Cybersecurity Attestation: What SMBs Need to Know About AICPA Risk Management Examinations

Understanding the framework that's changing how businesses prove their security posture

By Jim Venuto | November 16, 2025

Cybersecurity has moved from the IT department to the boardroom. What was once treated as a technical issue is now recognized as a critical business risk that demands executive attention and independent verification. If you're a business leader facing questions from investors, partners, or customers about your cybersecurity posture, you need to understand a formal framework that's becoming increasingly important: the AICPA Cybersecurity Risk Management Examination.

This isn't just another compliance checkbox. It's a rigorous, independent assessment of your entire cybersecurity risk management program—designed to give stakeholders reliable, objective information about how well you're protecting your business against cyber threats.

Why This Matters Now

The escalating frequency and sophistication of cyberattacks have fundamentally changed stakeholder expectations. Boards of directors, investors, analysts, and business partners no longer accept assurances at face value. They require independent, objective verification to fulfill their fiduciary and oversight responsibilities.

Think about it from their perspective: they're making decisions about operational resilience, business continuity, and value—all of which depend on your ability to manage cyber risk effectively. Layer on top of that the explosive adoption of AI tools—which both create new vulnerabilities and give attackers more sophisticated weapons—and you have a threat landscape evolving faster than most organizations can adapt.

The Market Shift: Stakeholders now demand independent attestation on cybersecurity programs the same way they demand audited financial statements. The AICPA Cybersecurity Risk Management Examination provides that general-purpose report, offering an independent practitioner's opinion on your cybersecurity risk management program.

How This Differs from SOC 2

If you're familiar with SOC 2 reports, you might be wondering how this examination differs. While both are attestation services, they serve distinct purposes and audiences:

Aspect	Cybersecurity Risk Management Examination	SOC 2® Engagement
Purpose	Provide broad users with information about your entire cybersecurity risk management program to support informed decision-making	Provide system users with information about controls at a service organization relevant to specific trust services criteria
Intended Users	General Use: Board members, investors, analysts, business partners, external stakeholders—designed for a broad audience	Restricted Use: Management of the service organization, user entities, and their auditors with specific context
Scope	Enterprise-wide cybersecurity risk management program	Controls related to a specific system at a service organization

In simple terms: SOC 2 is about specific systems and specific services. The Cybersecurity Risk Management Examination is about your entire organization's approach to managing cyber risk.

The Two Things Being Evaluated

Understanding what's actually being examined is critical. The practitioner forms opinions on two distinct but complementary subject matters:

1. The Description of Your Cybersecurity Risk Management Program

The practitioner evaluates whether your written description of your cybersecurity risk management program is presented fairly and in accordance with description criteria. This isn't just checking if you have nice-sounding policies. The description must include:

Your governance structure and who's accountable
Your risk assessment processes and methodologies
The scope of what's covered (and what's not)
Your cybersecurity objectives
The policies, processes, and controls you've implemented
How you detect, respond to, mitigate, and recover from security events

2. The Effectiveness of Controls Within That Program

The practitioner evaluates whether the controls within your program were effective in achieving your stated cybersecurity objectives throughout a specified period. This is where the rubber meets the road—did your controls actually work?

Critical Understanding: You get separate opinions on these two subject matters. It's possible to have an accurate description but ineffective controls, or effective controls but a misleading description. Both matter.

Your Responsibilities as Management

Before you even consider engaging a practitioner for this examination, you need to understand what's required of you. This isn't a passive exercise where auditors show up and tell you what to do. Management has significant, non-negotiable responsibilities:

Management Must:

Prepare the Program Description – Develop a comprehensive description of your cybersecurity risk management program in accordance with specified description criteria
Provide a Written Assertion – Formally assert in writing that:
- The description is presented in accordance with the description criteria
- The controls were effective to achieve your cybersecurity objectives based on the control criteria
Establish a Reasonable Basis – Have documented evidence supporting your assertion, typically from your own monitoring and assessment activities
Provide Unrestricted Access – Grant the practitioner access to all relevant information, records, documentation, and personnel
Provide Written Representations – Furnish formal written representations at the conclusion of the engagement

Deal-Breaker Alert

If you refuse to provide a written assertion, the practitioner must withdraw from the engagement or disclaim an opinion. No assertion means no credible examination. This is non-negotiable.

