The coronavirus pandemic accelerated the journey towards the fourth industrial revolution and new threats emerged in the process. Business leaders must therefore think about cybersecurity in a new way, writes Dani Michaux. Over the past year, we have seen significant geopolitical changes driven by the impact of COVID-19, forcing organisations to strengthen their resilience. The realisation has also dawned that the world as we once knew it has changed. Amid all of this, I see a new and very different operating model emerging for business. That new operating model is based on various restructuring activities, accelerating digitalisation initiatives, alternative partnership models, and a sharper focus on core activities. As organisations pivot, it is essential to reflect and consider the risks that may emerge as part of these organisational changes. What do the changes mean for the organisation, its supply chain partners and players, connected industry, government, and broader society? One prominent challenge is the need to safeguard the new digital ecosystem, which underpins this transformation, from cyberattack and information infrastructure breakdown. The world kept turning in 2020 During the early part of 2020, we saw an increased number of CEO identity frauds, payment frauds, ransomware attacks, and crude attacks on insecure cloud services. As the year grew old, we saw more complex attacks targeting supply chains, major cloud environments, remote working applications, security product providers, and even critical infrastructure services. This time last year, we claimed that cybersecurity is key to achieving the fourth industrial revolution. COVID-19 has accelerated that revolution and the use of digital and cloud technologies in both the public and private sectors. Those technologies are now fundamental to our society. Sadly, the pandemic has also shown that organised crime is opportunistic and ruthless in exploiting events to gain financial advantage. Thus, we witnessed a steady stream of high-profile cyberattacks on private enterprise, government, and social media platforms during the year. It is nevertheless encouraging to observe the pace at which organisations rolled out robust digital infrastructure during difficult times and the collaboration between business, technology, and security teams to safeguard these rapidly deployed services. It illustrates how these often-siloed parties can work together effectively to introduce secure innovation at market speed. COVID-19 has propelled Chief Information Security Officers (CISO) into a new dimension. Suddenly, they must manage thousands of home-working sites, personal devices, and a rapid shift to the cloud. The CISO has moved from securing corporate IT boundaries to a broader view of enterprise security. The timescale for many cloud migration projects has collapsed from years to months in the race to meet fast-changing business needs. Hyperscale cloud providers are increasingly dominant and intently focused on security. To succeed in the future, security teams must: Reskill employees to reflect the split of responsibilities between enterprise and cloud-service providers; Adapt to agile development methods and new digital channels; and Enact these innovations while cloud security skills attract a premium salary as the global job market competes for much-needed talent in 2021. The rise of supply chain attacks Political and business leaders have become alert to the global interdependence of many critical functions and the nature of risk that cross-border supply chains have. The pandemic made these murky operational and systemic risks real and gave people pause for thought. Supply chain attacks are not new. However, in the new highly digitalised and interconnected world, they are becoming more prominent. Frequent attacks raise concerns about organisations’ ability to remain resilient. We have seen several prominent cases over the past few years. Examples include the Target cybersecurity attack, where a network intrusion may have exposed approximately 40 million debit and credit card accounts; a global cyber-espionage campaign known as ‘Operation Cloud Hopper’, which formed part of a shift to target managed service providers; a worldwide campaign against telecommunications providers called ‘Operation Soft Cell’; and the latest cyberattack on Solarwinds, a global provider of network management solutions. A common theme in these attacks is the presence of third-party providers of hardware, services, or software. In complex infrastructure, set-ups that include rapid pivoting to new environments and dependencies on third-party suppliers are both common and intimate. Third-party providers are targeted with the ultimate aim of reaching a bigger mark. The methods and duration of the compromise vary, but there are some common patterns. These include exploiting speed and rapid deployment challenges and looking for exposures in security controls as firms shift rapidly to new technology. Of course, smaller organisations within the supply chain may also attract greater attention, based on the assumption of reduced sophistication and scale of security operations. Lessons can be learned from sectors like oil and gas, where human safety is at the top of executive agendas and assumptions are challenged continuously. It starts from the proposition that you cannot assume that anything will work in the event of an explosion. For example, a company might have a procedure to pre-book hospital beds for casualties, but what happens if the hospital doesn’t have a burns unit? What happens if the ambulances can’t get to the site of the explosion? These things have to be planned for in advance, requiring creative paranoia and a certain mindset. That’s the type of culture of resilience that should be in place in all organisations. It is a question of overall operational resilience, not just the resilience of IT systems and security. In this complex world, organisations should address the following practical questions: 1. Understand the risks and dependencies in the supply chain. Here are some questions to ask: What are the threats and exposures associated with third-party access to your environments, services, and products? Do you have contractual agreements in place with clear service level agreements concerning expectations around cybersecurity? Are you in a position to monitor those, including supplier activities? Do you monitor exposures and cyber risks associated with the supply chain and discuss these issues as part of an ongoing agenda within the organisation’s management and risk committees? 2. Understand the full extent of the supply chain within the existing environment and any changes arising from new digitalisation initiatives. Here are some questions to ask: How has the profile changed based on the rapid digitisation, restructuring and transformation initiatives in place? Do you have a view further down the supply chain (to fourth- and fifth-party providers, for example)? 