Financial reporting enters a new age

The Securities and Exchange Commission is leaning on an expansive interpretation of a provision in one of the statutes it enforces as the agency looks to more aggressively assert jurisdiction over cybersecurity-related matters, legal analysts said.

The provision at issue, Section 13(b)(2)(B) of the Securities Exchange Act, requires public companies to maintain internal accounting controls. The SEC in recent years has expanded its interpretation and use of the provision in ways that have raised eyebrows.

In the latest example, the SEC last week announced that R.R. Donnelley & Sons Co., a global provider of business communication and marketing services, agreed to pay about $2.1 million to settle commission charges that it violated Section 13(b)(2)(B) by failing to “devise and maintain a system of cybersecurity-related internal accounting controls.” The charges stemmed from the company’s response to a 2021 ransomware attack.

“As the dissenting SEC commissioners noted, it’s arguably an aggressive expansion of the SEC’s use of this provision,” Charu Chandrasekhar, a partner in the securities enforcement practice of law firm Debevoise & Plimpton, said in an interview. “I don’t think the application to cybersecurity systems is consistent with the purpose of the provision and the context in which the provision has historically been applied by the SEC.”

The enforcement action represents the SEC’s latest assertion of jurisdiction under Section 13(b)(2)(B) to punish a company for alleged failures that don’t impact financial reporting or accounting controls, according to a memo published by law firm Sullivan & Cromwell on Friday.

And the case also marks the second time in which the agency has used the provision to address a cybersecurity breach, the memo said. The first such action, against Austin, Texas-based software provider SolarWinds, is currently being litigated in the U.S. District Court for the Southern District of New York.

“Given the pending challenge in the SolarWinds case to the SEC’s expansive interpretation of its jurisdiction under Section 13(b)(2)(B), it remains to be seen whether the SEC’s use of the provision to penalize companies victimized by cybercrime will withstand judicial scrutiny,” the memo said.

The SEC over the last few years has been sharpening its cybersecurity enforcement and regulatory focus.

In October, the commission sued SolarWinds and its chief information security officer, Timothy Brown, for allegedly defrauding investors by mischaracterizing cybersecurity practices that were in place at the company leading up to a major breach discovered in December 2020. SolarWinds was also accused of violating reporting and internal controls provisions of the Exchange Act. The company has denied the charges.

Meanwhile, last December, the agency began enforcing new rules that require public companies to disclose “material” cybersecurity incidents within four days of determining that it is a material breach. The rules build on prior agency guidance. At the time, Erik Gerding, director of the SEC’s Division of Corporation Finance, said the agency wasn’t seeking to “prescribe particular cybersecurity defenses, practices, technologies, risk management, governance, or strategy.”

The SEC’s latest action is in direct conflict with Gerding’s statement, according to a Thursday blog post published by Debevoise & Plimpton.

The SEC’s interpretation of Section 13(b)(2)(B) in the case puts the agency in the position of “basically judging or second-guessing the strength and adequacy of a company’s cybersecurity controls,” Mark Schonfeld, a litigation partner at law firm Gibson, Dunn & Crutcher, said in an interview.

“I think there’s certainly the question as to whether this is what Congress intended by internal accounting controls,” he said.

Another reason the case is problematic is that it creates regulatory uncertainty, according to Schonfeld.

“This enforcement action doesn’t really provide any guidance as to what constitutes an adequate set of cybersecurity controls,” he said.

Under section 13(b)(2)(B), public companies must devise and maintain a system of internal accounting controls sufficient to provide “reasonable assurances” that access to company assets is permitted “only in accordance with management’s general or specific authorization.”

Based on the SEC’s reading of the statute, the agency can punish any company that is the victim of a cybercrime, according to Nicole Friedlander, a partner at Sullivan & Cromwell’s Criminal Defense and Investigations Group and co-head of its cybersecurity practice. 

