustainability reporting,” says Bober. Regulators, meanwhile, are working to address this concern by developing reporting mechanisms that capture ESG data and insights. The US SEC, the EU and the UK all have new ESG reporting rules in the pipeline.

Shareholders and regulators are encouraging the same thing: for companies to provide relevant, business-specific ESG data that demonstrates their long-term strategy. Zeroing in on that data, however, can be a challenge for businesses. The first step toward building a new process to report on sustainability data and demonstrate a company’s long-term thinking to shareholders is a prioritization assessment.“There’s so much in the ESG universe that it’s impossible to tackle it all, which is why prioritization assessments are key,” says Velislava Ivanova, EY Americas Chief Sustainability Officer and Climate Change and Sustainability Services Leader. “It allows businesses to really determine what is important to them, their business and their stakeholders.” Next, finance leaders should undertake readiness assessments to understand what they need to develop once the regulations go into effect. A good assessment will inform finance leaders of where they need to collect data, what targets they need to set, and ultimately what processes and procedures they need to achieve their goals.Few requirements will come as a surprise — the EU’s are already defined, and the proposed SEC rules are the topic of much discussion — so companies are in a great position to prepare now. Rigorous financial reporting builds trust with shareholders, and ESG reporting is no different. By holding ESG disclosures to consistent standards, businesses can prove to shareholders that they are thinking through any challenges on the road ahead and creating the resilience to tackle them head on.