3. Make arrangements to respond to supply chain cyberattacks collectively. Here are some questions to ask: Are there any mechanisms in place? Have you exercised these? Has the organisation included lessons learned from previous attacks? How has the organisation adapted based on the lessons learned from incidents? Are any other improvements required? Stepping into the future As we look to the future of highly digitalised and scalable environments, resilience will be paramount and non-negotiable. Organisational resilience will rely heavily on the stability of the end-to-end supply chain. However, it will also require a new approach to data security. The hunt will be on for cybersecurity orchestration opportunities, robotic process automation around manual security processes, more integration with key IT workflows, and new managed service and delivery models. Third-party security may also need new models for more dynamic risk management and scoring, including better tracking of supply chain stresses. Of course, assessments such as SOC 2 and ISAE 3402 will play a growing role as firms seek to provide evidence once to satisfy myriad client questions about cybersecurity. However, we can also expect to see the rise of ‘utility models’ where intermediary organisations aggregate client assurance requirements to undertake a one-size-almost-fits-all assessment of suppliers’ cybersecurity. This is already happening in the UK with the support of financial regulators. Over the last few years, firms have also sprung up offering risk scoring services based on a scan of a firm’s internet-facing services. They also monitor for data disclosures in the shady corners of the internet and alert customers to a potential supplier problem that they may not be aware of or are yet to disclose. Large companies will often ask these risk-scoring services to monitor hundreds of suppliers. As the outsourcing of non-core business services accelerates, it is worth asking: do you pay sufficient attention to your dependency on third-party actors who are now integral to your security and resilience as a business? As we look to the future, organisations will need to move on from thinking exclusively about enterprise firewalls, anti-virus software, and patching policies. Instead, they will need to consider approaches to security. This begins with the premise that a company’s success is based upon its reputation, which is ultimately a manifestation of the trust others have in its offerings. This mindset leads companies to embed security into products and services, but it also focuses attention on protecting customers, clients, and those increasingly important supply chain partners. It emphasises stewardship of the trust they place in you when they share their most sensitive data or show their willingness to become dependent on you. No organisation is an island, and all of us are part of an increasingly hyperconnected world. In that world, trust in supply chains and ecosystem partnerships matters more than ever. Dani Michaux is Head of Cybersecurity at KPMG Ireland.

Dr Joanne Murphy has researched the Northern Ireland business community’s experiences in facing the challenges of the Troubles to make life as normal as possible for their customers. It is perhaps timely to listen to their voices and reflect on the crucial role businesspeople play in fostering and maintaining peace. “We had a door in the bar that squeaked, and I used to think that sometime in my life, that door will squeak and my stomach won’t tighten – I’ll not have that fear in me. The first year was just like hell.” These are the words of a publican I interviewed, reflecting on his first years in business at the start of the Troubles. While much has been written about this period, few existing accounts reflect the business community’s experience of living and working through violence. From my research in Northern Ireland, the Basque Country, and Bosnia on how leaders and managers adapt to and function in environments of conflict, I have identified four common characteristics among those who share such experiences: The fear, countered by courage, experienced in running a business against a background of the threat and reality of violence; The ability to continue to make decisions in the ‘grey zone’ of an environment where a clear good or positive outcome is often not possible; An acute understanding of the political dynamics at play at a community level; and An ability to seize the business opportunities presented by political change and evolution. Fear and courage It is easy to forget that in violent environments, experiences are visceral. An experience repeatedly shared by business owners I have interviewed is one of living with fear and the need for the courage to confront it. In the case of Northern Ireland, many have described how the disruption and street violence of the civil rights period quickly descended into the chaos of full-blown conflict and its impact on what had been a stable, albeit divided, business environment. A pharmacist with a business at the centre of a market town described the early years of protest and trouble: “When the demonstrations and counter-demonstrations started, we would have had to lock the doors because there were fights bouncing off the windows. It progressed on to the bombing and incendiaries.” As the conflict progressed and periods of violence became more intense, low levels of intimidation sometimes became active threats. The same pharmacist recalled frightening days in 1981: “During the hunger strikes, we got a slip of paper through our letterbox saying ‘When Bobby Sands dies, you close for the funeral’… but we didn’t close and there were three of them that came in about 9.30am. I knew one of them… ‘You’re not closed?’, they said, and I said ‘No’. And they said ‘Are you going to close?’, and I said ‘I’m not. I prayed for Bobby Sands at mass this morning. I prayed for his family. I don’t think he should have taken his own life’. So then, they went out, and about ten minutes later, the phone rang. ‘If you’re not closed in half an hour, you’ll be dead.’ I sent the two staff home – there weren’t many customers about, but I did the rest of the day myself. And I can assure you that every time the door opened…” With towns and cities encircled by barriers and security forces, the economic impact was devastating. Interviewees talked about losing half their business when towns were gated to protect them from bomb attacks, deterring casual shoppers. Even with this difficulty, there were consistent attempts to stay positive and open for business. A shop owner reflected: “The way I looked at it, you had to think of the people that took the trouble to come to you”. Undoubtedly, there was a personal impact on people’s peace of mind and mental health. One business owner reflected on a particularly difficult period. “There were times you would drive into work, the mountains so peaceful above you, and I’d think ‘I’d just love to drive on and walk in those mountains’. I’m a very calm person, but I remember the whole front of the shop was blown out with a bomb, and we had to barricade it up and lock it with a chain and a padlock. One day I couldn’t get it open with the key, and I just kicked it down… not like me at all.” The resilience to persevere through fear and uncertainty was critical. Decision-making in the ‘grey zone’ In his book, The Drowned and the Saved, Italian industrial chemist and Holocaust survivor Primo Levi wrote about the moral ambiguity of being trapped in an environment of terror, the ‘grey zone’, where moral compromises persist and perfect outcomes are not possible. In such situations, business owners struggle to manage relationships when