THE

BULLETIN
OUR VIEW ON CORPORATE GOVERNANCE MATTERSVOLUME 8, ISSUE 7

Setting the 2024 Audit Committee Agenda
Compared to prior years, our suggested 2024 audit committee agenda has taken a bit of aturn due to ongoing and recent market and regulatory developments. It includes important
enterprise, governance, process, technology, and financial reporting and disclosure issues
that merit consideration by the audit committee beyond its ongoing chartered activities.
In addition to discussing these agenda items, we offer assessment questions for audit
committees to consider when evaluating their performance. In formulating these topics,
we considered input from our interactions with client audit committees and insights frommeetings with active directors in various forums.

The 2024 Mandate for Audit Committees
Enterprise, Process and Technology Issues

Financial Reporting Issues

1. Discuss the implications of the SEC’s cyberdisclosure enhancements

6. Assess the impacts of inflation, higher interest rates,
economic uncertainty, tighter lending standards andother relevant factors on financial reporting assertions

2. Determine the extent of any talent and skills
shortages
3. Inquire as to external reporting implications offinance’s use of generative AI
4. Review the substance and consistency of ESG
reports and the underlying reporting process
5. Assess internal audit’s commitment to relevance

7. Ascertain whether a “next generation” mindset is being
deployed to combat rising SOX compliance costs
8. Monitor the impact of cost-optimisation measures andorganisational changes on key internal controls
Note: The committee should continue to self-assesscomposition and focus.

Enterprise, Process and Technology Issues
Our suggested agenda includes five enterprise, process and technology issues:
1. Discuss the implications of the SEC’s cyber disclosure enhancements — The U.S.
Securities and Exchange Commission (SEC) has adopted amendments1 to its rules oncybersecurity risk management, strategy, governance and incident reporting. These ruleamendments apply to public companies subject to the reporting requirements of the
Securities Exchange Act of 1934. They warrant the audit committee’s attention.
Specifically, the committee should obtain an understanding of the SEC’s requirements relative
to when the rule goes into effect and the nature of the required disclosures, including the relatedmateriality considerations. To that end, Protiviti has issued a Flash Report2 summarising theCommission’s amended rules and offering guidance to public companies that will need to comply
as soon as December 2023. The thrust of the amended rules is not new, just more prescriptive.
Armed with an understanding of the rules, the committee should inquire as to the following:— The game plan for monitoring whether a cyber incident has occurred— The materiality assessment framework for evaluating the significance of an incident orseries of incidents within a reasonable time frame to determine whether it/they should be
disclosed (note that once deemed material, a cyber incident or series of incidents must be
disclosed within four business days)— The planned approach for describing the cybersecurity program and disclosing
material incidents— The stakeholders at the table determining the adequacy of the disclosures (e.g., the general
counsel, the chief financial officer (CFO), other members of the disclosure committee andthe chief information security officer)
In addition, the committee should obtain an understanding of the extent of changes inaudit scope by the external auditor with respect to cybersecurity matters, formal reporting
compliance and Sarbanes-Oxley (SOX) compliance.

1“Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” SEC, July 31, 2023: www.sec.gov/files/rules/
final/2023/33-11216.pdf.

2“SEC Cybersecurity Disclosure Enhancements: Efforts to Boost Investor Confidence,” Protiviti, August 2, 2023: www.protiviti.com/us-en/
flash-report/sec-cybersecurity-disclosure-enhancements-efforts-boost-investor-confidence#.

protiviti.com

The Bulletin • 2

2. Determine the extent of any talent and skills shortages — According to a Protiviti survey of
CFOs and finance teams, half of all CFOs consider the ability to recruit qualified candidates a key
area of concern.3 A similar issue falls just behind this challenge: replacing employees who leave
the organisation. Understandably, there are notable year-over-year increases in plans to address
individual career growth and upskilling as well as commitments to individual promotion tracks toachieve more versatility among the finance organisation team members.
Why it matters: With executive leadership, including many CFOs and chief audit executives(CAEs), concerned about attracting, acquiring and retaining qualified candidates, anunderstanding of existing skills gaps, retention plans, and upskilling and development strategies
is needed. To that end, following are suggested questions for audit committees:— How is the CFO optimising finance talent investments to increase flexibility as well assustain access to cutting-edge skills and innovative thinking? For example, is financebalancing the use of full-time staff, interim professionals, contractors, managed services
providers and outsourcers, as well as seeking ways to blend upskilling, reskilling andretention activities in managing the group?
— Is the CFO function partnering with the human resources group to develop data-driven talentstrategies that include redesigned job roles, enterprisewide skills inventories, rolling talent
forecasts, skills modelling, and change management plans for quickly adapting work and jobs
to new technologies — such as generative artificial intelligence (AI) — and other innovations?
— Are we devoting more time to succession planning and related leadership development
activities while practicing transparency with rising finance leaders and investing intheir progression?
— How is the CAE addressing skills development of team members and talent strategies forthe internal audit function going forward?

