CFO Brew helps finance pros navigate their roles with insights into risk management, compliance, and strategy through our newsletter, virtual events, and digital guides.

CFO Brew

Kristen Talman

cfobrew.com

The SEC has a long wish list of priorities in 2023

 The SEC released its fall 2022 agenda detailing the upcoming year and it doesn’t look like the agency is slowing down anytime soon.

SEC set for another busy year

If Republicans gain control of Congress, Gensler and his team may be on the spot.

After the midterms, what’s next for the SEC?

Drew Adamek

An illustration with the scales of justice, a gavel and a bitcoin coin

The SEC's new initiative will take a closer look at corporate crypto assets.

SEC launches new office to examine crypto filings

Courtney Vien

In an era when Jeff Bezos and Mark Zuckerberg are household names, many C-suiters can be considered public figures. That status, though, comes with risks, as the 

“The ability for people to use available public data to track the movement of a CEO is much easier today,” Peter Chan, a partner at law firm Baker McKenzie, told CFO Brew. “The truth is, a CEO doesn’t get to take off his hat and say ‘I’m now a private citizen.’”

The elevated public profile of CEOs and other executives has increased the desire for them—and, in some cases, 

—to have security. Companies’ spending on security for top executives was on the rise even before Thompson’s murder. The S&P 500’s median security costs for CEOs 

 between 2019 and 2023, Glass Lewis analysis shows.

The SEC, though, considers security spending a perk, and requires companies to disclose it as part of executive compensation in annual filings. Chan, who formerly worked for the SEC, and his colleague, Baker McKenzie partner Jennifer Broder, argue that ought to change.

They also believe that the SEC should rethink classifying executives’ personal travel as a perk. Since 2006, when the SEC’s rules regarding perks received their last major expansion, the lines between “personal” and “business” travel have blurred, Broder told CFO Brew. Technology has advanced, and boards now expect C-suiters to be available around the clock, to travel frequently to offices that might be scattered across the globe, and to be working en route, she and Chan pointed out. “But the SEC has taken an expansive view of what’s considered personal,” Broder said.

 discussion with public company executives and other stakeholders to review executive compensation disclosure requirements, and it opened a public comment period on the topic.

SEC Chair Paul Atkins believes the area is ripe for an overhaul. He’s described the current disclosure requirements as a “Frankenstein patchwork of rules” that are 

Perks are one area up for review. During the roundtable, Commissioner Hester Pierce questioned whether companies should be required to 

 of the amounts spent on executive perks like rides on corporate jets, car services, or overseas housing allowances. Such disclosures, she said, seemed intended to merely satisfy the 

 and to “entertain the onlooker rather than educate the investor.”

 It’s important that investors have information about perks, the Glass Lewis report asserts. A survey from the firm found that “a majority of investors expressed concern that excessive perquisites may indicate broader pay concerns,” and that directors should be accountable for limiting excessive perk compensation.

But questions remain as to whether items like security and travel should still count as perks and therefore be considered part of executive compensation, or whether it would be more appropriate to classify them as business expenses. Chan argues that making some perks part of compensation can make an executive’s salary look artificially inflated. It can have “the unfortunate perverse effect of distorting the information to investors,” he said.

Investors may not need the level of granularity around perks that the SEC requires, Chan said. If a board has determined that an executive’s travel or security are appropriate business expenses, they’ll still be “disclosed in the sense that they’re aggregated in the financial statements,” he said. He finds it hard to see, he said, why having such information itemized “would be, as a standalone, material to investors.”

Are the SEC’s rules on executive perks ripe for a rehaul?

The agency’s reviewing perks and other aspects of executive compensation disclosure.

Natasha Piñon

It’s weird. When people leave their jobs en masse, you might find your workplace understaffed. It’s, like, so random and inexplicable.

Paul Atkins, the Securities and Exchange Commission’s newly appointed chair, said the agency is looking to fill vacancies left by departing staffers.

 Atkins’ tenure would be marked by a hands-off regulatory approach. And now, there are even fewer hands around.

In a speech before the House Appropriations Subcommittee on Financial Services and General Government on Tuesday, Atkins said the SEC has reduced headcount by 15% since the start of fiscal 2025. He noted that “many” staffers “took advantage” of early retirement and voluntary separation options the Trump administration offered government employees, including efforts like the “Fork in the Road” buyout program.