trust is in short supply and there is acute anxiety about outcomes and the consequences of action. One commented on the struggle to find a middle way: “I didn’t trust the cops, and I didn’t trust the paramilitaries”. Many of those I interviewed spoke about making choices to establish acceptable behaviour norms to mitigate a volatile environment’s worst aspects. For example, a publican described taking a stand about bad language in his bar, despite being personally threatened. The difficulty of such decisions should not be underestimated, and many interviewees were open about the dread such choices entailed. They were also clear about the compromises made to be able to trade successfully. The employment of doormen, for example, could put bar and club owners into morally invidious positions. One observed that while such dilemmas had eased as the peace process developed, doing business still involved engaging with paramilitary elements in local communities. He described how demands from paramilitaries had changed from “You need to employ such and such” to a more conciliatory “If you’re employing doormen, will you employ these doormen and it’ll be completely legit, and you tell them what your rules are, and how you would like to run it?” He concluded: “Most things would work out okay”.  One of the factors that facilitated a move away from engagement with paramilitary elements was a high level of political and community knowledge among business leaders. Initiatives like sponsorship of local sports and youth clubs helped embed relationships in the community and allowed business owners to leverage a wide range of connections, providing a protective mechanism against organised paramilitarism. The grey zone was particularly extended for the business community during prolonged periods of heightened tension, such as the 1974 Ulster Workers’ Council strike when many businesses were either forced to close or closed voluntarily in protest at the Sunningdale Agreement. “During the Ulster Workers’ strike, we dealt with it in a very Irish way. We closed the front door and opened the back.” Such compromises, however, often obscured the very firm line businesspeople drew in the sand. “For anyone who has shown weakness, that’s the road to ruin. And anyone I’ve known who has joined in – let paramilitaries put machines in, laundered money, et cetera – it’s ended in a very bad way.” Understanding the political realities When asked about the knowledge and behaviours necessary to survive and thrive in a politically volatile and violent situation, one businessman observed, “You need to understand the environment very well, and the bad and difficult bits of it. I’ve been involved in low-level mediation, trying to do things behind the scenes, you know, when workers are being intimidated. If someone’s getting hassle, I would try to help because I know people. Knowing people is very important.” One common challenge was discrimination based on community background, religious belief, or political opinion. While much has been written about such discrimination in employment terms, respondents were often keen to relay their experiences of similar dynamics affecting the sale of property and the procurement of services. The boycotting of shops would intensify at times of political tension: the Ulster Workers’ Council strike, the hunger strikes, the Anglo-Irish Agreement and the Drumcree protests were all identified as difficult periods. Many were sanguine about the reality of the underlying community division that resulted in people choosing to do business or give their business to a rival based on community identity. One rural business owner noted the difficulties in buying and selling property, comparing it with the experience of racial segregation in the United States. “I remember being the highest bidder a couple of times on unionist property and it being withdrawn from sale and finding out later it had been sold. But I can understand that because those people had to live in the community. It’s not easy… but if they sell to me, they could be in trouble with their own people. You have to be at peace with your own community. Those who step outside that are very brave people.” Seizing the opportunities of change In 1994, the Confederation of British Industry (CBI) published Peace: A Challenging New Era, which became widely known as the ‘Peace Dividend paper’. It argued that a viable peace process would help spur economic growth, which would help promote peace. This initiative coincided with strenuous efforts to move to a non-violent environment, including John Hume’s ongoing dialogue to move the IRA away from violence. The CBI emphasised that the vast amounts of money being absorbed by the Troubles could be reinvested in education and infrastructure. At a local level, the business community could also sense change. One respondent, a Belfast-based businessman, recalled seeing the opportunity and changing his business strategy – but then having his expansion plans rejected by local funders, who were unconvinced. The idea of moving into Belfast city centre, previously an economic wasteland, closed and cut off during much of the Troubles, was indeed radical. “I decided to move the business to Belfast. I thought, I’ve got to get into the city centre – that was that. I knew that when I went to the centre of Belfast, people would start to come in.” While local entrepreneurs may have sensed that the environment and business opportunities were shifting, support was not necessarily forthcoming from regional business development agencies. The same businessman recalls visiting one such organisation in search of support after he decided to move his business into Belfast city centre. “I outlined my vision. They told me it was never going to work. It was a very short meeting, and I haven’t forgotten it.” Others reflected on how they sought to build community relations in various ways, including the employment of ex-combatants. Many also believed that they had the opportunity to give something back and benefit the wider community: “My firm’s ethos and culture is about doing some good here. And, if I’m honest, these things often have a very beneficial business upshot.” For many, the business benefits of peace also sit beside a clear commitment to the region and an investment in its stability and sustained progress. When the conversation with one businessman turned to recent violence by dissident republicans, including the murder of journalist Lyra McKee in Derry in 2019, he was unwavering in his view that a deterioration in the security situation would not impact his commitment to Northern Ireland. “If things got worse, I’d work harder. I’m far too invested in the community here to give up. I feel so blessed that I don’t carry any baggage from the past… I’ve not lost anyone or had anyone injured. I’m lucky in that sense.” The journey to a ‘kind of’ peace in Northern Ireland has been long, and not all stories have been told. We are only beginning to understand the impact local enterprise has on stabilising society and building accord, but the experiences of those who worked through difficult times stand as a testament to their resilience and the need to build on progress. Dr Joanne Murphy is Reader in Leadership & Change at the Centre for Leadership, Ethics and Organisation in Queen’s University, Belfast.

