Financial reporting enters a new age

A recent ruling in the Securities Exchange Commission’s lawsuit against Austin, Texas-based software provider SolarWinds has dealt a significant blow to the agency’s aggressive cybersecurity enforcement posture, legal analysts said.

Judge Paul Engelmayer of the U.S. District Court for the Southern District of New York last week dismissed much of the case, including the SEC’s claim that a cybersecurity failure can be punished as an “internal accounting controls” violation under Section 13(b)(2)(B) of the Securities Exchange Act.

“The decision substantially limits the SEC’s authority to challenge a company’s cybersecurity program,” Mark Schonfeld, a litigation partner at law firm Gibson, Dunn & Crutcher, said in an email. However, the ruling still permits the agency to proceed with an allegation that a company’s statements about its cybersecurity program are materially misleading, he added.

The litigation highlights a trend of aggressive cybersecurity actions by the SEC and other federal agencies since President Joe Biden took office. But the outlook is uncertain in the wake of recent court decisions.

In the SolarWinds case, “the court threw out all of the SEC’s most aggressive claims,” Walker Newell, vice president of management liability at insurance brokerage firm Woodruff Sawyer, said in an email. “This judge easily — and persuasively — decided that cybersecurity controls are not internal accounting controls.”

Whether the SEC intends to appeal the decision is unclear. An agency spokesperson declined to comment.

Meanwhile, the U.S. Supreme Court last month struck down its so-called Chevron test that gave deference to government agencies interpreting an ambiguous statute. That ruling is expected to have far-reaching effects across the federal government, including for agencies like the SEC that have claimed broad jurisdiction over cybersecurity-related matters without explicit authority from Congress, as previously reported by CFO Dive.

The SEC’s current cybersecurity enforcement agenda could also be upended by the upcoming presidential election in November, which could result in the appointment of new leadership at the agency.

“We won’t really know what the future of the SEC’s cyber enforcement program holds until next year,” Newell said.

SolarWinds sued over breach response

The commission sued SolarWinds and its chief information security officer, Timothy Brown, last October for allegedly defrauding investors by mischaracterizing cybersecurity practices that were in place at the company leading up to a major breach discovered in December 2020. SolarWinds was also accused of having cybersecurity deficiencies that amounted to a failure to "devise and maintain a system of internal accounting controls” under Section 13(b)(2)(B).

The U.S. Chamber of Commerce and the Business Roundtable jointly backed a motion by SolarWinds and Brown subsequently to dismiss the SEC’s case.

“The decision is obviously favorable to the defendants in many important respects, and CFOs especially will mark well the court’s finding that the SEC’s internal controls over financial reporting charge does not apply to cybersecurity controls as a matter of statutory construction,” Danette Edwards, a partner at Katten Muchin Rosenman and co-chair of the law firm’s Securities Enforcement Defense practice, said in an email.

Section 13(b)(2)(B) requires public companies to “devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that … access to assets is permitted only in accordance with management’s general or specific authorization,” according to the text of the statute.

Legal tool’s application expands

The SEC in recent years has expanded its interpretation and use of the provision in ways that have prompted concerns.

The SolarWinds lawsuit is one of two cases in which the SEC has used Section 13(b)(2)(B) to address a cybersecurity breach. In the second example, the agency announced last month that R.R. Donnelley & Sons Co., a global provider of business communication and marketing services, agreed to pay about $2.1 million to settle commission charges that it violated Section 13(b)(2)(B) in connection with the company’s response to a 2021 ransomware attack. 

In his court ruling, Engelmayer sided with SolarWinds on the Section 13(b)(2)(B) issue, holding that cybersecurity controls are outside the scope of the provision.

“The ruling has significant implications beyond cybersecurity, because the SEC has increasingly charged companies in recent years under this statute based on alleged deficiencies in legal, compliance or risk-management controls unrelated to corporate accounting,” Nicole Friedlander, a partner at Sullivan & Cromwell’s Criminal Defense and Investigations Group and co-head of its cybersecurity practice, said in an email.  

Based on the SEC’s reading of the statute, the agency would be able to punish any company that is the victim of a cybercrime, according to Friedlander, whose firm submitted an amicus brief in the case on behalf of the U.S. Chamber of Commerce and the Business Roundtable. 

More broadly, the SEC's rationale that the statute may be interpreted to cover all systems public companies use to safeguard their valuable assets “would have sweeping ramifications,” the judge said in his decision. “It could empower the agency to regulate background checks used in hiring nighttime security guards, the selection of padlocks for storage sheds, safety measures at water parks on whose reliability the asset of customer goodwill depended, and the lengths and configurations of passwords required to access company computers,” he said.