He noted that at peak headcount a year ago, the SEC had approximately 5,000 employees and 2,000 contractors. Now, the agency is “at approximately 4,200 employees and 1,700 contractors,” he said.

But despite saying the agency needs to fill some open positions, when speaking to Congress the same day, Atkins defended cuts to staffing at the agency, saying the SEC is still able to protect markets.

“We miss their expertise but I think we have plenty of expertise there at the Commission,” Atkins said, 

, claiming younger staffers could benefit as open positions turn into career opportunities. “I think it’s good every once in a while to have a house cleaning.” He claimed that contracting cuts have thus far totaled $9 million in savings.

Others are less sure that the agency can weather the staffing reductions seen in 2025 thus far.

, SEC Commissioner Caroline Crenshaw said the agency was “playing a game of regulatory Jenga,” stressing the importance of institutional knowledge and calling staffing cuts “the first, and perhaps most devastating, Jenga piece to go.”

“This is a dangerous game. We are pulling apart our own regulatory foundation—block by block, case by case, and rule by rule,” she added. “It feels all too familiar to those of [us] who have lived through 2008.”

SEC Chair Paul Atkins says the agency needs to fill some vacated job roles, defends job cuts 

We’re all trying to find the guy who did this…

The Securities and Exchange Commission’s purge of pending lawsuits against crypto exchanges is showing no signs of stopping.

” to dismiss its lawsuit against the crypto exchange, which is one of the largest in the world.

The move comes on the heels of last week’s news that the SEC would 

 into Coinbase and Robinhood, two other major crypto exchanges with pending lawsuits.

It was widely expected that during Trump’s presidency, the SEC would take its foot off the pedal when it comes to crypto regulation. Already, the commission’s actions have marked a sharp reversal from the 

The SEC sued Kraken in November 2023, under Gensler. As in its cases against other exchanges, at the heart of the SEC’s lawsuit was the allegation that the company acted as an unregistered broker, dealer, and exchange.

 Kraken “commingles its customers’ crypto assets with its own, creating what its own auditor had identified as ‘a significant risk of loss’ to its customers.”

In a blog post announcing the dropped lawsuit, Kraken said the dismissal marked “a turning point for the future of crypto in the US.”

“It ends a wasteful, politically motivated campaign, lifts uncertainty that stifled innovation and investment, and clears the path toward a stable, forward-thinking regulatory regime,” the company said.

The SEC hasn’t commented on the Kraken dismissal.

In its confirmation of the Coinbase dismissal, 

that it was dropping the lawsuit “given the pending work of the Crypto Task Force,” a 

 responsible for developing a regulatory path for crypto assets.

SEC drops another crypto lawsuit, company says

Crypto exchange Kraken said the commission dropped its lawsuit against the company. 

Let’s throw a new self-help guidebook into the mix: “What to Expect When You’re Expecting…an SEC Chair.”

In early December, President Donald Trump selected Paul Atkins as chairman of the Securities and Exchange Commission, bringing the business-friendly Republican back to the agency where he first cut his teeth. After working at the SEC under both Democrats and Republicans throughout the 1990s, Atkins served as SEC commissioner under President George W. Bush until 2008. Following his SEC tenure, Atkins founded a financial services consulting firm called Patomak, representing companies on regulatory matters.

Under Atkins’s tenure as chair, which still needs Senate confirmation, we’re likely going to see a hands-off regulatory approach at the SEC, particularly when it comes to crypto assets.

More on that in a minute. First, a general vibe check.

Atkins is well-respected in the securities regulation arena, Lisa Bragança, a former SEC branch chief who now leads a securities defense law firm, told CFO Brew.

“My understanding is his style is not combative,” Bragança said. “He's a reasonable person who tries to, through conversation or working with people, come to a reasonable solution.” Yes, that “reasonable solution” tends to be deregulation, she noted, but other securities experts also stress his cooperative demeanor.

“There's no question he's smart, capable, and experienced,” Ben Schiffrin, director of securities policy at Better Markets, a nonprofit that advocates for Wall Street regulation, told CFO Brew, highlighting Atkins’ appreciation for the Commission and the staff.