“The SEC is saying that assets are anything the company owns or possesses, including a computer system,” Friedlander said in an interview. “And so, if anybody touches those things without management authorizing them to, then the SEC can say the company has violated federal securities laws.”

R.R. Donnelley failed to execute a timely response to a ransomware attack that occurred between Nov. 29 and Dec. 23 of 2021, according to a commission order resolving the case.

The threat actor was able to use “deceptive hacking techniques” to install encryption software on certain R.R. Donnelley computers and exfiltrated 70 gigabytes of data, including data belonging to 29 of the company’s 22,000 clients, some of which contained personal identification and financial information, the order said.

However, the company’s investigation uncovered no evidence that the threat actor accessed financial systems and corporate financial and accounting data.

According to the commission’s order, R.R. Donnelley failed to design effective disclosure-related controls and procedures around cybersecurity incidents to ensure that relevant information was communicated to management to allow timely decisions regarding potentially required disclosure.

The company also failed to “reasonably design and maintain internal controls that complied with Exchange Act Section 13(b)(2)(B),” the SEC said. Specifically, the company’s cybersecurity alert review and incident response policies and procedures “failed to adequately establish a prioritization scheme and to provide clear guidance to internal and external personnel on procedures for responding to incidents,” the agency said.

“The Commission instituted this enforcement action because RRD’s controls for elevating cybersecurity incidents to its management and protecting company assets from cyberattacks were insufficient,” Jorge Tenreiro, acting chief of the SEC’s Crypto Assets and Cyber Unit, said in a press release. “RRD did, however, cooperate with our investigation in a meaningful way, and that is reflected in the terms of this settlement.”

Without admitting to or denying the SEC’s findings, R.R. Donnelley agreed to pay the $2.1 million civil penalty and to cease and desist from violating Section 13(b)(2)(B) of the Exchange Act as well as Exchange Act Rule 13a-15a, which requires public companies to maintain disclosure controls and procedures.

The SEC’s two Republican commissioners, Hester Peirce and Mark Uyeda, issued a joint dissenting statement objecting to the agency’s action.

“The Commission’s order faulting RRD’s internal accounting controls breaks new ground with its expansive interpretation of what constitutes an asset under Section 13(b)(2)(B)(iii),” the commissioners said.

A broad interpretation of the provision to cover computer systems “gives the Commission a hook to regulate public companies’ cybersecurity practices,” they said.

A spokesperson for the SEC declined to comment. R.R. Donnelley didn’t immediately respond to a request for comment.

The Financial Accounting Standards Board by a 7-0 vote Wednesday agreed to effectively finalize new rules that will require public companies to break out “relevant” expense line items on the income statement by disclosing in the notes to the financial statements certain expenses such as purchases of inventory, employee compensation, depreciation and intangible asset amortization. The amendments to standards that underpin GAAP will be issued by year-end and be effective for fiscal years beginning after Dec. 15, 2026, and interim periods within fiscal years beginning after Dec. 15, 2027, according to a FASB spokesperson. 

The expense disaggregation project has been in the works for some time, reemerging most recently as a prioritized project in 2021; along the way, it elicited some pushback from accountants and report preparers concerned about the cost of compliance. Subsequently, the board has made some changes to ease the burden of meeting the new requirements, such as allowing companies to use accounting estimates to determine the amounts disclosed.

FASB member Christine Botosan called out the notable nature of the new requirements during the meeting, adding that she hoped the board’s move to allow estimated values would help ease the transition. “This is a pretty big change for entities,” Botosan said of the new rules, noting that it’s understandable that they’ve caused a “bit of nervousness out there” among preparers. “Thinking about the last time there was any new requirement that would result in pervasive disaggregation across the income statement for companies, I think we have to go back over 100 years to when [they] first started requiring SG&A and cost of goods sold to be disaggregated on the income statement.”

Updates to GAAP requiring companies to break out more detailed information in financial statements has been a key theme for the U.S. accounting standards setter in recent years. 