The opinion “will hopefully help to curb the SEC’s aggressive application of its liability regime against victim companies (and their agents) in cybersecurity cases,” Scott Kimpel, a partner at law firm Hunton Andrews Kurth, said in an email. “In particular, the judge’s rejection of the SEC’s novel internal-controls theory may make it more difficult for the agency to bring similar claims in the future.”

The judge also rejected the SEC’s theory that certain “risk factors” stated by SolarWinds in a securities filing as well as post-breach disclosures were misleading.

“This should give comfort to public company legal and finance departments,” Newell said. “It will remain difficult for the government or private plaintiffs to allege securities fraud based on good faith cybersecurity-related statements in SEC filings.”

Limited victories for SEC

However, the ruling was not a total defeat for the SEC. The judge allowed the agency to proceed with securities fraud claims related to a cybersecurity statement that was posted on SolarWinds’ website.

“Despite the company’s argument that these statements were directed at customers — not investors — the court found that allegedly false statements on public websites can serve as the basis for securities claims,” Cara Peterman, a partner in Alston & Bird’s Securities Litigation Group, said via email. “The key takeaway from this portion of the ruling is that public companies and their officers and directors should be cognizant of the fact that any public statement regarding the company’s cyber controls may be scrutinized in later SEC enforcement actions and/or shareholder litigation.”

The decision highlights the need for public companies to treat all public statements about cybersecurity — including in the context of blogs, interviews, and conferences — “with care and caution,” according to Newell.

“Finance, legal, and communications teams should already be working hand-in-hand with cybersecurity leaders on any meaningful public statements in this area,” he said.

In another victory for the SEC, SolarWinds’ CISO remains a named defendant with respect to the surviving allegations. While the claims against him and the company were significantly narrowed, the ruling generally leaves the door open for CISOs, CFOs, and other public company executives to be held personally liable in SEC cybersecurity enforcement actions, according to analysts.

“Not only are the defendants still facing the most serious fraud charges here, the court’s ruling on disclosure controls, in contrast to internal controls, is very fact-specific,” Edwards said. “It does not foreclose the use of disclosure controls claims in other cybersecurity cases going forward.” 

The case does not impact the SEC’s ability to enforce new cybersecurity rules that it adopted last year, analysts said. The rules, promulgated under federal securities laws, require public companies to report a “material” cybersecurity incident to the SEC in an Item 1.05 Form 8-K within four days of determining the breach is material, among other requirements.

“The new rules don’t speak to accounting controls; they speak to disclosures only,” Peterman said. “And the SolarWinds case was not brought under the new rules.”

Still, the court decision does have indirect implications for any enforcement of the rules in the future, according to Newell. “It does show the SEC that it needs to tread carefully when it comes to aggressive cybersecurity cases,” he said.

Call it the generative AI paradox.

CFOs are chasing the hope of a bonanza from generative artificial intelligence in one of the most frenzied investments in technology in decades.

Yet they have, at best, a loose grip on how to measure the innovation’s ultimate business payoff, according to financial executives and AI experts.

“I haven’t seen anything quite like this,”  said Daniel Rock, who co-founded Workhelix, a generative AI consultancy, with Erik Brynjolfsson and Andy McAfee.

Since the public launch of ChatGPT in November 2022, “there has been this ‘Ah-ha!’ moment, when people say, ‘This is capable of things that I didn’t think information technology systems could do,’” Rock said in an interview, noting the prospect that AI will streamline operations, better serve customers, upgrade forecasting, speed software programming and improve marketing and sales.

The CFO rush to generative AI will likely prove especially rapid because adoption is happening primarily from the bottom-up — from consumers — rather than top-down — from businesses, San Francisco Federal Reserve Bank President Mary Daly said.

The release of ChatGPT marked a “surge moment,” as “generative AI went from a thing others did to relative ubiquity overnight,” Daly said at a University of Chicago conference in March. “This moment led to what I think of as ‘people-driven diffusion.’”

As a result, CFOs and their C-suite colleagues face shareholder pressure and rising expectations for AI-enabled efficiencies and customer service, Daly said. They must move “from apathy to action” faster than with other formative innovations including steam power, electricity and the internet.

“Our conclusion is that you will essentially see the benefits of generative AI over the next five years,” EY-Parthenon Chief Economist Gregory Daco said in an interview. To hit a similar payoff, computers took 10 years, electricity more than 40 years and steam power 80 years, Daco said.

