Rethinking Materiality: Your Threshold Should Not Be Derived Solely from Revenue
Brian Fricke, CISSP, CISM
Marine | 4x CISO | Technology Risk Executive | Board Advisor | Author |
Accurately assessing and managing risk is more critical than ever. Traditional approaches to determining materiality thresholds—often based solely on a percentage of revenue—are increasingly inadequate. The Securities and Exchange Commission (SEC) emphasizes that materiality should be evaluated using both quantitative and qualitative factors, tailored to an organization's specific context.
The Traditional Approach and Its Flaws
Historically, many organizations have set their materiality thresholds as a fixed percentage of annual revenue—say, 5%. While this method offers simplicity, it overlooks key aspects:
- Liquidity Limitations: Revenue does not reflect the company's cash position, which is crucial for absorbing immediate financial shocks.
- Profitability Variations: High revenue does not necessarily equate to high profitability. Companies with slim margins may be more vulnerable to risks despite significant revenues.
- Operational Resilience: Revenue figures do not account for operational efficiency or the company's ability to recover over time.
This revenue-centric model can lead to underestimating risks, misallocating resources, and ultimately, making ill-informed strategic decisions.
Using Cash Reserves and EBITDA to determine Materiality
To address these shortcomings, I propose using Cash Reserves and EBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) as the foundational metrics for establishing a more accurate materiality threshold.
1. Cash Reserves Gauge Short-Term Impact Absorption
Cash reserves represent the most liquid assets available to a company, reflecting its immediate capacity to handle financial shocks in the short term.
Why Cash Reserves Matter
- Immediate Liquidity: In the face of sudden risk events—like cyber-attacks, natural disasters, or supply chain disruptions—having readily available cash is essential for quick response and mitigation.
- Operational Continuity: Adequate cash reserves ensure that day-to-day operations can continue uninterrupted during a crises.
- Risk Absorption: High cash reserves indicate a stronger ability to absorb short-term losses without jeopardizing the company's stability.
Application in Materiality
By setting the materiality threshold as a percentage of cash reserves, organizations align their risk appetite with their actual liquidity. For example, if a company has $10 million in cash reserves, setting the materiality threshold at 25% would result in a threshold of $2.5 million, the risk appetite might be half of that.
2. EBITDA: Measuring Mid to Long-Term Recovery Capability
EBITDA focuses on operational profitability, providing insight into a company's ability to generate earnings from its core business activities over time.
领英推è
Why EBITDA Matters
- Operational Efficiency: EBITDA reflects the company's ongoing capacity to produce earnings, which is crucial for recovering from losses.
- Debt Servicing and Investment: A higher EBITDA suggests better ability to service debt and invest in future growth, aiding long-term resilience.
- Financial Health Indicator: Consistent EBITDA performance points to a sustainable business model capable of weathering extended challenges.
Application in Materiality
Setting the materiality threshold as a percentage of EBITDA ensures the threshold is proportionate to the company's earning power. For instance, with an EBITDA of $20 million, setting the threshold at 15% results in a materiality threshold of $3 million.
Combining Both Metrics for a Holistic View
Using both cash reserves and EBITDA provides a comprehensive understanding of a company's financial resilience:
- Short-Term Impact: Cash reserves address the immediate ability to absorb financial shocks.
- Mid to Long-Term Recovery: EBITDA reflects the capacity to recover and sustain operations over time.
With a more accurate materiality threshold, organizations can derive their Risk Appetite—the level of risk they are willing to accept to achieve their objectives.
- Set Risk Capacity: Assess total financial resources, including cash reserves and access to capital.
- Define Risk Appetite: Establish as a percentage of the blended materiality threshold. For example, 80% of $3.7 million = $2.96 million.
- Establish Risk Tolerance: Define acceptable variations around the risk appetite, such as ±10%.
Benefits of This Approach
- Accurate Reflection of Financial Resilience: Aligns risk assessments with both immediate liquidity and long-term profitability.
- Enhanced Risk Management: Provides a solid foundation for setting risk appetite and making informed decisions.
- Strategic Resource Allocation: Ensures that investments in risk mitigation are proportionate to the company's actual capacity.
Conclusion
Risks are multifaceted and financial landscapes complex, relying solely on revenue to set materiality thresholds is insufficient and potentially perilous. By incorporating Cash Reserves and EBITDA into the calculation, organizations gain a more accurate understanding of their financial resilience.
This method not only aligns with SEC guidance but also empowers businesses to make informed, strategic decisions about risk management. It ensures that both the immediate and long-term financial impacts of risk events are considered, leading to more robust and sustainable operations.
Sales Director, Cyber Security Enthusiast - CISSP, All around technology geek
4 个月There is the very vague definition of "would a reasonable investor want to know". In other words, a few large investment firms could post something like this and define what they would consider "material". At that point it is codified as what a reasonable investor would want to know and becomes a benchmark for everyone else. The SEC puts out a generic term, investors have the opportunity to put real meaning behind it.
Music to my ears. Great points!
Cyber / InfoSec Governance & Regulatory Compliance (GRC) | Enterprise Risk Assessment & RCSA Implementation Expert | Business Risk Expert | Deputy CISO / CIO | Business - Technology Liaison | Seasoned Board Member
4 个月Definitely going to use this in considering our processes. Thanks Brian!
President/CXO | Board Advisor | Cybersecurity & AI Thought Leader | Stand-Up Comedian & Show Producer
4 个月Spot on!
CEO | Founder @ Mijares Consulting | CISA, CRISC, CISM, MSMIS
4 个月I just came across this information that you might like https://www.sec.gov/newsroom/press-releases/2024-174?utm_medium=email&utm_source=govdelivery