For example, last year the board issued a final accounting standards update that increased requirements for how public companies report major segment expenses, meaning costs must be broken out for each of its business groups or divisions. 

Formally known as the Income Statement — Reporting Comprehensive Income — Expense Disaggregation Disclosures accounting standards update (Subtopic 220-40), the detailed breakouts of expense information that will soon be required could be a relatively big lift for public companies. 

The change now in the works is a “kind of a sleeper” accounting topic that many companies may not yet have focused on, according to Nicole Wright, an associate professor of accounting at James Madison University in Harrisonburg, Virginia. 

Even as companies typically have all the data that they will now need to report in their financial statements, it will likely require the finance department to pull information from a range of departments, she said. For example, human resources would be involved with the employee compensation piece, she said. 

“I know CFOs and how they think and they’ll say, ‘We’ve got this,’” Wright said in an interview. “But it’s going to take quite a bit of company resources across the board and it’s going to be more than just accounting…Once you try to amass all the data together, it’s a lot and there’s not really good guidance on how to do it.” 

Then too, companies will have to thread the needle determining how to disclose enough information to meet the new standards without unnecessarily giving up information that will hand their competitors proprietary information about their business strategy, she said.  

During the meeting, FASB Vice Chair James Kroeker said he felt the board’s accounting update has struck the right balance in providing guidance that will benefit stakeholders and not be too costly to implement. 

“What we’re really looking to do is disaggregate in a way that entities naturally keep their books,” said Kroeker, whose term on the board concludes June 30. 

Sponsored content

By Vertex

In today's business environment, managing sales and use tax brings ever-increasing risks for companies—and ever-increasing responsibilities for their tax teams. These teams have to help ensure that their companies’ returns are accurate, transparent and adhere to tax rule changes in 12,000+ local jurisdictions. And to help facilitate this work, technology and automation play a more prominent role than ever.

SAPInsider’s Benchmark 2023 report takes a deep dive into this issue. Surveying 128 members of its tax community, researchers learned that digital transformation for core business functions has accelerated dramatically in recent years. In fact, for the second consecutive year, digital transformation within finance and tax functions has been identified as a significant driver (32%) that is shaping global indirect tax management strategies.

Evolving reporting trends

Multiple concurrent trends are driving the need for transformation. For example, the way businesses interact with one another is continuously evolving, with the number of suppliers and parties involved in a single transaction continuing to grow, leading to other operational changes. State and local tax auditors now leverage the latest AI technology. And the timing of sales and use tax reporting is trending faster, as evidenced by global real-time reporting and e-invoicing mandates. All these factors have resulted in:

1. Increased focus on transparency: Companies are under increasing pressure to provide transparent financial information to tax authorities. This has led to the adoption of more stringent internal controls.

2. Need to be agile: Companies need to have a business model in place that can accommodate new tax reporting requirements quickly and easily.

3. Greater use of technology in tax reporting: Companies are leveraging emerging technologies, such as artificial intelligence (AI) and machine learning, to automate tax processes and improve the accuracy and efficiency of those processes.

Compliance risk trends

Organizations are looking for ways to leverage scalable sales and use tax compliance solutions to reduce manual errors, provide an audit trail and streamline the audit process. At the same time, they want to maximize the value of their staff and give them the time to focus on strategic work that supports business growth. Topics they need be focused on include:

1. Increased regulatory scrutiny: Regulatory bodies are becoming more vigilant in monitoring compliance. Non-compliance can result in significant financial penalties and reputational damage.

2. Growing complexity of compliance requirements: As businesses expand across the U.S., they must navigate a complex web of state and local regulations. This has led to an increased demand for compliance professionals and the implementation of comprehensive compliance programs.

3. Use of technology in compliance management: Companies are increasingly using technology to manage compliance risk, including AI-powered tools for monitoring and analyzing regulatory changes, automating compliance processes and identifying potential areas of non-compliance.