Rapid adoption of generative AI will enable companies to better innovate, harness the new skills of employees, retain customers and gain market share, Daly said.

At the same time, quick deployment of generative AI requires CFOs to measure ROI faster than prior technologies or risk wasteful spending, according to financial executives and AI experts.

AI shakedown

CFOs must also look out for hype and outright fraud, according to the top cop at the Securities and Exchange Commission.

“While perhaps not quite yet a perfect storm, there’s certainly one brewing around AI,” SEC Enforcement Director Gurbir Grewal said. “Every day, we see revolutionary technological advancements in artificial intelligence, or AI, that promise to transform nearly every aspect of our lives, including our financial decision making.”

“Every day, we see individuals, corporations, analysts and others touting these developments,” he said in an April speech. “Every day, we see companies attempting to not only develop AI capabilities, or harness it to improve their productivity and growth, but also to attract and retain investors.”

Most investors (61%) believe that rapid adoption of AI is very or extremely important to a company’s value, according to a PwC survey.

In turn, CFOs and their C-suite colleagues harbor “fear of missing out,” Glenn Hopper, CFO at Eventus Advisory Group, said in an interview. “They’re getting pressure from investors and boards — at every minute, from everybody.”

Consumers have also set a high bar, according to financial executives and AI experts.

“At some companies AI deployments will be something that must be done because customers expect it,” according to Rock, who is also assistant professor of operations, information and decisions at the University of Pennsylvania’s Wharton School. “It’s just going to be table stakes.”

During the coming year, 37% of U.S. companies plan to invest at least $100 million in generative AI, KPMG found in a survey of 220 companies published in March.

Spending on AI software will surge to $298 billion by 2027, 140% more than in 2022, according to Gartner, with 35% of investment focused on generative AI.

“You’re not going to be able to stop the momentum,” Hopper said.

Nvidia, arguably the decade’s top momentum stock, leads the juggernaut behind generative AI adoption. Its share price during the past year has rocketed 153%.

Yet a hint of speculation by Nvidia on the operational value of its products suggests that the onrush into the new technology may, at some point, venture onto shaky ground.

Countries as well as companies have hired the company to upgrade $1 trillion worth of data centers into “AI factories to produce a new commodity — artificial intelligence,” Nvidia CEO Jensen Huang said in a quarterly earnings call on May 22. “The next industrial revolution has begun.”

Every $1 invested by a cloud service provider in Nvidia’s software and networking can, over four years, yield $5 in revenue, Nvidia said in a “Company Overview” on a page titled, “The High ROI of High Compute Performance.”

In a footnote, however, Nvidia said in the May report that its calculation is merely an “illustrative example.”

To be sure, CFOs gauging ROI in generative AI are trying to map fuzzy terrain, the financial executives and AI experts said. Some payoffs from the emerging technology are potentially illusory, especially in the short term.

Only 5.2% of organizations attributed more than 10% of their earnings before interest and taxes to use of generative AI, McKinsey said in May, citing a global survey of 1,363 executives.

Big Data, Big Challenge

The challenge of measuring the value of data predates generative AI, as well as the advent of so-called Big Data and advanced analytics two decades ago.

CFOs and investors have struggled for years to precisely value proprietary data on customers, markets, products and other information.

The measurement challenge did not stop the meteoric rise of Amazon, Google, Uber and other Silicon Valley giants that rely on detailed, self-generated data to fuel profits and growth.

The path-breaking companies rode an explosion in the use of the internet, smartphones and other tools for connectivity and data sharing. Investors place more value on their proprietary data than on their buildings, workers or technologies, Laura Veldkamp, a finance professor at Columbia University’s Business School, said at a New York Fed conference on productivity in February.

CFOs in industries that arose before the advent of so-called information technologies often face a bigger challenge gauging a return from generative AI across their operations, Rock said. “I’m not sure that ROI in gross terms is going to be there.”

AI cost estimates by some companies have fallen short of the mark by as much as 1,000%, Nisha Bhandare, a Gartner vice president and analyst, said at a Gartner CFO conference in May. “Given how new AI is, we don’t really know how much it costs, and are learning as we go.”

Editor’s note: This is the first of two reports on the challenge of measuring return on investment from generative AI. In part two, CFO Dive will describe how financial executives can limit the cost and maximize the payoff from the technology even though, at the outset, they may lack a solid estimate of the potential gains.

