Audit committees are ‘zeroed in on’ cybersecurity: report

Hot topics like AI and ESG haven’t taken audit committees’ focus away from cybersecurity and risk management, according to a March report from Deloitte and the Center for Audit Quality (CAQ).

Nearly seven in 10 respondents said cybersecurity was one of their top three priorities over the next 12 months, and three in 10 ranked it their number-one priority. The second-biggest focus was on enterprise risk management; 48% put it in their top three. Similar shares of respondents said their committees addressed each of those topics quarterly.

While audit committees are examining more than they used to, they’re still focused on cybersecurity and “are zeroed in on” enterprise risk programs, Vanessa Teitelbaum, a senior director at CAQ, said in a press release announcing the report, which noted that AI and ESG “[received] comparably less attention.”

Cybersecurity has been a top priority in years past, the report said, but it’s been even more top of mind for audit committees since December, when the Securities and Exchange Commission began requiring companies to disclose material cybersecurity incidents.

“Finance and internal audit talent” (37%), “compliance with laws and regulations” (36%), and “finance transformation” (33%) were the third through fifth-ranking priorities among respondents, 74% of whom worked at US public companies, 81% of which had market caps above $700 million. There was a “significant increase” in the share of those calling compliance a top priority in the next 12 months, according to the report.

Room for improvement. About two-thirds of respondents said their audit committees could be doing a better job, especially with how they discussed issues and prepared for meetings. Three in 10 respondents said their committees would be more effective if members had more robust discussions at meetings, about the same share as those who said committees would be more effective if the materials they read before the meetings and the presentations during them were better. Almost half of respondents (48%) said their committees have some cybersecurity expertise, while 44% said they wanted more in the next year.