The accountancy profession needs to engage with  how emerging technologies like artificial intelligence will disrupt traditional career pathways. By Dr Patrick Buckley, Dr Elaine Doyle, and Ruth Gilligan Information technology has become inextricably embedded in virtually every aspect of our professional and personal lives. Data about what we do, what we are interested in, with whom we communicate and where we go can all be captured and stored at a scale unimaginable even five years ago. Technology giants such as Google, Amazon and Alibaba are engaged in a competitive race to capture the data generated by this new reality, lending credence to The Economist’s claim in 2017 that “the world’s most valuable resource is no longer oil, but data”. The data captured is valuable for several reasons. For one, traditional activities such as advertising can be personalised and optimised to a revolutionary degree – think of Facebook. Data also allows companies to build entirely new products. For example, the utility of Google Search results depends on analysing what information others have found useful in the past. A further value assigned to these data streams is linked to the development of artificial intelligence (AI). A host of mathematical and algorithmic tools – some novel, some more mature but turbocharged by the advent of big data – has propelled the development of AI. Leaving aside philosophical questions such as to what extent these systems are intelligent, every-day and now familiar examples of AI (Siri and Alexa, for example), are demonstrably practical and effective. These visible successes, combined with the breakneck pace of development, pose a multitude of questions about the impact of AI on our future – not least its impact on the future of work. The future of work Concerns about automation and jobless futures are not new. Two centuries ago, Ricardo proposed that technology caused unemployment. In the 1930s, Keynes predicted that new technologies would reduce the demand for human labour. In the 1980s, Leontief compared the role of a human in the modern economy to that of a horse in agricultural production – first diminished, and then eliminated by automation. Until the advent of AI, the consensus was that such predictions were overly simplistic. While new technologies can have a destructive effect on a particular industry or sector, their introduction often leads to increased opportunities in other areas. The overall effect is to change the structure of the jobs market, rather than result in a reduction in the work available. The jobs eliminated by new technology are replaced by jobs requiring higher-order cognitive skills (e.g. a robot replaces a welder but requires a software engineer to program it). Though this can be frightening and stressful for individuals, at a societal level, as long as education and training enable people to adapt to changing conditions by acquiring new skills, the long-term impact of technological change on the jobs market should be positive. The rise of AI has disrupted this consensus. In brief, the suggestion is that the human monopoly on tasks requiring significant cognitive processing is being broken. Education and training may become ladders to nowhere if AI systems that match or surpass human cognitive abilities are feasible. A glance at the world today demonstrates that many tasks humans once performed are being automated by AI systems, with virtually all studies showing that the process is accelerating as the capability of AI systems improves. For example, two Oxford economists, Frey and Osborne, predict that 47% of jobs in the US will be automated by 2030. The impact of AI Investigating how this disruption is likely to impact the accountancy profession, our research profiled the tasks that practitioners perform at different stages of their career and at three levels: trainee/junior, manager, and director/partner. We then calculated the probability of each task being automated by aggregating information from a range of sources, including academic studies and reports from professional, industry and government organisations. Our analysis makes it clear that, taken as a whole, accountants perform an enormous variety of tasks for their clients and employers. Some tasks, such as preparing accounts or tax returns, are considered extremely vulnerable to automation. Others, such as designing effective financial control strategies for clients, building relationships, or mentoring juniors and trainees are not. This feature of the profession has two implications: Given the enormous variety of tasks performed and roles fulfilled by accountants, assigning a single probability and suggesting that this represents an objective assessment of how vulnerable the profession as a whole is to automation is a simplification to the point of absurdity. The large number of tasks not vulnerable to automation means that for the foreseeable future, the profession as a whole does not face an existential threat. Tasks like designing effective tax strategies or the financial structures of businesses will require a mix of quantitative and soft skills as well as a deep, strategic understanding of the world beyond the capabilities of AI. Career pathways However, this does not mean that the profession can afford to be complacent. Analysing the potential effects of AI at different stages of a traditional career pathway reveals that the tasks vulnerable to automation belong predominately to early career stages. This is particularly the case for trainees/juniors, but also applies substantially to certain work at manager level. Therefore, while accountants may always be needed, the current economic case for most trainees and some managers may disappear. This presents challenges for the profession. Most obvious is the need to redesign career pathways in response to these trends. A traditional career pathway through the profession follows the well-worn path of trainee to manager to director to partner. A key question for firms and the profession is how to replenish senior ranks if the bottom rungs of the career progression ladder are removed. If there are no trainees or junior staff, where does the next generation of managers, directors and partners come from? A second, related issue is that of skills and knowledge development. Generally, the more experienced individuals in organisations perform the more cognitively demanding tasks. The tasks most vulnerable to AI automation are often seen as repetitive and undemanding. At first glance, the automation of such tasks may seem a positive development for employers and employees alike. However, this perspective takes no account of the knowledge and skills gained by performing these tasks in a real-world setting. For example, designing effective tax strategies requires experience that can only be acquired by spending time working on basic tax compliance. It may be possible to develop the skills and aptitudes required by more senior practitioners without a long, real-world apprenticeship. However, there is no evidence to support this position. At the very least, it seems likely that the entry pathway to the profession will need restructuring, with substantial changes required to curricula and entry requirements. In an extreme case, firms may face severe skills shortages a few years after engaging in significant automation. Higher-order skills may atrophy and disappear due to the lack of entry-level positions rupturing the supply pipeline of employees capable of performing higher-order tasks. Perception of the profession A third potential issue is the attractiveness of the profession to new entrants. If some of the tasks traditionally performed by managers are automated, then this will presumably have the effect of reducing the total number of individuals required at this level. The profession may evolve towards a position where a relatively small number of individuals (say 5%) do high-value, well-remunerated work while the other 95% are relegated to low-value, poorly paid tasks. A rational and risk-weighing decision-maker, the very type of intellect the profession seeks to attract, may select away from careers where the odds seem stacked against being able to access opportunity. In the long run, this selection bias may have a significant adverse effect on the profession’s ability to attract high-calibre candidates. The future of the profession Forecasting the future is a notoriously uncertain endeavour. Any predictions regarding the impact of AI on the accountancy profession (including those in this article) should be treated with scepticism. Reports of the imminent demise of the accountancy profession are, in all likelihood, greatly exaggerated. However, it would be equally short-sighted to discount the potential impact of AI on the profession entirely. It does seem likely that in the medium-term, the traditional career pathways associated with accountancy will be significantly dislocated. Responding to this will require meaningful, profession-wide dialogue and debate about how the next generation of accountants will be recruited, educated, and motivated.   Dr Patrick Buckley and Dr Elaine Doyle lecture at the Kemmy Business School, University of Limerick, and Ruth Gilligan is a Tax Associate at PwC Ireland.