Sponsored content

By Weaver

CFOs play a pivotal role in safeguarding a company’s financial health, and part of this responsibility involves navigating fair value assessments during financial audits. Early identification of fair value issues can significantly streamline your audit process, saving both time and money. However, determining whether a fair value assessment is necessary is not always straightforward. 

Fair value assessments have become an integral component of financial audits, especially as businesses increasingly operate in global markets with diverse assets and liabilities. These assessments are not just about compliance; they also provide a clearer picture of your company’s financial position, enabling better decision-making and strategic planning. For companies with complex asset portfolios or those preparing for significant events such as mergers or IPOs, understanding and accurately reporting fair value is essential. 

A key responsibility during your financial audit is to recognize when a fair value assessment is necessary. This task requires a thorough understanding of your company’s financial activities, the items listed on the balance sheet and the overall business objectives.  

To help identify the need for a fair value assessment, consider these four questions: 

1. What key events have occurred in the past 12 months? 

• Business combinations: If your company has purchased or merged with another business, you may need to account for acquired goodwill, intangible assets or contingent liabilities under ASC 805 to ensure accurate purchase price allocation. 

• Stock issuance: If your company has issued stock, options or performance units for employees, these transactions fall under ASC 718 to determine appropriate compensation costs. 

• Hedging activities: For companies that have entered into hedging arrangements, fair value assessments are necessary under ASC 815 to measure effectiveness. 

• Asset acquisitions with future disposal costs: If your company has acquired assets that may incur future disposal costs, fair value assessments are required under ASC 410 and ASC 420. 

• Retirement benefits: If your company provides retirement benefits such as pensions or other post-retirement obligations, these need to be evaluated under ASC 715.

2. What items are listed on the balance sheet? 

• Goodwill: If your balance sheet includes goodwill, this intangible asset may require evaluation for impairment under ASC 350. 

• Trade names, customer relationships, non-compete agreements, technology, patents, favorable or unfavorable contracts or other identifiable intangible asset: Whether they contribute positively or negatively to the company’s value, intangible assets and liabilities need to be assessed under ASC 350 and ASC 360.  

• Investments or ownership less than 50% of another entity: For investments in other entities where your company holds minority stakes or non-controlling interests, fair value assessments are required under ASC 820.  

• Contingent consideration liability: Liabilities for contingent consideration from business combinations where future payments are dependent on specific conditions or performance must be measured at fair value under ASC 805.  

• Financial instruments or securities: Bonds, equity investments and derivatives must be measured at fair value under ASC 820 to ensure that they are reported at their current market value. 

• Asset retirement obligations: For liabilities related to asset retirement or environmental obligations, fair value assessments are necessary under ASC 410.  

• Assets held for sale: Assets that your company plans to sell within a year should be measured at fair value under ASC 360.  

3. Does your company's primary objective involve investments or financial securities? 

• Investment entities and portfolios: If your company primarily invests in other entities, such as private equity firms or holds a portfolio of financial securities (e.g., stocks, bonds or derivatives), ASC 820's fair value measurement guidelines are crucial.  

4. Is your company considering an IPO? 

• Transitioning to public company standards: Companies preparing for an IPO must be aware of the distinct fair value requirements that apply to public companies. Transitioning from private to public company standards involves reassessing the fair value of various assets and liabilities to meet the heightened disclosure and valuation standards expected by public investors and regulatory bodies. 

Incorporating fair value assessments as a regular part of your financial audit process is more than just a best practice — it’s a strategic move that can fortify your company’s financial integrity. By understanding which aspects of your financial statements may require fair value assessments and collaborating with your audit team, you can avoid last-minute surprises and ensure your financial audits reflect a true and fair view of your company’s financial health. 

The emergence of new climate-related regulation has come in fits and starts: after first being proposed in 2022 the Securities and Exchange Commission’s long-anticipated climate-risk disclosure rule was finally approved in March only to be voluntarily stayed pending legal challenges.

Along the way the rule has faced considerable backlash. But PwC Partner Marc Siegel — who advises clients on ESG matters and was formerly on the Financial Accounting Standards Board and the Sustainability Accounting Standards Board — said in an online discussion that approaching the issue with complacency is a risky strategy given what he effectively sees as the dawn of a new era of climate-risk disclosure.

“In many ways, I think the market has spoken on some of this,” Siegel told CFO Dive’s Jim Tyson. Already 98% of S&P 500 companies voluntarily report ESG data with two thirds of them giving some assurance of their information. Meanwhile, the European Union’s Corporate Sustainability Reporting Directive is set. “The last thing that you want is to not be thinking about bolstering your ability to collect and report this information at scale and then all of a sudden have a rule that comes into place at the end and you’re scrambling to get ready for it.”

