Public Company Reporting Requirements

People often ask what I do. “AI audit & assurance” sounds abstract. "Are you an ISO 42001 auditor" --> No, but it's complicated. Here is the plain-English version. First, it's not just me. I lead a pretty amazing team at BABL AI. We help organizations reduce real business risk from high-risk AI systems. Our clients fall into two groups: ↳ AI providers selling high-risk tools ↳ Enterprises building or using high-risk AI internally Same underlying problem. Different pressure points. Enterprises are nervous about AI. Compliance risk. Liability risk. Reputational risk. Financial risk. That nervousness shows up in procurement, governance reviews, legal questions, and sometimes stalled deals. For AI providers, the problem is trust. Enterprise buyers want proof that your system has actually been tested, governed, and independently reviewed. Not marketing claims. Not slide decks. Questions like: ↳ Has this system been tested for bias, accuracy, and security? ↳ What were the results? ↳ Is customer data exposed or reused? ↳ Has this system been validated or audited by someone independent? We come in as an independent third party and verify the answers. Often, deals do not close without this work. For enterprises, the problem is capacity and credibility. Internal teams are under pressure from regulators, lawyers, and boards. They need assurance over real systems, fast. Many do not have the time or specialized skills to do it alone. The playbook is the same for both: ↳ Define what “good” looks like using a clear standard ↳ Test or review against that standard ↳ Provide defensible, independent assurance Yes, sometimes that includes ISO/IEC 42001 work (mostly to play the role of "internal audit" to satisfy Clauses 9 & 10). But the real problem we solve is helping organizations use AI without flying blind. We have a lot of students looking to get into this field, so hopefully this is helpful to them as well. ♻️ Repost if you think this might to helpful to others.

SEBI’s New RPT & Audit Norms: A Game Changer for Listed Entities? ⚖️📊 SEBI is tightening the screws on Related Party Transactions (RPTs) and auditor appointments, aiming for greater transparency and accountability in corporate governance. Here’s what’s changing: 🔹 RPTs Redefined: Transactions between a subsidiary and its JV partner previously outside the scope, will now require shareholder approval if they breach materiality thresholds (₹1,000 Cr or 10% of consolidated turnover). Public shareholders will have the final say, impacting deal timelines. 🔹 Stricter Auditor Norms: SEBI may introduce eligibility criteria for statutory auditors, ensuring firms have the qualifications and experience that match the complexity of listed entities. This comes after concerns over small firms handling large audits, highlighted in the Hindenburg-Adani case. 🔹 Secretarial Compliance Boost: ✔️ Annual Secretarial Compliance Report to be included in annual reports. ✔️ Secretarial auditor changes may now be considered material events, requiring disclosure. With these reforms, corporate governance is set to become more stringent and investor confidence stronger. 📈 CA Sakshi Borikar LinkedIn Guide to Creating

Provision 29 – Now common parlance in boardrooms. New company reporting requirement - What is it and how to deal with it. The Financial Reporting Council says annual reports must include a declaration about the effectiveness of all controls material to long-term sustainability of a listed company – such as resilience and cyber etc., not just financial controls. Provision 29 of the updated UK Corporate Governance Code has the detail. Control coverage is clearly wider than SOX but there is no mandate to get external assurance (audit) of the effectiveness statement. That assurance rests with the Board. Companies appear to be including between 30 and 50 material controls in their Board review i.e. not every control. It’s key that a Board's governance model demonstrates that accountability, risk management and assurance processes are fit for purpose. Provision 29 is not a management attestation. The Board owns the effectiveness declaration and needs to be able to explain how it arrived at it. The Board also needs to be clear on why they have defined controls as “material” and others not.  The Board’s assurance processes must be proportionate and sufficient to support their declaration. Critically, where material weaknesses exist, the Board must explain the actions taken or planned to remediate them. i-confidential is seasoned in its approach to defining, implementing and testing material controls. If any Board is concerned about Provision 29 compliance, get in touch. Calling i-confidential will help mitigate any fears you might have. Institute of Directors (IoD) Elaine McKechnie MCIIS Calum Michie Nicola Huskie

