Current Approach to Due Diligence Requires Rethink

Completing a corporate transaction without rigorous financial due diligence is unthinkable. Yet, despite numerous well publicised incidents of cybercrime, investors remain blasé about the potential impact of cyber risks on long term value.

Deals continue to be made without understanding the potential impact of this ticking time bomb, which U.S. Deputy Treasury Secretary Sarah Bloom Raskin has warned could be “the most pressing operational risk of our time”.

Hackers are becoming increasingly adept not only at penetrating networks, but also avoiding detection once inside corporate systems. Indeed, most significant breaches are uncovered, only after cyber criminals have been lurking inside corporate systems for weeks or months.

To understand the value of an investment and reduce the likelihood of a future catastrophic event, companies and their advisers must ensure cyber resilience is assessed alongside other strategic criteria, before a deal is completed. Leaving a review until after a deal has been signed is a very significant mistake.

A security assessment starts with a wide-ranging review, carried out by an external third party. However, just because the security review is being done at the same time as a financial review, it must not be confused with an audit. It is crucially important for investors to avoid the all-too-common pitfall of treating the security assessment as a checklist audit of security systems. Such an IT audit often does nothing more than confirm that a company meets a certain predefined infrastructure standard. It almost never considers the actual circumstances in which a company operates and tends to ignore the risks that are unique to each company, even though those risks cause the greatest vulnerability. Instead, a proper security assessment must be a customised and risk-focused review, aimed at understanding actual risks and suggests bespoke risk mitigation options.

In addition to identifying security gaps in hardware and software used by a company, a security review will determine the extent to which security is seen as a companywide priority. Everyone involved in using the IT systems has a crucial role to play. Therefore, an important part of good security is ensuring that employees are knowledgeable about their role in protecting company data and do not become the weak link in the security chain. Individuals must be taught to be vigilant about their behaviours, which will make it more difficult for attackers to catch someone unaware. Users also need to understand what to do if they suspect a problem with their computers or activities.

Careless executives or employees represent a significant risk to cyber security, according to a poll of US companies. The Stroz Friedberg ‘On the Pulse: Information Security Risk in American Business’ survey found that a key challenge for companies is to strengthen cyber security awareness among top executives. The survey found that 87% of senior managers regularly use personal email or cloud account to work remotely, placing such information at a much greater risk of being breached. More than half (58%) of senior management also reported that they had accidentally sent sensitive information to the wrong recipient, compared to just one quarter of workers overall.

The strategy to protect information must recognise also that cyber security extends beyond the data held directly by an enterprise. Key assets, including commercial contracts, intellectual property and strategic plans, are commonly held by third parties involved, such as financial or legal advisers. A determined hacker will not only aim to penetrate a corporate network but also target the company’s legal advisers, consultants suppliers and anyone else likely to have valuable information. Corporates must, therefore, ensure their lawyers, brokers, accountants and suppliers are also secure. Indeed, both the UK and US governments have specifically warned law firms that they are the targets of sophisticated hackers and must be better prepared to defend their networks.

Senior executives and their professional advisers can no longer be blind to cyber risks. As such threats become increasingly commonplace and costly, the resilience of the entire supply chain, including financial and legal advisers, must be addressed, so that the long-term value of an investment can be safeguarded from the very beginning.

Seth Berman is executive managing director of Stroz Friedberg, an investigations, intelligence and risk management company.