“We know in the tax world, that there's no one tax return that looks the same—every county, city, or state tax return is different, and audits regularly uncover data posted in the wrong form field, which potentially opens you up for audit penalties,” says Larry Mellon, Tax Director – Chief Tax Office at Vertex. “Using automated tax technology for both calculation and compliance can improve the accuracy of returns and reduce audit risk.”

The challenges

1. Keeping up with regulatory changes: Staying informed about the latest regulatory developments and adapting their tax calculation accordingly is a key priority for businesses—for example, in 2023 the total number of U.S. rate changes, combined with jurisdictions imposing new sales taxes, totaled 676. Without an automated tax engine with continually updated content, this constant evolution requires a significant effort in tax research and IT support.

2. Balancing transparency and data privacy: While companies are expected to provide transparent information about transactions, they must also protect sensitive data and comply with data privacy regulations. This can be a challenging balancing act.

The opportunities

When companies leverage technology for compliance management, they can gain a competitive advantage by reducing the cost and complexity of compliance and improving the accuracy of returns.

And when companies have this technology, they also have the ability to stay abreast of the latest trends, which helps ensure accurate returns and robust compliance management. Finally, the right technology also helps boost the value of the tax team since they can reduce time-consuming, manual compliance tasks and focus on more strategic projects, leading to even greater organizational efficiencies.

CFOs of large multinational companies in particular are facing a perfect storm when it comes to the new rules around environmental, social and governance reporting. Such reporting is complex, time-intensive and constantly evolving. It also requires internal teams, functions, regions and businesses to collaborate in new ways to collect, report, analyze and assure the accuracy of large swaths of data, much of which resides across disparate technology systems and spreadsheets.

Globally, 600 ESG standards are in play, and this number is growing. Alongside regulators and standard setters, we also see investors, analysts, customers, and employees are increasingly demanding reliable ESG data. CFOs have a lot riding on getting their ESG reporting right, and it’s clear that, even though the ESG reporting momentum may have slowed, it is a force here to stay.

Fortunately, although ESG reporting may be a relatively new challenge, there is nothing new about C-suite leaders facing transformative, “perfect storm” reporting requirements. To illustrate this point, we need not look any further than when Sarbanes-Oxley (SOX) was implemented in the early 2000s. Here are three key SOX lessons that today’s CFOs can use to weather the ESG reporting storm:

1) Mentality is everything: Reporting must be more than a check-the-box exercise. ESG reporting standards cover a far broader remit than SOX, but the goals are essentially the same. Like SOX, most ESG reporting standards and regulations aim to increase transparency, drive the development of more reliable ways to ensure data accuracy, and prevent companies from (knowingly or not) sharing misinformation with key stakeholders. SOX and ESG reporting both place a heavy burden on corporate finance teams. However, in the early days of SOX implementation, many CFOs quickly understood that the challenge of compliance could also lead to significant opportunities. With that mindset, progressive C-suite leaders saw the opportunity to do more than simply check the box and “comply” with SOX. They used SOX requirements as an impetus to put in place new safeguards, processes and governance practices that supported the long-term health of their organizations. The same mentality is essential for optimizing the potential positive business impact of ESG reporting.

2) Your initial ESG data may not paint a perfect picture, and that’s OK. You’ve got to start somewhere Many SOX compliance pioneers will tell you that once they started collecting and processing more expansive, more accurate financial data, they found significant (and sometimes even alarming) weaknesses and gaps. The SOX reporting process seemed daunting, in part because it uncovered so many processes, policies and practices to improve. It is vital that finance leaders do not get mired down — or overwhelmed — by the challenges or risks that can be uncovered through the discovery phase of addressing new ESG reporting requirements. Value can be unlocked by viewing the entire ESG reporting process as an opportunity to reduce risk and uncover new insights that can inform your business strategy.