Auditing isn’t just about checking numbers — it’s about ensuring trust, transparency, and accountability in every organization. Audits play a crucial role in maintaining financial integrity, regulatory compliance, and operational efficiency. Each type of audit serves a unique purpose in protecting an organization from risks, fraud, and inefficiencies while enhancing performance and credibility. Key Types of Audit Include: • Financial Audit: Ensures financial statements are accurate and compliant with accounting standards. • Internal Audit: Evaluates risk management, control, and governance within an organization. • Compliance Audit: Verifies adherence to legal and regulatory requirements. •Forensic Audit: Investigates fraud and financial misconduct. • Operational Audit: Reviews business processes for efficiency and improvement. • Tax Audit: Examines declared income under tax laws for accuracy. • Cybersecurity Audit: Assesses digital security and protection of sensitive information. ✓ Every audit builds confidence — not just in systems, but in the integrity of the organization itself. #Audit #Accounting #Finance #InternalAudit #ExternalAudit #Compliance #ForensicAudit #BusinessTransparency #CorporateGovernance #connect #repost

Corporate Sustainability Reporting Directive (#CSRD) is changing the game. And PwC's guidebook is here to help you stay ahead. It simplifies the process of preparing sustainability statements that meet the European Sustainability Reporting Standards (ESRS). Here’s what you need to know: • Start with structure. Sustainability statements are broken down into four key sections: General, Environmental, Social, and Governance (ESG). Simple, right? • Double materiality is key. This means looking at the environmental and social impacts of your operations, while also considering how sustainability affects your financial performance. • Think financial impact. You’ll need to show how sustainability risks and opportunities influence profits, balance sheets, and cash flows, both now and in the future. • Boards have a big role to play. They must integrate sustainability into strategy, ensure accurate reporting, and align executive pay with ESG goals. • Climate action is front and center. Transition plans, emissions data, and the financial impacts of climate risks are non-negotiable under ESRS E1. • Don’t forget the EU Taxonomy. Reporting on sustainability-related revenues and expenses is essential for compliance. • Transparency wins. Clear disclosures build trust, attract investments, and keep you ahead of regulations. • Talk to your stakeholders. Engaging with them ensures your reporting reflects real-world needs. • Stay adaptable. Standards are evolving, and keeping up is crucial for long-term resilience. PwC has turned a complex framework into actionable insights. Making it easier for organizations to navigate these changes. -------------------------------------------- So, how are you positioning your business to lead in sustainability reporting?

𝑴𝒂𝒄𝒉𝒊𝒏𝒆 𝑻𝒓𝒂𝒏𝒔𝒍𝒂𝒕𝒆𝒅 𝑻𝒆𝒙𝒕 𝒎𝒖𝒔𝒕 𝒃𝒆 𝒍𝒂𝒃𝒆𝒍𝒍𝒆𝒅 “𝑨𝑰” 𝒊𝒏 𝒕𝒉𝒆 𝑬𝑼 𝒇𝒓𝒐𝒎 𝑨𝒖𝒈𝒖𝒔𝒕 2 From this Sunday, Article 50 of the EU AI Act takes effect. Companies operating in the EU are subject to a new requirement: to put a clear label for AI-generated and AI-manipulated published text. This applies to machine translated text. The EU offers a set of icons for the disclosure. They must be immediately visible without requiring extra clicks and must remain visible for a sufficient duration. The requirement is mandatory only for public-interest information. For example, this includes covering politics, elections, public administration, health, the environment, the economy, science, education, and security. Product and advertising pages do not fall under this category, but informative social media posts just might. Here is a quick checklist whether your machine translated page needs a label. Criteria: -         Published and available -         Machine translated after August 2, 2026 -         Informative, may be classified as journalism -         Public-interest -         No human review by a competent person If you answered yes to all five criteria, then you should add an icon. Professional translators will rejoice because the requirement raises their sails. If one named person, with subject knowledge, and the power to stop a text piece from being published reviewed it, and left a record of the review, then no labelling is necessary. Industry associations get a powerful whip against organizations that publish machine translated text without human review. The fine for non-compliance is up to €15 million or 3% of worldwide annual turnover. Whether and how it will be enforced remains to be seen – as was the case with GDPR in 2018. Disclaimer: I'm not a lawyer, please refer to the official pages for details and decisions.