Although the weeks and months ahead will undoubtedly be challenging, quality should not be compromised argues Fiona Kirwan. Full-year and interim year reporting deadlines are fast approaching for accountants both in industry and practice. Companies’ financial reporting functions and their auditors are getting used to working in ‘new normal’ circumstances. However, these changed circumstances must not compromise the quality of the work we all deliver day-to-day. Here are some issues Chartered Accountants should consider as they seek to maintain the highest level of quality in all aspects of their work. People COVID-19 has transformed the way we live and work. We have heard this phrase a lot in recent weeks, but it remains true. Almost instantly, employees who are used to the rhythm of the workplace became remote workers – many without the chance to prepare adequately. This creates challenges for managers of both finance and audit teams in leading teams remotely. It is more challenging to coach and supervise people who are not physically in the same location. It is therefore important to stay in touch and stay close to your people. Connecting as a community during this time takes imagination. It could mean developing new channels or social tools for employees to share stories; it could mean embracing video calls to create a sense of physical presence. Virtual social events are becoming the norm. Even small investments in building a genuine community can have a significant impact on your employees’ morale. This sense of community helps when coaching teams. People who are closely aligned on a personal level will find it easier to communicate complex information simply and team members will feel more comfortable asking questions and querying essential messages. Teams must be aware that some colleagues may not have optimal ‘work from home’ environments; some are juggling home-schooling with office hours; others are working from their bedrooms in shared living spaces. Organisations should implement flexible working structures to allow teams to deliver quality work while maintaining processes to ensure confidentiality and transparency. Such flexible working structures mean that everyone in the financial reporting process, both finance teams and auditors, must allow extra time to execute tasks remotely. Technology Almost all finance functions and accounting firms transitioned to remote working arrangements overnight, and the quality of an organisation’s technology is critical to day-to-day operations and ensuring business continuity in this scenario. Some organisations may have challenges arising from the fact that their teams are heavily reliant on desktop computers, second screens, or printing facilities that are not available in the home environment. The move to remote working could also leave team members isolated, but this is where the ability to host video conferences, share screens, and collaborate in files in real-time has become vital. Not only do these technical solutions allow teams to communicate internally, they have also become critical channels for communication between auditors and their clients. At PwC, we utilise our combined suite of audit tools – Connect, Aura and Halo – to communicate with our clients and colleagues across the globe. We also use Google’s G-Suite of collaboration tools, and Datashare to help us work with the data of clients with less complex IT systems. The recent uptake in the adoption of these technologies has seamlessly transitioned a lot of this work, which was historically done in person, into the digital realm.  Controls One area where the successful application of technology solutions has become essential is the implementation of internal controls over financial reporting. The appropriate tone from the top is vital; managers need to remind people that remote working might change how controls work, but it does not lower the bar. How companies operate their controls has been amended to allow for remote working. For example, a manual sign-off may now be replaced with a confirmation by email. In these uncertain times, companies will want to ensure that shortcuts are not being taken and rigour – both in procedures and the provision of appropriate evidence to support the implementation of controls – are maintained. Auditors will need to consider whether the controls, as they currently operate, remain fit for purpose and any increased risks that may have arisen from recent changes. Financial reporting The COVID-19 outbreak, and the measures taken to mitigate its impact, are having a significant effect on economic activity. This, in turn, has implications for financial reporting. Companies and auditors must work together to ensure that quality is not compromised – even in challenging circumstances. The following is a sample of the wide range of accounting issues that companies and auditors have considered in recent weeks: Going concern and viability statement: companies must assess going concern at each annual and interim reporting period, with a look-forward period of one year from the financial statement issuance date. Companies impacted by COVID-19 have had to update their forecasts and provide appropriate disclosures to alert investors about the underlying financial impact and management’s plans to address it, including if conditions give rise to uncertainties about the company’s ability to continue to operate; Subsequent events: the consensus is that COVID-19 was a non-adjusting post-balance sheet event for 31 December 2019 reporting. However, the appropriate disclosure of impact on the overall financial statements is a critical element of the financial statements; Measurements of assets: for year-end reporting and interim statements after December 2019, companies and auditors must assess the timing of COVID-19-related events to determine the impact on assets, including goodwill and indefinite life intangible assets, inventories, and deferred tax assets. Companies and their auditors must consider disruptions to the entity’s business or the broader market in determining recoverable amounts of assets. Careful consideration must be given to the net realisable value of inventory and, in the event of a price decline, whether prices will recover before the inventory is sold; Revenue recognition and receivables: identify the appropriate sales price given increases in expected returns, additional price concessions, or changes in volume discounts. Companies and auditors should be mindful that revenue can only be recognised for new sales if payment is probable under IFRS 15; Alternative performance measures: the European Securities and Markets Authority (ESMA) has provided guidance relating to the use of Alternative Performance Measures (APMs) in the context of COVID-19. Consistent with previous guidance relating to the maintenance of consistency of APMs from one reporting period to another, ESMA advises that rather than adjusting existing APMs or including new APMs, issuers should improve their disclosures and include narrative information in their communication documents to explain how COVID-19 impacted and/or is expected to impact on their operations and performance; the level of uncertainty; and the measures adopted – or expected to be adopted – to address the COVID-19 outbreak; and Internal consultations and reviews: audit teams face significant additional internal consultations and reviews in the current environment. Early agreement on timetables and collaborations between companies and auditors will ensure that quality is not compromised. As events continue to unfold, the challenges faced by accountants both in industry and practice are mounting. The weeks and months ahead will undoubtedly be challenging. However, quality should not be compromised. Supporting our colleagues and utilising our technology capabilities will ensure that control frameworks continue to operate, financial reporting will be clear and transparent for all users, and audit quality will not be compromised. Fiona Kirwan is a Director at PwC’s Assurance Practice.