Here are 5 takeaways culled from Siegel’s talk Thursday around the core risks and opportunities that complying with this emerging new framework of climate regulation poses for CFOs:    

1. Work holistically to curb costs, avoid waste Siegel advises companies to think of climate risk disclosure reporting as they would any other project and to review what information you already have and plan accordingly. “Think about the SEC rule holistically, with all the other regulations you might be subject to around the world and do the appropriate GAAP analysis in order to leverage what you already might be capturing and reporting on a voluntary basis,” he said. 
2. Avoid ring-fencing Siloing information or efforts is one of the biggest mistakes that trip up companies’ climate reporting initiatives, Siegel said. Avoid thinking about a single rule as if it were the only one that a company needs to comply with and ignoring other potential requirements in other parts of the world, he said. “When you do that you might end up having to redo processes later or grab different information than you originally planned for because you’re just focusing on the SEC rules and then, all of a sudden…you notice ‘Oh no, I’m getting tripped up by the European rule which goes way beyond climate,” Siegel said.
3. Build out a cross-functional team to address ESG reporting Similarly, keeping the effort to comply with regulations siloed within the sustainability department and not leveraging the skills and the capabilities of the finance team itself can also be problematic. A better approach is a team that has representatives from across the entire company. At the same time, the organizational structure that is set up to manage ESG should align with the company’s culture. “If you’re a company that in almost every other way operates in a decentralized way…it won’t make sense to set up a centralized ESG reporting and governance model,” Siegel said.  
4. Steel yourself for a fragmented regulatory landscape The biggest surprise and disappointment Siegel sees companies finding as they embark on their ESG financial reporting is how splintered the regulatory frameworks are. The good news is there was some consolidation around the International Sustainability Standards Board but some companies are wholly adopting the standards while others are “inserting their own flavors in it.” Over the court of the decade, Siegel expects that there could ultimately end up being four different corporate reporting “dialects” that companies will grapple with. 
5. Scope 3 emissions measurement will continue to be a “third-rail topic” Requirements for public companies to disclose so-called scope 3 greenhouse gas emissions were carved out of the final SEC rules. They’ve drawn pushback as reporting of the emissions is so different from the kind of financial reporting companies are familiar with. “Most other 10-K information relates to either reporting about the financial position as of year-end or for the performance of the company over the last fiscal year. Well, scope 3 doesn’t have the same boundaries at all. It includes all the emissions of the company, suppliers, employees and customers in the value chain,” Siegel said. “So I think it’s going to continue to be a third-rail topic whenever any regulators try to touch it.”  

The Securities and Exchange Commission is leaning on an expansive interpretation of a provision in one of the statutes it enforces as the agency looks to more aggressively assert jurisdiction over cybersecurity-related matters, legal analysts said.

The provision at issue, Section 13(b)(2)(B) of the Securities Exchange Act, requires public companies to maintain internal accounting controls. The SEC in recent years has expanded its interpretation and use of the provision in ways that have raised eyebrows.

In the latest example, the SEC last week announced that R.R. Donnelley & Sons Co., a global provider of business communication and marketing services, agreed to pay about $2.1 million to settle commission charges that it violated Section 13(b)(2)(B) by failing to “devise and maintain a system of cybersecurity-related internal accounting controls.” The charges stemmed from the company’s response to a 2021 ransomware attack.

“As the dissenting SEC commissioners noted, it’s arguably an aggressive expansion of the SEC’s use of this provision,” Charu Chandrasekhar, a partner in the securities enforcement practice of law firm Debevoise & Plimpton, said in an interview. “I don’t think the application to cybersecurity systems is consistent with the purpose of the provision and the context in which the provision has historically been applied by the SEC.”

The enforcement action represents the SEC’s latest assertion of jurisdiction under Section 13(b)(2)(B) to punish a company for alleged failures that don’t impact financial reporting or accounting controls, according to a memo published by law firm Sullivan & Cromwell on Friday.

And the case also marks the second time in which the agency has used the provision to address a cybersecurity breach, the memo said. The first such action, against Austin, Texas-based software provider SolarWinds, is currently being litigated in the U.S. District Court for the Southern District of New York.

“Given the pending challenge in the SolarWinds case to the SEC’s expansive interpretation of its jurisdiction under Section 13(b)(2)(B), it remains to be seen whether the SEC’s use of the provision to penalize companies victimized by cybercrime will withstand judicial scrutiny,” the memo said.