“He'll be a leader that, at times, may disagree with the staff, but will be respectful to them and understand where they're coming from,” Schriffin, who worked at the SEC during Atkins’s first term, said.

 But SEC chairs don’t tend to be personality hires. For a better sense of where Atkins might take the SEC, look to speeches and other public remarks, Bragança and Schiffrin say.

Atkins did not respond to a request for comment.

“His speeches and statements are even more indicative than his voting record, because he's said how he is pretty skeptical of regulation,” Schiffrin noted.

In fact, his voting record is difficult to parse. While some commissioners publicly revealed their votes during Atkins’s first tenure, they did not do so routinely, “obscuring commissioners' overall records from public view,” 

 in an analysis of Atkins’ voting record. Only 28 months of Atkins’ voting records, from 2006 to 2008, are available.

But in speeches, for instance, Atkins has also been fiercely critical of Dodd-Frank, the protection act put in place by President Barack Obama after the 2008 financial crisis, going so far as to say “one could write a book about the various problems with the statutory text and implementation” of Dodd-Frank in a testimony to the House of Representatives Committee on Financial Services in 2015.

One especially revealing speech? A 2004 address where he argued that Wall Street was the “scapegoat” for economic deterioration in the US in the 1930s.

“The moral of the story is that the cause of the poor market performance and extended depression was not the result of the market's failure, but US economic and regulatory policy,” Atkins said in remarks before the Securities Traders Association in Boca Raton, Florida.

“The government failed to recognize that its attempt to fix the economy by interfering with market forces first enhanced the stock market bubble, then sent the market into a whirlwind crash, and then prolonged the business depression,” he said.

That’s a pretty telling stance, in Schiffrin’s eyes. “A lot of people think that the excesses of Wall Street caused the crash,” he pointed out, adding that the federal securities laws passed as a result are a large part of what keeps US capital markets flourishing.

“The reason that our capital markets are the envy of the world is because they're well regulated and well policed,” he said. “Obviously you can't prevent all fraud, but we have rules and regulations where people can feel relatively confident that they can invest their money safely. It's really important to bear in mind that regulation really is the foundation of our capital markets.”

Will Atkins prove reluctant to fine companies? 

Schiffrin believes Atkins will be unlikely to “levy civil penalties against corporations.” Reuters reported that, in remarks, Atkins “argued that corporate fines only hurt shareholders who had already suffered from the original misconduct.”

“He's pretty firmly on record saying he doesn't think that that's a good idea,” Schiffrin said. “Aside from the merits of that policy position, I think what will be interesting to see is, if that is, in fact, the case. Does he go after the individuals that are responsible? That is a simple, important distinction.”

Paul Atkins, former Commissioner of the U.S. Securities and Exchange Commission under President George W. Bush, arrives at Trump Tower. Credit: Drew Angerer/Getty Images

What to expect from incoming SEC chair Paul Atkins 

For starters, deregulation.

Alex Zank

Bad news: You missed the deadline in filing your annual report. Good news: You’re far from alone, and experts shared tips with CFO Brew on how to handle the many challenges that may impede your progress on finishing that vital Form 10-K.

 a roughly 40% increase in companies that announced they would be tardy in filing their Form 10-K compared to 2023.

Ro Sokhi, partner at UHY, attributed the surge in late filings to a few factors:

A boom in SPACs and IPOs in 2021 and 2022 meant that accounting departments found themselves doing more and different work for a now-public company compared to when they were private.

Regulators, namely the Public Company Accounting Oversight Board (PCAOB) and Securities and Exchange Commission (SEC), are ramping up pressure on accounting departments to “increase the quality of their internal controls [and] increase the quality of our audit procedures.”

On top of it all, the profession is seeing a 

, as more baby boomers retire and fewer young folks seem interested in accounting.

“All of that just created a perfect storm to cause these late filings,” he told CFO Brew.

 both a new auditing standard that was meant to clarify existing standards into a single document along with a quality control update that included new processes, programs, and reporting. Then in June, PCAOB 

 on technology-assisted audits and tightened a rule on auditor liability.