Large customers are good for business, but can stretch your cash flow.  By Peter Brady Have you recently received a ‘polite letter’ from your US multinational corporation (MNC) customer advising of a stretch in your credit terms from 30 days to 90 plus? Or, indeed, from any of your MNC customers? In recent years, the extension of MNC credit terms has become business as usual across the globe but for SMEs, it is anything but business as usual. Think about it. How would an extension of credit terms impact on your cash flow and projections this year? And what are the implications for your growth strategy in 2020 and beyond? Winning a contract with a large MNC is a measure of success for established SMEs. However, an extension of credit terms can feel like a double-edged sword as it puts excessive strain on cash flow. Why does it matter? A strain on your cash flow can have many implications, all of them negative. The first impact is on your suppliers – they expect payment in 30 days. There is an immediate gap in cash flow and you are unlikely to have sufficient sway with your suppliers to realign. This could mean: You are not in a position to fund the initial costs of fulfilling contracts; Pressure is placed on your existing supplier relationships in the form of increased risk around quality, timely delivery and higher prices; Capacity to deliver on-time to customers is affected; and Ability to grow the business at pace is limited. The lost opportunity  It may seem obvious, but having cash tied up in debtors with long credit terms is a fundamental challenge for most SMEs. If SMEs could access this cash early, it would give a distinct competitive advantage when negotiating terms with key suppliers. Think of what you could do if your invoices were paid on day one, not day 90. First, you could pay your suppliers early, enhance the relationship and ultimately secure better terms. Second, you could deploy funds into driving new customer acquisition and fund new business tenders with the comfort of cash flow certainty. So what do you do? You have two options: 1. You could try to negotiate: know where you stand in your customer’s eyes. Do your products or services play an important role in their success? Is your product or service critical to their delivery? Even so, unless you are the sole producer of a key strategic element, there’s another company out there to potentially replace you. Alternatively, your customer might offer softer credit terms in exchange for a pricing discount – but cutting margins is an extremely expensive source of finance and unlikely to be recovered. This course of action doesn’t make good business sense, as it is a race to the bottom. 2. Look at funding options to bridge the gap: the financial market is developing all the time to reflect the needs of business. For decades, when Ireland’s SMEs needed to fill the cash flow gap left by extended credit terms, they had limited choices – commercial overdrafts, short-term lending or an invoice discounting facility. That may have been adequate in the past but such is the success, ambition and global reach of Irish SMEs across all sectors today, this range of funding options falls short of their requirements. Commercial overdrafts are harder to secure and are generally seen as an unreliable method of funding, not directly aligned to the changing requirements of a business. Similarly, short-term lending is onerous to put in place and comes with significant levels of conditionality. An invoice discounting facility continues to plug the cash flow gap for many SMEs in Ireland. However, invoice discounting facilities are operationally clunky and carry significant fixed and hidden costs and limitations. They are therefore not really fit for purpose for today’s SMEs. Many SMEs often have a small number of key strategic customers in their sales mix. Supported by government bodies such as Enterprise Ireland, Ireland’s SMEs have a global footprint. Exporting is crucial to scalable business success, and not just to Western Europe. SMEs are securing contracts across the globe – US, Canada, EMEA and Asia. Invoice discounting facility For years, the invoice discounting facility has serviced working capital funding requirements. However, the facility comes with three major limitations: The facility limit; Geographical restrictions; and Debtor concentration risk limits. The facility limit At the outset, SMEs are subjected to a long and onerous process to get approval for the invoice discounting facility. Fair enough, you may say, as this is effectively a loan and it follows that the bank providing it decides how much the facility is for. SMEs must enter into a long-term commitment, often saddled with non-usage charges or exit fees. SMEs must also pay credit insurance and sign a personal guarantee – something entrepreneurs have grown to fear. Geographical restrictions Exporting to the UK? Great. Exporting to United States (US)? Not so great. Country risk and the law of the land plays a major role in how traditional lenders assess the risk and granting of facility limits. If the country in which your customer is located is outside of what is considered in banking terms to be palatable, funding limits and exclusions will apply. Debtor concentration risk limits The most common reason for restricting funding under an invoice discounting facility remains customer or debtor concentration. It applies when an SME becomes over-exposed to a single debtor. The debtor could be a large household brand name, but traditional lenders must impose facility limit restrictions. For SMEs, it is somewhat ironic that the more business you do with a key customer, the more your funding is limited. So, back to your US multinational extending its credit terms. You’ve worked tirelessly to win this business, but you can’t sustain 90 days’ credit and this customer accounts for over 60% of your debtor book. Your business needs: Consistent certainty of funding, without any limit relating to geography or debtors; Funders who recognise the strength of your business model and the substance of the underlying transactions; and Access to working capital to scale your business globally. Market and product innovation Invoice, purchase order and recurring revenue trading are collectively known as “receivables trading”. Receivables trading ticks all the boxes. It enables SMEs to leverage their customer relationships. By selling invoices and future invoices (purchase orders) to a pool of capital market funders, SMEs can access finance when they need it. What difference do capital market funders make? The funders are capital market institutional funders, pension funds, corporates and sophisticated investors – and there is a large pool of these funders. The fact that there is not just one entity, but a pool of funders purchasing the