A public company that suffers a cyberattack has a clock. If it determines the incident is material, it has four business days to file a Form 8-K describing it. For the auditor, that filing is a dated, public statement about the incident's nature, scope, timing and impact, and it lands in the middle of the audit cycle with no warning. Even if your clients are private, the rule shapes what lenders, parents and customers expect them to say after an incident. This post covers what the SEC requires and what auditors do with it.
What the rules require
The SEC adopted final rules on public company cybersecurity disclosures that created two obligations.
Incident disclosure: Form 8-K Item 1.05
Registrants must disclose any cybersecurity incident they determine to be material. The disclosure describes the material aspects of the nature, scope and timing of the incident, and its material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.
Two timing rules apply:
- The registrant must determine materiality without unreasonable delay following discovery.
- If the incident is material, the Item 1.05 Form 8-K is generally due within four business days of that determination, not of discovery.
The disclosure may be delayed if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. If the Attorney General indicates that further delay is necessary, the Commission will consider additional requests and may grant relief through possible exemptive orders.
Annual disclosure: Regulation S-K Item 106
Item 106 requires registrants to describe their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, and whether risks from cybersecurity threats, including from previous incidents, have materially affected or are reasonably likely to materially affect the registrant. It also requires a description of the board's oversight of cyber risk and management's role and expertise in assessing and managing it. Foreign private issuers have comparable requirements under amended Forms 6-K and 20-F.
Trade groups have petitioned the SEC to rescind Item 1.05 (File No. 4-856). The petition is not a rule change, and registrants must keep complying.
Compliance dates
- Item 106 disclosures: annual reports for fiscal years ending on or after December 15, 2023.
- Item 1.05: registrants other than smaller reporting companies began complying on December 18, 2023; smaller reporting companies began on June 15, 2024.
- Structured data: disclosures required under the rules must be tagged in Inline XBRL beginning one year after initial compliance with the related disclosure requirement.
Item 1.05 versus Item 8.01: the staff's May 2024 statement
The Division of Corporation Finance's Director issued a statement on May 21, 2024. It is staff guidance, not a Commission rule. Its points:
- Item 1.05 is for incidents the company has determined to be material. It is not a voluntary disclosure item, and it is by definition material.
- A company disclosing an incident that is not yet determined to be material, or that has been determined to be immaterial, is encouraged to use a different item, such as Item 8.01, to avoid investor confusion. The statement does not discourage voluntary disclosure.
- If an incident first disclosed under Item 8.01 is later determined to be material, the company should file an Item 1.05 Form 8-K within four business days of that determination.
- Companies should consider qualitative factors alongside quantitative factors in assessing materiality.
For an auditor, the choice of item is itself a data point. A disclosure under 8.01 tells you management had not determined materiality at that date, and the audit file should record what happened between then and any later Item 1.05 filing.
Audit implications for issuer audits
The rules do not change auditing standards. They change what the auditor has to read, reconcile and challenge.
- Read the 8-K and Item 106 language against what you know. Inconsistencies between the disclosure and what the engagement team learned about the incident, such as scope, systems affected or timing, are matters for the engagement partner.
- Test the materiality determination process. Ask how the company decided and when. The rule's "without unreasonable delay" standard and the four-business-day clock turn the date of determination into a fact worth documenting. Obtain the incident timeline, the materiality analysis, who was involved, and the board or audit committee communications.
- Trace the financial effects. Incident response costs, remediation spend, lost revenue, customer remedies, regulatory exposure and impairment indicators may all reach the financial statements. Loss contingencies under ASC 450 governs accrual and disclosure when a loss is probable and estimable or reasonably possible.
- Evaluate subsequent events. An incident discovered after year-end but before the report is issued requires an assessment of whether it provides evidence about conditions at the balance sheet date or arose afterwards, and what disclosure follows.
- Reassess the risk assessment. An incident that compromised financial systems can affect the reliability of the information you are using as audit evidence, including its completeness and accuracy. Revisit the IT general controls conclusion and any reliance on system reports. The ITGC guide covers the program.
- Look at the Item 106 disclosure as a control description. The annual description of cyber governance and processes is the company's statement of what it does. It is not audited, but contradictions between it and what you see in fieldwork are worth raising.
What this means in a nonissuer practice
Item 1.05 does not apply to a private company. It still reaches your engagements in three ways.
- Public-company parents and customers. If your client is a subsidiary, a vendor or a significant supplier to a registrant, the registrant's disclosure timeline can drive requests to your client for incident information on short notice. Ask in planning whether anyone is relying on your client's systems for reporting.
- The standard of care. The rule sets the market's expectation of how quickly a company decides materiality and what it says. Lenders and boards of private companies often borrow that expectation.
- Your own engagement letter. For clients that may become registrants, spell out how incidents are communicated. The engagement letter guide covers the structure.
Where the client faces ransomware or a similar event, see ransomware at an audit client for the engagement response.
Practical checklist
- Obtain the incident timeline with dates of discovery, containment, materiality determination and any filings.
- Obtain the materiality analysis, including qualitative factors.
- Read the 8-K, any Item 8.01 filings and the Item 106 text against the engagement file.
- Quantify costs incurred and expected, and assess accrual and disclosure.
- Update the risk assessment and the IT conclusions.
- Get written representations covering incident completeness.
Frequently asked questions
When does the four-business-day clock start?
It starts at the registrant's determination that the incident is material, not at discovery. The determination itself must be made without unreasonable delay following discovery.
Does Item 1.05 apply to smaller reporting companies?
Yes. Their compliance date was June 15, 2024, later than the December 18, 2023 date for other registrants.
Can a company file under Item 1.05 for an incident it has not found material?
The staff's May 2024 statement says Item 1.05 is meant for incidents determined to be material, and encourages other disclosures under a different item such as 8.01.
Sources
- SEC, Fact Sheet: Public Company Cybersecurity Disclosures; Final Rules: https://www.sec.gov/files/33-11216-fact-sheet.pdf
- SEC Division of Corporation Finance, Statement on Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents (May 21, 2024): https://www.sec.gov/newsroom/speeches-statements/gerding-cybersecurity-incidents-05212024
- SEC, Rulemaking petition File No. 4-856, request to rescind Item 1.05: https://www.sec.gov/comments/4-856/4-856.htm
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · SEC reporting and PCAOB audits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error