Close Close
Sign In
Newsletters
Popular Financial Topics Discover relevant content from across the suite of ALM legal publications From the Industry More content from ThinkAdvisor and select sponsors Investment Advisor Issue Gallery Read digital editions of Investment Advisor Magazine Tax Facts Get clear, current, and reliable answers to pressing tax questions
Luminaries Awards
Podcast Center Video Center Webcasts Resource Center Events
About ThinkAdvisor Contact Us Advertise With Us Asset & Logo Licensing Sitemap Terms of Service Privacy Policy Copyright © 2024 ALM Global, LLC. All Rights Reserved.
ThinkAdvisor

Regulation and Compliance > Cybersecurity

AICPA Releases Cybersecurity Guidance

By Danielle Andrus

X
Your article was successfully shared with the contacts you provided.

To help tax professionals and their clients manage cybersecurity risk, the American Institute of CPAs issued a voluntary reporting framework in April that lays out a “proactive and agile” approach to risk management, according to a statement from AICPA.

“Cybersecurity threats are escalating, thereby unnerving boards of directors, managers, investors and customers of businesses of all sizes — whether public or private,” Susan S. Coffey, executive vice president for public practice for AICPA, said in a statement.

The resources are designed to facilitate communication and risk management regarding cybersecurity.

(Related: A 7-Point Checklist for Advisors to Protect Against Cyberattacks)

In mid-April, AICPA’s Assurance Services Executive Committee released description criteria to help management teams lay out their cybersecurity program in a common language, and to help CPAs report on that program. 

AICPA also produced control criteria, which is available for purchase, to help CPAs evaluate a client’s cybersecurity program.

In May, AICPA released an attestation guide, “Reporting on an Entity’s Cybersecurity Risk Management Program and Controls,” to serve as an interpretive publication to sections in the Statements on Standards for Attestation Engagements No. 18, published in April 2016. Those sections address requirements for CPAs who perform attestation examinations for their clients’ cybersecurity programs.

The guide includes an overview of the risks to a firm from a data breach; steps for accepting, planning and performing a risk management exam; and how to evaluate and report on the results, as well as information about professional standards and codes of conduct.

The criteria and guide are part of AICPA’s System and Organization Controls (SOC) for Cybersecurity service offerings, a suite of services that CPAs may offer their clients. AICPA is currently working on resources to help CPAs report on clients’ cybersecurity risk in their vendor supply chains.

— Read Edward Snowden Talks WannaCry Attack, Blockchain, Financial Regs on ThinkAdvisor.

NOT FOR REPRINT

© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.