Adult senior diverse multi-ethnic Caucasian Hispanic Middle Eastern CEO executive team business people together in conference meeting room in contemporary modern office bright sunny daylight sunset dusk talking discussing planning organizing strategy well dressed suit and tie teamwork cooperation diversity multi-ethnic problems solutions unity cityscape downtown urban new beginnings breaking new ground dreamlike decisions choices the way forward diversity

Three critical areas of change faced by CAOs and Controllers

In a roundtable, CAOs and Controllers confront the implications of the new administration, cyber breaches and a redefining of their roles.


In brief
  • Political upheavals, wars, trade tensions and other surges in global turbulence require more frequent and flexible reassessments of strategic planning.
  • Cyberattacks are on the rise, bringing new dangers and increasing costs — and some lessons to share.
  • A bigger more strategic role for controllers is expected over the next five years, requiring new skills and a new mindset.

Chief Accounting Officers and Controllers are constantly faced with new pressure points and disruptive forces, but today’s waves of change feel more incessant and daunting than ever. If anything, the stakes are higher than in the past: how senior executives anticipate changes, prepare to deal with them and respond in real time when they are triggered is increasingly important to the success not only of their finance functions but of their companies.

  • Participants from across industries gathered virtually at the December Fortune 100 CAO/Controllers Leadership Network (CCLN) meeting to compare notes on three of the many consequential changes now before them: New policies and programs expected from a second Trump Administration, the latest in a spate of elections that have been redrawing the geopolitical landscape
  • The need to tighten controls and participate in responses to the escalating dangers from cyberattacks as more incidents of ransomware involve extortion
  • New opportunities for senior finance executives to expand their roles as strategic advisors and value creators — if they are ready to make the move

The roundtable was organized by the Center for Executive Leadership (CEL) and hosted by Myles Corson, EY Global and Americas Strategy and Markets Leader, Financial Accounting Advisory Services, and EY CEL CAO/Controller Program Leader.

Here are highlights from the roundtable.

1

Chapter 1

Assessing the US election and growing geopolitical risks

Regional wars and new governments across the world are creating a new landscape of risk and opportunity, particularly in the US, as the second Trump Administration takes shape.

The world is always changing, in ways both predictable and unforeseen. That mix is particularly turbulent these days. Regional wars in Europe and the Mideast carry the potential to escalate. Trade tensions splinter supply chains and also forge new alliances. Large flows of refugees - fleeing economic blight, terror, climate change — seek sanctuary. And not least, voters in numerous recent national elections — in Europe, South America, Asia and the United States — have picked new leadership, leading to sharply different policies and programs, some with regional and global impact.

In Washington

As the Trump Administration takes office again, the business community should focus on six areas of change: trade and foreign policy, tax reform, the regulatory environment, climate, technology and the workforce, said John Hallmark, US Political and Legislative Leader at the EY Office of Public Policy in Washington.

As 2025 takes shape, “you’ll see very rapid policy pivots and advancements” on priority topics for the incoming administration, including tariffs, cryptocurrency and more. “Trump thrives on unpredictability — by design,” Hallmark said. The bottom line is: “There’s a new sheriff in town.”

Key points discussed at the CCLN meeting are already in motion: withdrawing again from the Paris climate accords; replacing the Biden Administration’s executive order on artificial intelligence with another; and, of course, a sharp focus on the Southern border and a remaking of the federal workforce.

And what about tariffs, perhaps the biggest change agent in the new Administration’s trade agenda? Trump can act quickly, Hallmark said, “because he has significant authority to do so without Congress,” although he would still be subject to court challenges. He doubted that Trump would impose all of the tariffs he has discussed. Sweeping actions like instituting the 100% tariff on imported Chinese goods that Trump has described could be enormously disruptive, he added.

Around the world

For the past decade or so, uncertainty in the global order has become more pronounced, thanks in large measure to trade, immigration and climate shocks, according to Oliver Jones, the Markets, Sustainability and Geostrategy Leader in the EY-Parthenon Global Strategy and Transactions network.

The economic cooperation that led to offshoring, and intricate and lengthy supply chains, is giving way to onshoring, as companies are bringing their operations home to de-risk interdependencies and align with governmental economic security goals. Companies are also trying to mitigate the economic damage from wars and other conflicts triggered by geopolitical rivalries. Now, as numerous incumbent governments have either been kicked out by voters or forced into coalitions, the global landscape is experiencing “a large policy churn,” said Jones, a co-author of “Geostrategy by Design: How to Manage Geopolitical Risk in the New Era of Globalization.”

“In order to thrive and not just survive,” companies and their finance functions “have to identify the signal within the noise,” Jones said.

The business community was relatively late to recognize the growing tumult, he added. In the wake of the war in Ukraine in 2022, “almost everyone is making alterations in their strategic investment plans.”

One senior financial executive described “the evolution” of her function’s enterprise risk management. The assessing and updating of risks, and then the reporting of the potential impacts to the audit committee and board, have become both more “fluid” and more frequent, she said. “It’s not just an annual thing.”

Careful assessments can produce teachable moments, another executive noted.

“We had some real-life examples that didn’t reach materiality thresholds, but it took some time to come to that conclusion. As we were working through the case, we were keeping our audit committee updated. And that was an opportunity to educate them on our process and governance and what their role as the audit committee was.”

