Massimiliano Marsico

The FCA just turned sustainability data into a financial reporting obligation. CP26/5 proposes UK SRS-aligned climate disclosures for listed companies from January 2027. Most of the commentary focuses on timelines and transitional reliefs. That misses the point. The real question isn't what to report. It's whether your data infrastructure can survive the scrutiny. If your sustainability data lives in spreadsheets, disconnected from your governance and risk systems, you have an architecture problem — not a reporting problem. Simon Whitburn and I wrote about what CP26/5 actually demands when you look past the headlines — and five questions every organisation in scope should be asking right now.

43

3 Comments

Leadership changes, regulatory shifts, growing complexity - PwC UK’s governance approach helped keep things on course. From AI risk to audit reform, the Annual Report shows how structure, transparency and challenge supported long-term decision-making. Well worth a read: https://pwc.to/48eRYNs

5

Risk-Based Auditing in the UK After more than a decade in audit, one thing is clear: a “tick-box” approach no longer works. Stakeholders in the UK expect auditors to understand what really drives risk and to focus effort there. That’s exactly what the risk-based audit model helps us do. What I’ve found makes the biggest difference: • Know the business first, test later. Spend time with management and walk through processes before designing procedures. • Prioritise material risks. Not every balance needs the same attention – concentrate on the areas where a misstatement would truly matter. • Integrate controls and analytics. Use data and controls testing to zero-in on exceptions instead of blanket sampling. • Communicate early and often. Share emerging risks with the board and audit committee before they crystallise. The result is higher quality audits, more efficient teams and boards who see auditors as partners in risk management, not just compliance. This is the shift UK audit is making, and it is rewarding to be part of it. #RiskBasedAudit #UKAudit #Governance #AuditQuality #Insights

14

1 Comment

All good GRC frameworks are more than the sum of their parts. NIST 2.0 and ISO27001 provide the framework and a certain amount of detail, but #DORA and #NIS2 provide the specific details at times. Like this tree in the picture, the details make the framework complete. The PwC Ireland Cyber approach is to help you understand how to make your cybersecurity governance framework work best for you. Now is a good time to evaluate your organisation’s conformity with DORA and NIS 2.

44

2 Comments

The new edition of the KPMG Regulatory Barometer has been published and it’s no surprise that the regulatory pressure score for Payments has increased. Firms continue to experience waves of regulatory change in the UK and emerging divergence between UK and EU regulatory frameworks. #kpmg #financialservices #regulation #kpmgpayments

9

As cyber threats continue to escalate, mid-market businesses become more and more concerned about cybersecurity and digital risk. It's no surprise then that leaders prioritise investments in security infrastructure. Read our article to understand how businesses can better prepare for cybersecurity disruptions. https://lnkd.in/dXYVMU-W #Cybersecurity #InternationalBusiness

23

We’re excited to share that Veracode has been selected by TECNIMONT Services, a business line of MAIRE, to enhance their application security across digital and energy initiatives. This collaboration marks another step forward in securing critical infrastructure with Veracode’s AI-driven platform, built to scale across complex environments. As digital transformation accelerates in industrial sectors, proactive and continuous application security is more essential than ever. Read more about the partnership and what it means for resilience in the energy industry: #Appsec

13

Phased implementation of the EU AI Act has started. However, most organisations are still in the early stages, and internal audit teams are keen for guidance. Earlier this year, I was privileged to lead panel discussion with Nishobika Sivakumaran from EY and Frank Heldens from Achmea, who generously shared their insights and recommendations to help organisations navigate the uncharted territory of EU AI Act compliance. Below are the Top 5 takeaways: https://lnkd.in/ezGF8c9R

18

PA Consulting has been assured by the National Cyber Security Centre to provide Cyber Incident Exercising (CIE). CIE allows organisations to test the effectiveness of their Incident Response Plans in a safe environment and strengthen their incident management processes. CIE provides a controlled, scenario-based opportunity for organisations to practise, evaluate and improve their cyber incident response plans. https://lnkd.in/eJ-segHK

81