Call us now:
What constitutes materiality is a hot topic, with the recent SEC final cyber rule requiring covered companies report material cyber risks and incidents. The enclosed article by Shivaram Rajgopal, Kester and Byrnes Professor at Columbia Business School discusses the reporting of materiality by companies. Using the Chinese company BYD as a example to set the baseline standards by which auditors evaluate materiality.
The author discusses the material thresholds. ‘A study conducted by Chowdhary, Merkley and Schipper finds from confidential PCAOB data that many audit firms seem to use 5% of pretax net income as material. In the new proposed climate rule, the SEC seems to suggest that a 1% bright line threshold in a company’s financial statements—either in revenue, expenditures, or assets—is deemed material’
Professor Rajgopal raises an important point in his article, companies and audit firms invariably do not publicly disclosed material thresholds, and why do investors tolerate such secrecy? If U.S public companies do evaluate their materiality baselines, then evaluating cybersecurity risk and incident against those baselines is relatively straightforward. One suspects covered companies have not considered standards of materiality for many reasons; least of all corporate governance and the questions that may get asked by investors. Questions that will get asked under the SEC cyber rule.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC U.S. Securities and Exchange Commission
#cybersecurity #cyberriskmanagement #materiality
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7214163761568382977