Mitigating security risks has become an essential practice for organizations. Whether in public accounting, business, or industry, CPAs are key stakeholders in protecting their clients’ financial data and overseeing risk management for their organization.
2023 Innovation, Technology, and Accounting Virtual Conference presenter, Imran Ahmad, a Senior Partner and Canadian Head of Technology at Norton Rose Fulbright Canada LLP, shares the importance of the CPA’s role in identifying IT and security risks:
“CPAs have a clear understanding of what the impact of a materials disruption would be, from both an operational and associated financial standpoint,” he says.
“For example, if a ransomware attack was to disrupt the business’ operations for a period of two weeks, a CPA is uniquely positioned to quantify the loss and assess how the immediate financial loss will be along with longer term losses—for example, client attrition, backlog, et cetera.”
CPAs are not only responsible for identifying said disruption, but finding solutions as well. As Imran points out: “CPAs will also work with IT and insurance service providers to see how the operational disruption risk can be effectively mitigated, to reduce the risk to the organization as much as possible. Most importantly, CPAs will often be the bridge between management and front line responders, often translating technical impact into operational and financial losses, thereby assisting leadership in making informed decisions.”
According to Imran, the most common IT and security risks organizations face today include ransomware attacks, business email compromises—which lead to direction of funds to accounts controlled by cyber criminals—and third-party vendor risks.
Fortunately, Imran offers a few areas of focus that organizations should adopt to mitigate risk:
- Develop and update a comprehensive and detailed Cyber Incident Response Plan (CIRP), which factors in technical issues as well as communications, insurance, legal, and overall governance considerations. The complexity around crafting an industry-acceptable CIRP has increased in light of new regulatory requirements and guidelines.
- Conduct advanced tabletop (cyber simulation) exercises that test the organization’s overall cyber readiness. This exercise should not be exclusive to IT, but rather should include all business functions (e.g., finance, HR, communications, legal, etc.) so as to assess gaps within the greater organization and identify the necessary actions to address them.
While there are currently no comprehensive Canadian studies on the financial losses stemming from security incidents, the CIRA 2022 Cybersecurity Survey is a good resource for Canadian organizations.
Identifying cyber risks and dedicating resources to mitigate them needs to be a top priority for all CPAs. To learn more on this topic, register today for CPA Alberta’s Innovation, Technology, and Accounting Conference and join Imran Ahmad for his session, “Effectively identifying and managing IT and security risks in a digital world”.
