Advice to AC members is to ask lots of questions

There are many challenges at the global, national and local levels that put companies’ financial reporting, compliance, risk and internal control environments to the test – ranging from global economic uncertainty, regional conflicts with far-reaching effects, new major regulatory mandates, and the emergence of generative AI. 

The theme of the session on the regulatory landscape and governance at the Conference on Monday afternoon was how audit committees can tackle these challenges.

Risk assessment is comprehensive, iterative and continual

Comprehensive risk assessment – a prevalent theme at this year’s Conference – is an important agenda item for audit committees. Panelists keyed in on several practical suggestions for audit committees to action.

In an August 2023 statement, SEC Chief Accountant Paul Munter mentioned the importance of taking a holistic approach to risk assessment by looking at entity-level risks in addition to risks that directly impact financial reporting. Panelists stressed the importance of overseeing that management implements a holistic approach by timely identifying and disclosing such risks, as appropriate, and designing and implementing appropriate processes and controls.

New ESG regulatory mandates are growing

Newly released and anticipated regulatory mandates will dramatically increase climate, sustainability and other ESG disclosure requirements for US companies. While companies await final SEC climate rules, the landscape is moving and companies are preparing to comply with a number of sustainability mandates, including: 

• California climate legislation signed into law in October 2023 – including carbon offset disclosures that are required for January 1, 2024
• European Sustainability Reporting Standards issued under the EU’s Corporate Sustainability Reporting Directive, which require comprehensive sustainability reporting of impacts, risks and opportunities to a broad range of stakeholders
• IFRS Sustainability Disclosure Standards issued by the International Sustainability Standards Board, which require comprehensive sustainability reporting of risks and opportunities to primary stakeholders such as investors.

Just determining which standards apply, applicable effective dates and the level of interoperability of the standards requires significant planning. Beyond these preparatory activities, actually complying with the mandates will be a major undertaking. Board oversight of this process is critical, particularly because cross-functional management teams will be needed – e.g. management’s disclosure committee and an ESG team/committee.  

A separate ESG panel on Day 3 of the Conference is expected to cover operational challenges of sustainability reporting.

See our ESG reporting resources here.

New cybersecurity disclosure mandate from the SEC

The SEC’s rules require several new and enhanced disclosures on cybersecurity risk management, strategy, governance and incident reporting. Companies must disclose new information in two broad categories.

The audit committee should consider what resources and processes management’s disclosure committee needs in developing and maintaining cybersecurity-related disclosure controls and procedures and internal control over financial reporting.   

Read more about the requirements here.

Generative AI (GenAI)

How to leverage GenAI is a trending topic in C Suites across the globe, as evidenced by the 2023 KPMG US AI Risk Survey. From a finance perspective, survey respondents expect an increase in the use of AI models and expect new audit requirements for AI models by the end of 2026.

The C Suite focus on GenAI likely means that the oversight of this technology will be a priority for many boards in 2024. At a minimum, the audit committee may be tasked with overseeing compliance with differing laws and regulations governing this technology, including the development and maintenance of related internal controls and disclosure controls and procedures. However, it may have broader oversight responsibilities, such as oversight of aspects of the company’s governance structure for developing and using GenAI. 

Additional technology panels on Day 3 of the Conference are expected to highlight the investor perspectives on GenAI and further insights from preparers and auditors.

Read more about GenAI on our dedicated resource page here.