Indeed, Jones said, “we are seeing that businesses are approaching geopolitics as a broad opportunity, and not solely as a risk, and are incorporating their assessments into the strategy and planning process in addition to the risk process.”

“It’s such a big issue,” he said.

2

Chapter 2

New dangers on the frontlines of the cyber war

Cyberattacks have grown more sophisticated, and the average ransomware payout has ballooned, adding a new dimension for controllers to consider as they address materiality rules.

Cyberattacks have become more common in recent years and the price of paying off the criminals has “exploded,” said Patrick Hynes, a principal in the Advisory Cyber Threat Management practice of Ernst & Young LLP, citing EY internal shadow investigations showing that the average ransomware payment in fiscal year 2024 more than doubled to $8 million, from $3.7 million in FY2023. Worse yet, more companies are being targeted for ransomware, according to the shadow investigations.
 

A traditional ransomware attack involves a break-in and disruption of a company’s systems, with a demand for money (in bitcoin) to “unlock” the encrypted data, Hynes said. Now, more and more cyber criminals are turning to extortion, he said, by threatening to release highly sensitive or embarrassing information online. And even after a payment is made, there are no guarantees — all that a company gets is a “pinky promise” that the stolen data has been deleted.
 

The SEC’s July 2023 cybersecurity rule “is disclosure only,” said David Horn, a managing director in the Technical Accounting Advisory Group at Ernst & Young LLP. “It doesn’t require companies to change policies, procedures, processes or systems, but many have discovered they needed to make certain changes in order to comply with the disclosure requirements.”
 

A recent analysis of Form 10-Ks and proxy statements filed by Fortune 100 companies found that 81% have assigned cyber oversight to audit committees, compared with 61% in 2018; and 47% now perform simulations, tabletop exercises or response readiness tests, up from just 3% in 2018.1
 

As for the developing trends in disclosures, three stand out. They have to be tailored to the company’s specific facts and circumstances (one size does not fit all). Materiality determinations continue to be a challenge for many companies (as they need to consider both quantitative and qualitative factors). And several companies have reported incidents under Item 1.05 of Form 8-K, rather than under Item 8.01, after concluding that they were not material or materiality conclusions had not yet been determined.
 

Several finance executives said that they are grappling with oversight issues regarding the granting of access to company data, particularly when it comes to privileged access. Regular reviews on tighter schedules are needed to continue or revoke such access.
 

Another executive described the two attacks that her company experienced. One required disclosure; the other did not. A number of remediation efforts have been made, including introducing or strengthening preventive and detective controls and enhancing the company’s risk culture. Now, every employee is deemed to own the risk and has a role to play in controlling it.
 

The more recent breach “set a regular cadence of meetings once it was discovered — once a day or more — and then less as the incident matured,” the executive said. “We’re probably on a multi-year journey. We have a massive modernization going on to replace a ton of legacy technical systems with centralized tools and architecture.”

3

Chapter 3

Tomorrow’s Controller: getting from here to there

Broader yet somewhat undefined roles are in the wings for Controllers. Their groups are getting more involved in balancing the stewardship of financial data with the strategic objectives of the CFO.

For Controllers, a gap remains between the skill sets and mindsets required today. That includes what is needed to make the leap from value protector to trusted advisor and value creator, such as capturing the potential of artificial intelligence while managing its unknowns.

To close that gap, today’s Controllers will have to reshape and rebuild their teams while remaking themselves, said Myles Corson, the meeting’s facilitator and sponsor of the EY 2024 DNA of the Financial Controller Survey, “How can the Controller transform to shape the future with confidence?” They and their teams will have to embrace uncertainty and disruption and develop a broad range of business, personal and technological skills.

Here are a few highlights from the survey:

“I always wanted to focus on a forward-looking, business-driven agenda,” said one finance leader, “but historically I got dragged back in to do blocking and tackling.” Things are now changing, though, she added. “The way technology is emerging, my entire team can shift focus to drive growth and value and be known for that. Because now we are technically proficient.” 

The Better Finance podcast

The Better Finance podcast explores the changing dynamics of the business world and what it means for finance leaders of today and tomorrow.


Summary

The controllership has always been a work in progress, taking account of changes in the business climate, the economy and world events, and responding with new priorities and processes.

But the pace of these shifts seems quicker now, the volume bigger and the consequences more far-reaching. The challenge is to respond to the torrent of change involving data, talent and regulations while managing traditional day-to-day responsibilities.

But as their predecessors did, today’s controllers are getting up to speed. And, as before, they are finding opportunities in the turbulence, like AI, which is helping to spur their own big role change.

About this article

Related articles

How CFOs view tax, trade and regulations amid GOP sweep

EY CFO roundtable on the 2024 election’s impact on tax and economic policy, trade, M&A and antitrust regulation for 2025 and beyond. Read more.

21 Nov 2024 Juan Uro

CFOs beyond the balance sheet: steering strategy and innovation

Learn how CFOs are transforming finance with strategic vision, technology adoption and innovation to drive business success and enhance performance.

25 Oct 2024 David Herbert + 1

How can CFOs be confident in value creation without confidence in reporting?

Investors seek a strong value story from leaders and confidence in delivery, but new EY research finds both investors and CFOs have their doubts.

23 Oct 2024 Myles Corson + 1
    You are visiting EY us (en)
    us en