Accounting for a Cyber Incident: IAS 37 Provisions and Disclosure

When an organisation suffers a cyber incident, the finance team is asked two questions almost immediately: what do we have to recognise, and what do we have to disclose. The accounting answer is rarely a single number, because a breach generates several different kinds of obligation and each is treated differently. Our CPD course library covers financial reporting and IFRS in depth.

Start by separating the costs

A cyber incident typically produces four categories, and conflating them is the most common error:

• Response and remediation costs — forensic investigation, legal advice, system rebuild, notification. Generally expensed as incurred, since the obligating event is the work being done.
• Regulatory fines — a potential liability whose treatment depends on whether a present obligation exists at the reporting date.
• Third-party claims — from customers or counterparties whose data or money was affected.
• Asset consequences — impairment of intangibles, goodwill or capitalised development where the breach has damaged the value in use.

Provision or contingent liability?

IAS 37 sets three tests for a provision: a present obligation arising from a past event, a probable outflow of resources, and a reliable estimate. All three must hold.

For a regulatory fine, the past event is the breach itself rather than the regulator's eventual decision, so the question is whether an outflow is probable and estimable at the reporting date. Early in an investigation it often is not, in which case the matter is a contingent liability and is disclosed rather than recognised. As an investigation progresses and a penalty range becomes estimable, the position can change, and the disclosure should move with it.

For third-party claims the analysis is the same, applied claim by claim or by class. The distinction between recognition and disclosure is the one examiners test most often, and it is covered in provisions versus contingent liabilities.

Insurance recoveries are not a netting-off exercise

This is where otherwise careful teams go wrong. Under IAS 37 a reimbursement is recognised as a separate asset only when it is virtually certain to be received, and the asset may not exceed the related provision. A cyber insurance policy does not automatically meet that threshold: insurers investigate, policies carry exclusions, and a claim under negotiation is not virtually certain.

Nor can the recovery be offset against the provision in the statement of financial position. The provision and the reimbursement asset are presented separately, though the expense and the reimbursement may be presented net in profit or loss.

Impairment

A serious incident can damage the value of assets as well as creating liabilities. Customer attrition, reputational damage or a halt in trading may be an indicator of impairment, triggering a test under IAS 36 for goodwill and other affected assets. Where capitalised software has to be rebuilt, the carrying amount of the original asset needs examining. Our guide to IAS 36 sets out the mechanics.

Timing and subsequent events

An incident occurring after the reporting date but before the financial statements are authorised is a subsequent event. Whether it is adjusting or non-adjusting turns on whether it provides evidence of a condition that existed at the reporting date. A breach that occurred before year end but was only detected afterwards is usually adjusting; an attack that happened after year end is usually not, though it may still require disclosure because of its materiality.

In severe cases the assessment reaches going concern, particularly where operations have been interrupted or where the potential liabilities are large relative to the entity.

Frequently asked questions

Can we provide for the cost of improving security after a breach?

No. Future operating costs, including planned improvements, do not meet the present-obligation test. They are recognised as incurred.

Do we disclose an incident that caused no loss?

Disclosure is driven by materiality and by the existence of contingent liabilities, not by whether a loss crystallised. An incident with no financial effect may still require disclosure if a regulatory investigation is underway.

Where does the incident response itself sit?

Response costs are expensed as incurred. The operational side of that process is covered in ransomware and cyber incident response.

A worked sequence

Take an entity with a December year end that suffers a ransomware attack in October. By the reporting date it has paid forensic and legal fees, rebuilt part of its systems, received notice that the data protection authority is investigating, and lodged an insurance claim that the insurer has acknowledged but not accepted.

The forensic, legal and rebuild costs incurred to the reporting date are expensed; they are past events with no remaining obligation. The regulatory investigation is a contingent liability at this stage: the obligating event has occurred, but an outflow is not yet probable or reliably estimable, so it is disclosed with an explanation of the uncertainty rather than provided for. The insurance claim is not recognised as an asset, because an acknowledged claim under investigation is not virtually certain. If customer losses have been identified and the entity has accepted liability for a class of them, that part may meet the provision tests even while the regulatory position does not.

Twelve months later the same facts may produce a very different set of entries, which is the point: the accounting follows the state of the obligation, not the date of the incident.

Does a payment to an attacker get expensed?

Any such payment raises legal and sanctions questions well before it raises an accounting one, and those should be resolved first. Treat it as a matter for legal advice and, where relevant, sanctions screening, not as a routine cost classification.