According to a Protiviti survey of CFOs and finance teams, half of all CFOs consider
the ability to recruit qualified candidates a key area of concern. A similar issue falls
just behind this challenge: replacing employees who leave the organisation.

3

Accelerate: 2023 Global Finance Trends Survey, Protiviti, October 2023: www.protiviti.com/us-en/survey/global-finance-trends-survey.

protiviti.com

The Bulletin • 3

3. Inquire as to external reporting implications of finance’s use of generative AI — The promise ofgenerative AI is enormous, impacting sales and marketing, product research and development,
customer operations, and software engineering as well as other business functions. Finance is no
exception, as most finance organisations are diving into it.
What they’re saying: With risks relating to ownership rights, prejudice in text and images,
deepfakes, hallucinations, and security and privacy issues, there are legitimate concerns
regarding potential misinformation and disinformation issues. Fortunately, generative AI andtechnology companies are developing new partnerships designed to help organisations bringthese models “inside their four walls” to deploy their own data sets in conjunction with anappropriate governance framework.
Between the lines: The audit committee should inquire of management, the CFO and the CAE
regarding the impact of this novel technology on compliance, regulatory and other required
reporting, including forecasting and forward-looking guidance. The committee should also
ensure that generative AI benefits are being achieved in a secure, reliable and unbiased
manner. For example:— Are a cross-functional technology lens and expertise in data security, data privacy, risk
management, and legal and compliance being deployed when spearheading generative AI
solutions in the finance group?
— Are we using controlled data sets in a closed source model and requiring attribution ofmodel content to engender transparency and confidence? How are we managing the riskof unintentional bias on the part of those who define the data sets used and program thealgorithms for creating content from the data?
— How are we managing data from external sources (e.g., strategic suppliers, third-party
providers and channel partners)?
— Is appropriate supervision and review applied to generative AI content just as it would be tocontent generated by a finance function employee to ensure that it is factual and authentic?
— What use cases are we envisioning in finance (e.g., financial planning and analysis, fraud
prevention, capital allocation, investment planning, and scenario planning)? Will these and otherapplications across the company affect financial reporting and disclosures?
— Do we have the skills needed to accomplish our objectives in implementing these models?
— Has the CAE sufficiently considered the organisation’s exploration and use of AI (or lackthereof) in the internal audit risk assessment and planning process, and are AI-related risks
subject to assurance or advisory review?

protiviti.com

The Bulletin • 4Final word: The audit committee should ask management to keep it and the rest of the board
informed of generative AI trends, risks, benefits and internal uses through periodic updates andongoing communications.

Almost two-thirds of public organisations and just over 50% of private companies
indicate a marked increase in the focus and frequency of their reporting related to
ESG issues.

4. Review the substance and consistency of ESG reports and the underlying reporting process— While the term “ESG” is getting shopworn in the market, the underlying issues that impact
the sustainability of the enterprise and its business model are not. Sustainability disclosures andreports, in one form or another, are being demanded by and provided to various stakeholders.
Regulators in the European Union have set dates and deadlines for ESG disclosures with entity
statutory reports.4 The market continues to anticipate the SEC’s release of its climate disclosurerules. Guidance has been issued on internal control over sustainability reporting.5 Insurers’
underwriting processes, banking partners’ lending applications and customers’ requests for
proposals are asking for ESG-related documentation. So are third-party risk questionnaires andindependent surveys. As these disclosures may be authored by different stakeholders in theorganisation, they may or may not be consistent with the mandated reporting to investors.
The aforementioned survey of CFOs and finance teams indicates that ESG stands out as
the highest priority for the finance organisation to address over the next 12 months. Almost
two-thirds of public organisations and just over 50% of private companies indicate a marked
increase in the focus and frequency of their reporting related to ESG issues (on top of prioryears, where increases were noted as well — a cumulative effect in increasing emphasis).
There is also a notable jump in finance groups in which measuring and reporting on ESG
risks and issues is becoming part of their role. Because the integrity and consistency of thecompany’s sustainability reporting is of interest to the board, the audit committee shouldcollaborate with the full board and various committee chairs to ensure that there is a “wholeboard view” into the organisation’s sustainability performance, reporting and disclosures. This
governance role has reputational and brand image implications.
4“Corporate Sustainability Reporting Directive (CSRD) Approved by European Council; More Than 50,000 Organisations Affected,” Protiviti, November
30, 2022: www.protiviti.com/us-en/flash-report/corporate-sustainability-reporting-directive-csrd-approved-european-council-more-50000.