3) Stay ahead of exponential change by leading with a digital-first mindset. Considering the high stakes of ESG reporting, it is surprising that KPMG’s 2024 ESG Organization Survey found that 47% of companies still manage their ESG data with spreadsheets. The promising news is that the same report found that in the next three years, 40% of organizations plan to invest in ESG-specific software, and 37% plan to invest in data collection and management tools. I would argue that those investments cannot be made soon enough. Pioneers of SOX implementation had somewhat limited technology support at their disposal. However, those who acted fast to leverage available Corporate Performance Management (CPM) technology to enhance financial data collection and reporting and lower the resource burden of compliance were at a distinct advantage. Similarly, today’s finance leaders who accelerate investment in advanced CPM platforms will be in the best position to drive efficient and fast progress in ESG reporting. Integrating ESG data through a CPM framework enables organizations to automate reporting, cut through data complexity, mitigate risk, and comply with the ever-changing ESG regulatory environment, while identifying new opportunities to advance their sustainability strategy.

ESG reporting is not the first “perfect storm” CFOs have faced, and it won’t be the last. But “perfect storms” aren’t just challenges — if weathered correctly, they can be opportunities too. By viewing ESG reporting as greater than a “check the box” exercise, and leading with a digital-first mindset, CFOs can harness the power of ESG reporting to build stakeholder confidence, positively impact their corporate valuation, and amplify the value they bring to their organizations.

Nearly half of small- and medium-sized enterprises worldwide (48%) believe that their peers during the past decade have become more willing to distort financial statements to hide fraud and other corruption, according to the Association of Chartered Accountants.

Roughly three out of five SMEs believe their counterparts are likely to face a risk of bribery and other corruption, the ACCA found in its global survey, while the same proportion believe challenging such wrongdoing will harm their trade and other opportunities. 

“Corruption is a poison — it distorts markets, stunts economic growth and deters investment,” Jillian Couse, head of ACCA North America, said in a statement.

The U.S. has made little progress combating corruption since 2021, according to Transparency International, which last year ranked 180 countries and territories by their perceived levels of public sector corruption.

The U.S. for the second consecutive year scored 69 out of a scale of 100 — with 100 being “clean” of malfeasance — based on factors such as bribery, diversion of public funds, prosecution of corrupt officials and the use of public office for private gain, Transparency International said when releasing its Corruption Perceptions Index in January.

“The stagnant U.S. score reflects a continuing struggle for progress on anti-corruption measures that can protect our democratic processes and institutions,” Transparency International said, noting that U.S. citizens believe that their wealthy counterparts “buy” elections more easily than in any other developed country.

The ACCA findings suggest that corruption is apparently more veiled than five years ago. Compared with a 2019 survey, the owners of SMEs and their financial advisors worldwide currently say they have greater difficulty identifying wrongdoing in contract-related consultancy or facilitation fees and in invitations to corporate hospitality.

The offer of gifts or payments not related to services and the suggestion of special treatment by regulatory officials are also more difficult to bring to light compared with five years ago, according to ACCA findings.

At the same time, among markets subject to bribery and corruption, the owners of SMEs and their financial advisors believe that they are more likely than in 2019 to see malfeasance in dealing with public sector officials and when negotiating contracts for cross-border trade in goods and services, according to ACCA survey results.

Wrongdoing is also more prevalent than in 2019 in negotiations over private sector contracts and as a result of supply chain pressures, according to respondents to the ACCA survey.

“Many small businesses don't have the bargaining power to refuse when small bribes are demanded of them,” the ACCA said. “Entrepreneurs have to choose between paying the bribe or losing the business — and often that is no choice at all for someone trying to support a family.”

London-based ACCA has 247,000 members in 181 countries.

The Public Company Accounting Oversight Board on Monday adopted “foundational” audit standards that include trimming the deadline for filing final documentation after completion of an audit to 14 days from 45 days.