The SEC over the last few years has been sharpening its cybersecurity enforcement and regulatory focus.

In October, the commission sued SolarWinds and its chief information security officer, Timothy Brown, for allegedly defrauding investors by mischaracterizing cybersecurity practices that were in place at the company leading up to a major breach discovered in December 2020. SolarWinds was also accused of violating reporting and internal controls provisions of the Exchange Act. The company has denied the charges.

Meanwhile, last December, the agency began enforcing new rules that require public companies to disclose “material” cybersecurity incidents within four days of determining that it is a material breach. The rules build on prior agency guidance. At the time, Erik Gerding, director of the SEC’s Division of Corporation Finance, said the agency wasn’t seeking to “prescribe particular cybersecurity defenses, practices, technologies, risk management, governance, or strategy.”

The SEC’s latest action is in direct conflict with Gerding’s statement, according to a Thursday blog post published by Debevoise & Plimpton.

The SEC’s interpretation of Section 13(b)(2)(B) in the case puts the agency in the position of “basically judging or second-guessing the strength and adequacy of a company’s cybersecurity controls,” Mark Schonfeld, a litigation partner at law firm Gibson, Dunn & Crutcher, said in an interview.

“I think there’s certainly the question as to whether this is what Congress intended by internal accounting controls,” he said.

Another reason the case is problematic is that it creates regulatory uncertainty, according to Schonfeld.

“This enforcement action doesn’t really provide any guidance as to what constitutes an adequate set of cybersecurity controls,” he said.

Under section 13(b)(2)(B), public companies must devise and maintain a system of internal accounting controls sufficient to provide “reasonable assurances” that access to company assets is permitted “only in accordance with management’s general or specific authorization.”

Based on the SEC’s reading of the statute, the agency can punish any company that is the victim of a cybercrime, according to Nicole Friedlander, a partner at Sullivan & Cromwell’s Criminal Defense and Investigations Group and co-head of its cybersecurity practice. 

“The SEC is saying that assets are anything the company owns or possesses, including a computer system,” Friedlander said in an interview. “And so, if anybody touches those things without management authorizing them to, then the SEC can say the company has violated federal securities laws.”

R.R. Donnelley failed to execute a timely response to a ransomware attack that occurred between Nov. 29 and Dec. 23 of 2021, according to a commission order resolving the case.

The threat actor was able to use “deceptive hacking techniques” to install encryption software on certain R.R. Donnelley computers and exfiltrated 70 gigabytes of data, including data belonging to 29 of the company’s 22,000 clients, some of which contained personal identification and financial information, the order said.

However, the company’s investigation uncovered no evidence that the threat actor accessed financial systems and corporate financial and accounting data.

According to the commission’s order, R.R. Donnelley failed to design effective disclosure-related controls and procedures around cybersecurity incidents to ensure that relevant information was communicated to management to allow timely decisions regarding potentially required disclosure.

The company also failed to “reasonably design and maintain internal controls that complied with Exchange Act Section 13(b)(2)(B),” the SEC said. Specifically, the company’s cybersecurity alert review and incident response policies and procedures “failed to adequately establish a prioritization scheme and to provide clear guidance to internal and external personnel on procedures for responding to incidents,” the agency said.

“The Commission instituted this enforcement action because RRD’s controls for elevating cybersecurity incidents to its management and protecting company assets from cyberattacks were insufficient,” Jorge Tenreiro, acting chief of the SEC’s Crypto Assets and Cyber Unit, said in a press release. “RRD did, however, cooperate with our investigation in a meaningful way, and that is reflected in the terms of this settlement.”

Without admitting to or denying the SEC’s findings, R.R. Donnelley agreed to pay the $2.1 million civil penalty and to cease and desist from violating Section 13(b)(2)(B) of the Exchange Act as well as Exchange Act Rule 13a-15a, which requires public companies to maintain disclosure controls and procedures.

The SEC’s two Republican commissioners, Hester Peirce and Mark Uyeda, issued a joint dissenting statement objecting to the agency’s action.

“The Commission’s order faulting RRD’s internal accounting controls breaks new ground with its expansive interpretation of what constitutes an asset under Section 13(b)(2)(B)(iii),” the commissioners said.

A broad interpretation of the provision to cover computer systems “gives the Commission a hook to regulate public companies’ cybersecurity practices,” they said.

A spokesperson for the SEC declined to comment. R.R. Donnelley didn’t immediately respond to a request for comment.