“It’s a labor-intensive push on some of those [updates],” especially for companies that have gone through major changes such as an acquisition or merger, Amy Gallagher, managing director of UHY Consulting, told CFO Brew. “Just finding all of the information to be able to get clarity around that is a lot of work.”

Among short-staffed accounting teams, the SEC reporting deadline “consistently comes up as some fire drill,” Gallagher said. Companies such as 

 have cited a lack of accounting staff when announcing they would be late in filing their annual reports.

 There are some actions organizations can take to make due and hopefully avoid delayed filings, according to the UHY experts.

While it may sound simple, there’s benefit to having all filing deadlines and upcoming major events—say, an acquisition or a divestiture—all on one calendar, Sokhi said. Visualizing what’s on the horizon can help ensure accounting teams devote enough time to get things done while potentially having bandwidth for “the unknown.”

Sokhi laid out all the paperwork deadlines, both scheduled and a surprise, a company may encounter: “There are three 10-Qs, if you’re a US public filer, and then there’s one 10-K annual filing. But…if there’s a significant acquisition, you may need to file financial statements of the acquisition on an 8-K. If you have a cybersecurity event that’s a material breach, as soon as the company’s determined it’s a material breach, you have four days within which you have to file it on an 8-K.”

Of course, there’s only so much one accounting team can handle, especially if they’re not at full strength. Companies should have relationships with outside firms to quickly add staffing and resources in order to meet deadlines, Gallagher said.

“Some of the companies that we work with, the really small companies or [those] that just went public, they have tiny accounting departments,” she said. “They have one person that they depend on for SEC reporting, and that’s just not enough capacity for anybody to be successful. So, I would say certainly having your partners [is important].”

Late 10-K filings increased last year

Recent IPO surge, more red tape, and ongoing talent shortage all contributors to spike in late filings, experts say.

You know that cybersecurity has made its way into the cultural zeitgeist now that security firms are taking out 

. The new SEC cyber incident disclosure rule may push cybersecurity even more firmly into the minds of public companies and their investors.

, and detail cyber risk management practices regularly in their annual 

The new rule could boost companies’ cyber hygiene, now that they are reporting their practices to the public, Alissa Lugo, senior director and analyst with Gartner’s legal and compliance group, told CFO Brew.

“I do think it’s going to raise up some best practices, and I think organizations will be better off for it, even though there’s some heartburn right now trying to think about all of this,” Lugo said.

 Transparency is key because many organizations are not up to speed on their governance and risk management practices, according to Pete Cordero, a retired FBI special agent and founder of cybersecurity advisory firm Hacking The Cyber Threat LLC, told CFO Brew.

“I don’t think we’re anywhere near optimal,” Cordero told CFO Brew. That means some organizations have work to do to catch up.

Early results indicate that companies are still getting a feel for what should be reported. Some of the first cyber incident disclosures only contain minimal information and do not answer some important questions, 

 in January reporting a recent breach, it wrote that “the incident has not had a material impact on the Company’s operations.” Microsoft told 

 that “because the law is so new, we wanted to make sure we honor the spirit of the law.”

 Finance leaders, who often have organizational compliance and risk management under their purview, have skin in the game. A 

 recommended that “CFOs…should be ready to answer questions from the board about disclosures regarding material and immaterial cyber incidents as well as annual disclosures of cyber risk management, strategy, and governance.”

 from AuditBoard suggests the CFO is involved less often than the CISO in reshaping practices to ensure SEC compliance. Three-quarters of the 300-plus security professionals surveyed by AuditBoard indicated the CISO and/or information security team was involved in the disclosure process, while 45% of respondents said the CFO/finance team was involved.

However, not every organization has a CISO. In those cases, Lugo said in an email that she recommended organizations hire a CISO, but in the meantime, they should “clearly outline who the risk owner is [and] who is responsible for managing the cyber program.”

John Pearce, principal of Grant Thornton’s cyber risk advisory services, told CFO Brew that some organizations charge the board’s audit committee with cyber oversight, while others may have something like a technology risk committee.

Whatever the oversight mechanism is, firms need to make sure to document it. “What we’ve instructed folks is, if you’re going to put it in your 10-K, you better have it memorialized, and prove that it actually actions that way. That’s where we’re seeing the biggest gaps,” Pearce said.