The Four-Phase Engagement Lifecycle

Understanding what happens during this examination helps you prepare effectively. The process follows a structured, four-phase approach:

1Acceptance

Practitioner verifies independence, confirms criteria are suitable, assesses team capabilities, and ensures preconditions are met

2Planning

Establishes engagement strategy, considers materiality, performs risk assessment, and designs examination procedures

3Performance

Evaluates program description and tests control effectiveness through inquiry, inspection, observation, and reperformance

4Conclusion

Obtains written representations, evaluates subsequent events, and issues the final examination report

What Happens During the Performance Phase

The performance phase is where the actual examination work occurs. Let me break down what practitioners are looking for:

Evaluating Your Program Description: The practitioner uses multiple techniques to verify your description is accurate and complete:

Inquiry – Discussing the program with management, IT teams, security personnel, and other relevant staff
Inspection – Reading board minutes, organizational charts, policies, procedures, customer contracts, risk assessments, incident reports
Observation – Watching control procedures and activities performed by your personnel

Throughout this process, the practitioner is assessing whether your description contains material misstatements or is misleading through omission or distortion.

Evaluating Control Effectiveness: This requires assessing both design suitability and operating effectiveness:

Suitability of Design – Are your controls, as designed, actually capable of preventing or detecting and correcting events that would threaten your cybersecurity objectives? A poorly designed control, even if operating perfectly, is fundamentally ineffective.

Operating Effectiveness – Did your controls operate as designed throughout the examination period? Practitioners test this through:

Inquiry of personnel who perform or monitor the control
Observation of control activities as they're performed
Inspection of records (system logs, access reports, change tickets, incident documentation)
Reperformance of the control to verify it produces the expected results

The Third-Party Vendor Challenge

When you rely on third-party vendors for key processes or controls, the practitioner must obtain sufficient evidence regarding the effectiveness of your monitoring controls over those third parties. This might involve reviewing SOC 2 reports from your vendors and assessing how you evaluate and act on those reports. If you have AI service providers, expect particular scrutiny on how you monitor data handling, model access, and security controls at the AI platform level.

Understanding Materiality: What Actually Matters

One of the most important concepts in this examination is materiality—and it's different for each subject matter:

For the Program Description: Materiality is primarily qualitative. The question is whether misstatements or omissions could influence the decisions of report users. For example, if you fail to disclose that a major cybersecurity objective related to regulatory compliance isn't part of your program's scope, that's material—even if the dollar impact is unclear.

For Control Effectiveness: Materiality considers both qualitative and quantitative factors. Would the deficiency prevent you from achieving your cybersecurity objectives? Could it result in a security incident? How widespread is the issue?

Practical Implication: The practitioner's materiality determination directly influences what they test, how much they test, and what findings make it into the final report. Understanding what constitutes a material issue in your specific context helps you prioritize your cybersecurity investments.

Opinion Types: What the Report Actually Says

The practitioner's report expresses opinions on both subject matters. Here's what each type of opinion means:

Unmodified (Clean) Opinion

The practitioner concludes that the description is fairly presented and controls were effective. This is what you're aiming for, but it doesn't mean perfection—it means reasonable assurance based on the evidence obtained.

Modified Opinions: When Things Go Wrong

Opinion Type	When It's Issued	What It Means for You
Qualified Opinion	Issues are material but not pervasive. Could result from: • Scope limitation (couldn't get sufficient evidence) • Material misstatement in the description • Material deficiency in control effectiveness	The bulk of your program works, but there's a specific, significant issue that needs attention. Often phrased as "except for [this issue], the description is fair and controls are effective"
Adverse Opinion	Misstatements in the description or deficiencies in control effectiveness are both material and pervasive	Serious red flag. The issues are so significant they fundamentally undermine the presentation of your description or the effectiveness of your program as a whole
Disclaimer of Opinion	Scope limitation is both material and pervasive	The practitioner couldn't obtain enough evidence to form an opinion at all. This typically happens when management restricts access or necessary evidence doesn't exist

Subsequent Events: The After-Period Problem

The practitioner has a duty to consider events that occur after the examination period but before the report is issued. This is particularly important in cybersecurity because:

If you discover a security incident after the examination period ends—say, a data breach—and determine that the root cause was an unknown vulnerability that existed during the examination period, that subsequent event must be disclosed. Why? Because it provides additional information about conditions that existed during the period being reported on.

The disclosure ensures report users have a complete picture of what risks were present during the examination period, even if they weren't discovered until later.

AI-Specific Consideration

If you've implemented new AI tools during or shortly after the examination period, subsequent events could include discovered vulnerabilities in those AI systems, data exposure incidents through AI platforms, or identification of inadequate AI security controls that existed during the examination period. Be prepared to disclose these even if they're discovered after the examination concludes.

Key Definitions You Need to Know

Understanding the specific language used in this framework helps you communicate effectively with practitioners and stakeholders:

Cybersecurity Risk Management Program: The set of policies, processes, and controls designed to protect information and systems from security events that could compromise the achievement of your cybersecurity objectives, and to detect, respond to, mitigate, and recover from security events on a timely basis.