We audit every day. But do we ever stop to ask why? Files get reviewed. Findings get raised. Reports get issued. Actions get tracked. It’s what we do. But somewhere between planning meetings and closing meetings, audit can quietly become routine. We get very good at doing audit and slowly forget to anchor ourselves in why we do it. In this 16-part series am breaking down the Domains and Principles of Internal Audit beginning with Domain One, which interestingly has no principle. It simply defines OUR PURPOSE. "The purpose of internal audit is to strengthen the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight." It’s a short statement but it is loaded. Create. Protect. Sustain. Are we helping the organization create value — or are we only identifying control gaps? Are we protecting value — or are we pointing out weaknesses after value has already been eroded? Are we thinking about sustainability of the controls? Then comes the weightier test: are we truly independent? Not just structurally, but intellectually. Can we challenge management when necessary? Do we escalate uncomfortable truths? Is our function positioned with direct accountability to the Board and do we behave like it? And what does “risk-based” really mean in our day-to-day work? It means prioritizing what could materially derail strategy. It means understanding the business deeply enough to know where value is most vulnerable and where it is most likely to be created. The purpose statement does not stop at assurance. It calls for advice, insight, and foresight. That is a high bar. If audit only appears after something has gone wrong to explain what should have been done, we are providing hindsight. Necessary, yes. But limited. Foresight: helping management anticipate emerging risks, strategic shifts, structural weaknesses is where audit moves from compliance partner to strategic enabler. The statement also reminds us that audit is most effective when performed by competent professionals in conformance with the Global Internal Audit Standards, and when the function is independently positioned. Every single word in that purpose statement should influence how we plan audits, how we conduct interviews, how we write findings, and how we engage stakeholders. So before we move into the technical principles in the coming weeks, this is the reset. In our next audit assignment, perhaps the real question is not “Did we complete the audit?” but: "Did we strengthen the organization’s ability to create, protect, and sustain value"? That is our purpose and purpose should never become routine. #InternalAudit #AuditLeadership #Governance #RiskManagement #GIA

𝗙𝗿𝗼𝗺 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁𝗼𝗿 𝘁𝗼 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗣𝗮𝗿𝘁𝗻𝗲𝗿 It's been nine months since the Global Internal Audit Standards from The Institute of Internal Auditors became effective. Having had some time to reflect, I would like to remind everyone of some key shifts that I believe will truly elevate our profession from a backward-looking function to a forward-thinking business partner. 𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝘀𝘁𝗮𝗻𝗱𝘀 𝗼𝘂𝘁 𝘁𝗼 𝗺𝗲: 1️⃣ 𝗙𝗼𝗿𝗲𝘀𝗶𝗴𝗵𝘁, not just hindsight. The new Purpose statement for internal auditing now explicitly mentions "foresight". This marks a step forward. It focuses on anticipating risks and providing proactive advice to help the business thrive. 2️⃣ 𝗘𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹 𝗖𝗼𝗻𝗱𝗶𝘁𝗶𝗼𝗻𝘀. The Standards introduce "Essential Conditions" that must be in place for internal audit to be effective. This means the Chief Audit Executive (CAE) needs to sit down with the Board and Senior Management to discuss and agree on these conditions. It formalises the support we need to do our jobs right. 3️⃣ 𝗧𝗵𝗲 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗿𝗼𝗮𝗱𝗺𝗮𝗽. The CAE must now develop an internal audit strategy. This is not a one-year plan but a long-term vision and plan of action for the internal audit function. It's the roadmap for fulfilling our mandate and achieving long-term success. 4️⃣ 𝗔𝘀𝘀𝘂𝗿𝗮𝗻𝗰𝗲, not duplication. The new Standards emphasise working with other assurance providers, such as external auditors, to reduce overlapping efforts and uncover gaps in risk coverage. 5️⃣𝗖𝗵𝗮𝗿𝗮𝗰𝘁𝗲𝗿 𝗺𝗮𝘁𝘁𝗲𝗿𝘀. The Standards now emphasise professional courage and scepticism. We are expected to speak up and critically evaluate information, even when it is uncomfortable or difficult. It’s about having the conviction to do what is right, based on the facts. 6️⃣ 𝗤𝘂𝗮𝗹𝗶𝘁𝘆 has two parts. It isn't just about following the rules (conformance), but also about meeting performance objectives (performance). It serves as a good reminder that the value of our work is judged not only by how well we follow standards but also by the real impact we create. What are your thoughts on these new Standards? 𝙒𝙝𝙖𝙩 𝙘𝙝𝙖𝙣𝙜𝙚𝙨 𝙝𝙖𝙫𝙚 𝙮𝙤𝙪 𝙛𝙤𝙪𝙣𝙙 𝙢𝙤𝙨𝙩 𝙞𝙢𝙥𝙖𝙘𝙩𝙛𝙪𝙡?

