Wall Street’s top regulator is putting a new spin on a decades-old rule designed to root out accounting fraud, leaving public companies and their attorneys wondering how far the rules extend.
R.R. Donnelley & Sons Co. agreed last month to pay $2.1 million to settle Securities and Exchange Commission charges that the marketing and printing company violated disclosure and internal accounting control rules stemming from a 2021 cybersecurity breach.
The settlement, which comes amid heightened SEC focus on cybersecurity, represents a new—and expansive—take on the accounting control provisions. The regulator included a similar accounting charge in its high-profile suit against SolarWinds over its public statements on cyber risks leading up to a massive breach.
This development has sparked a wider conversation among legal professionals. Issues of compliance and internal control have traditionally been viewed through the lens of financial fraud. With the SEC’s recent actions, there is now a clear signal that these rules can be extended to include governance and disclosure practices around cybersecurity as well.
Attorneys representing public companies are advising their clients to reevaluate their internal controls, particularly in the context of cyber risk management. The evolving regulatory landscape underscores the importance of adopting comprehensive cybersecurity measures not only to safeguard against breaches but also to comply with the SEC’s increasingly expansive interpretation of longstanding accounting rules.
For more details, you can visit the full article on Bloomberg Law’s website.