The standards, replacing interim rules set in 2003, “will help ensure that PCAOB standards on the most fundamental auditor responsibilities are up to date and optimized for investor protection,” PCAOB Chair Erica Williams said in a statement.

The PCAOB rule unifies into a single standard several rules that are focused on ensuring professional skepticism, independence, competence and judgment. The standards, subject to approval by the Securities and Exchange Commission, will take effect for fiscal years beginning on or after Dec. 15, 2024.

Williams has championed several new audit standards and sharpened PCAOB enforcement since taking the board’s leadership role in January 2022.

Efforts by Williams align with the aims of Gary Gensler who, after becoming SEC chair in 2021, shook up the five-member board and called on it to strengthen oversight of the accounting firms that audit publicly listed companies.

The new standards “modernize, clarify and streamline the general principles and responsibilities of auditors and provide a more logical presentation,” Williams said. The set of changes “solidifies the foundation of every audit, leading to investor protection and informative, accurate and independent audit reports.”

The standards — geared to streamlining with new technology — clarify the responsibility of the auditor to determine whether financial statements are presented fairly, as well as the obligations of the engagement partner.

“The foundational standards include reasonable assurance, due professional care, professional skepticism, independence, competence and professional judgment,” the PCAOB said. “These principles and related responsibilities provide a foundation for the proper performance of the audit.”

The rules underscore that “an auditor’s professional skepticism extends beyond the evaluation of the sufficiency and appropriateness of audit evidence,” the board said. “As noted by this change, an auditor exercises professional skepticism throughout the audit process.”

Firms that annually complete audits for more than 100 publicly-traded companies will need to accelerate the document completion date to 14 days for financial statements beginning on or after Dec. 15, 2024. Smaller audit firms will have an additional year to meet the standard.

The accelerated filing date will enable the PCAOB to begin the inspection process sooner and “reduce the window of opportunity for improper alteration of audit documentation,” the board said.

While tightening requirements, the PCAOB is also giving the auditor more clout, Kara Stein, a board member, told her colleagues before the unanimous approval of the rule.

“The standard before us today for the first time reorients and empowers the independent auditor with the freedom and the requirement to decide issues in an unbiased and objective manner,” Stein said. “This is especially important when auditor conclusions may be contrary to the interests of management,” she said.

The board also adopted a rule requiring audit firms to upgrade their quality control systems by identifying their risks and creating a system with policies and procedures to safeguard against the risks.

The current standards were developed by the American Institute of Certified Public Accountants before the PCAOB was created in 2002.

“When quality control systems operate effectively, quality audits follow and investors are better protected,” Williams said in a statement.

The rule drew a dissent from Christina Ho, a board member.

“I agree that we need a robust and modernized quality control standard, which was why I supported the proposal over 18 months ago,” she said before the board approved the rule by a 4-1 vote. “But we must do it right and not rush to replace an outdated standard with one harmful to audit quality by increasing burdens without credible benefits that will likely reduce competition.”

Companies hiring for internal audit should prepare for disruptive innovations by employing more technology-savvy workers who are ready to take on challenges in business strategy, the Institute of Internal Auditors said Monday.

Internal audit leaders “confront a critical task of ensuring a steady stream of qualified new workers in the face of labor shortages, existing competition and new and potentially disruptive business models, ”the IIA said in a study sponsored by Deloitte.

“For the profession to remain healthy, the next generation of internal auditors must be tech-savvy, innovative and more resilient than any of its predecessors,” according to the IIA. “Finding, training, and keeping these new überauditors will not be easy.”

For years the demand for accountants for audit and other roles has exceeded supply, and there is no guarantee that the imbalance will end anytime soon.

The number of students who graduated at the end of the 2021-2022 academic year with a degree in accounting plunged 7.4% compared with the prior period, accelerating a six-year trend of declining entrants into the profession, according to the American Institute of Certified Public Accountants.