5“Achieving Effective Internal Control Over Sustainability Reporting,” Committee of Sponsoring Organisations (COSO), 2023: www.coso.org/_
files/ugd/3059fc_a3a66be7a48c47e1a285cef0b1f64c92.pdf.
Continued ...

protiviti.com

The Bulletin • 5According to a market data report, 59% of “green” claims made by Europeanand U.K. fashion brands are misleading, and two-thirds of executives worldwide
questioned whether their company’s sustainability efforts were genuine.

What to watch: Accusations of greenwashing are on the rise. According to a market datareport, 59% of “green” claims made by European and U.K. fashion brands are misleading, andtwo-thirds of executives worldwide questioned whether their company’s sustainability efforts
were genuine.6 As the prevalence of greenwashing in the business world negatively impacts
customer loyalty and satisfaction, more brands are publicly reporting as little as possible on theirsustainability efforts (i.e., “greenhushing”).7
These developments are a result of many factors. With the current array of reporting
frameworks, aggressive activists, the lack of rigorous disclosure processes and controls, theissuance of reports by parties unfamiliar with various regulatory and public reporting standards,
and disjointed, uncoordinated efforts across the organisation, the audit committee should:— Ascertain that the CFO function8 is engaged in the review of sustainability reports issued
across the company for consistency across all reporting channels.
— Inquire of management regarding (1) the rigour underpinning the processes, data andmetrics feeding ESG-related disclosures and reports, (2) the means by which management’s
assertions regarding the effectiveness of disclosure controls and procedures relating to
ESG metrics and reporting are supported, and (3) the processes for identifying and adapting
to new or clarified sustainability reporting and disclosure demands and requirements
applicable to the company’s operations.
— Consider the implications of the company’s human capital, climate and other ESG
disclosures on the assumptions underlying financial reporting assertions.
— Ensure there is appropriate board oversight over assurance activities, if the company opts
to obtain assurance, including the review of external auditor independence.

6“Must-Know Greenwashing Statistics,” by Lorena Castillo, Gitnux, October 15, 2023: https://blog.gitnux.com/greenwashing-statistics.

7“The Rise of ‘Greenhushing’: Why Are Brands Going Silent About Their Sustainability Efforts?” by Josh Stephenson, Marketing Week,
September 13, 2023: www.marketingweek.com/the-rise-of-greenhushing-why-are-brands-are-going-silent-about-their-sustainability-efforts/.

8

As certifying officers of public companies and the de facto purveyors of data at organisations of all kinds, many CFOs are charged withgoverning the environmental data and analyses in financial statements and ESG reports — including the oversight of reliability of data sources
and reporting integrity, consistency and compliance.

protiviti.com

The Bulletin • 6

Important takeaways: For many companies, it is expected that the audit committee discharge
many, if not all of the above responsibilities. Market demand for and regulatory scrutiny of ESG
reporting activities merits coordinated board oversight.

Impactful communications, along with the methodologies, data and systems
required to produce them, are the most important contributor to growinginternal audit’s relevance.

5. Assess internal audit’s commitment to relevance — According to Protiviti’s research,
top-performing internal audit groups focus on delivering streamlined, tailored, impactfulcommunications and reporting.9 They evolve and adapt routinely. They actively and persistently
seek ways to integrate data and technology throughout the audit life cycle. They push themselves
to find and build talent and resources from both within and outside their organisations.
All of this is in the name of sustaining “relevance,” meaning remaining connected and aligned withwhat’s important and being insightful and providing value through quality communications andinformation sharing to management and the board. Impactful communications, along with themethodologies, data and systems required to produce them, are the most important contributor
to growing internal audit’s relevance. The efficacy of communications and reporting requires the
optimisation of activities throughout the audit life cycle, including risk assessment, scoping andplanning, project status, audit committee reporting, and issue follow-up and validation.
The bottom line: The relevance and value orientation of internal audit is in everyone’s interests.
Competing priorities are the greatest barrier to internal audit innovation. Audit committees
should be routinely asking internal audit leaders whether:— They have the resources, competencies and skills needed to transition to new valueadding capabilities.
— There are any obstacles stopping them from focusing on priority items in the near or long term.
Our point of view: The committee should expect internal audit leaders to be prepared to answer
these questions directly and thoroughly, so they can evaluate how the office of the CAE ispositioning the function to deliver against the goal of sustaining its relevance and value.
9

