Cybersecurity risk

Definition

For an auditor, cybersecurity risk is the risk that unauthorized access, ransomware, data theft or system disruption could cause a material misstatement or affect the audit. There is no separate cybersecurity audit standard in a financial statement audit. The topic fits under AU-C 315 (risks arising from IT), AU-C 240 (fraud), AU-C 560 (subsequent events) and AU-C 570 (going concern).

Why it matters in an audit or review

A ransomware event can lock the accounting system, destroy records, interrupt operations and create liabilities for ransom, remediation, legal claims or regulatory penalties. The auditor asks management about incidents, reviews access and backup controls, and considers whether an incident after year end is a subsequent event that requires disclosure. If operations are impaired, going concern evaluation is affected. Records that cannot be recovered can limit the evidence available.

Example

Illustrative: three weeks after year end a client is hit by ransomware and its ERP is down for 10 days. The auditor asks about backups, whether the books were restored completely, whether the attacker had access to data that was changed, and whether insurance covers losses. The team extends procedures over reconstructed records, evaluates a possible contingent liability, and considers disclosure of the event.

Common mistakes

Asking only whether the client has cyber insurance. The auditor needs to know if the books and controls were affected.

Sources

• AICPA, AU-C Section 315, Identifying and Assessing the Risks of Material Misstatement (understanding the entity's IT environment and risks arising from IT)
• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
• AICPA, AU-C Section 560, Subsequent Events and Subsequently Discovered Facts
• AICPA, AU-C Section 570, The Auditor's Consideration of an Entity's Ability to Continue as a Going Concern