The Financial Accounting Standards Board by a 7-0 vote Wednesday agreed to effectively finalize new rules that will require public companies to break out “relevant” expense line items on the income statement by disclosing in the notes to the financial statements certain expenses such as purchases of inventory, employee compensation, depreciation and intangible asset amortization. The amendments to standards that underpin GAAP will be issued by year-end and be effective for fiscal years beginning after Dec. 15, 2026, and interim periods within fiscal years beginning after Dec. 15, 2027, according to a FASB spokesperson. 

The expense disaggregation project has been in the works for some time, reemerging most recently as a prioritized project in 2021; along the way, it elicited some pushback from accountants and report preparers concerned about the cost of compliance. Subsequently, the board has made some changes to ease the burden of meeting the new requirements, such as allowing companies to use accounting estimates to determine the amounts disclosed.

FASB member Christine Botosan called out the notable nature of the new requirements during the meeting, adding that she hoped the board’s move to allow estimated values would help ease the transition. “This is a pretty big change for entities,” Botosan said of the new rules, noting that it’s understandable that they’ve caused a “bit of nervousness out there” among preparers. “Thinking about the last time there was any new requirement that would result in pervasive disaggregation across the income statement for companies, I think we have to go back over 100 years to when [they] first started requiring SG&A and cost of goods sold to be disaggregated on the income statement.”

Updates to GAAP requiring companies to break out more detailed information in financial statements has been a key theme for the U.S. accounting standards setter in recent years. 

For example, last year the board issued a final accounting standards update that increased requirements for how public companies report major segment expenses, meaning costs must be broken out for each of its business groups or divisions. 

Formally known as the Income Statement — Reporting Comprehensive Income — Expense Disaggregation Disclosures accounting standards update (Subtopic 220-40), the detailed breakouts of expense information that will soon be required could be a relatively big lift for public companies. 

The change now in the works is a “kind of a sleeper” accounting topic that many companies may not yet have focused on, according to Nicole Wright, an associate professor of accounting at James Madison University in Harrisonburg, Virginia. 

Even as companies typically have all the data that they will now need to report in their financial statements, it will likely require the finance department to pull information from a range of departments, she said. For example, human resources would be involved with the employee compensation piece, she said. 

“I know CFOs and how they think and they’ll say, ‘We’ve got this,’” Wright said in an interview. “But it’s going to take quite a bit of company resources across the board and it’s going to be more than just accounting…Once you try to amass all the data together, it’s a lot and there’s not really good guidance on how to do it.” 

Then too, companies will have to thread the needle determining how to disclose enough information to meet the new standards without unnecessarily giving up information that will hand their competitors proprietary information about their business strategy, she said.  

During the meeting, FASB Vice Chair James Kroeker said he felt the board’s accounting update has struck the right balance in providing guidance that will benefit stakeholders and not be too costly to implement. 

“What we’re really looking to do is disaggregate in a way that entities naturally keep their books,” said Kroeker, whose term on the board concludes June 30. 

CFOs of large multinational companies in particular are facing a perfect storm when it comes to the new rules around environmental, social and governance reporting. Such reporting is complex, time-intensive and constantly evolving. It also requires internal teams, functions, regions and businesses to collaborate in new ways to collect, report, analyze and assure the accuracy of large swaths of data, much of which resides across disparate technology systems and spreadsheets.

Globally, 600 ESG standards are in play, and this number is growing. Alongside regulators and standard setters, we also see investors, analysts, customers, and employees are increasingly demanding reliable ESG data. CFOs have a lot riding on getting their ESG reporting right, and it’s clear that, even though the ESG reporting momentum may have slowed, it is a force here to stay.

Fortunately, although ESG reporting may be a relatively new challenge, there is nothing new about C-suite leaders facing transformative, “perfect storm” reporting requirements. To illustrate this point, we need not look any further than when Sarbanes-Oxley (SOX) was implemented in the early 2000s. Here are three key SOX lessons that today’s CFOs can use to weather the ESG reporting storm:

1) Mentality is everything: Reporting must be more than a check-the-box exercise. ESG reporting standards cover a far broader remit than SOX, but the goals are essentially the same. Like SOX, most ESG reporting standards and regulations aim to increase transparency, drive the development of more reliable ways to ensure data accuracy, and prevent companies from (knowingly or not) sharing misinformation with key stakeholders. SOX and ESG reporting both place a heavy burden on corporate finance teams. However, in the early days of SOX implementation, many CFOs quickly understood that the challenge of compliance could also lead to significant opportunities. With that mindset, progressive C-suite leaders saw the opportunity to do more than simply check the box and “comply” with SOX. They used SOX requirements as an impetus to put in place new safeguards, processes and governance practices that supported the long-term health of their organizations. The same mentality is essential for optimizing the potential positive business impact of ESG reporting.