Achieving Audit Relevance, Protiviti, March 2023: www.protiviti.com/gl-en/survey/next-gen-ia-2023.

protiviti.com

The Bulletin • 7Financial Reporting Issues
As financial reporting issues are fundamental to the audit committee’s core mission, the 2024
suggested agenda includes three important items:
6. Assess the impacts of inflation, higher interest rates, economic uncertainty, tighter lending
standards and other relevant factors on financial reporting assertions — Aggressive central
bank monetary policies have commanded much attention in the market. The impact typicallyripples through the economy as a whole. Higher interest rates increase borrowing costs forbusinesses, customers and consumers and affect present value calculations used in valuing
leasing arrangements and financial instruments.
Lending standards tighten. Demand for loans to firms of all sizes weakens. These and other
trends put a damper on economic growth. If consumer spending declines significantly, theeconomy could drift toward recession. The effects vary in different sectors and companies. The
reality is that changes in inflation, interest rates, supply chains and customer demand affect boththe top and bottom lines of a company’s customers and suppliers.
These market developments can alter the assumptions and estimation processes underlying
going concern, asset and deal valuations, loss contingencies, revenue and pricing projections,and other accounting, reporting and disclosure matters. They can affect forecasting andforward-looking guidance. The audit committee should inquire of their impact on theassumptions underpinning:— Valuation of existing, and calculation of new, financial instruments (including customer accounts
and notes receivable), investments, long-lived fixed and intangible assets, and goodwill— Valuation and net realisable value determinations associated with inventories andvarious fair value measurements— Revenue recognition and pricing projections— Loss contingencies— Debt service issues and going concern assessments— Customer and supplier viability— Other accounting and disclosure matters
A key point: With respect to these matters, companies should consider information that
becomes available after the balance sheet date but before the issuance of the financial
statements. If significant subsequent events occur, companies are required to disclose their

protiviti.com

The Bulletin • 8nature and either an estimate of the financial statement impact or a declaration that an impact
assessment cannot be made.

Protiviti’s research indicates that more companies are embracing a new, “nextgeneration” SOX compliance mindset, one that prioritises introducing tools andtechnology to support the company’s internal controls systematically and efficiently.

7. Ascertain whether a “next generation” mindset is being deployed to combat rising SOX
compliance costs — Protiviti’s research indicates that more companies are embracing a
new, “next generation” SOX compliance mindset, one that prioritises introducing tools andtechnology to support the company’s internal controls systematically and efficiently.10
Companies are attacking climbing compliance costs by taming the complexity of theircontrol environment and exploring and pursuing options to further tech-enable controls
and testing activities.
The research also noted that a growing number of organisations are investing in automation andadvanced technology tools to support their SOX compliance.
— They use intelligent audit management and governance, risk and compliance (GRC)
platforms, workflow automation, continuous monitoring, process mining, advanced
analytics, and data visualisation tools to streamline gathering and extracting relevant
data from documents and other control artifacts, controls testing, reporting, and othermanual compliance activities.
— With companies attacking climbing compliance costs in this manner, the audit committee
should understand the extent to which automation and advanced technology tools aresupporting the company’s internal controls systematically and efficiently.
— Importantly, Protiviti’s survey results indicate that more compliance programs would
benefit from moving in this direction, as there are efficiency, effectiveness and costsaving benefits to be realised.

10“The Evolution of SOX: Tech Adoption and Cost Focus Amid Business Changes, Cyber and ESG Mandates,” Protiviti, September 2023:
www.protiviti.com/us-en/podcast-transcript/evolution-of-sox.

protiviti.com

The Bulletin • 9Between the lines: Automation and technology enablement, resourcing models that include
outsourcing options and centres of excellence, and greater use of standardised controls acrossmultiple locations and complex organisations are foundational elements of a next-generation
SOX compliance program.
— The audit committee should inquire of management to understand whether the company
is considering these elements.
— The committee should ascertain whether this next-generation mindset is driving a refreshof controls rationalisation, risk assessment and scoping, and the scope of the external
auditor’s work. For example: When was the SOX program risk assessment and scoping
process last revisited, and did it include control rationalisation efforts to standardise
controls and reduce complexity of the control environment?
— More importantly, is it having a positive impact in streamlining and strengthening
business processes and IT controls?