Companies also need to test their information controls “to make sure that the right information is being shared with leaders on a timely basis, and then that that information is being evaluated…if it needs to be publicly disclosed,” Lugo said. Firms should test its practices in simulated tabletop exercises to ensure disclosure is appropriately achieved and with the right information, she added.

 The new reporting requirements also will improve boards’ cyber hygiene, experts said. For one, the 10-K disclosures will highlight the qualifications (or, sometimes, lack thereof) of board members to capably oversee cyber risk, according to Pearce.

“Now these boards have to say…‘How are we going to say that we’re qualified to oversee this risk, as well as management?’ So, [it’s] better to think through what that reporting and cadence structure is and the skillsets, so that when they write up in the 10-K what they’re doing…that they do actually have proper oversight of the programs,” Pearce said.

The short-term solution is to educate members currently on the board—Pearce said groups like the National Association of Corporate Directors (NADC) offer cyber risk oversight training. In the longer term, organizations will put more emphasis on new board members who have stronger cyber backgrounds.

Experts also recommended firms bring in outside consultants to review their cyber risk management and governance programs. The reviews could in turn bolster cyber readiness.

How to adapt to this new era of cyber incident reporting

Reporting quarterly may not even be enough, says one expert.

We’re in a new era of cyber incident reporting, and experts have ideas on how companies should adapt

 went into effect last week. Most companies are “largely ready” to comply, Matt Gorham, senior managing director and leader of PwC’s Cyber & Privacy Innovation Institute, told CFO Brew, “but that doesn’t mean there isn’t work to do.”

As their companies’ finance leaders, CFOs are instrumental in determining whether a cybersecurity incident is material, but they have other roles to play as well. Gorham shared his advice for how CFOs can help their organizations comply with the new regs.

As a reminder, the regulations consist of what Gorham refers to as three “buckets.” Companies that file with the SEC are required to:

Declare any material cybersecurity incidents to the SEC on Item 1.05 of Form 8-K within four business days of determining materiality

Disclose information about their cyber risk management and strategy on a new section of the 10-K called Item 1C

Disclose information about their boards’ and management’s role in overseeing cybersecurity risk

The first two “buckets,” Gorham said, will likely require the most work to comply with.

Have a team and a process in place for determining materiality: 

That team should include the CFO, general counsel, and the CISO or CIO, Gorham said. The CFO will likely handle the quantitative aspects of an incident’s material, he said, but other personnel can provide input on other impacts, such as customer and vendor relationships, reputation, and potential litigation.

“Bake” materiality into your procedures: 

Review your incident escalation procedures and make sure their “material considerations” are “baked in,” Gorham said.

“Incident responders don’t generally think in terms of materiality, and folks that wrestle with materiality don’t generally think in terms of the incident response process,” he said, so he stressed the importance of coordinating to ensure that the team making the materiality determination gets the information it needs.

Ensure incident reporting captures repeated incidents: 

The SEC regulations state that companies now need to disclose repeated cybersecurity incidents if their total impact is material. The first time a bad actor attacks a company it may not be material, Gorham said, but if the same bad actor attacks again and the cumulative impact of the incidents is material, then that company would need to “re-escalate both of those so they can be considered in an aggregate fashion.” Companies need to make sure they have good procedures in place for tracking incidents, he said.

Make sure you can respond within the four-day timeline. 

Companies must report to the SEC within four business days of determining an incident’s material, and not within four days of the incident’s occurrence. It can take “days, weeks, a month” to make that determination, Gorham said, but four days is nevertheless a “condensed time frame.” Review your processes to ensure you can capture the “nature, scope, time, and material impact of an incident in disclosure language and have it all approved” in that time, he recommended.

Conduct a tabletop exercise in compliance. 

Companies can also test their response to a fictional cybersecurity incident to identify any gaps in their processes. Such exercises can help them “shrink the decision process and give themselves more agility” in the event of an attack, Gorham said. That way, they won’t be “trying to figure it out the first time in the middle of an incident,” he added.

A medieval shield with digital lines going through it with a computer mouse pointing at it close with binary code and a black and green squares behind it on a dark blue background

SEC