Following on from its webinar on the Corporate Sustainability Reporting Directive (CSRD) it held last week, the Department of Enterprise, Trade and Employment (DETE) has this week issued a public consultation seeking the views of interested parties on the member state options in the CSRD. More details can be found here and you can access the consultation here. Even though it is not consulting on direct effect/mandatory provisions, comments and questions on all aspects of the CSRD are invited to facilitate DETE’s work in the transposition of the CSRD. The consultation is open until 5pm on Thursday 9 March 2023. For reader’s information, the CSRD is a European directive requiring certain companies to disclose information on sustainability-related information. The directive aims to modernise and strengthen the rules about the type of social and environmental information that companies will have to report. The CSRD envisages the adoption of European Sustainability Reporting Standards which seek to ensure that investors and other stakeholders have access to the information they need to assess investment risks arising from climate change and other sustainability issues. They seek to create a culture of transparency about the impact of companies on people and the environment. The CSRD was approved by the European Parliament and the EU Council in late 2022 and was published in the EU Official Journal on 16 December. Following this publication, EU member states have 18 months to transpose the directive into their own national laws. Finally, readers may also be interested in accessing the speakers’ PowerPoint slides from the DETE webinar to get further information on the various presentations made. There was a presentation from DETE, PWC and EFRAG on the CSRD and a presentation by DETE on a Proposal for a Directive on Corporate Sustainability Due Diligence.

Revenue has published a range of preliminary statistics on PAYE for 2022, including information on 2022 Income Tax returns filed to date and the end of year tax position for PAYE taxpayers yet to file. Employees should now be able to access their Preliminary End of Year Statement for 2022 (“the Statement”) through myAccount.  The Statement is based on income and statutory deductions reported by employers, pension providers and the Department of Social Protection. The Statement will indicate whether the correct amount of tax has been paid in 2022. To obtain a final Statement of Liability, employees must complete an income tax return, returning details of additional income, allowable reliefs, and/or available credits (if any).    Commenting on income tax returns for 2022 filed to date, Ms. Aisling Ní Mhaoileoin, Revenue’s National PAYE Manager, said: “Over 370,000 tax returns have been processed in respect of PAYE taxpayers who have already filed their return for 2022, this is up over 30 percent on the same period last year. Approximately 275,000 of these returns resulted in an overpayment of tax and €193 million has already been refunded to individuals’ bank accounts as a result.  The major difference for 2022 is the introduction of the Rent Tax Credit in the Budget. Unlike usual Budget tax credit changes which apply for the following year, this credit applies retrospectively for 2022 and can be claimed on an Income Tax return for the tax year 2022. The value of the credit is up to €500 per year for individual taxpayers and up to €1,000 per year for jointly assessed married persons or civil partners. Of the 2022 tax returns received to date, approximately 78,400 claims have been made in respect of rent tax credit. In addition, we expect that from mid-February, customers will be able to claim Rent Tax Credit for 2023 in real-time through the ‘Manage Your Tax’ option in myAccount.” 

With new EU cybercrime rules coming down the line, now is the time to step up your organisation’s ICT security strategy, writes Neil Redmond Increased regulatory scrutiny is among the five most important ways businesses have been impacted since 2020, according to the Irish senior executives who participated in PwC’s Global Digital Trust Insight Survey 2023. Regulators are becoming increasingly cognisant of the risk posed by cyber threats to businesses and their customers. As part of new legislation, the European Union (EU) aims to address cyber, and information and communications technology (ICT) risks. By understanding these regulations and knowing how to prepare, organisations can act now to align with the requirements of new EU legislation. Four key pieces of the new legislation are introducing additional requirements for business: the Network and Information Security Directive Revision 2 (NIS2); the Digital Operational Resilience Act (DORA); the Digital Services Act (DSA); and the Digital Markets Act (DMA). How can your business best prepare to comply with these legislative changes? By taking the following key actions, you can ensure that your organisation is ready ahead of time. 1. Assess the maturity of your organisation’s cybersecurity Reviewing your business’s systems and information security is critical to prepare for the upcoming regulations. Assessing your organisation’s cybersecurity and ICT risk management controls can provide executives with valuable information regarding the business’s cyber risk profile. By finding potential compliance gaps in their cybersecurity, firms can improve their posture before legislation comes into force, mitigating the risk of non-compliance and subsequent consequences, such as brand damage and financial penalties. 2. Test your business’s operational resilience at the enterprise level As part of a cyber maturity assessment, evaluating the organisation’s resilience to disruptive events will be key in preparing for upcoming regulations. While executives may believe that their business is robust and can continue to operate in adverse circumstances, the testing of business continuity and disaster recovery plans allows businesses to measure their resilience and continuously enhance their cybersecurity posture. The first step is to ensure that the organisation has contingency plans for different scenarios. These scenarios should be exercised and iteratively improved to ensure that they are fit for purpose. Examples include switching failing systems to backups or simulating a response to a malware attack on your network. All relevant stakeholders, including third parties, should participate in the testing of contingency plans—in today’s world of sophisticated threat actors, executives must ensure that their entire business is ready to respond. 3. Enhance your incident reporting processes A cornerstone of NIS2 and DORA is reporting ICT and cyber incidents. Businesses need to review their existing reporting channels and procedures, implementing processes to monitor, log, classify and report on incidents consistently. An effective way to ensure that reporting is standardised and complies with regulatory requirements is to centralise incident reporting across the organisation. Establishing formalised processes for managing reported incidents can support businesses in fulfilling their regulatory obligations. Furthermore, the DSA and DMA will require organisations to report to authorities regularly. National Digital Service Coordinators will be established, and they will be responsible for compliance monitoring. Reporting to new supervisory bodies will be a feature of these upcoming legislative changes—a trend likely to be seen in future regulations. 4. Analyse and understand your ICT and third-party cyber risk Today’s business world is deeply interconnected, with organisations often relying on a wide network of suppliers to conduct business. Reliance on third parties can increase the organisation’s susceptibility to cyber-attacks, increasing both the attack surface available to threat actors and the potential for attacks to affect operations significantly. Regulators have grown concerned about gaps in organisations’ third-party risk management processes in recent years as businesses become increasingly reliant on third parties. NIS2 and DORA build on existing guidance and legislation, such as NIS1 at the EU level and the Central Bank of Ireland’s Operational Resilience Guidelines and Guidance on Outsourcing at the national level. In particular, DORA will set out many provisions for businesses to report on the ICT risks stemming from their dependency on third parties, requiring them to describe this reliance in detail. Analysing your business’s exposure to cyber risk through the lens of third parties is a key means of securing your customers’ data and satisfying regulators. Neil Redmond is Director of Cybersecurity Practice at PwC Ireland