Rethinking Materiality: Your Threshold Should Not Be Derived Solely from Revenue

Rethinking Materiality: Your Threshold Should Not Be Derived Solely from Revenue

Accurately assessing and managing risk is more critical than ever. Traditional approaches to determining materiality thresholds—often based solely on a percentage of revenue—are increasingly inadequate. The Securities and Exchange Commission (SEC) emphasizes that materiality should be evaluated using both quantitative and qualitative factors, tailored to an organization's specific context.

The Traditional Approach and Its Flaws

Historically, many organizations have set their materiality thresholds as a fixed percentage of annual revenue—say, 5%. While this method offers simplicity, it overlooks key aspects:

  1. Liquidity Limitations: Revenue does not reflect the company's cash position, which is crucial for absorbing immediate financial shocks.
  2. Profitability Variations: High revenue does not necessarily equate to high profitability. Companies with slim margins may be more vulnerable to risks despite significant revenues.
  3. Operational Resilience: Revenue figures do not account for operational efficiency or the company's ability to recover over time.

This revenue-centric model can lead to underestimating risks, misallocating resources, and ultimately, making ill-informed strategic decisions.

Using Cash Reserves and EBITDA to determine Materiality

To address these shortcomings, I propose using Cash Reserves and EBITDA (Earnings Before Interest, Taxes, Depreciation, and Amortization) as the foundational metrics for establishing a more accurate materiality threshold.

1. Cash Reserves Gauge Short-Term Impact Absorption

Cash reserves represent the most liquid assets available to a company, reflecting its immediate capacity to handle financial shocks in the short term.

Why Cash Reserves Matter

  • Immediate Liquidity: In the face of sudden risk events—like cyber-attacks, natural disasters, or supply chain disruptions—having readily available cash is essential for quick response and mitigation.
  • Operational Continuity: Adequate cash reserves ensure that day-to-day operations can continue uninterrupted during a crises.
  • Risk Absorption: High cash reserves indicate a stronger ability to absorb short-term losses without jeopardizing the company's stability.

Application in Materiality

By setting the materiality threshold as a percentage of cash reserves, organizations align their risk appetite with their actual liquidity. For example, if a company has $10 million in cash reserves, setting the materiality threshold at 25% would result in a threshold of $2.5 million, the risk appetite might be half of that.

2. EBITDA: Measuring Mid to Long-Term Recovery Capability

EBITDA focuses on operational profitability, providing insight into a company's ability to generate earnings from its core business activities over time.

Why EBITDA Matters

  • Operational Efficiency: EBITDA reflects the company's ongoing capacity to produce earnings, which is crucial for recovering from losses.
  • Debt Servicing and Investment: A higher EBITDA suggests better ability to service debt and invest in future growth, aiding long-term resilience.
  • Financial Health Indicator: Consistent EBITDA performance points to a sustainable business model capable of weathering extended challenges.

Application in Materiality

Setting the materiality threshold as a percentage of EBITDA ensures the threshold is proportionate to the company's earning power. For instance, with an EBITDA of $20 million, setting the threshold at 15% results in a materiality threshold of $3 million.

Combining Both Metrics for a Holistic View

Using both cash reserves and EBITDA provides a comprehensive understanding of a company's financial resilience:

  • Short-Term Impact: Cash reserves address the immediate ability to absorb financial shocks.
  • Mid to Long-Term Recovery: EBITDA reflects the capacity to recover and sustain operations over time.

With a more accurate materiality threshold, organizations can derive their Risk Appetite—the level of risk they are willing to accept to achieve their objectives.

  • Set Risk Capacity: Assess total financial resources, including cash reserves and access to capital.
  • Define Risk Appetite: Establish as a percentage of the blended materiality threshold. For example, 80% of $3.7 million = $2.96 million.
  • Establish Risk Tolerance: Define acceptable variations around the risk appetite, such as ±10%.

Benefits of This Approach

  • Accurate Reflection of Financial Resilience: Aligns risk assessments with both immediate liquidity and long-term profitability.
  • Enhanced Risk Management: Provides a solid foundation for setting risk appetite and making informed decisions.
  • Strategic Resource Allocation: Ensures that investments in risk mitigation are proportionate to the company's actual capacity.

Conclusion

Risks are multifaceted and financial landscapes complex, relying solely on revenue to set materiality thresholds is insufficient and potentially perilous. By incorporating Cash Reserves and EBITDA into the calculation, organizations gain a more accurate understanding of their financial resilience.

This method not only aligns with SEC guidance but also empowers businesses to make informed, strategic decisions about risk management. It ensures that both the immediate and long-term financial impacts of risk events are considered, leading to more robust and sustainable operations.

Brian Kay

Sales Director, Cyber Security Enthusiast - CISSP, All around technology geek

4 个月

There is the very vague definition of "would a reasonable investor want to know". In other words, a few large investment firms could post something like this and define what they would consider "material". At that point it is codified as what a reasonable investor would want to know and becomes a benchmark for everyone else. The SEC puts out a generic term, investors have the opportunity to put real meaning behind it.

赞
回复

Music to my ears. Great points!

赞
回复
Stacey Romanello, CISSP, CCSP, CAMS, MBA

Cyber / InfoSec Governance & Regulatory Compliance (GRC) | Enterprise Risk Assessment & RCSA Implementation Expert | Business Risk Expert | Deputy CISO / CIO | Business - Technology Liaison | Seasoned Board Member

4 个月

Definitely going to use this in considering our processes. Thanks Brian!

Sachin Bansal

President/CXO | Board Advisor | Cybersecurity & AI Thought Leader | Stand-Up Comedian & Show Producer

4 个月

Spot on!

Alejandro Mijares

CEO | Founder @ Mijares Consulting | CISA, CRISC, CISM, MSMIS

4 个月

要查看或添加评论,请登录

Brian Fricke, CISSP, CISM的更多文章

  • The 3 C's to replace FUD

    The 3 C's to replace FUD

    In the context of a CISO communicating to management and board, focusing on Clarity, Confidence, and Collaboration is…

    3 条评论
  • Cybersecurity Risk and Control Maturity Assessment Methodology

    Cybersecurity Risk and Control Maturity Assessment Methodology

    In this article I explain a useful method to link a Cyber Risk Assessment with a Control Maturity Assessment, which…

    11 条评论
  • Information Security Risk Metrics: Part II

    Information Security Risk Metrics: Part II

    In a previous article; I unpacked a survey taken by Bank CISOs on InfoSec Metrics. In this article; I will attempt my…

    4 条评论
  • Information Security Risk Indicators: Bank CISOs Compare Notes

    Information Security Risk Indicators: Bank CISOs Compare Notes

    Whether it's for the Board of Directors, the CEO, the Regulators, or just for your team: CISOs always struggle with: "…

    16 条评论

社区洞察

其他会员也浏览了