Is your company planning to hire a new CFO? A recent survey found that hiring managers look for more than financial acumen when vetting CFO candidates. In fact, only 38.5% of CFOs at Fortune 500 and S&P 500 companies were licensed CPAs in 2023, according to executive recruiting firm Crist Kolder. What other skills may be needed to fill these shoes?

Financial know-how opens doors.

The Pennsylvania Institute of Certified Public Accountants recently surveyed over 320 hiring executives about what skills matter most for the CFO role. Not surprisingly, “2024 Corporate Finance Report: CPAs in the C-Suite” found that the top must-have for CFO candidates is the ability to manage the company’s finances effectively.

The top 10 financial skills identified in the survey include:

1.Capital management and strategy,

2.Financial forecasting,

3.Operations and financial reporting,

4.Critical thinking,

5.Financial reporting compliance,

6.Strategy creation,

7.Industry/product forecast and outlook,

8.Tax compliance,

9.Accounts receivable, and

10.Networking and industry relationships.

The survey draws two key findings. First, CPAs aspiring to become CFOs must expand their skill sets beyond traditional accounting to include strategic planning, risk management, and technology oversight. Second, today’s CFOs must “strategize for growth and stability, not just report past results.”

Nonfinancial skills seal the deal.

Today’s hiring managers are looking for more than finance and accounting skills when filling CFO positions. They prefer candidates with the following general competencies, listed in order of importance:

• Leadership/strategic aptitude to develop high-performing teams and strategic goals,
• Compliance and regulatory expertise to ensure organizational adherence to laws, regulations, and internal policies,
• Technology and analytical proficiency to make data-driven decisions and use cutting-edge tools,
• Industry-specific knowledge to understand market conditions and how they influence the organization, and
• Communication skills to build effective relationships with internal and external stakeholders to maintain alignment with corporate strategy.

In addition, respondents emphasized the need for CFO candidates to possess “general business acumen” and “emotional intelligence.” However, the survey cautions that most hiring managers assume candidates who apply for executive positions have already mastered these general skills.

What’s the right fit for your executive team?

Finding the right person to head up your company’s finance and accounting department can be challenging in today’s tight labor market. The CFO’s main responsibility is to provide timely, relevant financial data to other departments — including information technology, operations, sales, and supply chain logistics — to help improve the business’s operations. He or she also must be able to drum up cross-departmental support for major initiatives. So, it’s important that you choose a candidate who’s a team player. You might even want to outsource the position to a skilled professional. Contact us for help evaluating CFO candidates to find the right mix of skills and experience for your company’s finance and accounting department.

The average cost of a data breach has reached $4.88 million, up 10% from last year, according to a recent report. As businesses increasingly rely on technology, cyberattacks are becoming more sophisticated and aggressive, and risks are increasing. What can your organization do to protect its profits and assets from cyberthreats?

Recent report

In August 2024, IBM published “Cost of a Data Breach Report 2024.” The research, conducted independently by Ponemon Institute, covers 604 organizations that experienced data breaches between March 2023 and February 2024. It found that, of the 16 countries studied, the United States had the highest average data breach cost ($9.36 million).

The report breaks down the global average cost per breach ($4.88 million) into the following four components:

1. $1.47 million for lost business (for example, revenue loss due to system downtime and costs related to lost customers, reputation damage and diminished goodwill),
2. $1.63 million for detection and escalation (such as forensic and investigative activities, assessment and audit services, crisis management, and communications to executives and boards),
3. $1.35 million for post-breach response (including product discounts, regulatory fines, legal fees, and costs related to setting up call centers and credit monitoring / identity protection services for breach victims), and
4. $430,000 for notifying regulators, as well as individuals and organizations affected by the breach.

A silver lining from the report is that the average time to identify and contain a breach has fallen to 258 days from 277 days in the 2023 report, reaching a seven-year low. One key reason for faster detection and recovery is that organizations are giving more attention to cybersecurity measures.

Implementing cybersecurity protocols

Cybersecurity is a process where internal controls are designed and implemented to:

• Identify potential threats,
• Protect systems and information from security events, and
• Detect and respond to potential breaches.

The increasing number of employees working from home exposes their employers to greater cybersecurity risk. Many companies now have sensitive data stored in more places than ever before — including laptops, firm networks, cloud-based storage, email, portals, mobile devices and flash drives — providing many potential areas for unauthorized access.

Targeted data

When establishing new cybersecurity protocols and reviewing existing ones, it’s important to identify potential vulnerabilities. This starts by inventorying the types of employee and customer data that hackers might want to steal. This sensitive material may include:

• Personally identifiable information, such as phone numbers, physical and email addresses, and Social Security numbers,
• Protected health information, such as test results and medical histories, and
• Payment card data.

Companies need to have effective controls over this data to comply with their obligations under federal and state laws and industry standards.
Hackers may also try to access a company’s network to steal valuable intellectual property, such as customer lists, proprietary software, formulas, strategic business plans, and financial data. These intangible assets may be sold or used by competitors to gain market share or competitive advantage.

Auditing cyber risks

No organization, large or small, is immune to cyberattacks. As the frequency and severity of data breaches continue to increase, cybersecurity has become a critical part of the audit risk assessment.

Audit firms provide varying levels of guidance, both when assessing risk at the start of the engagement and when uncovering a breach that happened during the period under audit or during audit fieldwork.

We can help

Contact us to discuss your organization’s vulnerabilities and the effectiveness of its existing controls over sensitive data. Additionally, if your company’s data is hacked, we can help you understand what happened, estimate and disclose the costs, and fortify your defenses going forward.