The reporting frameworks within the financial sector are intricately interconnected with the reporting regulations in the corporate sector, creating a cohesive ecosystem for sustainability and transparency. This interdependency ensures that financial institutions can accurately assess and disclose the sustainability and ESG risks of their investments, which are significantly influenced by the corporate practices of the entities in which they invest. Consequently, corporate reporting on sustainability practices directly impacts the financial sector's ability to comply with its own reporting obligations, fostering a transparent, sustainable, and responsible economic environment. All regulation proceeds from EU Green New Deal. These include the Corporate Sustainability Reporting Directive (CSRD), EU Taxonomy Regulation, Corporate Sustainability Due Diligence Directive (CSDDD), Sustainable Finance Disclosure Regulation (SFDR), European Banking Authority (EBA) Pillar 3 disclosures, and the Benchmark Regulation. The European Union's Green Deal aims to transform the EU's economy into a sustainable one, addressing climate and environmental challenges. Key to this ambition are several interconnected regulatory frameworks: the Corporate Sustainability Reporting Directive (CSRD), EU Taxonomy Regulation, Corporate Sustainability Due Diligence Directive (CSDDD), Sustainable Finance Disclosure Regulation (SFDR), European Banking Authority (EBA) Pillar 3 disclosures, and the Benchmark Regulation. These frameworks collectively create a robust ecosystem for sustainable finance and corporate responsibility. - CSRD mandates comprehensive sustainability reporting, providing essential data that underpin other frameworks. - EU Taxonomy Regulation classifies economic activities as sustainable, guiding investments based on CSRD-reported data. - CSDDD ensures companies manage their environmental and human rights impacts, complementing CSRD data with operational practices. - SFDR requires disclosure of how investments consider ESG factors, utilizing data from CSRD and EU Taxonomy to inform investors. - EBA Pillar 3 Disclosures enhance financial stability by requiring banks to disclose ESG risks and capital adequacy, relying on corporate sustainability data. - Benchmark Regulation ensures financial benchmarks reflect true sustainability, drawing on insights from other frameworks. These regulations support the EU's Green Deal by ensuring transparency, promoting sustainable investments, and fostering responsible corporate behavior. They exemplify a comprehensive approach to integrating sustainability into the financial system and corporate governance, setting a global standard for sustainable economic development.

New EU rules on AI content starting Aug 2. This one is important. (Here’s everything you need to know) The EU AI Act's content disclosure rules go live on Sunday 2nd August. Most founders I talk to think it's a blanket ban on using AI in content. It isn't. There are areas where you will need to disclose and areas where you won't. Here's what it actually targets ⬇️ 1/ The creator will need to disclosure when: → AI images or videos of a real person doing or saying something they didn't (deepfakes) → AI voice clones or avatars presented as the founder speaking → Photorealistic AI-generated people posted as if they're real, even if they don't resemble anyone specific → AI-drafted text on news, politics or public health published without human review (btw, I think this is a great move). 2/ If you are doing one of the following, you don’t need to change the process: → AI helping you draft a LinkedIn post you then review and publish under your name → Real photos with quote cards designed by a human → AI illustrations that are clearly graphic or abstract (not photorealistic humans) -- The simple rule of thumb: If you review and edit AI-assisted text before it goes out, and you're not depicting a real person synthetically, you're fine. The moment AI generates or manipulates how a real person looks, sounds, or is depicted, add "Image/video created with AI" the first time it appears. It doesn't matter where you're based. If your content reaches an EU audience, this applies. Here’s a worked example: You might remember “Mia Zelu” the influencer who got millions of views at Wimbledon last year. The only catch…she wasn’t real. But few realised it at the time. With the new regulations, the person who runs her account would need to disclose it from the start. THANK YOU EU. - Dan Sherrard-Smith