receivables (invoices or purchase orders) eliminates the requirement for imposing concentration or geographic limits on the SME. It extinguishes the need for any commitment, lock-ins or fixed costs. At no stage is there an ask for a personal guarantee. This funding solution puts control back into the hands of SMEs and allows them to decide when they need to access funding on their terms – a liberating benefit. How does it work? Receivables trading is available via an online platform. A pool of institutional funders (the buyers) are members of the platform. SMEs (the seller) uploads their invoice or purchase order and the buyers purchase them. The model is ideally suited to established SMEs with MNC or sovereign debtors. The SME can use the online platform in conjunction with their existing facility by carving out specific debtors from the invoice discounting facility. In conclusion Business is constantly changing and working capital funding has caught up. Alternative funding where sellers and buyers connect directly via an online platform is fast becoming the norm. With this funding solution, SMEs can tender for business of any scale globally – confident that they can fund the upfront costs. It’s a gamechanger for most. According to the Central Bank Survey of SMEs, which was published in January 2019, the top two reasons for credit applications were working capital, and growth and development. ISME’s quarterly business survey reveals that 70% of Ireland’s SMEs still rely solely on traditional bank funding. In Europe, it’s only 30%. Alternative funding is the future of funding. Peter Brady FCA is Co-Founder and CFO at InvoiceFair.

Blockchain represents both an end and a beginning for the accountancy profession. By Fearghal McHugh and Dr Trevor Clohessy Transparency can be considered the holy grail of governance best practice. The codes, acts and markets demand it as it enhances the view of corporate transactions, which has in turn affected issues such as environmental and sustainability reporting. Transparency is the core of blockchain, which will affect accountancy while satisfying this core principle and driver of good corporate governance. The difference is that it will not take the blockchain elements outlined below as long to become mainstream as it has taken to impact on environment and sustainability concerns. The consensus is that blockchain and its technologies will change the people skills, the processes, the systems and the structure of accounting practice currently applied to any transactions involved in the recording of any information. This has big implications for those in the sector but, significantly, gives a market opportunity to those who are not. Indeed, this opportunity is further enhanced when artificial intelligence integrates with blockchain. Scale of disruption The potential disruption is on the same scale as Amazon, which competes with all retail shops in the country. The first to market with the ‘Accountazon’ brand, named here first, will dent the current position of large or small practices. Accountazon requires accountants, but the ability to scale, integrate and generate output based on fully transparent and rules-based decision-making at the lower level of processing while, at the upper level, having the decision-making and knowledge base of a collective of highly-paid accountants will affect the accounting industry. This can drive the accounting industry to build on specialisation and value proposition offerings at a higher level than those currently generating income. In other words, intelligent computer systems will do what accountants currently do. The impact will force the industry to seek a new place away from rudimentary transaction-type roles of fundamental audit and tax processes. This will require in-depth knowledge (which artificial intelligence can replace) to pure decision-making; in essence, the better the decision-making, the higher one’s revenue and reputation. The purpose and role of accountants will remain, but will be implemented at a higher knowledge application and analysis level and further away from the current operations position and perspective. A personal approach There is no need for panic yet. As with Amazon, retail shops have continued in business but the pricing, delivery, support, convenience and speed we enjoy from the online retailer may also need to be addressed in the accountancy industry; we need to make accountancy accessible, friendly, convenient, productive and transparent. Either the market or the technology will drive the change, or the accountancy industry will embrace it first and deliver value. A Ryanair approach, encouraging a more direct business model using technology, could be applied in the accountancy industry and is more likely now with blockchain and artificial intelligence. The middleman remains the accountant, however, and if it is deemed that a lot of processes don’t add value, the middleman needs to present a value proposition that cannot be offered by the system itself in order to add future value. In the Ryanair model context, so many travel agents adjusted and seem to have found that personal service, customisation and the time taken to provide a tailored travel package for customers is what many consumers want. The drive for digitisation An example of a driver of this type of change arose earlier this year when the then-head of the IMF, Christine Lagarde, urged central banks to launch digital currencies to satisfy public policy, financial inclusion, security, consumer protection and privacy in payments. While blockchain is mostly linked with cryptocurrencies, digitisation policies embraced by companies like Nestlé, Guinness and Glanbia are being encouraged by stakeholders but embraced in a controlled manner. Blockchain technology is part of the cryptocurrency system that actually worked. It is becoming embedded in many industries from manufacturing to web-based services, facilitating faster and more secure transactions on a growing scale. When companies and consumers have a better, easier, faster and more transparent way to do business, they will select it as time is a critical factor in corporate life. The practical elements and approaches to blockchain, as highlighted below, will be seen by clients as having the potential to reduce charges and the time involved in accountant reviews and advice, which Revenue could see as a means of speeding up returns. Public versus private Blockchain is not a mobile application, a company or a cryptocurrency. In its simplest terms, blockchain is a ledger that records transactions digitally and records details about the transaction. These details are recorded in multiple places on the same network. Blockchain comes in two flavours: public and private. A public blockchain allows anybody on the network to