Security Event: An occurrence, arising from actual or attempted unauthorized access or use by internal or external parties, that impairs or could impair the availability, integrity, or confidentiality of information or systems. This includes both incidents that require action (security incidents) and events that don't escalate to that level.

Compromise: A loss of confidentiality, integrity, or availability of information, including any resultant impairment of processing integrity or availability of systems. This is the bad outcome you're trying to prevent.

Cybersecurity Objectives: The objectives you establish to address cybersecurity risks that could otherwise threaten the achievement of your overall business objectives—including compliance, reporting, and operational objectives.

Action Item: Define Your Cybersecurity Objectives

Before engaging a practitioner, you must have clearly defined, documented cybersecurity objectives that tie back to your business objectives. These aren't IT objectives—they're business objectives. Examples:

"Maintain customer trust by protecting personal information from unauthorized disclosure"
"Ensure operational continuity of critical business systems with 99.9% availability"
"Comply with HIPAA requirements for patient data protection"
"Protect proprietary AI models and training data from theft or unauthorized access"

Your entire program will be evaluated against these objectives, so they need to be specific, measurable, and complete.

Preparing for an Examination: Practical Steps

If you're considering pursuing this examination—whether because stakeholders are requesting it or you want to differentiate your organization—here's what you need to do:

Pre-Engagement Preparation Checklist

Document Your Program
- Create comprehensive documentation of governance, policies, processes, and controls
- Ensure your documentation includes AI-specific controls if you're using AI services
- Map controls to specific cybersecurity objectives
Establish Monitoring and Assessment Activities
- Implement regular control testing and monitoring
- Document the results of your internal assessments
- This creates the "reasonable basis" for your assertion
Address Third-Party Risks
- Obtain SOC 2 reports from critical vendors
- Document how you evaluate and act on vendor reports
- Implement formal vendor monitoring controls
Review Description Criteria and Control Criteria
- Understand what criteria will be used to evaluate your program
- Conduct a gap assessment against those criteria
- Remediate significant gaps before the examination begins
Ensure Executive Buy-In
- This examination requires significant management involvement
- Board and executive leadership must understand and support the process
- Assign clear ownership and accountability

The Professional Standards Framework

For context, practitioners conducting these examinations must comply with a hierarchy of professional standards established by the AICPA:

Primary Standards: AICPA's Statements on Standards for Attestation Engagements (SSAEs), specifically AT-C section 105 (Concepts Common to All Attestation Engagements) and AT-C section 205 (Examination Engagements)

Interpretive Guidance: The AICPA guide "Reporting on an Entity's Cybersecurity Risk Management Program and Controls" provides specific implementation guidance

International Alignment: These standards are founded on International Standard on Assurance Engagements (ISAE) 3000 (Revised), with modifications to align with U.S. professional standards

Why does this matter to you? Because it means the examination follows rigorous, consistent professional standards with clear requirements for independence, evidence, and reporting. This isn't a casual review—it's a formal attestation engagement with real professional accountability.

The Bottom Line for SMBs

The AICPA Cybersecurity Risk Management Examination represents a fundamental shift in how organizations demonstrate cybersecurity competence. It moves beyond vendor questionnaires and marketing claims to provide independent, standardized assurance on your entire cybersecurity risk management program.

For SMBs, this creates both opportunity and challenge:

The Opportunity: If you can successfully complete this examination, you have a powerful differentiator. You're not just claiming to take security seriously—you have independent verification from a CPA firm following rigorous professional standards. That matters to investors, partners, customers, and board members.

The Challenge: This examination requires significant preparation, documentation, and executive commitment. You can't fake it. The practitioner will evaluate whether your controls actually work, whether your description is accurate, and whether you have reasonable basis for your assertions.

Three key takeaways:

First, start with your cybersecurity objectives. Everything flows from clearly defined, business-aligned objectives that tie to your compliance, operational, and reporting goals. If your objectives are vague or incomplete, the entire examination foundation is weak.

Second, invest in continuous monitoring and assessment. The written assertion you'll need to provide requires a reasonable basis—that means documented evidence from your own ongoing testing and monitoring activities. You can't assemble this retroactively.

Third, address the AI question proactively. If you're using AI services for customer interactions, data processing, security monitoring, or any other function, make sure your cybersecurity program explicitly addresses AI-specific risks. Document how you secure AI components, monitor AI vendors, protect training data, and control model access. Practitioners are increasingly scrutinizing AI-related controls because the risks are real and evolving.

Whether you pursue this examination now or in the future, understanding the framework helps you build a stronger cybersecurity program. The requirements—clear objectives, documented controls, continuous monitoring, third-party oversight, executive accountability—represent sound cybersecurity management regardless of whether you seek independent attestation.

The market is moving toward requiring independent verification of cybersecurity programs. The question isn't whether this type of assurance will become standard—it's whether your organization will be ready when stakeholders demand it.