Efforts to optimise costs or transform the organisational structure or businessmodel may have an impact on the control structure and could result in ignoringcertain critical controls or less diligence in their execution or timely remediation.

8. Monitor the impact of cost-optimisation measures and organisational changes on key internal
controls — Referencing Protiviti’s survey of CFOs and finance teams yet again, the impact ofinflation, financial planning and analysis, and profitability reporting and analysis are among theirhighest-ranked 2024 priorities. These priorities reinforce efforts already underway throughout
2023 to optimise costs amid inflationary trends and an uncertain global economy. More thantechnology improvement or risk management, cost optimisation is viewed as a top priority
for process improvement in organisations. And some companies are thinking about what theorganisation’s structure and business model should look like in the future.
Why it matters: Efforts to optimise costs or transform the organisational structure or business model
may have an impact on the control structure and could result in ignoring certain critical controls
or less diligence in their execution or timely remediation. Combined with the effects of continued
workplace developments, changes in personnel and processes can have subtle effects on internal
control over financial reporting, cybersecurity risks, and exposure to compliance and fraud risk.
protiviti.com

The Bulletin • 10

As the primary advocate for the control structure in the boardroom, the audit committee should
consider engaging management on the following questions:— Have we determined that changes in internal processes as a result of cost optimisation,business transformation efforts and workplace transitions have not affected the integrityof our internal control structure and execution of key financial controls? How do we know?
— Have recent and expected workplace changes, plans for reopening or shutting down
physical locations, and shifts in the company’s talent model affected the company’s cyberthreat landscape and exposure to compliance and fraud risk?
— Are we satisfied there aren’t any segregation of duties issues in sensitive areas, exposing
our organisation to errors or irregularities?
— Amid changes in our operating environment, have controls over general IT, user access(including privileged, sensitive access) and change management remained strong and intact?
— Have adjustments to the business model or to underlying business processes resulted inany significant changes in the internal control structure? How do we know?
— Are there changes in our control environment material enough to warrant disclosure?
In the context of the above matters, the committee should ascertain whether legal counsel has
been consulted to ensure compliance with applicable laws and regulations.

Self-Assess Committee Effectiveness
Audit committees are encouraged to self-assess their performance periodically. To that end,
we have made available illustrative questions at www.protiviti.com/us-en/newsletter/bulletinassessment-questions-audit-committees. Committee members should periodically assess thecommittee’s composition, charter and focus with consideration of the company’s industry,
circumstances, risks, financial reporting issues and current challenges.
Topics Covered by “Assessment Questions for Audit Committees to Consider”• Committee composition and dynamics• Corporate culture• Committee charter and agenda• Executive sessions• Oversight of internal controls and financial
reporting• ESG reporting• Oversight of the external auditor• Oversight of internal audit• Risk oversight• Committee effectiveness• Business context• Member orientation and education

protiviti.com• Oversight of the finance organisation

The Bulletin • 11

Summary
The next 12 months will prove interesting for audit committees and the companies they serve.
Giving consideration to cyber disclosure enhancements, talent and skills shortages, generative AI
implementations, sustainability/ESG reporting, internal audit’s relevance, the financial reporting
implications of continued market developments, the emergence of a next-generation SOX
compliance mindset, and the impact of cost-optimisation measures and organisational changes on
key internal controls is a full plate on top of the committee’s customary chartered responsibilities.
But it is also an opportunity to provide value-added advice and counsel to management on various
important matters that can impact financial and public reporting, directly or indirectly.

About the Author
Andrew Struthers-Kennedy
Protiviti Managing Director
Global Practice Lead, Internal Audit and Financial Advisory
As the global lead of Protiviti’s Internal Audit and Financial Advisory
practice, Andrew Struthers-Kennedy is privy to significant boardroom
experience — his own as well as that of the managing directors he leads.
His market focus is on increasing the relevance of and value delivered byinternal audit both in the boardroom and across the company.
Contact Andrew at andrew.struthers-kennedy@protiviti.com.

Protiviti (www.protiviti.com) is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help
leaders confidently face the future. Protiviti and our independent and locally owned Member Firms provide clients with consulting and managed solutions in finance,technology, operations, data, analytics, digital, legal, HR, governance, risk and internal audit through our network of more than 85 offices in over 25 countries.
Named to the 2023 Fortune 100 Best Companies to Work For® list, Protiviti has served more than 80 percent of Fortune 100 and nearly 80 percent of Fortune 500
companies. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly
owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.
© 2023 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. PRO-1123-IZ-EN
Protiviti is not licensed or registered as a public accounting firm and does not issue opinions
on financial statements or offer attestation services.