input transactions and data onto the blockchain. No single entity controls the network. A public blockchain operates like Wikipedia in that users have a composite view that’s constantly changing. Bitcoin, the tradename used to represent the familiar digital currency along with another called Ethereum are examples of public blockchains. Private blockchains work in a similar fashion to public blockchains, but with access restrictions that control who has access to the network. One or multiple entities control the network. Think of this in terms of a traditional database system that can only be accessed by specific authorised employees. Two features differentiate blockchain digital ledgers from traditional ledgers. First, the assets and transactions recorded in these digital ledgers are secured through cryptography. As an example, in season four of the Netflix drama, Narcos, Guillermo Pallomari’s financial ledgers records are taken as evidence by the Drug Enforcement Authority (DEA). However, due to the complicated coding system deployed by Pallomari within these financial ledgers, the DEA is unable to decipher the transactions and/or assets in order to use them as evidence. Pallomari holds the encryption key, which would enable the DEA to crack the code. In terms of blockchain, this also holds true. Due to sophisticated encryption keys, the transactions and assets are secure, immutable and unforgeable. Second, blockchain encompasses the disintermediation of traditional financial intermediaries (e.g. banks, brokerages, mutual funds). This disintermediation is made possible by smart contracts, which are complex algorithms that execute the terms and conditions of a traditional contract without the need for human intervention. This leads to a superior ability to prove custodianship and ownership of assets, which could potentially improve efficiency and enhance transparency while also reducing costs and income in the accountancy profession. Complexity and novelty Today, a number of multinational technology organisations enable businesses to implement blockchain practically. For instance, Microsoft currently offers a blockchain development solution that combines the advantages of cloud computing (e.g. virtualisation, scalability, pay-as-you-go pricing model) and blockchain. This service is called Blockchain-as-a-Service (BaaS) and comes with a set of development templates (e.g. smart contract development and integration) that users can deploy and configure with minimal blockchain knowledge. However, prior to diving into the blockchain sea, accountancy organisations should adopt a caveat emptor mantra. History suggests that two dimensions impact on how a new technological trend and its business use can evolve. The first is complexity, which is represented by the level of coordination required by the organisation to produce value with the new technology. The second dimension is novelty, which describes the level of effort a user requires to understand the problems that the new technological trend can solve. The more novel a concept is, the greater the learning curve. Accountancy organisations can develop adoption strategies that map possible blockchain implementations against these two dimensions. Complexity and novelty can vary from low to high in terms of the stage of technology development. For instance, accountancy organisations that are new to the blockchain concept may want to introduce a pilot initiative that is low in novelty and low in complexity. One such initiative could encompass the inclusion of cryptocurrency transactions in a firm’s transactions processes. New skills While blockchain is spread across many systems, it is not public. It protects transactions because they are shared and copied on many parts of storage devices, and would require all parts and copies of the transaction to be amended and/or deleted to have an effect. Deleting a transaction in one place is easy, deleting it from several locations and tracking each one – while not impossible – would require some work. This capability could potentially scare some in that transactions cannot suddenly be erased, but it is encouraging for others. Apply this concept first to the level of payments and receipts and build that up to management reporting, budgets and strategic reports to ensure a higher level of accuracy and clarity. This will eventually lead to a sense of integrity, another governance ideal. With reference to speed, this can move business from reliance on past information to live analysis and if it’s faster, it will be cheaper in the long-run to produce. While a positive for business, it will not require the skill of a finance professional but a computing-finance professional. In a 2018 Irish industry report, one of the authors, Trevor Clohessy, identified that IT/education providers must do more to demystify blockchain and expedite the learning process. The report outlined how the core competencies and skills required for blockchain are broader than the core technology and encompassed skill sets, which fall under the following categories: Foundational technology (e.g. cryptography, public key architecture); Distributed ledger technology (e.g. mining, consensus algorithms); Forensics and law enforcement (e.g. money laundering, dark-net); Markets, economics and finance (e.g. business modelling, cryptonomics); Industrial design (e.g. supply chain, Internet of Things); and Regulations and standards (e.g. smart contracts, governance frameworks). From an accountancy perspective, it is envisaged that certain traditional skills relating to accountancy will be eliminated or reduced (such as reconciliations or provenance assurance, for example). Blockchain transactions will enable new value-adding activities but while the range of extant skills required will change, this change need not be Byzantine. It is envisaged that the markets and regulations categories outlined above will be important for bridging the blockchain literacy gap between various business and technology stakeholders. Looking ahead, accountancy practices can examine their business models in order to derive value from blockchain. Janus, the Roman god, contained both beginnings and endings within him. That duality characterises blockchain too. It will put an end to traditional ways of doing things and usher in a new era for business and for the world at large. It will be divisive, pervasive and transformational all at the same time, and will encourage accountancy professionals to look ahead and not base their operations and decision-making on past data. The blockchain future is one with present and predictive transacting data systems with in-built transparency and integrity.   Fearghal McHugh is a lecturer in Chartered Accountants Ireland and GMIT. Dr Trevor Clohessy is a researcher and lecturer in GMIT.