The number of graduates who received a bachelor’s degree fell 7.8% compared with the 2020-2021 period, while those earning a master’s degree declined 6.4%, the AICPA found. At the conclusion of the 2020-2021 academic year, the number of bachelor’s and master’s degrees awarded fell 2.8% and 4.7%, respectively, compared with the prior period.

Internal audit leaders are trying to tap limited pools of expertise in both accounting and technology, according to IIA.

“Internal audit is competing with some of the biggest names across the tech sector for graduates with backgrounds in AI, cybersecurity and data analytics, IIA CEO Anthony Pugliese said in a statement.

In addition, “we are seeing some of the softer skills related to leadership and communication being prioritized by hiring managers," he said.

Internal audit leaders during the past five years most preferred hiring college graduates who have studied accounting, with 80% citing that undergraduate field, the IIA said.

Internal audit and general business gained 53% and 44% preference levels, respectively, the institute said, reporting on survey results. Computer science and technology were favored by just 43%.

“The evolving technology and risk landscape has expedited the need for internal audit to expand its talent and recruitment pool,” Pugliese said.

In their hiring, internal audit leaders need to prepare for disruption from new technology such as artificial intelligence and robotic process automation, IIA said. The innovations will free some staff for higher-value work while nudging some employees out of the profession.

“New technologies invariably will morph the entire internal audit workforce,” the institute said. “Internal audit will progress beyond providing simple assurance to encompass a broader advisory and business strategy focus.”

Roughly three months after backing away from a bigger revamp of existing software accounting guidance, the Financial Accounting Standards Board in a unanimous (7-0) vote agreed to formally move forward with a narrower proposal to improve software cost guidance by providing more flexible and “targeted improvements” to existing standards largely contained in Intangibles—Goodwill and Other—Internal-Use, known as Subtopic 350-40.

If finalized, the new proposal would require most cash outflows for software capitalized under 350-40 to be presented separately as investing cash flows in the statement of cash flows. But the board decided not to require any incremental presentation or disclosure for software costs accounted for under Subtopic 985-20, Software—Costs of Software to be Sold, Leased, or Marketed.  

Several members expressed reservations about what one called the more “modest” scale of the changes but noted that investors appeared to prefer keeping many elements of the status quo. “I do struggle with the idea of not recognizing what is, particularly for software companies, perhaps their most valuable asset,” FASB Vice Chair James Kroeker said in the meeting, noting that GAAP is often criticized for guidance that leads to financial statements that are devoid of some of a company’s most valuable assets. “It’s odd to me that…investors that we talk to don’t want to see greater alignment between revenue generated by an investment and the cost of that investment.”  

The FASB voted to move ahead with a draft of the new rules and to put them out for a 90-day public comment period. If finalized, the updates would mark the first time since 2018 that the U.S. standard setter has made any changes to its software accounting guidance, according to a FASB spokesperson. But the software rules have not been subject to a major update for much longer than that, experts say. 

“The Board backed off a major change to the software accounting model because investors and other stakeholders provided feedback that they believe an overhaul is unnecessary,” a FASB spokesperson said in an email. 

During the meeting Chair Richard Jones was one of the other members to express some disappointment about proceeding with the scaled back project, noting that the board got pushback on whether companies should provide additional information on the balance sheet nearly three decades ago. 

“We’ve had 27 years to convince investors they actually should want assets on the balance sheet and that that would actually provide them decision-useful information and it doesn’t look like we’ve succeeded,” Jones said. 

Still, even in its narrower form the proposed new rules will affect many companies who develop software for themselves or others. 

“Companies will need to evaluate their existing policies and procedures to determine what, if any, changes will be needed since the software capitalization guidance will no longer require an evaluation of software development stages. This could include developing a new process to evaluate if software projects have any unresolved high-risk development issues (novel, unique, unproven functions and features or technological innovations),” Chris Chiriatti, managing director in Deloitte’s National Office - Accounting and Reporting Services Group, said in an email.