Defend against threats

1. Categorise incidents

Clearly define incidents to determine an appropriate response during an event or crisis, depending on whether it's low, medium, or high impact.

2. Establish a communication strategy

Create a robust communication strategy for internal stakeholders and external audiences to ensure key details are shared with the right people at the right time.

3. Get pre-approved external advisers

Keep pre-approved external advisers on standby to make quick and informed decisions during a crisis.

4. Invest in scenario planning

Conduct regular scenario planning and simulations to help people across the business understand how to handle cyber events so they don't escalate into crises.

1. Security 

AI has the potential to leak confidential data, which could lead to market-price changes or the exposure of commercially sensitive information.

2. Privacy

AI systems that handle personal data must comply with regulations like GDPR, which require explicit consent from the data subjects.

3. Intellectual property

AI systems might store proprietary information which vendors could use to create standardised products and offer them to competitors.

4. Regulation

Businesses must comply with various regulatory requirements, such as the EU AI Act, or risk penalties. 

5. Cost

AI implemented without a clear commercial strategy could result in wasted outlay.

AI not governed correctly can cause both reputational and financial damage to a business. CFOs must work closely with technology and governance colleagues to make sure any new use of the technology is compliant and secure – especially in highly regulated industries, such as pharmaceuticals or banking. 

Updates to governance frameworks should give CFOs visibility over all AI solutions used or developed within the company so they align with strategic and reputational goals. Likewise, governance should ensure the training, validation, and testing of datasets so they’re free of errors and relevant to the intended purpose. 

1. Tighten access

Establish clear policies and advanced controls to limit who can do what within financial systems. This includes ensuring proper segregation of duties to prevent conflicts of interest, such as making sure that the same person can't both raise and approve a purchase order.

2. Implement advanced finance controls 

Monitor changes in financial data, track who has made changes and guarantee a clear journey of evidence for all transactions. Techniques like anomaly detection and Benford analysis can identify unusual patterns that might indicate fraud or errors.

3. Verify that data is accurate, reliable, and complete 

Put robust processes in place to verify the accuracy of financial reports and guarantee that all data goes through proper controls and governance. Automating financial processes like reconciliations and approvals reduces the risk of human error and increases efficiency.

4. Scan for process debt 

Process debt describes inefficiencies and outdated processes that can undermine a control environment. To avoid this, CFOs must regularly audit financial IT systems to keep pace with current needs.