2) Your initial ESG data may not paint a perfect picture, and that’s OK. You’ve got to start somewhere Many SOX compliance pioneers will tell you that once they started collecting and processing more expansive, more accurate financial data, they found significant (and sometimes even alarming) weaknesses and gaps. The SOX reporting process seemed daunting, in part because it uncovered so many processes, policies and practices to improve. It is vital that finance leaders do not get mired down — or overwhelmed — by the challenges or risks that can be uncovered through the discovery phase of addressing new ESG reporting requirements. Value can be unlocked by viewing the entire ESG reporting process as an opportunity to reduce risk and uncover new insights that can inform your business strategy.

3) Stay ahead of exponential change by leading with a digital-first mindset. Considering the high stakes of ESG reporting, it is surprising that KPMG’s 2024 ESG Organization Survey found that 47% of companies still manage their ESG data with spreadsheets. The promising news is that the same report found that in the next three years, 40% of organizations plan to invest in ESG-specific software, and 37% plan to invest in data collection and management tools. I would argue that those investments cannot be made soon enough. Pioneers of SOX implementation had somewhat limited technology support at their disposal. However, those who acted fast to leverage available Corporate Performance Management (CPM) technology to enhance financial data collection and reporting and lower the resource burden of compliance were at a distinct advantage. Similarly, today’s finance leaders who accelerate investment in advanced CPM platforms will be in the best position to drive efficient and fast progress in ESG reporting. Integrating ESG data through a CPM framework enables organizations to automate reporting, cut through data complexity, mitigate risk, and comply with the ever-changing ESG regulatory environment, while identifying new opportunities to advance their sustainability strategy.

ESG reporting is not the first “perfect storm” CFOs have faced, and it won’t be the last. But “perfect storms” aren’t just challenges — if weathered correctly, they can be opportunities too. By viewing ESG reporting as greater than a “check the box” exercise, and leading with a digital-first mindset, CFOs can harness the power of ESG reporting to build stakeholder confidence, positively impact their corporate valuation, and amplify the value they bring to their organizations.

Nearly half of small- and medium-sized enterprises worldwide (48%) believe that their peers during the past decade have become more willing to distort financial statements to hide fraud and other corruption, according to the Association of Chartered Accountants.

Roughly three out of five SMEs believe their counterparts are likely to face a risk of bribery and other corruption, the ACCA found in its global survey, while the same proportion believe challenging such wrongdoing will harm their trade and other opportunities. 

“Corruption is a poison — it distorts markets, stunts economic growth and deters investment,” Jillian Couse, head of ACCA North America, said in a statement.

The U.S. has made little progress combating corruption since 2021, according to Transparency International, which last year ranked 180 countries and territories by their perceived levels of public sector corruption.

The U.S. for the second consecutive year scored 69 out of a scale of 100 — with 100 being “clean” of malfeasance — based on factors such as bribery, diversion of public funds, prosecution of corrupt officials and the use of public office for private gain, Transparency International said when releasing its Corruption Perceptions Index in January.

“The stagnant U.S. score reflects a continuing struggle for progress on anti-corruption measures that can protect our democratic processes and institutions,” Transparency International said, noting that U.S. citizens believe that their wealthy counterparts “buy” elections more easily than in any other developed country.

The ACCA findings suggest that corruption is apparently more veiled than five years ago. Compared with a 2019 survey, the owners of SMEs and their financial advisors worldwide currently say they have greater difficulty identifying wrongdoing in contract-related consultancy or facilitation fees and in invitations to corporate hospitality.

The offer of gifts or payments not related to services and the suggestion of special treatment by regulatory officials are also more difficult to bring to light compared with five years ago, according to ACCA findings.

At the same time, among markets subject to bribery and corruption, the owners of SMEs and their financial advisors believe that they are more likely than in 2019 to see malfeasance in dealing with public sector officials and when negotiating contracts for cross-border trade in goods and services, according to ACCA survey results.

Wrongdoing is also more prevalent than in 2019 in negotiations over private sector contracts and as a result of supply chain pressures, according to respondents to the ACCA survey.

“Many small businesses don't have the bargaining power to refuse when small bribes are demanded of them,” the ACCA said. “Entrepreneurs have to choose between paying the bribe or losing the business — and often that is no choice at all for someone trying to support a family.”

London-based ACCA has 247,000 members in 181 countries.